ML17313B019

LER 99-005-00:on 990618,RT on Low DNBR Was Noted.Caused by Hardware Induced Calculation Error.Cr Operator Was Taken to Place Reactor in Stable Condition IAW Appropriate Operating Procedure

ML17313B019
Person / Time
Site:	Palo Verde
Issue date:	07/16/1999
From:	Marks D ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:
Shared Package
ML17313B018	List: ML17313B017 ML17313B019
References
LER-99-005, NUDOCS 9907280252
Download: ML17313B019 (7)

Text

NRC FORM 388 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB No. 31504104 EXPIRES 08/30/2001 (6-1996)

Estimated burden per response to comply vAth this mandatory informathn collecson requesl: 50 hrs. Re ed lessons learned are incorporated Into LlCENSEE EVENT REPORT (LER) the licensing process and red back to industry. Forward comments arding burden estimate to the Records Management Branch (TW F33),

(See reverse for required number of U.S. N r Reguhtory Commlssbn, Washington, DC 2055 I, and to the Papeiwork Reduction Prolect (31500104), Office or Management and digitslcharacters for each block) B et, Washington, DC 2 . If an information collection does not di a currently valid OMB control number, the NRC may nol conduct or sponsor, and a person is not required to respond to, the information collecbon.

FACILITYNAME (1) DOCKET NUMBER (2) PAGE (3)

Palo Verde Nuclear Generating Station-Unit 2 05000529 1 OF 5 TITLE Ie)

Reactor Trip on Low DNBR EVENT DATE (6) LER NUMBER (8) REPORT DATE (7) OTHER FACILITIES INVOLVED(8)

FACILirYNAME DOCKET NUMBER SEQUENTIAL REVISION MONTH DAY YEAR NUMBER NlMBER MONTH DAY YEAR N/A FACILITYNAME 06 18 1999 1999 - 005 - 00 07 16 1999 N/A OPERATING THIS REPORT IS SUBMITTED PURSUANT TO THE REQU IREMENTS OF 10 CFR: Check one or more 11 MODE (8) 20.2201 b 20.2203 a 2 v 50.73 a 2 50.73 a 2 vii POWER 20.2203 a 1 20.2203 a 3 50.73 a 2 ii 50.73 a 2 x LEVEL (10) 100 20.2203 a 2 50.73 a 2 ii 73.71 r'$pjYQ%'j 20.2203 a 2 I 20.2203 a 4 50.73 a 2 v

., /<K'$

+g~>~e <<$ v OTHER 20.2203 a 2 li 50.36 c 1 50.73 a 2 v Specify in Abstract behw or 20.2203 a 2 iv 50.36 c 2 50.73 a 2 vii in NRC Form 366A UCENSEE CONTACT FOR THIS LER (12)

TELEPHONE NUMBER gnctude Area Code)

Daniel G. Marks, Section Leader, Nuclear Regulatory Affairs 623-393~92 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 13 REPORTABLE CAUSE SYSTEM COMPONENT MANUFACTURER CAUSE SYSTEM COMPONENT MANUFACTURER TO EPIX TO EPIX SB CPU S204 SUPPLEMENTAL REPORT EXPECTED 14 EXPECTED MONTH DAY YES SUBMISSION If es, complete EXPECTED SUBMISSION DATE).. X No DATE (15)

ABSTRACT (Limit to 1400 spaces, l.e., approximately 15 single-spaced typewritten lines) (18)

On June 18, 1999, at approximately 2229 MST, Palo Verde Unit 2 was in Mode 1 (POWER OPERATION),

operating at approximately 100 percent power when an automatic reactor trip occurred on low Departure from Nucleate Boiling Ratio (DNBR). The four Core Protection Calculators (CPC) generated a reactor trip on low DNBR due to CPC sensor failures. By approximately 2245 MST, the reactor was stabilized in Mode 3 (HOT STANDBY). The Shift Manager classified the event as an uncomplicated reactor trip. No engineered safety feature actuations occurred during the event and none were required. Required safety systems, including Steam Bypass Control, responded to the event as designed.

Although additional investigative activities remain to be completed, the cause of the reactor trip appears to be a hardware induced calculational error that resulted in an erroneous penalty factor being generated in control element assembly calculator (CEAC) ¹2.

A previous similar event was reported in LER 50-529/94-006-00.

9'Ti07280252 990716 PDR ADOCK 05000529 S PDR

NRC FORM 666A (6-1996)

U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3)

SEQUENTIAL REVISION NUMBER NUMBER PaIo Verde Nuclear Generating Station unit 2 05000529 2 OF 5 1999 005 00 TEXT Pf more spece ls required, use eddi donel copies of NRC Form 366A) (17)

1. REPORTING REQUIREMENT(S):

This LER (50-529/99-005-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(iv), to report a reactor protection system initiated reactor trip which occurred on June 18, 1999.

2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):

The core protection calculator/control element assembly calculator (CPC/CEAC)(EIIS: JC) system monitors pertinent reactor core conditions and provides an accurate, reliable means of initiating a reactor trip. The CPC/CEAC system is an integral part of the plant protective system in that it provides departure from nucleate boiling ratio (DNBR) and local power density (LPD) trips to the reactor protection system (RPS) (EIIS: JC). Trip signals are provided to the reactor protection system whenever the minimum DNBR or fuel design limit LPD is approached during reactor operation.

Each CEAC receives reed switch assembly inputs for all control element assemblies (CEAs)

(EIIS: AA). The CEACs compare the positions of all CEAs within each CEA subgroup and determine penalty factors based upon CEA deviations within a subgroup. A penalty factor is transmitted via four fiber-optic data links to the CPCs. The CPCs also compute penalties for CEA group out-of-sequence and subgroup deviation conditions.

The CPCs function to monitor pertinent reactor core conditions, calculate and display appropriate results, provide CEA withdrawal prohibit (CWP) signals to the control element drive mechanism control system (CEDMCS) (EIIS: AA) and low DNBR/high LPD trip signals to the reactor protection system (RPS).

The reactor protection system (RPS) provides a rapid and reliable shutdown of the reactor to protect the core and the reactor coolant system pressure boundary from potentially hazardous operating conditions. Shutdown is accomplished by the generation of reactor trip signals. The trip signals open the reactor trip switchgear (RTSG) breakers(EIIS: AA), de-energizing the control element drive mechanism (CEDM) coils(EIIS: AA), allowing all CEAs to drop into the core by the force of gravity.

3. INITIALPLANT CONDITIONS:

On June 18, 1999, at approximately 2229 MST, Palo Verde Unit 2 was in Mode 1 (POWER OPERATION), operating at approximately 100 percent power. There were no structures, systems, or components that were inoperable at the start of the event that contributed to the event.

NRC FORM 886A (6-1998)

U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3)

SEQUENTIAL REVISION NUMBER NUMBER Palo Verde Nuclear Generating Station Unit 2 05000529 3 OF 5 1999 005 00 TEXT pf more spece ls rerlulred, use eddlllonel copies of NRC Form 366A) (17)

4. EVENT DESCRIPTION:

Prior to the reactor trip, at approximately 2205 MST on June 18, 1999, Control Room personnel received two unexpected alarms indicating CPC sensor channel "C" failure and a simultaneous Control Element Assembly Withdrawal Prohibit (CWP). The "C" channel sensor failure and simultaneous CWP alarms cleared one second later. Control room personnel initiated responsive actions in accordance with applicable alarm response procedures.

While investigating the alarms, at 2229 MST, the RPS initiated trip signals on low DNBR and approximately six seconds later the reactor trip circuit breakers opened allowing control rods to insert into the reactor (EIIS: RCT, AC). All control rods fully inserted into the reactor core and required safety systems responded as designed. Four of eight steam bypass control valves directed excess steam flow to the main condenser (EIIS: SG) which remained available throughout the event. No main steam (EIIS: SB, RV) or primary safety valves (EIIS: AB, RV) lifted and none were required. Electrical busses transferred to offsite power (EIIS: BP), and although not required during the event, the high pressure safety injection (EIIS: BQ), residual heat removal (EIIS: BP),

and auxiliary feedwater systems (EIIS: BA) remained available and capable of performing their intended safety function.

At approximately 2245 MST, the reactor had stabilized in Mode 3 (HOT STANDBY) and the event was classified as an uncomplicated reactor trip. There were no ESF actuations and none were required. There was no loss of heat removal capability or loss of safety functions associated with the event.

On June 19, 1999, at approximately 0531 MST, CPC trip buffers had been downloaded and trouble shooting efforts had commenced. Initial CEAC ¹2 troubleshooting efforts could not conclusively identify a failed component, however, failure symptoms and available information suggested that the probable cause of the failure was a malfunctioning CEAC processor board and/or upper and lower core memory. At 1730 MST, on June 19, 1999 the CEAC processor and memory boards had been replaced and CEAC ¹2 was declared operable upon completion of post maintenance testing.

Plant restart was commenced and at 1002 MST on June 20, 1999, Unit 2 was synchronized to the grid, at approximately 11 percent power.

On June 21, 1999 at 0332 MST, while at approximately 77 percent power, Control Room personnel received a CEA deviation alarm on CEAC ¹2 and a CWP alarm. At 0336 MST, CEAC 2 was made inoperable by inserting INOP codes in all four CPCs. The failure was similar to the previous failure however, during the most recent occurrence the CEAC had reset and did not send the high penalty

NRC FORM seeA (6-1998)

U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3)

SEQUENTIAL REVISION NUMBER NUMBER Palo Verde Nuclear Generating Station Unit 2 05000529 4 OF 5 1999 005 - 00 TEXT Pf more spece ls required, use eddillonel copies of NRC Form 366A) (17) factor data to the CPCs. The remaining CEAC ¹2 floating point, ALO-multiply-divideand self test circuit boards were replaced and no additional problems were observed. Power ascension continued and at 1400 MST on June 21, 1999, reactor power was stable at 99.5 percent.

5. ASSESSMENT OF SAFETY CONSEQUENCES:

The low DNBR trip is provided to prevent the DNBR in the core from exceeding the fuel design limit in the event of design bases anticipated operational occurrences. The reactor trip occurred when all four channels of CPCs calculated a DNBR value that exceeded the low DNBR trip setpoint. The CPC calculated DNBR resulted from an erroneous penalty factor generated in CEAC ¹2 due to an apparent malfunction in the processor board. The actual DNBR safety limit was not approached nor exceeded.

Primary and secondary pressure boundaiy limits were not approached due to the reactor tripping from a steady state condition, followed by a "quick open" of the steam bypass control system (EIIS: Jl). The transient did not cause any violation of the specified acceptable fuel design limits. Therefore, there were no safety consequences or implications as a result of this event. This event did not adversely affect the safe operation of the plant or health and safety of the public.

Unit 2 plant performance and plant protection system evaluations were performed to determine plant responses to transients experienced subsequent to the plant trip. The plant performance evaluation included a'safety function impact analysis for each of the safety functions and included an assessment of equipment malfunctions, abnormal alarms and/or events observed during the event. The plant protection system evaluation identified reactor protection system and engineered safety features actuations that were observed during the event. The evaluations revealed that the plant responded as required, and the reactor trip was uncomplicated and that no safety limits were exceeded, and that the event was bounded by current safety analyses.

6. CAUSE OF THE EVENT:

An independent investigation of this event is being conducted in accordance with the APS corrective action program. Although additional investigative activities remain to be completed, the cause of the reactor trip appears to be a hardware induced calculational error that resulted in an erroneous penalty factor being generated in CEAC ¹2 No unusual characteristics of the work location (e. g., noise, heat, poor lighting) directly contributed to the event. No personnel errors or procedural error contributed to this event

NRO FORM seeA (6-1998) 0 U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME (1) DOCKET NUMBER (2) LER NUMBER (B) PAGE (3)

SEQUENTlAL REVISION NUMBER NUMBER Palo Verde Nuclear Generating Station Unit 2 05000529 5 OF 5 1999 . 005 00 TEXT pf more spece ls required, use eddldonel copies of NRC Form 366A) (17)

7. CORRECTIVE ACTIONS TO PREVENT RECURRENCE:

Control Room Operator action was taken to place the reactor in a stable condition in accordance with the appropriate operating procedures. Troubleshooting activities were commenced but were unsuccessful in isolating a specific failed subcomponent. APS Engineering evaluated available data, Control Room Operator observations, and past CEAC failures, and determined that an apparent malfunction in a processor board caused CEAC ¹2 to generate an erroneous penalty factor. The CPCs correctly processed the erroneous DNBR penalty factor and initiated a reactor trip signal.

The CEAC ¹2 processor and memory boards were initially replaced and subsequently the floating point, ALO-multiply-divideand self test circuit boards were also replaced. As part of the investigation, an equipment root cause of failure analysis of CEAC ¹2 is being performed by APS Engineering. The preliminary evaluation has not identified any specific subcomponent failure(s) which would cause the CEAC to malfunction. If information is subsequently developed that would significantly affect the readers'nderstanding or perception of this event, a supplement to this LER will be submitted. ~

8. PREVIOUS SIMILAR EVENTS:

A similar event occurred on October 29, 1994, when the Palo Verde Unit 2 reactor tripped from 100 percent power following a low DNBR trip signal. The trip signal was initiated from the Core Protection Calculators (CPC) after processing an erroneous penalty factor generated by CEAC ¹1.

9. ADDITIONALINFORMATION:

The reactor trip was a single actual initiating event that affected only the initiating event cornerstone in the new regulatory oversight and assessment process. (The new regulatory oversight and assessment process is currently in the pilot phase.) The event was tabulated as an "Unplanned Scram" in the performance indicator category of initiating events. Risk significance is factored into the "Unplanned Scrams" performance indicator's threshold limits. As such, application of the NRC Significant Determination Process was not used to assess or estimate the risk significance associated with the event.