ML17304B294
| ML17304B294 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 06/09/1989 |
| From: | Rogers A ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR |
| To: | |
| Shared Package | |
| ML17304B281 | List: |
| References | |
| NUDOCS 8907060277 | |
| Download: ML17304B294 (60) | |
Text
PALO VERDE NUCLEAR GENERATING STATION UNITS 1, 2, AND 3 JUSTIFICATION FOR CONTINUED OPERATION CEA DROP EVENTS Prepared by:
Re~iewed b
- Manager, Nu lear Licensing
- Manager, Engineering Revkeued by:
/A' dc A-Reviewed by:
Di.r N
1 Safety and Licensing
- Manager, N~
ea Fuels Management 3
Approved by:
- Chairman, Pl nt Review Board Concurrence by'i Unit PlanE Manager Concurrence by:
nt Manager Concurrence by:
Approved by:
nit 3 Pla t anager ch/89 Plant Director 1677K/0059K 8~07060~77 s~obl9 pDR ADOC~q 050005~8 p
- PDR
5
TABLE OF CONTENTS PAGE EXECUTIVE
SUMMARY
I.
EQUIPMENT DESCRIPTION A.
CONTROL ELEMENT DRIVE MECHANISM CONTROL 'SYSTEM (CEDMCS).
B.
CORE PROTECTION CALCULATORS (CPCs)
II.
HISTORY III.
RELEVANT INDUSTRY EXPERIENCE.
IV.
ENGINEERING EVALUATION.
A.
ROOT CAUSE ANALYSIS.
B.
SAFETY ANALYSIS.
12 V.
REGULATORY IMPLICATIONS 12 VI.
CORRECTIVE ACTION PLAN.
15 VII.
JUSTIFICATION FOR CONTINUED OPERATION 17 APPENDICFS A.
FIGURES B.
TECHNICAL REPORTS
4i
+P r>
EXECUTIVE
SUMMARY
'On December 10,
A multidisciplinary review and evaluation conducted as a
result of this event determined that a
degraded Control Element Drive Mechanism (CEDM),
which resulted from a
manufacturing deficiency, was the initial condition responsible for intermittent grounding of the CEDM lower lift coil lead wires.
This intermittent grounding introduced noise into the Control Element Drive Mechanism Control System (CEDMCS) circuitry resulting in the observed double CEA slip.
Experience has shown that the defective CEDMs q
become evident early in plant life.
The defective CEDMs at PVNGS have been identified and all will have been replaced prior to restart of the affected units.
The CEDMCS susceptibility to externally introduced
- noise, which resulted in the double CEA slip event at PVNGS, was identified by Combustion Engineering (C-E) in a 10 CFR Part 21 Notification submitted to the NRC.
This condition continues to exist in the PVNGS CEDMCS but, based upon many reliable years of operation at C-E plants with CEDMCS equipment, this condition is considered a very low probability event and continued operation of PVNGS Units 1, 2, and 3 is justified.
Continued operation of PVNGS Units 1, 2, and 3 is justified by the following:
All known defective coil stacks, identified during testing, will be replaced prior to restart of the affected unit.
This is expected to eliminate the source of CEA slippage associated with ground faults.
A testing plan has been developed and implemented to test for defective Control Element Drive Mechanism (CEDM) coil's in Unit 2
prior to restart and will test for defective CEDM coils in Units 1
and 3 prior to restart of each unit.
Additionally, ground fault testing will be performed during CEA operation't normal unit startups and shutdowns associated with refueling outages.
gl
'4
C-E believes, and APS
- concurs, that the intermittent grounding phenomena causing a multiple CEA slip or drop is an extremely rare occurrence.
As such, it should not be considered an Anticipated Operational Occurrence (AOO).
Unless the failed insulation condition is exhibited during initial operation, it is not expected to develop from normal operation or equipment aging.
Automatic reactor trips at full power conditions will occur for most multiple CEA slip or drop events with at least one CEAC and all CPC channels operable.
Reactor operating procedures, which were revised to direct the operators to immediately trip the reactor if two or more CEAs slip or drop into the core more than 9.9 inches (except during reactor power cutback) and an automatic reactor trip does not
- occur, will be maintained.
The probability of fuel pins entering DNB is very low during most multiple CEA slip or drop events even without prompt operator action.
The potential for the fuel design limits being exceeded is dependent upon which CEAs slip and the magnitude of the deviation.
The Justification for Continued Operation "CEA Drop Events" was reviewed in accordance with the requirements of 10 CFR 50.59 for an unreviewed safety question.
The findings of this evaluation were that operation following the replacement of the grounded CEDM lower lift coils and testing during startup and shutdown does not constitute an unreviewed safety question.
The corrective actions outlined in this JCO provide additional assurance that in the unlikely event that some other source of noise is found that could result in a multiple CEA slip or drop event and an automatic reactor trip does
. not
- occur, operator guidance exists to immediately trip the unit.
/ l
Even though this is not an AOO, a program will be undertaken to further ensure that multiple CEA sl'ip or drop events at PVNGS',
resulting.from noise in the CEDMCS, are either eliminated by design modifications to the CEDMCS or do not lead to a condition where Specified'cceptable Fuel Design Limits are violated.
This program will include one or more of the following:.
Modifying the design of the CEDMCS to reduce its sensitivity to noise.
Demonstrating, through analysis, that the results of multiple rod slips or drops are acceptable.
Modify the,CPC/CEAC software such that a reactor trip occurs on all multiple rod drops or slips beyond technical specification limits.
This program will be undertaken wi.th a
goal of determining appropriate improvements within six months and'mplementing the improvements by the beginning of Unit 1, Cycle 4 operation.
<<g V
>>l
I.
E UIPMENT DESCRIPTION A.
CONTROL ELEMENT DRIVE MECHANISM-CONTROL SYSTEM CEDMCS The purpose of the CEDMCS is to provide the drive signals to the coils of the magnetic-jack Control Element Drive Mechanisms (CEDMs) which position and hold the individual Control Element Assemblies (CEAs).,
The CEDMCS controls the direction,. rate, and'uration of CEA motion in response to automatic or manual demands.
The CEDMCS is a non-safety related control system.
The safety function of the CEAs is to drop into the core when power is.
removed from the CEDMs.
Power is removed from the CEDMs when the reactor trip breakers open in response to valid reactor protection signals.
Refer to Appendix A, Figure 1 for a schematic of the power supply arrangement to the PVNGS CEDMCS.
Single failure considerations were accounted for in the design of the CEDMCS.
The following single failure condi'tions were included in, the engineering specification. for the CEDMCS (SYS80-ICE-6022):
1)
No single malfunction in the CEMDCS shall cause any of the following CEA drop conditions:
simultaneous drop of
.two CEAs of a four or five CEA subgroup.
simultaneous drop o'f three CEAs of a four or five CEA,subgroup.
simultaneous drop
,of four non-symmetrical CEAs of a five CEA subgroup.
simultaneous drop of'wo or more CEAs assigned to different CEA subgroups.
41 P \\
- t R
4 2)
No single malfunction in the CEDMCS shall cause any single CEA to be withdrawn from the core, or allow the withdrawal of any single CEA except in the manual individual mode of control with that CEA selected for trimming.
3)
No single malfunction in the.
CEDMCS shall cause any single CEA to be inserted into the core, or all'ow the insertion of any CEA except in the manual individual mode of control with that CEA selected for trimming.
4)
No single malfunction in the CEDMCS shall cause the following non-demanded/non-selected CEA motion:
simultaneous motion of two or three CEAs of a four CEA subgroup in any mode of control.
simultaneous motion of four non-symmetrical CEAs of any five CEA subgroup in any mode of operation.
In spite of the numerous years of operation at C-E plants with the CEDMCS equipment, the event at PVNGS demonstrated that a
single deficiency in the CEDMCS did cause a multiple rod-slip event to occur.
Based upon many good years of experience, there is no reason to consider such a deficiency as an AOO.
B.
CORE PROTECTION'ALCULATORS CPCs accomplish this function by conservatively determining the DNBR and four CPC LPD values for the most limiting core location.
All channels directly monitor the position of each CEA within a
single The purpose of the Core Protection Calculators (CPCs) is to initiate automatic protective actions to ensure that the Specified Acceptable Fuel Design Limits (SAFDLs) on Departure from Nucleate Boiling Ratio (DNBR) and Local Power Density (LPD) are not exceeded during Anticipated Operational Occurrences (AOOs).
The CPCs 0
P
'4.
I 1
, ~
'.~a,
quadrant of the core.
Since each CEA subgroup contains one CEA in each quadrant, the individual CPC channels can detect deviations between subgroups in a single group,
.and out of sequence insertion or withdrawal of CEA groups.
The CPCs are assisted
'by the two Control El'ement Assembly Calculators (CEACs).
Each CEAC monitors the position of all CEAs in the core.,
The purpose of the CEACs is to provide the CPCs with information about individual CEA deviations which are not detectable by the CPCs.
Section 7.2.2.l.l of CESSAR lists the incidents of moderate frequency and infrequent incidents against which the CPCs are designed to protect.
The CEA related events from CESSAR that were used to determine the system design basis are:
1)
Insertion or wi.'thdrawal of full-length or part-length CEA
- groups, including:
Uncontrolled sequential withdrawal of CEA groups, Out of sequence insertion, or withdrawal of CEA groups, Malpositioning of the part-length CEA groups, or Excessive sequential insertion of full-length CEA groups~
2)
Insertion or withdrawal of full-length.
or part-length CEA subgroups, including:
Uncontrolled insertion or withdrawal of a CEA subgroup, Dropping of one CEA subgroup, or Misalignment of 'CEA subgroups comprising a
designated CEA group; Ol
~
\\
lt
3)
Insertion or withdrawal of a
single full-length or part-
'length CEA, including:
Uncontrolled insertion or withdrawal of a single full-length or part-length
single CEA sticking, with the remainder of the CEAs in that group moving, or A statically misaligned CEA.
The list of events does not incl'ude multiple dropped CEAs except where all the CEAs are from the same group or subgroup.
The CPC design basis is consistent with that of the CEDMCS in that multiple dropped CEAs are not assumed to be design basis events.
The following listing provides the unanalyzed CEA drop cases that were not included in the CPC design basis:
a)
The simultaneous drop of 2 CEAs of any CEA subgroup.
b)
The simultaneous drop of 3 CEAs of any CEA subgroup.
c)
The simultaneous drop of 4 CEAs of any 5
CEA subgroup.
d)
The simultaneous drop of 2 or more CEAs assigned to different CEA subgroups.
Since several CEA misalignment events are not included in the CPC design
- basis, an automatic reactor trip may not be received for some of these events.
e
~
II.
HISTORY Coil grounding problems with CEA No.
64 (Unit 1) were first observed in May 1985.
At that time, lower gripper assembly grounds were identified on CEA Nos.
63 and 64.
During the first refueling outage for Unit 1,
CEA Nos.
63 and 64 were megger tested,and a circuit continuity check was performed.
The results of this testing led to the decision that the two CEAs were acceptable for continued use.
Following the completion of the refueling outage in March 1988, the CEAs successfully completed the monthly exercise testing until October 8,
- 1988, when CEA No.
64 slipped during performance of the monthly exercise test.
This was
.a small slip of CEA No.
64 (to approximately 137 inches withdrawn) but it did result in pre-trips and a trip on one channel of the reactor protection system.
CEA No.
64 slipped again during the next performance of the monthly exercise test on November 5, 1988.
CEA No.
64 slipped to approximately 139.9 inches withdrawn during this test.
This resulted in a 10 inch deviation from, the position of the other CEAs in the group.
An LER was submitted to the NRC as a result of this event (refer to LER 88-026-00 dated December 5, 1988).
CEA No.
64 also slipped during the next required performance of the monthly exercise test on December 10, 1988.
An LER was submitted as a
result of this event (refer to LER 88-020-00 dated January 9,
1989) and a
scheduled supplement to this LER will provide details of the subsequent investigation.
During this
- test, CEA No.
64 was being exercised in the manual individual mode and slipped to approximately 138 inches withdrawn.
During attempts to recover CEA No,.
64, it further slipped into the core to approximately 121 inches withdrawn.
Concurrently, the operators identified that CEA No.
57 had slipped from a
fully withdrawn position to approximately 105 inches withdrawn.
The operators returned CEA No.
57 to the fully withdrawn position and then continued recovery activities for CEA No. 64.
CEA No.
64 reached a
minimum position of 61 inches withdrawn before being repositioned to ld
~
~
the fully withdrawn position approximately 27 minutes after the CEA had initially slipped.
No coil stack assemblies in PVNGS Unit 1,
other than those associated with CEA Nos.
63 and 64,.have exhibited these grounding indications.
Due to the recurring nature of the
- problem, an exigent Technical Specification change was requested from the NRC.
The requested change allowed for the continued operation of Unit 1 until the end of its current cycle without conducting further exercise testing on CEA No.
64.
The NRC granted this request on January 13,
- 1989, and no grounding
\\
indications were experienced during the monthly CEA exercise testing performed in January or February of 1989.
PVNGS reported in LERs 88-026-00 and 88-020-00 that the cause of the CEA No.
64 slip events was an apparent, ground on.the CEDM lower gripper coil.
The ground occurred immediately following the voltage increase associated with energizing the lower liftcoil..
The magnitude of the ground varied and thus CEA slippage did not occur on every cycle.
Additionally, the lower gripper and lower liftcoils are only energized during CEA motion (either insertion or withdrawal).
When the CEA is stationary, the CEA is held by the upper gripper coil and the lower gripper coil is not energized.
Therefore, there is little risk of CEA No.
64 inadvertently, slipping into.the core when no motion is demanded.
A multidisciplinary investigation involving APS
.'and Combustion Engineering (C-E) was undertaken to determine the cause of CEA No.
57 slippage during the efforts to recover CEA No. 64.
The design of the CEDMCS system was reviewed and a safety analysis investigation of the implications of CEA drop events was performed.
The engineering evaluation section of this Justification for Continued Operation (JCO) reports on the results of this investigation.
The findings lead APS and C-E to expect that removal and disassembly of PVNGS Unit 1
coil stacks for CEA's 64 and 63 -will reveal failed insulation on their respective lower liftcoils and evidence of arcing to their respective nipple 'ssemblies.
This condition would be similar to that observed on lower liftcoils from Unit 2 which were examined by APS and C-E and described in the Engineering Evaluation section of this JCO.
~l
~ 4
~
~
Two CEDM'oil'stacks, exhibiting similar grounding characteristics, but not double slippage,.
were removed from CEA's 33 and 19 in PVNGS Unit 2
during the first refueling outage.
Since their replacement, no PVNGS Unit 2 coil stack assemblies have exhibited grounding indications and no slippage has occurred.
,No grounding indication or slippage
.attributed to grounding has been observed at PVNGS Unit 3.
III.
RELEVANT INDUSTRY EXPERIENCE Following the December 10, 1988 dual CEA slip event at PVNGS Uni't 1,
a search
. was initiated within the industry to determine if other nuclear power units had experienced
'any similar multiple CEA,slip or drop events.
The PVNGS Reliability Analysis organization performed a search of the Nuclear Plant Reliability Data.System (NPRDS) data base for CEA slip or drop events.
The NPRDS data base contained 98 CEA slip or drop events.
Of these.
98 events, 11 involved multiple CEAs.
An event at Turkey Point Unit 4
in August 1985 and an event at,Surry Unit 1 in September 1986 were initially thought to be similar to the recent event at Palo Verde.
For both of these
- events, a single control rod dropped and was followed by the subsequent drop of:a second control rod before the first control rod had 'been recovered.
Further investigation of the Turkey Point Unit 4 and Surry Unit 1 events concluded,
- however, that there were basic differences between these events and the PVNGS Unit 1 event.
PVNGS also contacted C-E to determine if they were aware of any multiple CEA slip or drop events at any C-E designed plants.
C-E indicated that they were aware of an event that occurred at San Onofre in July 1986 (discussed below),
a drop, of four CEAs at Maine Yankee in 1975 due to a power supply failure, and' drop of two CEAs at Calvert Cliffs Unit 2
in April 1982 due to a technician error.
The multiple CEA drop events at Maine Yankee and Calvert Cliffs Unit 2
were dissimilar from the PVNGS event and did not warrant further review.
0 P
PVNGS contacted representatives at each of the recent vintage C-E plants tha't are equipped with CPCs.
Representatives from Arkansas Power and Light and Louisiana Power and Light were not aware of any mutiple CEA slip-or drop events at their plants.
- However, conversations with Southern California Edison (SCE) personnel indicated that San Onofre Unit,2 dropped two CEAs on July 7,
1986.
The event began when CEA No.
55 dropped fully into the reactor.
A short time
- later, CEA No.
49 also dropped into the reactor.
This resulted in an automatic reactor trip because of high CEA misalignment penalty factors calculated by the CEACs.
SCE determined that the root cause of the CEA No.
55 drop was electronic failures due to overheating in the CEDMCS cabinets.
The CEDMCS cabinets overheated after a chiller failed.
CEA No.
49 dropped due to an unrelated cause; it resulted from a failed CEDM gripper coil DC current sensor which was aggravated by an existing design deficiency.
In summary, of the several multiple slip or drop events evaluated, only San Onofre Unit 2 has experienced an event similar to the event at PVNGS Unit 1.
- However, there are two differences between the two events.
SCE was able to conclusively determine that the two CEAs dropped due to unrelated causes.
Additionally, the CPCs initiated a reactor trip for the CEA misalignment experienced during the San Onofre event.
APS concluded, therefore, that no CEA slip or drop events similar to the event at PVNGS Unit 1 have been previously reported.
IV.
ENGINEERING EVALUATION A.
ROOT CAUSE ANALYSIS A root cause analysis evaluation was conducted by APS and supported by C-E.
The evaluation consisted of several parallel activities including:
1)
Extensive CEDMCS circuitry testing was conducted at PVNGS Units 1
and 2, with assistance from C-E, to investigate the observed grounding phenomenon.
The goal was to duplicate the
~
~
conditions and precursors leading to the double CEA slip
'event.
In addition, a coil which had previously exhibited intermittent grounding in Unit 2, was bench tested.
During bench testing, lower liftcoil-lead wire movement (associated with lower lift coil movement believed to result from magnetic coupling of the coils and the CEDM assembly) was.
observed
- along, with arcing at the lower liftcoil lead wire penetration through the housing assembly (the nipple) illustrated in Appendix A, Figure 2.
A variable ground was applied to the Unit 1
CEDM circuitry to duplicate the observed CEDM grounding.
Noise was noted in the control circuit (CEDMCS).
,This noise is postulated to have increased over time and to have eventually interfered with the zero crossing detector circuit in the CEDMCS.
This reduced the voltage holding another
Duplicating this intermittent grounding during testing led to reproducing the slippage of CEA 57.
Testing has shown that a sustained ground fault will not produce the noise which caused the observed slippage.
2)
The motor generator (MG) set was investigated for potential contribution to the dual CEA slip event.
performed the investigation.
The investigation concluded that the MG set did not contribute to the dual CEA slip event.
3)
Two coil stacks from Unit 2 (for CEDM Nos.
33 and 19) were analyzed.
These coil stacks (illustrated in Appendix A,
Figure 2) had exhibited grounding characteristics similar to the coil stack for CEDM No.
64 in Unit 1.
Both coil stacks were removed from Unit 2 during the first refueling outage (early 1988).
~ 4
~ r
a)
EVALUATION OF UNIT 2 COIL STACK FROM CEDM NO.
33 The coil stack for CEDM No.
33 was disassembled,
- examined, and evaluated at PVNGS'y representatives of the Engineering Evaluations Department.
During the examination, substantial damage was found in the area of the lower liftcoil where the coil lead wires pass through the nipple assembly.
The evaluation concluded that the ground fault associated with CEA No.
33 was the result of damage to the coil lead wires which was later found to have occurred during the
- assembly, process (a manufacturing deficiency).
b)
EVALUATION OF UNIT 2 COIL STACK FROM CEDM NO 19 The coil stack for CEDM No.
19 was sent to C-E for an independent evaluation.,
During the evaluation, C-E identified damaged fiberglass sheathing and insulation on the coil leads.
This was determined to be a
manufacturing deficiency that occurred during the coil stack assembly process.
Two factors are believed to have contributed to the manufacturing deficiency becoming a pathway for a short to ground.
The two factors were the observed moti:on of the lower lift coil leads and the orientation of the coil within its housing.
These conditions combined to narrow the gap between the bare wire and the housing which allowed an intermittent ground
- fault, subsequent insulation deterioration over
- time, and subsequent arcing to the housing (nipple) assembly.
C-E has indicated that the failed insulation was a
result of a
manufacturing deficiency and was a
condition present from initial startup and not a
fault that developed as a
result of normal operation or equipment aging.
le) 4 gP
,gl wQ>
% ~
~
~
CEA Nos.
64 and 63 in PVNGS Unit 1, and CEA Nos.
33 and 19 in PVNGS Unit 2
exhibited the intermittent coil grounding described above since plant startup.
No other coils have exhibited the grounding phenomena.
No grounding indication or slippage attributed to grounding has occurred at PVNGS-3.
The Palo Verde units lower liftcoil leads move during CEA exercising
- which, in combination with the faulted lead, enables the intermittent grounding to occur on the lower lift coil.
Coils that did not indicate this ground phenomena during startup have remained sound with no ground indications during operation.
C-E's inspection of 16 lift and latch coils having experienced a
minimum of 730,000 steps of travel each during product testing, which is equivalent to over 18 years of.design
- life, have shown no coil lead insulation failure.
The condition leading to observed intermittent grounding in CEDM Nos.
19 and 33 for Unit 2 has been determined to be a
coil stack manufacturing deficiency.
APS believes that this same condition will be found in CEDM 63 and 64 for Unit 1 when they are examined and that this led to the observed dual CEA slippage in Unit 1.
This manufacturing deficiency caused the coils to intermittently ground and resulted in noise in the CEDMCS.
This noise caused the CEDMCS zero crossing detector circuit to misfire arid resulted in the observed dual slippage of CEA Nos.
64 and 57 in PVNGS Unit 1.
The root cause of the multiple CEA slippage, that a
single fault (intermittent grounding of a
CEDM coil lead during CEA stepping) may result in a multiple CEA slip, is discussed in the 10 CFR Part 21 report submitted to the NRC by C-E on April 20, 1988 (Appendix B, Technical Report 2).
Justification for continued operation of the PVNGS Units with this known defect is provided in Section VII.
I
~ 4 I
J'P "4~
A
B.
SAFETY ANALYSIS The required safety analyses for CEA misoperation events have been performed for Palo Verde in accordance
,with the guidance of Standard Review Plan (SRP) Section 15.4.3.
The safety analyses are documented in CESSAR Section 15.4.1.
The safety analyses are consistent with the existing design basis for the CEDMCS and the CPCs in that only credible single failures are evaluated.
Events that are beyond the current design basis, such as multiple CEA slip or drop events, are not analyzed.
These beyond design basis events were not required to be analyzed to show compliance with the NRC's acceptance criteria.
V.
REGULATORY IMPLICATIONS The NRC acceptance criteria and review guidelines for control rod misoperation events are presented in Standard Review Plan (SRP) Section 15.4.3.
The SRP lists three specific General Design Criteria (GDC) as providing acceptance criteria for CEA misoperation events.
The relevant GDCs are described below,.
The GDCs are included in 10 CFR 50, Appendix A.
The Palo Verde Operating Licenses require compliance with all NRC regulations except where specific relief has been, provided.
- Reactor Design The reactor core and associated
- coolant, control, and protection systems shall be designed with appropriate margin to assure that specific acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.
- Protection System Functions The protection systems shall be designed'1) to initiate automatically the operation of appropriate systems including the reactivity control
- systems, to assure that specified ac'ceptable fuel design limits are not exceeded as a result of
~P
~I I
I
anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to.safety.
GDC 25 -
Protection System Requirements.
for Reactivity Control'alfunctions, The protection system shall be designed to assure that specified acceptable fuel design 1'imits.are not exceeded for any single malfunction of the reactivity control
- systems, such as accidental withdrawal (not ejection or dropout) of the control rods.
In addition to these GDC,10 CFR 50 provides explanations for the terms Antici ated 0 erational Occurrence and'in le Failure.
These explanations are excerpted below along with GDC 24 and 29,
- which, although not cited in:
SRP Section 15.4.3, are related to the present situation.
Anticipated Operational Occurrence (10 CFR 50, Appendix A)
Anticipated Operational Occurrences mean-those'onditions of normal operation which are expected to occur one or more times
.during the life of the nuclear power unit.
Single Failure (10'FR 50, Appendix A)
Multiple failures resulting from a
single
'occurrence are considered to be a Single Failure.
GDC 24 Separation of Protection and Control Systems The protection system shall be separated from control systems to the extent that failure of any single control system component or.channel, or failure or removal from service of any single protection system component or,channel which is common to the control and protection system leaves intact a
system satisfying all reliability, redundancy, and IP J
~
)
t" 1
independence requirements of the protection system.
Interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired.
GDC 29 ProtectionAgainst Anticipated Operational Occurrences The protection and reactivity control systems shall be designed to assure an extremely high probability of accomplishing their safety functions in the event of Anticipated Operational Occurrences.
PVNGS demonstrated compliance wi.th the previously listed regulations as presently documented in the UFSAR.
CESSAR Section 7.2.2.1.1 lists the incidents of moderate frequency and infrequent incidents against which the reactor protection system was designed to protect.
One of the listed events is the dropping of a full or part length CEA.
This section of CESSAR does not list multiple CEA drop events (except for events involving a whole group or subgroup).
Multiple CEA drop events were not included in the design basis of
.the reactor protection system.
The design of the reactor protection system (not protecting against multiple CEA drop events) is supported by the engineering specification for the CEDMCS.
This engineering specification states that no single malfunction within CEDMCS shall cause the simultaneous drop of more than one CEA in the same or different subgroups.
The safety analyses for Palo Verde only considered single CEA'rop events.
The NRC
- judged, during the licensing review process, that Palo Verde complied with the applicable regulations based on the design basis of the
- CEDMCS, the design basis of the reactor protection system, and satisfactory results from the safety analyses for CEA drop events.
The investigation and evaluation conducted as a result of the December 10,
- 1988, multiple CEA sl'ip event at PVNGS has concluded that a single failure can result in multiple CEAs slipping or dropping.
- However, this event would not have been expected to occur if the initiating fault, the manufacturing deficiency in the coil
- leads, had not been present.
This information was provided to C-E designed plants in 0
)
t g
J L*
Infobulletin 89-02, Supplement 1, dated March 17, 1989 (Appendix B,
Technical-Report 1).
Information concerning the defect (that a single fault, intermittent grounding of a CEDM coil lead during CEA
- stepping, may result in a
multiple CEA slip) was provided to the NRC by C-E in the form of a 10 CFR Part 21 report on April 20, 1989 (Appendix B,
Technical Report 2).
The Section IV.A of this JCO.
results of the evaluation are presented in C-E's evaluated technical position, concurred with by APS, is that the probability of the initiating fault occurring again is very small and may be considered similar to an initiating fault on a new coil with no manufacturing deficiency.
The expected result of a coil ground, if it occurs, is the slip or drop of at most a single CEA.
Multiple slips or drops are not expected to occur due to a
developing ground if corrective actions are taken after the first indication are seen.
- APS, therefore, due to the concludes that having additional multiple CEA slips or drops suspected fault is very unlikely.
The reduced likelihood of an uncorrected intermittent ground fault, and the very low probability of such a fault causing a
multiple CEA slip or drop continues to exclude the consideration of multiple rod drop events from the category of an Anticipated Operational Occurrence.
These considerations continue to place PVNGS in conformance with the General Design Criteria in that Design Basis Events which are expected to occur once or more during the life of PVNGS (Anticipated Operational Occurrences) do not cause Specified Acceptable Fuel Design
- Limits, maximum linear heat
- rate, and minimum Departure from Nucleate Boiling Ratio, to be violated as stated in CESSAR, Section 3.1.16.
VI.
CORRECTIVE ACTION PLAN To correct the problems that exist and to aid in the detection of future
- problems, established:
the following corrective action plan has been Ir
(
~,
P
'J i>,
A 1
A testing plan has been developed and implemented that has tested for defective CEA coils in Unit 2 (no additional defective coils were identified during the testing beyond those in CEDMs 19 and 33 that were identified previously).
The testing plan will also test for defective CEDM coils in
.Units 1
and 3 prior to restart of each unit.
Additionally, even though further CEDM grounding conditions are not expected because the intermittent grounding condition is related to a manufacturing deficiency that becomes evident early in plant life, ground fault testing will be performed during CEA operation at normal unit startups and shutdowns associated with refueling outages.
If a
ground is discovered, the cause of the ground will be isolated (not all grounds in the CEDMCS will cause multiple slips). If an identified ground is determined to be originating from a
CEA coil
- assembly, that CEA should either no longer be moved (Technical Specification change required) unless absolutely required or the Unit should be shutdown and the affected coil assembly replaced.
2)
All known defective coil stacks, identified during
- testing, will be replaced prior to restart of the affected unit.
This is expected to eliminate the source of CEA slippage problems associated with ground faults.
3)
CEDM coil stacks from Unit 1
that previously exhibi:ted intermittent grounding (Nos.
63 and 64) will be disassembled and examined during the Unit 1 outage to confirm that they demonstrate similar damage to that found when the Unit 2
coils were examined.
This will confirm the failure mechanism leading to the observed intermittent grounding in Unit l.
4)
At least one CEAC should be maintained operable during monthly CEA exercise testing as this would provide automatic protection in most cases should two or more CEAs slip or drop into the core.
t e.
I
~-
5)
Reactor operating procedures, which were revised to direct the operators to immediately trip the reactor if two or more CEAs slip or drop into the core more than 9.9 inches (except during reactor power cutback) and an automatic reactor trip does not occur, will be maintained.
6)
Even though this is not an AOO, a program will be undertaken to further ensure that multiple CEA slip or drop events at
- PVNGS, resulting from noise in the
- CEDMCS, are either eliminated by design modifications to the CEDMCS or do not lead to a condition where Specified Acceptable Fuel Design Limits are violated.
This program will include one or more of the following:
Modifying the design of the CEDMCS to reduce its sensitivity to noise.
Demonstrating, through analysis, that the results of multiple rod slips, or drops are acceptable.
Modify the CPC/CEAC software such that a reactor trip occurs on all multiple rod drops or slips beyond technical specification limits.
This program will be undertaken with a goal of detexmining appropriate improvements within six months and implementing the improvements by the beginning of Unit 1,
Cycle 4
operation.
VII.
JUSTIFICATION FOR CONTINUED OPERATION Continued reactor operations are justified by the following:
It is C-E's technical position, concurred with by
- APS, that replacing the lower lift coils that.
exhibit grounding will correct the failed insulation pxoblem and return those coils to the as-designed 0
E.
1
condition.
Since testing has shown that a sustained fault will not produce the noise found to have caused the observed
- slippage, it is believed that only the lower lift coil, due to its observed motion during actuation, could produce the symptoms necessary to cause interference with another CEDM.
From the pattern of symptoms observed, it is evident that a fault of this type would produce noticeable symptoms such as intermittent ground fault annunciation and/or slippage of a single CEA prior to reaching a
level whereby, noise could interfere with other CEA operation.
Testing for ground faults during CEA operation at normal startups and shutdowns associated with refueling outages will detect intermittent grounding phenomena that potentially could cause CEA misoperation.
Prompt corrective action for an indicated intermittent ground fault identified during testing or operation will prevent'eterioration of the ground fault to the point that a multiple CEA slip could be experienced.
Based on the above information, the APS position, in conjunction with C-E, is that the probability of the initiating fault occurring again is very small and may,be considered similar to an initiating fault on a
new coil with no manufacturing deviations.
- APS, therefore, bel'ieves that having additional multiple CEA slips or drops due to the suspected fault is very unlikely.
This position is further substantiated by the following:
1)
The operating history at the Palo Verde units and other similarily C-E designed plants leads to the conclusion that the possibility of a
different intermittent ground fault mechanism
- causing, CEA slips or drops is remote.
2)
While there is insufficient evidence to rule out the possibility of similar noise generated by some other source, there is a very low probability that such a fault would occur with such timing that it would result in a reduction of the voltage holding other
- CEAs, such that there would be a
multiple CEA slip or drop.
There is no evidence to suggest 0
~I a~
4.
P bC n>>
V such phenomena causing single or multiple CEA drops at the Palo Verde units and other similarly C-E designed plants other than the coil grounding event at PVNGS-I,.
3)
Automatic reactor trips at full power conditions will occur for most multiple CEA slip or drop events with at least one CEAC and all CPC channels operable.
4)
The probability of fuel pins entering DNB is very low during most multiple CEA slip or drop events even without prompt operator action.
The potential for the fuel design limits being exceeded is dependent upon which CEAs slip and the magnitude of the resulting deviation.
A best estimate analysis performed by C-E, which considered the effects to the fuel following the drop of any two CEAs during Unit 1,
Cycle 3
operation, has determined that Specified Acceptable Fuel Design Limits would not be exceeded for at least the first 15 minutes following the event.
The Justification for Continued Operation "CEA Drop Events" was reviewed in accordance with the requirements of 10 CFR 50.59 for an unreviewed safety question.
The findings of this evaluation were that operation following the replacement of the grounded CEDM lower lift coils and.
testing during startup and shutdown does not constitute an unreviewed safety question.
The corrective actions outlined in this JCO'rovide additional assurance that in the unlikely event that some other source of noise is found that could result in a
multiple CEA slip or drop event and an automatic reactor trip does not
- occur, operator guidance exists to immediately, trip the unit.
0 Ii E.
l
(
In conclusion, the reduced likelihood of an uncorrected intermittent ground fault, and the very low probabil'ity of such a
fault causing a multiple CEA slip or drop, continues to exclude the consideration of multiple rod drop events from the, category of an Anticipated Operational Occurrence.
Additionally, there is, an even lower probability that a doubl'e CEA slip or drop would be of the limited set which could cause
.a specified acceptable fuel design limits to be exceeded.
0
( ~
APPENDIX A FIGURES
I L
480 VAC ASO VAC hG S" iS
%ACTOR TRIP BROKERS CEDMCS POW""R SUPPLY BUS SUMROUP BRBLKER
(
PICAI.
C~M SUSGROUP TO IM)IVIDUAL C-Dht SCRs FIGURE 1 CEDMCS POWER SUPPLY
'4l l'
gl I
h 1
I I I III))IIII)lI
)lI iI)IN
~ yIng4/
/
~ ~ QA,
'pper
~t~
".C.'ripper
~':;
iripples
~ ',
Spaccr
, 'I 4
~ ~
tlat
~
I Lower Lifter~~
Lower Gripper FIGURE 2 COIL, STACK ASSEMBLY
Oi l'
I
APPENOIX 8 TECHNICAL REPORTS
1L g)
$ lg
~ w
-'aft/
>l "
I i.I>>
,U
MULTIPLECZA SLIPfDROP EVZNTS hpril 19, 1989 h>>.>>
i i
events. This Supp!cmcat provides additional information which has resulted from thc continuing investigations at Palo Verde.
C-'E willfile a rcport pursuant to 10CPR21 to notify the NRC of thcsc findings.
~1.'nvestigation of thc multiple CEh slip event at Palo Vcrdc-1 has identified that a single fault, intermittent grounding of a CEDM coil'lead during CEA. stepping, tnay result in a multiple CZA slip or drop. This unanticipated conscqucncc, which is outside of the plant design basis, may occur due to intermittent ground fault noise induced into CZDM control system circuits. ht Palo Vcrdc-l, thc suspcctcd fault is a brcak in thc insulation of the CZDMlower lift coil lead, which permitted intermittent arcing bctwccn thc coil lead and aa adjacent nipple assembly during CZA stepping.
Such intermittent arcing may result in ~ slip or drop of other CZAs. A ground fault indication from th CEDM motor gcacrator (MC) sct, therefore, may be indicative of an increased risk for a multiple CZA slip or drop eveat.
Two CZDM coils at Palo Vcrdc-2 had exhibited s'imilar MG set grounding but had aot resulted in z CZA slip.
Disassembly of these two CZDM coil stacks revealed a break in. the lower lift coil lead wire insulation and cvidcncc of clcctrical arcing to an adjac nt nipple assembly.
No further indicatioa of intermittent grounding has occurred at Palo Verde-2 since these two lower liftcoils werc replaced. It is expected that disassembly of thc two suspect CZDMlower liftcoil stacks from Palo Vcrdc.l will reveal similar insulation and arcing problems.
Evidence suggests that this grounding phenomenon, idcntiflcd only in two CPDM lower liftcoils at Palo Verde-2 and suspected oa two coils at Palo Vcrdc-l, h s cxistcd since thc beginning of'plant operation.
However, the only multiple CZA operational fault rcportcd frotn Palo Verde-1 occurred after approximately three (3) years of plant operation, It was noted during testing at C-2 that.thc.
CZDM lower lift coil leads can move slightly during CZ'A operation.
This movcmcat in conjunction with a break in the coil lead insulation caused thc intermittent ground fault to occur on these coils.
Movcmcnt of thc lower lift coil is. a phenomenon that may be unique, to th System-80 design plants, The fault mechanism postulated at Palo Verde is bclicvcd unique to the 4-coil stack CZDM design utilized for System-80 plants.
However, intermittent ground faults from an unknown sourc-may iatroduc" like cffccts in other plaats cquippcd with similar CEDM
'ontrol systems.
cxhibitcd during initial operation, is not expected to develop as a result of normal operation or aging.
Monitoring for thc cxistenc" of ground faults during C=-A stepping is rccommcndcd.
Utilitics are advised to repair or rcplac CZDM coils that exhibit grounding.
Differences in CZA control system designs among the C-F. NSSS classes may result in som p!ants being more susceptible to a mu!tiple C:-A slip or drop cvcnt, An evaluation of th existing C:-A control system to confirm whether induced noise could result in a multiple C:-A slip or drop event should be considered.
Should a multiple CZh slip or drop be detected, utilities should ensure that prompt actions will bc implemented, for cxamplc, a plant trip or ifjustified a power reduction, to prcvcat exc "ding plant safety limits, CEDM control systems include Arkansas-2, San Oaofre-2,3, waterford-3, and St. Lucie-2.
Because of differences ia C:-DM control system designs, Main" Yankee, Mllstonc-2, Calvert Clif'fs-1,2, and St. Lucie-1 are less likely to experie c. similar problems.
Further, Palisades aad'ort Calhoun are believed unlike!y to be at fected sine they have substantially di!ferent control clcmcat drive system designs.
G~ff'U~ Joaquin Betaacourt (203) 285e4125
'H fetor-Itvoh coot ~ choo Ih tl el thtooeloetve '4 Ieovgeo tly c'\\ I\\ \\ eerv4e M vo<<r orclhettt4ve shoe ooer ~tloh el ~ eeel tl<<I 4
~I 0<<e ~ rv <<h"ve vee4 co<<tfet IH reeeorJ 50fe.
eho e+vo ~ ~ I rhehv IIC,~rt hOI <<hevh ee'I IH<<eo
~. I<<e ehrtv<<e ~ I oh he ~ ~ Oe vl<<II4 Shiv <<." Ihe Vho ~me ~ Sag th ~ I Q (
~ ~ ~ ~ H <<<<
~
Ie ~ ~ Or ~ ~ ~I ~ eehlff4hl. I ~ Irfee Or e I'4$.
IleCero~
freest ve Or tItHI~ (Or
~ Oert4<<
~ I 0<<IIII~ Ol r<<ert Ihtloeely, <<hh ref Scot lo l4 I
'alloy, Coe<<O~I ~ rveee or ~rovveee ol IHrhett oe Iehl ~ eveo. '~ ~ Iho Veer l~, LI heo<<ty, n~e~
of 0 her<<iee. I ~ I I~ I<<lt st yeerr elec ot t eo eel~.
c t cd"K Nav. stes)
4l 41
,l e
V
~p g
ll 1
a 4I
~t