05000529/LER-1999-005, :on 990618,RT on Low DNBR Was Noted.Caused by Hardware Induced Calculation Error.Cr Operator Was Taken to Place Reactor in Stable Condition IAW Appropriate Operating Procedure
| ML17313B019 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 07/16/1999 |
| From: | Marks D ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR |
| To: | |
| Shared Package | |
| ML17313B018 | List: |
| References | |
| LER-99-005, NUDOCS 9907280252 | |
| Download: ML17313B019 (7) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation |
| 5291999005R00 - NRC Website | |
text
NRC FORM 388 (6-1996)
U.S. NUCLEARREGULATORYCOMMISSION LlCENSEE EVENT REPORT (LER)
(See reverse for required number of digitslcharacters for each block)
APPROVED BY OMB No. 31504104 EXPIRES 08/30/2001
, the NRC may nol conduct or
- sponsor, and a person is not required to respond to, the information collecbon.
FACILITYNAME(1)
Palo Verde Nuclear Generating Station-Unit 2 TITLEIe)
Reactor Trip on Low DNBR DOCKET NUMBER(2) 05000529 PAGE (3) 1 OF 5
EVENT DATE (6)
LER NUMBER (8)
REPORT DATE (7)
OTHER FACILITIESINVOLVED(8)
MONTH DAY 06 18 1999 1999 005 00 07 16 1999 SEQUENTIAL REVISION YEAR NUMBER NlMBER MONTH DAY YEAR FACILirYNAME N/A FACILITYNAME N/A DOCKET NUMBER OPERATING MODE (8)
POWER LEVEL(10) 100 THIS REPORT IS SUBMITTEDPURSUANT TO THE REQU 20.2201 b
20.2203 a 1
20.2203 a 2 v 20.2203 a 3 20.2203 a 2
IREMENTS OF 10 CFR:
Check 50.73 a 2
50.73 a 2 ii 50.73 a 2
ii one or more 11 50.73 a 2 vii 50.73 a 2 x 73.71 r'$pjYQ%'j /<K'$
., +g~>~e <<$v 20.2203 a 2
I 20.2203 a 2 li 20.2203 a 2 iv 20.2203 a 4 50.36 c 1
50.36 c 2 50.73 a 2
v 50.73 a 2 v 50.73 a 2 vii OTHER Specify in Abstract behw or in NRC Form 366A UCENSEE CONTACT FOR THIS LER (12)
TELEPHONE NUMBERgnctude Area Code)
Daniel G. Marks, Section Leader, Nuclear Regulatory Affairs 623-393~92 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 13
CAUSE
SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX
CAUSE
SYSTEM COMPONENT MANUFACTURER TO EPIX SB CPU S204 SUPPLEMENTAL REPORT EXPECTED 14 YES If es, complete EXPECTED SUBMISSION DATE)..
X No EXPECTED SUBMISSION DATE (15)
MONTH DAY ABSTRACT (Limitto 1400 spaces, l.e., approximately 15 single-spaced typewritten lines) (18)
On June 18, 1999, at approximately 2229 MST, Palo Verde Unit 2 was in Mode 1 (POWER OPERATION),
operating at approximately 100 percent power when an automatic reactor trip occurred on low Departure from Nucleate Boiling Ratio (DNBR). The four Core Protection Calculators (CPC) generated a reactor trip on low DNBR due to CPC sensor failures.
By approximately 2245 MST, the reactor was stabilized in Mode 3 (HOT STANDBY). The Shift Manager classified the event as an uncomplicated reactor trip. No engineered safety feature actuations occurred during the event and none were required.
Required safety systems, including Steam Bypass Control, responded to the event as designed.
Although additional investigative activities remain to be completed, the cause of the reactor trip appears to be a hardware induced calculational error that resulted in an erroneous penalty factor being generated in control element assembly calculator (CEAC) ¹2.
A previous similar event was reported in LER 50-529/94-006-00.
9'Ti07280252 990716 PDR ADOCK 05000529 S
NRC FORM 666A (6-1996)
FACILITYNAME(1)
U.S. NUCLEARREGULATORYCOMMISSION LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION DOCKET NUMBER (2)
LER NUMBER (6)
PAGE (3)
PaIo Verde Nuclear Generating Station unit 2 05000529 TEXT Pf more spece ls required, use eddi donel copies ofNRC Form 366A) (17) 1.
REPORTING REQUIREMENT(S)
SEQUENTIAL REVISION NUMBER NUMBER 1999 005
00 2
OF 5
This LER (50-529/99-005-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(iv), to report a reactor protection system initiated reactor trip which occurred on June 18, 1999.
2.
DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The core protection calculator/control element assembly calculator (CPC/CEAC)(EIIS: JC) system monitors pertinent reactor core conditions and provides an accurate, reliable means of initiating a reactor trip. The CPC/CEAC system is an integral part of the plant protective system in that it provides departure from nucleate boiling ratio (DNBR) and local power density (LPD) trips to the reactor protection system (RPS) (EIIS: JC). Trip signals are provided to the reactor protection system whenever the minimum DNBR or fuel design limitLPD is approached during reactor operation.
Each CEAC receives reed switch assembly inputs for all control element assemblies (CEAs)
(EIIS: AA). The CEACs compare the positions of all CEAs within each CEA subgroup and determine penalty factors based upon CEA deviations within a subgroup.
A penalty factor is transmitted via four fiber-optic data links to the CPCs.
The CPCs also compute penalties for CEA group out-of-sequence and subgroup deviation conditions.
The CPCs function to monitor pertinent reactor core conditions, calculate and display appropriate results, provide CEA withdrawal prohibit (CWP) signals to the control element drive mechanism control system (CEDMCS) (EIIS: AA)and low DNBR/high LPD trip signals to the reactor protection system (RPS).
The reactor protection system (RPS) provides a rapid and reliable shutdown of the reactor to protect the core and the reactor coolant system pressure boundary from potentially hazardous operating conditions. Shutdown is accomplished by the generation of reactor trip signals. The trip signals open the reactor trip switchgear (RTSG) breakers(EIIS: AA), de-energizing the control element drive mechanism (CEDM) coils(EIIS: AA), allowing all CEAs to drop into the core by the force of gravity.
3.
INITIALPLANTCONDITIONS:
On June 18, 1999, at approximately 2229 MST, Palo Verde Unit 2 was in Mode 1 (POWER OPERATION), operating at approximately 100 percent power. There were no structures, systems, or components that were inoperable at the start of the event that contributed to the event.
NRC FORM 886A (6-1998)
FACILITYNAME (1)
U.S. NUCLEARREGULATORYCOMMISSION LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION DOCKET NUMBER (2)
LER NUMBER (6)
PAGE (3)
Palo Verde Nuclear Generating Station Unit 2 TEXT pfmore spece ls rerlulred, use eddlllonel copies ofNRC Form 366A) (17) 4.
EVENT DESCRIPTION
05000529 SEQUENTIAL REVISION NUMBER NUMBER 1999 005
00 3
OF 5
Prior to the reactor trip, at approximately 2205 MST on June 18, 1999, Control Room personnel received two unexpected alarms indicating CPC sensor channel "C"failure and a simultaneous Control Element Assembly Withdrawal Prohibit (CWP). The "C" channel sensor failure and simultaneous CWP alarms cleared one second later. Control room personnel initiated responsive actions in accordance with applicable alarm response procedures.
While investigating the alarms, at 2229 MST, the RPS initiated trip signals on low DNBR and approximately six seconds later the reactor trip circuit breakers opened allowing control rods to insert into the reactor (EIIS: RCT, AC). Allcontrol rods fullyinserted into the reactor core and required safety systems responded as designed.
Four of eight steam bypass control valves directed excess steam flowto the main condenser (EIIS: SG) which remained available throughout the event.
No main steam (EIIS: SB, RV) or primary safety valves (EIIS: AB, RV) lifted and none were required.
Electrical busses transferred to offsite power (EIIS: BP), and although not required during the event, the high pressure safety injection (EIIS: BQ), residual heat removal (EIIS: BP),
and auxiliary feedwater systems (EIIS: BA) remained available and capable of performing their intended safety function.
At approximately 2245 MST, the reactor had stabilized in Mode 3 (HOT STANDBY)and the event was classified as an uncomplicated reactor trip. There were no ESF actuations and none were required. There was no loss of heat removal capability or loss of safety functions associated with the event.
On June 19, 1999, at approximately 0531 MST, CPC trip buffers had been downloaded and trouble shooting efforts had commenced.
Initial CEAC ¹2 troubleshooting efforts could not conclusively identify a failed component, however, failure symptoms and available information suggested that the probable cause of the failure was a malfunctioning CEAC processor board and/or upper and lower core memory. At 1730 MST, on June 19, 1999 the CEAC processor and memory boards had been replaced and CEAC ¹2 was declared operable upon completion of post maintenance testing.
Plant restart was commenced and at 1002 MST on June 20, 1999, Unit 2 was synchronized to the grid, at approximately 11 percent power.
On June 21, 1999 at 0332 MST, while at approximately 77 percent power, Control Room personnel received a CEA deviation alarm on CEAC ¹2 and a CWP alarm. At 0336 MST, CEAC 2 was made inoperable by inserting INOP codes in all four CPCs.
The failure was similar to the previous failure however, during the most recent occurrence the CEAC had reset and did not send the high penalty
NRC FORM seeA (6-1998)
FACILITYNAME(1)
U.S. NUCLEAR REGULATORYCOMMISSION LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION DOCKET NUMBER (2)
LER NUMBER (6)
PAGE (3)
Palo Verde Nuclear Generating Station Unit 2 05000529 TEXT Pf more spece ls required, use eddillonel copies ofNRC Form 366A) (17)
SEQUENTIAL REVISION NUMBER NUMBER 1999 005 -
00 4
OF 5
factor data to the CPCs.
The remaining CEAC ¹2 floating point, ALO-multiply-divideand self test circuit boards were replaced and no additional problems were observed.
Power ascension continued and at 1400 MST on June 21, 1999, reactor power was stable at 99.5 percent.
5.
ASSESSMENT OF SAFETY CONSEQUENCES
The low DNBR trip is provided to prevent the DNBR in the core from exceeding the fuel design limitin the event of design bases anticipated operational occurrences.
The reactor trip occurred when all four channels of CPCs calculated a DNBR value that exceeded the low DNBR trip setpoint. The CPC calculated DNBR resulted from an erroneous penalty factor generated in CEAC ¹2 due to an apparent malfunction in the processor board. The actual DNBR safety limitwas not approached nor exceeded.
Primary and secondary pressure boundaiy limits were not approached due to the reactor tripping from a steady state condition, followed by a "quick open" of the steam bypass control system (EIIS: Jl). The transient did not cause any violation of the specified acceptable fuel design limits. Therefore, there were no safety consequences or implications as a result of this event. This event did not adversely affect the safe operation of the plant or health and safety of the public.
Unit 2 plant performance and plant protection system evaluations were performed to determine plant responses to transients experienced subsequent to the plant trip. The plant performance evaluation included a'safety function impact analysis for each of the safety functions and included an assessment of equipment malfunctions, abnormal alarms and/or events observed during the event. The plant protection system evaluation identified reactor protection system and engineered safety features actuations that were observed during the event. The evaluations revealed that the plant responded as required, and the reactor trip was uncomplicated and that no safety limits were
- exceeded, and that the event was bounded by current safety analyses.
6.
CAUSE OF THE EVENT
An independent investigation of this event is being conducted in accordance with the APS corrective action program. Although additional investigative activities remain to be completed, the cause of the reactor trip appears to be a hardware induced calculational error that resulted in an erroneous penalty factor being generated in CEAC ¹2 No unusual characteristics of the work location (e. g., noise, heat, poor lighting) directly contributed to the event.
No personnel errors or procedural error contributed to this event
NRO FORM seeA (6-1998) 0 FACILITYNAME(1)
U.S. NUCLEARREGULATORYCOMMISSION LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION DOCKET NUMBER (2)
LER NUMBER (B)
PAGE (3)
Palo Verde Nuclear Generating Station Unit 2 05000529 SEQUENTlAL REVISION NUMBER NUMBER 1999
. 005
00 5
OF 5
TEXT pfmore spece ls required, use eddldonel copies ofNRC Form 366A) (17) 7.
CORRECTIVE ACTIONS TO PREVENT RECURRENCE:
Control Room Operator action was taken to place the reactor in a stable condition in accordance with the appropriate operating procedures.
Troubleshooting activities were commenced but were unsuccessful in isolating a specific failed subcomponent.
APS Engineering evaluated available data, Control Room Operator observations, and past CEAC failures, and determined that an apparent malfunction in a processor board caused CEAC ¹2 to generate an erroneous penalty factor. The CPCs correctly processed the erroneous DNBR penalty factor and initiated a reactor trip signal.
The CEAC ¹2 processor and memory boards were initiallyreplaced and subsequently the floating point, ALO-multiply-divideand self test circuit boards were also replaced. As part of the investigation, an equipment root cause of failure analysis of CEAC ¹2 is being performed by APS Engineering. The preliminary evaluation has not identified any specific subcomponent failure(s) which would cause the CEAC to malfunction. Ifinformation is subsequently developed that would significantly affect the readers'nderstanding or perception of this event, a supplement to this LER willbe submitted.
~
8.
PREVIOUS SIMILAREVENTS
A similar event occurred on October 29, 1994, when the Palo Verde Unit2 reactor tripped from 100 percent power followinga low DNBR trip signal. The trip signal was initiated from the Core Protection Calculators (CPC) after processing an erroneous penalty factor generated by CEAC ¹1.
9.
ADDITIONALINFORMATION:
The reactor trip was a single actual initiating event that affected only the initiating event cornerstone in the new regulatory oversight and assessment process.
(The new regulatory oversight and assessment process is currently in the pilot phase.)
The event was tabulated as an "Unplanned Scram" in the performance indicator category of initiating events.
Risk significance is factored into the "Unplanned Scrams" performance indicator's threshold limits. As such, application of the NRC Significant Determination Process was not used to assess or estimate the risk significance associated with the event.