ML17305A335
| ML17305A335 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 10/20/1989 |
| From: | Bernies R ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR |
| To: | |
| Shared Package | |
| ML17305A334 | List: |
| References | |
| NUDOCS 8911020144 | |
| Download: ML17305A335 (58) | |
Text
PALO VERDE NUCLEAR GENERATING STATION UNITS 1, 2,
AND 3 JUSTIFICATION FOR CONTINUED OPERATION CONTROL ELEMENT ASSEMBLY (CEA)
DROP EVENTS REV.
3 Prepared by!
- Manager, Nuclear Licensing Reviewed by!
Reviewed by!
- Manager, Nuclear Eng neering Mana er Nu r F 1 Management Approved bye Director, Nuclear Safety Approved by< Wuye~A
- Chairman, Plant e
and Licensing ew Board Approved by!
/ere 8 lant Director
/
Date DR
<DO 4 8910p5 020144 K 05000528 Q pNUQ 1677K/0059K
I' f
\\
~ +
l I
1
TABLE OF CONTENTS 0
PAGE EXECUTIVE
SUMMARY
I.
EQUIPMENT DESCRIPTION 1
A.
CONTROL ELEMENT DRIVE MECHANISM CONTROL SYSTEM (CEDMCS).
1 B.
CORE PROTECTION CALCULATORS (CPCs) 2 II.
HISTORY 5
III.
RELEVANT INDUSTRY EXPERIENCE.
7 IV.
ENGINEERING EVALUATION..
8 A.
ROOT CAUSE ANALYSIS.
~
8 B.
SAFETY ANALYSIS.
~
12 V.
REGULATORY IMPLICATIONS.
12 VI.
CORRECTIVE ACTION PLAN.
~
16 VII.
JUSTIFICATION FOR CONTINUED OPERATION 19 APPENDICES A.
FIGURES B.
TECHNICAL REPORTS e
e H,
EXECUTIVE
SUMMARY
On October 14,
- 1989, PVNGS Unit 2 exhibited Control Element Drive Mechanism Coil stack intermittent grounding on CEA Nos 41 and 27.
CEA 41 slipped approximately eight inches during a reactor startup.
These two occurrences exhibited similar characteristics
-of several previous coil grounds on Unit 1 (CEA Nos 63 and 64) and on Unit 2
(CEA Nos 33 and 19).
No grounding indication or CEA slippage attributed to grounding has been observed at PVNGS Unit 3.
A multidisciplinary review and evaluation conducted as a
result of the previous Unit 1
event determined that a degraded Control Element Drive Mechanism (CEDM), which resulted from a
manufacturing deficiency, was the initial condition responsible for intermittent grounding of the lower lift coil lead wires.
This intermittent grounding introduced noise into the Control Element Drive Mechanism Control System (CEDMCS) circuitry resulting in one observed double CEA slip in Unit 1 (CEA 64 and 57).
Based on the operational experience at PVNGS 1, 2,
and 3 and based on the coil grounding/CEA slippage occurrences, faults of this type produce noticeable symptoms such as intermittent ground fault annunciation and/or slippage of a
single CEA prior to reaching a level whereby noise could interfere with other CEA operation.
An action plan has been established to correct existing
- problems, detect
- problems, and prevent ground fault deterioration prior to its causing CEA misoperation.
During CEA o'peration, PVNGS will continuously monitor for ground fault indications to detect intermittent grounding occurrences that potentially could cause CEA misoperation.
PVNGS will take prompt corrective action for an indicated intermittent ground fault to prevent deterioration of the ground fault to the point that a multiple CEA slip could be experienced, Shutdown banks and control banks 1 and 2 that exhibit coil grounding will be maintained in position during operation.
For future coils indicating grounding in regulating banks (3,
4, 5 and P),
the Unit will be shutdown and the condition will be corrected.
'I I
I v>
Continued operation of PVNGS Units 1, 2 and 3 is justified by the following:
All previously known defective CEDMs at PVNGS (until recent grounding of CEDM 41 and 27 in Unit 2) have been replaced.
The CEDMCS susceptibility to externally introduced
- noise, which resulted in the one double CEA slip at PVNGS Unit 1, was identified by Combustion Engineering (C-E) in a 10 CFR Part 21 Notification submitted to the NRC.
This condition continues to exist in the PVNGS CEDMCS;
- however, it is considered to have a
very low probability of leading to multiple CEA slips.
This is based upon many years of reliable operation of C-E plants with CEDMCS equipment
- and, due to enhanced monitoring established at PVNGS.
Based on the operational experience at PVNGS-1, 2,
and -3, and based on the coil grounding/slippage events which have occurred at PVNGS-1 and
-2, as described above, faults of this type produce noticeable symptoms such as intermittent ground fault annunciation and/or slippage of a single CEA prior to reaching a level whereby noise could interfere with other CEA operation.
Monitoring for ground fault indications during CEA operation will detect intermittent grounding phenomena that potentially could cause CEA misoperation.
Prompt corrective action for an indicated intermittent ground fault.will prevent deterioration of the ground fault to the point that a multiple CEA slip could be experienced.
A CEDM monitoring program for CEA movement will be implemented which consists of the following:
Any time CEA's are to be moved, rods may only be moved in the manual mode (automatic mode will not be utilized).
Operations has been instructed to monitor the ground fault meters in the upper right hand corner of the MG set control panels for ground faults.
I
, ~ ic y;,
1+
"l l Oi
Video training has been'prepared and will be given to operations to identify the normal meter reading as well as a positive or a negative grounded coil.
Recorded ground indications from
~ Unit
¹2 CEA 27 and 41 will be used as examples.
Should,a ground fault occur CEA movement shall be stopped and investigated.
No movement of a CEA with a known ground fault will be made during operation of a
unit except when the Unit is in Mode 3 or as r
necessary to put the plant in a safe condition.
Although our evaluation has concluded that monitoring and corrective actions will preclude multiple CEA slips during power operation, automatic reactor trips at full power conditions occur for most multiple CEA slip or drop events with at least one CEAC and all CPC channels operable.
This provides additional assurance that fuel design limits will not be exceeded.
- Further, a
best estimate evaluation performed by Combustion Engineering has determined that.
Specified Acceptable Fuel Design Limits (SAFDL) would not be violated following the simultaneous drop of any two CEAs, even without prompt operator action.
Reactor operating procedures have been revised to direct the plant operators to immediately trip the reactor if two or more CEAs slip or drop into the core more than 9.9 inches (except during reactor power cutback) in the event an automatic reactor trip does not occur.
C-E believes, and APS
- concurs, that the intermittent grounding phenomena causing a multiple CEA slip or drop is an extremely rare occurrence.
As such, it should not be considered an Anticipated Operational Occurrence (AOO).
Unless the failed insulation condition is present from initial manufacturing, no mechanism has been identifed which would cause grounding to initiate and develop from normal operation or equipment aging.
-iv-
'I
(
n
Although this event is not considered an AOO, a program will be undertaken to further ensure that multiple CEA slip or drop events at PVNGS, resulting from noise in the CEDMCS, are either eliminated by design modifications to the CEDMCS or do not lead to a condition where Specified Acceptable Fuel Design Limits are violated.
This program consists of the following:
Eliminating any remaining manufacturing defects by inspection followed by
- repair, refurbishment, modification or replacement of any defective coils as appropriate, on the following schedule:
(1)
Unit 2,
at the upcoming refueling outage presently scheduled for February, 1989.
(2)
Unit 3 at the next scheduled refueling outage (3)
Unit 1 prior to restart from the current refueling outage.
In
- addition, the prog'ram
- has, and will continue to, identify and evaluate other improvements including:
Modifying the design of the CEDMCS to reduce its sensitivity to noise.
Demonstrating, through analysis, that the results of multiple rod slips or drops are acceptable.
Modifying the CPC/CEAC software such that a
reactor trip occurs on all multiple rod drops or slips beyond Technical Specification limits.
This, program will be undertaken with a
goal of determining appropriate improvements within six months and implementing the improvements by the beginning of Unit 1, Cycle 4 operation.
I
I.
E UIPMENT DESCRIPTION A.
CONTROL ELEMENT DRIVE MECHANISM CONTROL SYSTEM CEDMCS The purpose of the CEDMCS is to provide the drive signals to the coils of the magnetic-jack Control Element Drive Mechanisms (CEDMs) which position and hold the individual Control Element Assemblies (CEAs),
The CEDMCS controls the direction, rate, and duration of CEA motion in response to automatic or manual demands.
The CEDMCS is a non-safety related control system.
The safety function of the CEAs is to drop into the core when power is removed from the CEDMs.
Power is removed from the CEDMs when the reactor trip breakers open in response to valid reactor protection signals.
Refer to Appendix A, Figure 1 for a schematic of the power supply arrangement to the PVNGS CEDMCS.
Single failure considerations were accounted for in the design of the CEDMCS.
The following single failure conditions were included in the engineering specification for the CEDMCS (SYS80-ICE-6022):
1)
No single malfunction in the CEMDCS shall cause any of the following CEA drop conditions:
simultaneous drop of two CEAs of a four or five CEA subgroup.
simultaneous drop of three CEAs of a four or five CEA subgroup.
simultaneous drop of four non-symmetrical CEAs of a five CEA subgroup.
simultaneous drop of two or more CEAs assigned to different CEA subgroups.
2)
No single malfunction in the CEDMCS shall cause any single CEA to be withdrawn from the core, or allow the withdrawal of any single CEA except in the manual individual mode of control with that CEA
" selected for trimming.
3)
No single malfunction in the CEDMCS shall cause any single CEA to be inserted into the core, or allow the insertion of any CEA except in the manual individual mode of control with that CEA selected for trimming.
4)
No single malfunction in the CEDMCS shall cause the following non-demanded/non-selected CEA motion:
simultaneous motion of two or three CEAs of a four CEA subgroup in any mode of control.
simultaneous motion of four non-symmetrical CEAs of any five CEA subgroup in any mode of operation.
In spite of the numerous years of operation at C-E plants with the CEDMCS equipment, the event at PVNGS demonstrated that a
single deficiency in the CEDMCS can'ause a multiple rod slip event to occur without a program for ground fault monitoring in place.
Based upon many good years of experience, there is no reason to consider such a deficiency as an AOO, when an appropriate ground fault monitoring program is in place.
B.
CORE PROTECTION CALCULATORS CPCs The purpose of the Core Protection Calculators (CPCs) is to initiate automatic protective actions to ensure that the Specified Acceptable Fuel Design Limits (SAFDLs) on Departure from Nucleate Boiling Ratio (DNBR) and Local Power Density (LPD) are not exceeded during Anticipated Operational Occurrences (AOOs).
The CPCs accomplish this function by conservatively determining the DNBR and l4 I
LPD values for the most limiting core location.
All four CPC channels directly monitor the position of each CEA within a
single quadrant of the core.
Since each CEA subgroup contains one CEA in each quadrant, the individual CPC channels can detect deviations between subgroups in a single group, and out of sequence insertion or withdrawal of CEA groups.
The CPCs are assisted by the two Control Element Assembly Calculators (CEACs).
Each CEAC monitors the position of all CEAs in the core.
The purpose of the CEACs is to provide the CPCs with information about individual CEA deviations which are not detectable by the
- CPCs, Section 7.2.2.1,1 of CESSAR lists the incidents of moderate frequency and infrequent incidents against which the CPCs are designed to protect.
The CEA related events from CESSAR that were used to determine the system design basis are:
1)
Insertion or withdrawal of full-length or part-length CEA
- groups, including:
Uncontrolled sequential withdrawal of CEA groups, Out of sequence insertion or withdrawal of CEA groups, Malpositioning of the part-length CEA groups, or Excessive sequential insertion of full-length CEA groups; 2)
Insertion or withdrawal of full-length or part-length CEA subgroups, including:
Uncontrolled insertion or withdrawal of a CEA subgroup, Dropping of one CEA subgroup, or Misalignment of CEA subgroups comprising a
designated CEA group.
3)
Insertion or withdrawal of a
single full-length or part-length CEA, including:
Uncontrolled insertion or withdrawal of a single full-length or part-length
- CEA, Dropped full-length or part-length
- CEA, A
single CEA sticking, with the remainder of the CEAs in that group moving, or A statically misaligned CEA.
The list of events does not include multiple dropped CEAs except where all the CEAs are from the same group or subgroup.
The CPC design basis is consistent with that of the CEDMCS in that multiple dropped CEAs are not assumed to be design basis events.
The following listing provides the unanalyzed CEA drop cases that were not included in the CPC design basis:
a)
The simultaneous drop of 2 CEAs of any CEA subgroup.
b)
The simultaneous drop of 3'EAs of any CEA subgroup.
c)
The simultaneous drop of 4 CEAs of any 5 CEA subgroup.
d)
The simultaneous drop of 2 or more CEAs assigned to different CEA subgroups.
Since several multiple CEA misalignment events are not included in the CPC design basis, an automatic reactor trip may not be received for some of these events.
- However, recent best estimate analysis performed by Combustion Engineering has determined that SAFDLS would not be violated following the simultaneous drop of any two CEA's, even without prompt operator action.
e
~
'1
0
,II.
HISTORY Coil grounding problems with CEA No.
64 (Unit 1) were first observed in May 1985.
At that time, lower gripper assembly grounds were identified on CEA Nos.
63 and 64.
During the first refueling outage for Unit 1, CEA Nos.
63 and 64 were megger tested and a
circuit continuity check was performed, The results of this testing led to the decision that the two CEAs were acceptable for continued use.
Following the completion of the refueling outage in March 1988, the CEAs successfully completed the monthly exercise testing until October 8,
- 1988, when CEA No.
64 slipped during performance of the monthly exercise test.
This was a small slip of CEA No.
64 (to approximately 137 inches withdrawn) but it did result in pre-trips and a trip on one channel of the reactor protection system.
CEA No.
64 slipped again during the next performance of the monthly exercise test on November 5, 1988.
CEA No.
64 slipped to approximately 139.9 inches withdrawn during this test.
This resulted in a
10 inch deviation from the position of the other CEAs in the group.
An LER was submitted to the NRC as a result of this event (refer to LER 88-026-00 dated December 5, 1988).
CEA No.
64 also slipped during the next required performance of the monthly exercise test on December 10, 1988.
An LER was submitted as a
result of this event (refer to LER 88-020-00 dated January 9,
1989) and a
scheduled supplement to this LER will provide details of the subsequent investigation.
During this
- test, CEA No.
64 was being exercised in the manual individual mode and slipped to approximately 138 inches withdrawn, During attempts to recover CEA No. 64, it further slipped into the core to approximately 121 inches withdrawn.
Concurrently, the operators identified that CEA No.
57 had slipped from a fully withdrawn position to approximately 105 inches withdrawn.
The operators returned CEA No.
57 to the fully withdrawn position and then continued recovery activities for CEA No.
64.
CEA No.
64 reached a
minimum position of 61 inches withdrawn before being repositioned to the fully withdrawn position approximately 27 minutes after the CEA had initially slipped.
No coil stack assemblies in PVNGS Unit 1, other than those associated with CEA Nos.
63 and 64, have exhibited these grounding indications.
Due to the nature of the problem, an exigent Technical Specification change was requested from the NRC.
The requested change allowed for the continued operation of Unit 1 until the end of its current cycle without conducting further exercise testing on CEA No.
64.
The NRC granted this request on January 13,
- 1989, and no grounding indications were experienced during the monthly CEA exercise testing performed in January or February of 1989.
PVNGS reported in LERs 88-026-00 and 88-020-00 that the cause of the CEA No.
64 slip events was an apparent ground on the CEDM lower gripper coil.
The ground occurred immediately following the voltage increase associated with energizing the lower liftcoil.
The magnitude of the ground varied and thus CEA slippage did not occur on every cycle.
Additionally, the lower gripper and lower lift coils are only energized during CEA motion (either insertion or withdrawal).
When the CEA is stationary, the CEA is held by the upper gripper coil and the lower gripper coil is not energized.
Therefore, there is little probability of CEA No.
64 inadvertently slipping into the core when no motion is demanded.
A multidisciplinary investigation involving APS and Combustion Engineering (C-E) was undertaken to determine the cause of CEA No.
57 slippage during the efforts to recover CEA No. 64.
The design of the CEDMCS system was reviewed and a safety analysis investigation of the implications of CEA drop events was performed.
The engineering evaluation section of this Justification for Continued Operation (JCO) reports on the results of this investigation.
The inspections of PVNGS Unit 1 coil stacks for CEA's 64 and 63 revealed failed insulation on their respective lower lift coils and evidence of arcing on their respective nipple assemblies.
This condition is similar to that observed on lower lift coils from Unit 2 which were examined by APS and C-E and described in the Engineering Evaluation section of this JCO.
- (
These two CEDM coil stacks which exhibited similar grounding characteristics, but not double
CEDM coil stacks 41 and 27 in PVNGS Unit 2 exhibited grounding on October 14, 1989.
CEA 41 slipped approximately eight inches during a
reactor startup (the slip did not result from the grounding of coil stack 27).
These failures exhibited the same characteristics of previous coil grounds.
No grounding indication or slippage attributed to grounding has been observed at PVNGS Unit 3.
III.
RELEVANT INDUSTRY EXPERIENCE Following the December 10, 1988 dual CEA slip event at PVNGS Unit 1,
a search was initiated within the industry to determine if other nuclear power units had experienced any similar multiple CEA slip or drop events.
The PVNGS Reliability Analysis organization performed a search of the Nuclear Plant Reliability Data System (NPRDS) data base for CEA slip or drop events.
The NPRDS data base contained 98 CEA slip or drop events.
Of these 98 events, ll involved multiple CEAs.
An event at Turkey Point Unit 4
in August 1985 and an event at Surry Unit 1 in September 1986 were initially thought to be similar to the recent event at Palo Verde.
For both of these
- events, a single control rod dropped and was followed by the subsequent drop of a second control rod before the first control rod had been recovered.
Further investigation of the Turkey Point Unit 4 and Surry Unit 1 events concluded,
- however, that there were basic differences between these events and the PVNGS Unit 1 event.
PVNGS also contacted C-E to determine if they were aware of any multiple CEA slip or drop events at any C-E designed plants.
C-E indicated that they were aware of an event that occurred at San Onofre in July 1986 (discussed below),
a drop of four CEAs at Maine Yankee in 1975 due to a power supply failure, and a drop of two CEAs at Calvert Cliffs Unit 2
in April 1982 due to a technician error.
The multiple CEA drop events at Maine Yankee and Calvert Cliffs Unit 2
were dissimilar from the PVNGS event and did not warrant further review.
0 PVNGS contacted representatives at each of the recent vintage C-E plants that are equipped with CPCs.
Representatives from Arkansas Power and Light and Louisiana Power and Light were not aware of any mutiple CEA slip or drop events at their plants.
- However, conversations with Southern California Edison (SCE) personnel indicated that San Onofre Unit 2 dropped two CEAs on July 7,
1986.
The event began when CEA No.
55 dropped fully into the reactor.
A short time
- later, CEA No.
49 also dropped into the reactor.
This resulted in an automatic reactor trip because of high CEA misalignment penalty factors calculated by the CEACs.
SCE determined that the root cause of the CEA No.
55 drop was electronic failures due to overheating in the CEDMCS cabinets.
The CEDMCS cabinets overheated after a chiller failed.
CEA No.
49 dropped due to an unrelated cause; it resulted from a failed CEDM gripper coil DC current sensor which was aggravated by an existing design deficiency.
In
- summary, of the several multiple slip or drop events evaluated, only San Onofre Unit 2 has experienced an event similar to the event at PVNGS Unit 1.
- However, there are two differences between the two events.
SCE was able to conclusively determine that the two CEAs dropped due to unrelated causes.
Additionally, the CPCs initiated a
reactor trip for the CEA misalignment experienced during the San Onofre event.
APS concluded, therefore,"
that no CEA slip or drop events similar to the event at PVNGS Unit 1 have been previously reported, IV.
ENGINEERING EVALUATION A.
ROOT CAUSE ANALYSIS A root cause analysis evaluation was conducted by APS and supported by C-E.
The evaluation consisted of several parallel activities including:
1)
Extensive CEDMCS circuitry testing was conducted at PVNGS Units 1
and 2, with assistance from C-E, to investigate the observed grounding phenomenon.
The goal was to duplicate the
e
conditions and precursors leading to the double CEA slip event.
In addition, a coil which had previously exhibited intermittent grounding in Unit 2, was bench tested.
During bench testing, lower liftcoil lead wire movement (associated with lower lift coil movement believed to result from magnetic coupling of the coils and the CEDM assembly) was observed along with arcing at the lower liftcoil lead wire penetration through the housing assembly (the nipple) illustrated in Appendix A, Figure 2.
A variable ground was applied to the Unit 1
CEDM circuitry to duplicate the observed CEDM grounding.
Noise was noted in the control circuit (CEDMCS).
This noise is postulated to have increased over time and to have eventually interfered with the zero crossing detector circuit in the CEDMCS.
This reduced the voltage holding another
Duplicating this intermittent grounding during testing led to reproducing the slippage of CEA 57.
Testing has shown that a sustained ground fault will not produce the noise which caused the observed slippage.
2)
The motor generator (MG) set was investigated for potential contribution to the dual CEA slip event.
performed the investigation.
The investigation concluded that the MG set did not contribute to the dual CEA slip event.
3)
Two coil stacks from Unit 2 (for CEDM Nos.
33 and 19) were analyzed.
These coil stacks (illustrated in Appendix A,
Figure 2) had exhibited grounding characteristics similar to the coil stack for CEDM No.
64 in Unit 1, Both coil stacks were removed from Unit 2 during the first refueling outage (early 1988).
Two coil stacks from Unit 1 (for CEDM Nos.
64 and 63) were inspected and had similar failures as the previous defective coils.
0
a)
EVALUATION OF UNIT 2 COIL STACK FROM CEDM NO.
33 The coil stack for CEDM No.
33 was disassembled,
- examined, and evaluated at PVNGS by representatives of the Engineering Evaluations Department.
During the examination, substantial damage was found in the area of the lower lift coil where the coil lead wires pass through the nipple assembly.
The evaluation concluded that the ground fault associated with CEA No.
33 was the result of damage to the coil lead wires which was later found to have occurred during the assembly process (a manufacturing deficiency).
Two factors are believed to have contributed to the manufacturing deficiency becoming a pathway for a short to
- ground, The two factors are the observed motion of the lower lift coil leads and the orientation of the coil within its housing.
These conditions combined to narrow the gap between the bare wire and the housing which allowed an intermittent ground fault, subsequent insulation deterioration over
- time, and subsequent arcing to the housing (nipple) assembly.
b)
EVALUATION OF UNIT 2 COIL STACK FROM CEDM NO.
19 The coil stack for CEDM No, 19 was sent to C-E for an independent evaluation.
During the evaluation, C-E identified damaged fiberglass sheathing and insulation on the coil leads.
This was determined to be a
manufacturing deficiency that occurred during the coil stack assembly process and the contributing factors outlined above.
I~
e
C-E has indicated that the failed insulation was a
result of a
manufacturing deficiency and was a
condition present from initial startup and not a fault that developed as a
result of normal operation or equipment aging.
CEA Nos.
64 and 63 in PVNGS Unit 1, and CEA Nos.
33 and 19 in PVNGS Unit 2
exhibited the intermittent coil grounding described above since plant startup.
No grounding indication or slippage attributed to grounding has occurred at PVNGS-3.
The Palo Verde units lower liftcoil leads move during CEA exercising
- which, in combination with the faulted lead, enables the intermittent grounding to occur on the lower lift coil.
C-E and PVNGS engineers performed an inspection of 16 lift and latch coils that had experienced a
minimum of 730,000 steps of travel each during product testing (which is equivalent to over 18 years of design life).
This inspection re'suited in the conclusion that the coil lead grounding problem was not only wear
- related, but had to be preceeded by the initial manufacturing defect.
The wires showed no insulation damages that would lead to arcing of the wires to ground.
This observation led to the conclusion that normal cycling of the coils would cause damage only if an initial manufacturing defect was present.
The condition leading to observed intermittent grounding in CEDM Nos.
19 and 33 for Unit 2 has been determined to be a coil stack manufacturing deficiency.
The same condition has been found in CEDM 63 and 64 for Unit 1.
This manufacturing deficiency caused the coils to intermittently ground and resulted in noise in the CEDMCS.
This noise caused the CEDMCS zero crossing detector circuit to misfire and resulted in the observed dual slippage of CEA Nos.
64 and 57 in PVNGS Unit 1.
The root cause of the multiple CEA slippage, that a single fault (intermittent grounding of a CEDM coil lead during CEA stepping) may result in a multiple CEA slip,
(
is discussed in the 10 CFR Part 21 report submitted to the NRC by C-E on April 20, 1988 (Appendix B,
Technical Report 2).
Justification for continued operation of the PVNGS Units with this known defect is provided in Section VII.
B.
SAFETY ANALYSIS The required safety analyses for CEA misoperation events have been performed for Palo Verde in accordance with the guidance of Standard Review Plan (SRP) Section 15.4.3.
The safety analyses are documented in CESSAR Section 15.4.1.
The safety analyses are consistent with the existing design basis for the CEDMCS and the CPCs in that only credible single failures are evaluated.
Events that are beyond the current design basis, such as multiple CEA slip or drop events, are not analyzed.
These beyond design basis events were not required to be analyzed to show compliance with the NRC's acceptance criteria.
V.
REGULATORY IMPLICATIONS The NRC acceptance criteria and review guidelines for control rod misoperation events are presented in Standard Review Plan (SRP)
Section 15.4.3.
The SRP lists three specific General Design Criteria (GDC) as providing acceptance criteria for CEA misoperation events.
The relevant GDCs are described below.
The GDCs are included in 10 CFR 50, Appendix A,
The Palo Verde Operating Licenses require compliance with all NRC regulations except where specific exception has been provided.
GDC 10 - Reactor Design The reactor core and associated
- coolant, control, and protection systems shall be designed with appropriate margin to assure that specific acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.
0
GDC 20 - Protection System Functions The protection systems shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems,,
to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.
GDC 25 -
Protection System Requirements for Reactivity Control Malfunctions The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control
- systems, such as accidental withdrawal (not ejection or dropout) of the control rods.
In addition to these
- GDC, 10 CFR 50 provides explanations for the terms Antici ated 0 erational Occurrence and Sin le Failure.
These explanations are excerpted below along with GDC 24 and 29,
- which, although not cited in SRP Section 15.4.3, are related to the present situation.
Anticipated Operational Occurrence (10 CFR 50, Appendix A)
Anticipated Operational Occurrences mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit.
Single Failure (10 CFR 50, Appendix A)
Multiple failures resulting from a
single occurrence are considered to be a Single Failure.
GDC 24 -
Separation of Protection and Control Systems The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection system leaves intact a
system satisfying all reliability, redundancy, and independence requirements of the protection system.
Interconnection of 'the protection and control systems shall be limited so as to assure that safety is not significantly impaired.
GDC 29 -
Protection Against Anticipated Operational Occurrences The protection and reactivity control systems shall be designed to assure an extremely high probability of accomplishing their safety functions in the event of Anticipated Operational Occurrences.
PVNGS demonstrated compliance with the previously listed regulations as presently documented in the UFSAR.
CESSAR Section 7.2.2.1.1 lists the incidents of moderate frequency and infrequent incidents against which the reactor protection system was designed to protect.
One of the listed events is the dropping of a full or part length CEA.
This section of CESSAR does not list multiple CEA drop events (except for events involving a whole group or subgroup)
~
Multiple CEA drop events were not included in the design basis of the reactor protection system.
The design of the reactor protection system (not protecting against multiple CEA drop events) is supported by the engineering specification for the CEDMCS.
This engineering specification states that no single malfunction within CEDMCS shall cause the simultaneous drop of more than one CEA in the same or different subgroups, The safety analyses for Palo Verde only considered single CEA drop events.
The NRC
- judged, during the licensing review process, that Palo Verde complied with the applicable regulations based on the design basis of the
- CEDMCS, the design basis of the reactor protection system, and satisfactory results from the safety analyses for CEA drop events.
The investigation and evaluation conducted as a result of the December 10,
- 1988, multiple CEA slip event at PVNGS has concluded that a single failure can result in multiple CEAs slipping or dropping.
- However, 0
+I tp
this event would not have been expected to occur if the initiating fault, the manufacturing deficiency in the coil
- leads, had not been present.
This information was provided to C-E designed plants in Infobulletin 89-02, Supplement 1, dated March 17, 1989 (Appendix B,
Technical Report 1).
Information concerning the defect (that a single fault, intermittent grounding of a CEDM coil lead during CEA
- stepping, may result in a
multiple CEA slip) was provided to the NRC by C-E in the form of a 10 CFR Part 21 report on April 20, 1989 (Appendix B,
Technical Report 2).
The results of the evaluation are presented in Section IV.A of this JCO.
C-E's evaluated technical position based on operating experience, concurred with by APS, is that the expected result of a coil ground, if it occurs, is the slip or drop of at most a single CEA.
Multiple slips or drops are not expected to occur due to a coil ground if corrective actions (i.e.
no longer moving the affected CEA or replacing the grounded coil) are taken after the first indication is seen.
- APS, therefore, concludes that having additional multiple CEA slips or drops due to the suspected fault is very unlikely.
The very low probability of such a fault causing a
multiple CEA slip or drop continues to exclude the consideration of multiple rod drop events from the category of an Anticipated Operational Occurrence.
In the unlikely event that a
multiple CEA slip occurs the probability of fuel pins entering DNB is very low even without prompt operator action.
Best estimate anlayses performed by Combustion Engineering have determined that SAFDLS would not be violated following the simultaneous drop of any two
- CEAs, even without prompt operator action.
These considerations continue to place PVNGS in conformance with the General Design Criteria in that Design Basis Events which are expected to occur once or more during the life of PVNGS (Anticipated Operational Occurrences) do not cause Specified Acceptable Fuel Design
- Limits, maximum linear heat rate, and minimum Departure from Nucleate Boiling Ratio, to be violated as stated in
- CESSAR, Section 3.1.16.
, VI.
CORRECTIVE ACTION PLAN To correct the problems that exist and to aid in the detection of future
- problems, the-following corrective action plan has been established:
1)
A testing plan had been developed and implemented that tested for defective CEA coils in Unit 2
no additional defective coils were identified during the initial testing beyond those in CEDMs 19 and 33 that were identified previously.
Subsequently, CEAs 41 and 27 were identified as having coil grounds.
The testing plan will also test for defective CEDM coils in Units 1
and 3 prior to restart from the refueling outage of each unit.
Shutdown banks and control banks 1
and 2
that have exhibited coil grounding will be maintained in the fullout position during operation, and will be replaced or corrected, as indicated previously in the executive summary.
For coils indicating grounding in banks 3,
4, 5
and P,
the unit will be shutdown and the coil will be replaced or corrected.
Surveillance testing on Unit 2 will continue to be performed on all rods, on a monthly basis by shutting down to Mode 3.
Testing to identify ground faults associated with coil stacks will be performed just prior to opening breakers for a refueling outage and prior to returning to power following a
refueling outage.
Guidance to operators for responding to ground indications that occur during normal operation (including Technical Specification required monthly CEA exercise testing) has been provided.
Augumented monitoring for ground indications will be performed by operations during movement of CEA's by monitoring ground fault indicators on the MG panel.
If grounding is detected, CEA movement is to be stopped and evaluated, except as necessary to put the plant in a safe condition.
Monitoring for grounds at the MG panel allows for earlier detection 0
~)
of ground faults than use of the control room alarm alone, further increasing confidence that grounds will be detected and addressed before degradation could lead to multiple CEA slips.
2)
All known defective coil
- stacks, identified during the previous cycle or refueling shutdown will be replaced prior to restart from refueling of the affected unit.
This is expected to minimize potential sources of CEA slippage problems associated with ground faults.
3)
CEDM coil stacks from Unit 1
that previously exhibited intermittent grounding (Nos.
63 and 64) were disassembled and examined on October 16, 1989 and APS confirmed that they demonstrated similar damage to that found when Unit 2 coils (Nos.
19 and 13) were examined.
This confirmed the postulated failure mechanism leading to the observed intermittent grounding in Unit 1.
4)
At least one CEAC must be maintained operable during CEA
- movement, This will provide automatic protection in most cases should two or more CEAs slip or drop into the core.
5)
Reactor operating procedures, which were revised to direct the operators to immediately trip the reactor if two or more CEAs slip or drop into the core more than 9.9 inches (except during reactor power cutback) and an automatic reactor trip does not occur, will be maintained.
6)
Even though this is not an AOO, a program will be undertaken to further ensure that multiple CEA slip or drop events at
- PVNGS, resulting from noise in the
- CEDMCS, are either eliminated by design modifications to the CEDMCS or do not lead to a condition where Specified Acceptable Fuel Design Limits are violated.
This program consists of the following:
0 e
a)
Eliminating any remaining manufacturing defects by inspections, followed by
- repair, replenishment, modification or replacement of any defective coils, as appropriate on the following schedule:
(1)
Unit 2, at the upcoming refueling outage presently scheduled for February, 1989 (2)
Unit 3, at the next refueling outage (3)
Unit 1,
prior to restart from the current refueling outage.
In addition, the program has, and will continue to, identify and evaluate other improvements including:
Modifying the design of the CEDMCS to reduce its sensitivity to noise.
Demonstrating, through analysis, that the results of multiple rod slips or drops are acceptable.
Modifying the CPC/CEAC software such that a reactor trip occurs on all multiple rod drops or slips beyond Technical Specification limits.
This program will be undertaken with a goal of determining appropriate improvements within six months and implementing the improvements by the beginning of Unit 1,
Cycle 4
operation, 0
11 g1
~ C l
I i
0
/II.
JUSTIFICATION FOR CONTINUED OPERATION Continued reactor operations are justified by the following:
2 and all shutdown groups that have exhibited evidence of grounding will be maintained in a
fullout position during mode 1 operation, and defective coils will be replaced or corrected at the earliest practical opportunity not later than the next refueling outage.
Should any coils indicate grounding in banks 3,
4, 5
and P,
as evidenced by the operational monitoring described
- earlier, the unit will be shutdown and the coil replaced or corrected.
Surveillance testing will continue to be performed on all rods, on a
monthly basis by shutting down to Mode 3.
Since testing has shown that a
sustained fault will not produce the noise found to have caused the observed slippage, it has been concluded that only the lower lift coil, due to its observed motion during actuation, could produce the symptoms necessary to cause interference with another CEDM.
Additional testing to identify ground faults associated with coil stacks will be performed just prior to opening breakers for a refueling outage and prior to returning to power following a
refueling outage until inspection and repair, modification or replacement has eliminated all manufacturing defects that may r'emain.
Guidance to operators for responding to ground indications that occur during normal operation (including Technical Specification required monthly CEA exercise testing) will be provided.
Any ground faults identified during operation or Technical Specification required monthly CEA exercise testing will be responded to as indicated above.
Based on the operational experience at PVNGS-1, -2, and -3, and based on the coil grounding/slippage events which have occurred at PVNGS -1 and -2, as described above, faults of this type produce noticeable symptoms such as intermittent ground fault annunciation and/or slippage of a single CEA prior to reaching a level whereby noise could interfere with other CEA operation, During CEA operation, continuous monitoring for ground fault indications will detect intermittent grounding phenomena that e
yh
potentionally could cause CEA misoperation.
Prompt corrective action for an indicated intermittent ground fault will prevent deterioration of the ground fault prior to the point that a multiple CEA slip could be experienced.
APS, therefore, believes that having additional multiple CEA slips or drops due to the suspected fault is very unlikely.
This position is further substantiated by the following:
1)
The operating history at the Palo Verde units and other similarily C-E designed plants leads to the conclusion that the possibility of a
different intermittent ground fault mechanism causing CEA slips or drops is remote and does not constitute a new AOO.
2)
While ther'e is insufficient evidence to rule out the possibility of similar noise generated by some other source, there is a very low probability that such a fault would occur with such timing that it would result in a reduction of the voltage holding other
- CEAs, such that there would be a
multiple CEA slip or drop.
There is no evidence to suggest such phenomena causing single or multiple CEA drops at the Palo Verde units and 'other similarly C-E designed plants other than the coil grounding event at PVNGS-1.
3)
Automatic reactor trips at full power conditions will occur for most multiple CEA slip or drop events with at least one CEAC and all CPC channels operable.
4)
The probability of fuel pins entering DNB is very low during most multiple CEA slip or drop events even without prompt operator action.
The potential for the fuel design limits being exceeded is dependent upon which CEAs slip and the magnitude of the resulting deviation.
A best estimate analysis performed by C-E, which considered the effects to the fuel following the drop of any two CEAs during Unit 1,
Cycle 3
operation, has determined that exceeding Specified 0
I'8
Acceptable Fuel Design Limits would not be expected for at least the first 15 minutes following the event.
Operating procedures have been modified to require an immediate reactor trip in the event of multiple CEA slips or drops.
The corrective actions outlined in this JCO provide additional assurance that in the unlikely event that some other source of noise is found that could result in a multiple CEA slip or drop event and an automatic reactor trip does not
- occur, operator guidance exists to immediately trip the unit.
In conclusion, the very low probability of such a fault causing a
multiple CEA slip or drop, continues to exclude the consideration of multiple rod drop events from the category of an Anticipated Operational Occurrence.
Additionally, there is an even lower probability that a double CEA slip or drop would be of the limited set which could cause a specified acceptable fuel design limits to be exceeded.
0
(
J I
APPENOIX A PIGURES
0
"/
'\\
II h~<
t
l)l 1%1
))3111" J
~~2; pp'f0)
'J<
. l~~.lt,d L ~
Upper Lifter ~
':iS".;-"'
Cg I
55 Upper Gripper Vgi
~
'+&I Spacer A 'y
~ g
~
ta. "-
I
,~.p
,g~
~ f,;,
Lower Lifter t."5~
I l
t iiipples Lower Gripper FIGURE 2 COIL STACK ASSEMBLY
0 e
480 VAC 480 VAC hG SETS REACTOR TRIP BREAKERS CEGMCS POEY":R SUPPLY BUS SUMRQUP ~
BREAKER TYPICAL CEA SUBGROUP
(
(
TQ lhOlVlGUAL CEL"M SCRs FIGURE 1 CEDMCS POllER SUPPLY
'I lf
APPENDIX 8 TECHNICAL REPORTS
k fl lb 8
J yf 4
i'io, sv-tr2ttSgOpIt MULTIPLECEA SLG'/DROP EVENTS hpril 19, 1989 h
i iV
.hcvcnts.,This Supplcmcnt provides additional information which has rcsultcd from thc'continuing
'U
'".investigations at Palo Verde, C-E.will file a report pursuant to 10CFR21 to notify.the HRC of thcsc findings.
tgisttnt investigation of the multiple CEA slip event at Palo Verde-I has Identified that a single fnult, Intermittent grounding of n cEDM soil lend during chs stepping, may result in a El multiple CEA slip or drop. This unanticipated conscqucncc, which ls outside of the plant dcslgn basis, may occur due to intermittent ground fault noise induced into CEDM control system circuits. At Pa1o Verde-l, the suspected fault is a break ln the insulation of the CEDM lower lift coil lead, which permitted intermittent arcing bctwccn the coil lead and an adjacent nipple assembly during CEA stepping.
Such intermittent arcing may result in a slip or drop of other CEAs. A ground fault indication from the CEDM motor generator (MG) sct, thcrcfore, may bc indicative of an increased risk for a multiple CZA slip or drop event.
~
~
~
~
~
~
~
~
Two CEDM coils at Palo Vcrdc-2 had exhibited similar MQ sct grounding but had not resulted ln a CZA slip.
Disassembly of these two CEDM coll stacks revealed a break in the lower lift r
coil lead wire insulation and evidence of clcctrical arcing to an adjacent nipple assembly.
No further indication of intermittent grounding has occurred at Palo Verde-2 since these two lower liftcoils were replaced, It is expected that disassembly of thc two suspect CEDM lower liftcoil
rpstacks from Phlo'Vcrdc-1 will reveal similar'insulation and arcing problems, Evidcncc suggests that this grounding phenomenon, idcntlflcd only in two CEDM lower liftcoils at Palo Verde-2, QJ and suspected on two coils at Palo Ycrdc-l, has cxistcd since thc beginning of'plant operation.
However, thc only multiple CEA operational fault rcportcd from Palo Verde-1 occurred after approximately three (3) years of plant operation.
It was noted during testing at C-E that.thc.
CEDM lower lift coil leads can move slightly during CEA operation.
This moveincnt in conjunction with a break in the coil lead insulation caused the intermittent ground fault to occur on thcsc coils.
Movement of the lower lift coil is a phcnomcnon that may be unique to thc System-80 design plants. The fault mechanism postulated at Palo Verde is bclicvcd unique to thc 4-coil stack CEDM design utilized for System.80 plants.
However, intermittent ground faults from an unknown source may introduce like cffccts in other plants equipped with similar CEDM
'ontrol systems.
~e hhi h
h*
hh iii i
i h
cxhibitcd during initial operatJon, ls not cxpectcd to dcvclop as a result of normal operation or
- aging, Monitoring for thc existence of ground faults during CEA stepping is recommcndcd.
,:; Utilities arc advised to,repair.or replace CEDM coils that exhibit grounding.
Differences in CEA control system designs among the C-E NSSS classes may result in some p'tants being more susceptible to a multiple CEA slip or drop cvcnt. An evaluation of the existing CEA control system to confirm whether induced noise could result in a multiple CZA slip or drop event should be considcrcd.
Should a multiple CEh slip or drop be dctccted, utilities should ensure that prompt actions will bc implcmcntcd, for cxamplc, a plant trip or ifjustified a power reduction, to prevent exceeding plant safety limits, r
hi CEDM control systems include Arkansas-2, San Onofre-2,3, Paterford-3, and St. I.ucic-2.
h Because of diffcrcnces in CEDM control system designs, Maine Yankee, Mllstonc-2, Calvert
~
~
~
~
~
~
~
~
Cliffs-1,2, and St, Lucie-1 arc less likely to experience similar problems.
Further, palisades and Fort Calhoun arc believed unlikely to be affected since they have substantially different control clcmcnt drive system designs.
Qltlf.'~ Joaquin Betancourt (203) 285.4125 ytte lnforn tpon conttsned fn mtt fn(oohttttpn tt ontvdtd tsr C t I ~ ~ Iervhta tp rtnr onftnhgttvsn. S:nct ooer ttton o( lour crt~
ha to t<<I~ rv <<hntn ~ co<<tref Ind moo<<4 >otv.
and hnvo v ~I trhenv IIctorI oog i<<ttnhn Q i ~ alho<<htooI, 1vhI trito<<rh ~ tron nh ~ r OI hrt<<I to orttv vrtn Ino uno ~ rIl~ nolrvg trh ~ I C ( <<isa
~ ~ rhn <<er ~"os ~ or ~ ~ ~I ~ I ~ os tthons, I a prtat or rot'< 4 ahrenl'ea 0( fttn~ I~ (or ~ pert4<<l ~ I ohhroot ~ or rrhelcrsntsohthtr
<<nhr ~ Ioecl to IM ac urtcY cornohtttnest or uaetutrheas of I he <<oration tons ~ hned. C ig~. I 4 I ha Oh I h I y h In r he O l v d 4 eh 4 4 OI 4afhtIvv ht4 h II a I~ a I et 0 ( y0ur WI 0 ( V'
< I~tent C t CCOO"K fhosf. s/Osl hah
~h rs
'1 r
(