ML20137X667

AEOD/E602, Unexpected Criticality Due to Incorrect Calculation & Failure to Follow Procedures, Engineering Evaluation Rept

ML20137X667
Person / Time
Site:	Summer
Issue date:	01/16/1986
From:	Freeman R NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20137X661	List: ML20137X656 ML20137X667
References
TASK-AE, TASK-E602 AEOD-E602, NUDOCS 8603110533
Download: ML20137X667 (15)

Text

- _ _

O e

^

AE00 ENGINEERING EVALUATION REPORT II UNIT: Virgil C. Sumer Unit 1 EE REPORT NO.: AEOD/E602 DOCKET N0.: 50-395 DATE:

L FcNSEE: South Carolina Electric and EVALUATOR / CONTACT: R. Freeman Gas Company NSSS/AE: Westinghouse / Gilbert Comonwealth

SUBJECT:

UNEXPECTED CRITICALITY DUE TO INCORRECT CALCULATION AND FAILURE TO FOLLOW PROCEDURES

SUMMARY

On February 28, 1985, with Virgil C. Sumer Unit 1 in a reactor startup, a reactor trip occurred on a high flux positive rate trip. The event was attri-buted to a number of causes. First, the licensed operator conducti19 the startup failed ^ to adhere to applicable procedures in that criticality was not anticipated during control rod bank withdrawal and an awareness of plant con-ditions was not maintained at all times. The second cause which contributed to the event was a lack of adequate guidance in the procedures used to calculate the estimated critical rod position (ECRP) and reference critical data (PCD).

Finally, the last cause identified which could have contributed to the event was procedural inadequacy in the licensee's administration of the plant's on-the-job training program.

1. .~

Uncontrolled rod bank withdrawal from a subcritical core condition is an analyzed condition II fault in the licensee's. Updated Safety Analysie, Report (USAR). The resultant reactivity insertion rate for the February 28, 1985 event was determined to be a conservative case compared to the analyzad transient for this accident. Thus, the Summer startup event of Februi.ry 28, 1985 was bounded by the accident analysis. However, some concerns were iden-tified it: our review of this event and related operating experience. The ability of currently used ECRP procedures to correctly predict the core critical position and adequate training in the use of these procedures are suspect and may warrant further refinement.

AE00 identified a number of recent events from its review of operating experience where the actual critical rod bank position deviated significantly from the predicted critical rod bank position. In most cases, these events could be attributed to inadequate procedures, erroneous input of data, and failure to adhere to procedures. These causes could indicate deficiencies in several licensees' quality assurance and quality control programs for the proper maintenance of the ECRP procedures and quality in the proper training of plant personnel in the use of these procedures. The deficiencies identified in Sumer's ECRP procedures could potentially exist at other PWR facilities since

, this licensee's ECRP calculational method is not unique to this facility. An 1/ This report supports ongoing AE0D and NRC activities and does nnt repre-sent the position or requirements of the responsible NRC program office.

8603110533 860116 PDR ADOCK 05000395 S PDR

- ~

inaccurate ECRP could misinform the operator of the actual core conditions at the time of reactor startup which could result in the core achieving criti-cality below the rod insertion limits. Plant operation with the control rods below the rod insertion limits, when combined with a power transient, could result in exceeding local departure from nucleate boiling (DNB) limits. An industrial organization has. issued a report cover!ng some of the recent premature criticality events. Licensees are currer.tly following up on its recommendations. Thus, no further action by' this of fice is deemed necessary.

INTRODUCTION In its review of Reference 1, AE00 identified an event at Virgil C. Summer Unit I which may have generic safety implications. This event involved a high core flux positive rate reactor trip that occurred during a reactor startup.

The positive rate trip is generated by the reactor protection system (RPS) whenever the rate of reactor power level increase is equal to or greater than five percent within a two second time period from any two out of four power range nuclear instruments. A positive rate reactor trip during a reactor startup requires a reactivity insertion rate much greater than that u:ually allowed by most station administrative procedures. Personnel performance and procedural control should have prevented the occurrence. Also contributing to the event was calculational error which resulted in the ECRP being off by approximately 128 rod bank steps.

The Nuclear Regulatory Commission (NRC) reports to the Congress each quarter under provisions of Section 108 of the Energy Peorganization Act of 1974 on any abnormal occurrences involving facilities and activities regulated by the NRC.

An abnormal occurrence is defined in Section 108 as an unscheduled incident or r~ event which the Commission determines is significant from the standpoint of public health or safety. The NRC had determined that the February 28, 1985 event at Summer met the abnormal occurrence criteria and reported it to the Congress (Ref. 2). AEOD conducted an evaluation to assess the safety significance and to identify the potential generic implications of the Summer event.

DISCUSSION The reactor startup, conducted on February 28, 1985 at 1:30 p.m., was preceded by a reactor startup that same day at 6:30 a.m. The reactor was critical for approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> prior to shutdown. The RCD used to predict the ECRP for the 1:30 p.m. reactor startup was bcsed on the brief period of criticality instead of the equilibrium core conditions from the previous reactor power history. Therefore, when the ECRP was calculated for the reactor startup at 1:30 p.m., incorrect values of reactivity worth of poisons (i.e., Xenon and Samarium) in the core were used. Additionally, a nonconservative value for the control rod worth was used in the ECRP calculation. The control rod worth was based on middle of life (MOL) instead of beginning of life (BOL) rod worth curves. The core lifetime for fuel cycle 2 was between BOL and MOL, and the BOL curve more accurately reflected the current rod worth. These two factors contributed to the miscalculatior of the ECRP by approximately 128 rod bank steps.

Under the direct supervision of the shif t supervisor, the control rods were withdrawn from the core by an operator trainee with no prior reactor or

9 simulator experience at this facility in reactor startups. The shift supervisor instructed the trainee to withdraw the control rods until 100 rod steps on bank D was~ achieved. The ECRP calculation predicted criticality would occur at 168 rod steps on bank D. Thus, this rod position allowed a 68 rod bank step error in the ECRP calculation. However, the operator trainee was not instructed in the need to anticipate criticality whenever control rods are being withdrawn from the core or to closely monitor the appropriate instru-mentation for indication of criticality. The shift supervisor neither provided the necessary attentiveness nor did he monitor it himself.

~ There were two other licensed operators who were on duty in the control room during the perforn:ance of the reactor startup. One operator was engaged in other startup-related activities on another part of the control board.. The other operator, a control room supervisor, was at his assigned station; however, his view of the instrumentation important to this event was blocked by the shift supervisor and the operator trainee. Consequently, attaining criticality at 40 rod steps on bank D was not recognized and rod bank with-drawal continued until the high positive rate trip setpoint was reached and tripped the reactor. This occurred at 76 rod steps on bank D. The reactor was expected to be critical at 168 rod steps on bank D. The startup rate at the time of reactor trip was determined to be approximately 16.4 decades per minute (DPM), and the indicated reactor power level was 6 percent.

ANALYSIS Prior to a reactor startup, an ECRP calculation is performed in accordance with startup administrative procedures. Technical specifications require an ECRP to be determined in order to ensure that the control rods are above the rod m insertion limits when criticality is achieved. The rod insertion limits are a technical specificatiori limit placed on how far the control rods may be inserted into the core for a given power level. This limit ensures that:

(1) the reactor will be.placed in the hot shutdown condition following a reactor trip (i.e., adequate shutdown margin), (2) the reactivity worth of an ejected control rod is ininimized, and (3) the local core power peaking factors are minimized. There age a number of different ways the estimated critical position can be calculated, but they all essentially perform a core reactivity balance.

The ECRP calculational procedure used by Sumer during the February 28, 1985 event involves determining the core reactivity at a previous critical core position and adjusting this value to the plant conditions just prior to achieving the next expected criticality. RCD is usually taken prior to shutdown with the exception of the boric acid concentration value which is obtained from the last reactor coolant system (RCS) chemistry sample.

then mat'e to the core reactivity for changes in boric acid Adjustments concentration, arp' Xenon and Samarium worth, power defect, RCS temperature control rod worth to detennine the control rod bank position needed to achieve the text criticality. The licensee considers the ECRP calculation acceptable if ti:e actual critical rod bank position is within 50 rod bank steps of the ECRP prediction. Usually the reactivity equivalent of 50 rod bank steps is approximately equal'to or less than 400 percent milli-rho (PCM).

Although fundamental, most licensees' ECRP procedures require the use of many reactivity worth curves, tables, and other data. Because of this, there is a

potential for data to be incorrectly applied to the calculation which could result in an inaccurate ECRP, particularly when the use of curves and data interpolation are required. Also, because the ECRP is an approximate calculation based on a set of assumptions, each ECRP calculational procedure is subject to limitations. Its ability to predict the core critical position may vary under certain core conditions. This could result in the ECRP signif-icantly deviating from the actual critical rod bank position and misinfonn the operator of the actual core conditions at the time of reactor startup. Simu-lator and/or classroom training which uses up-to-date plant ECRP procedures, plant data, and form sheets could significantly reduce the likelihood of calculational error by familiarizing operators with the proper use of these procedures prior to conducting actual plant startups.

Plant operation with the control rods below the rod insertion limits is an undesirable condition for a number of reasons. First, core power operation with rods greatly inserted into the core produces poor power distributions. In general, the peak linear heat generation per foot of fuel rod would increase because the total reactor power would be produced in a smaller area of the core. This would increase local power peaking, when combined with a power transient, and could result in exceeding the local power levels analyzed for DNB. Secondly, plant operation with the control rods below the rod insertion limits does not ensure that there is enough negative reactivity associated with the rods to place the reactor in the hot shutdown condition following a reactor trip. Thus, it cannot be assured that the reactor will remain shut down following a reactor trip based upon the assumptions used in accident analysis.

Finally, plant operation with the control rods greatly inserted into the core increases the consequences of a hypothetical rod ejection accident. This is because the amount of positive reactivity that can be added to the core from an N ejected control rod increases the more the rods are inserted into the core.

In addition to the potential for being critical below the rod insertion limits, an ECRP which overestimates the actual critical position could also indicate a previously inadequate core shutdown margin. A core shutdown margin calculation is very similar to the ECRP calculation in that it also performs a core reactivity balance taking into account most of the same core parameters. The major difference between the two calculations is that instead of determining the rod bank position where the reactor is expected to go critical, the shutdown margin calculation detennines the RCS boric acid concentration required to maintain the core at a reactivity value specified in the plant's technical specifications. An inadequate core shutdown margin could result in an unexpected criticality from planned or unplanned plant evolutions which could add positive reactivity to the core.

Because the ECRP procedure can be an involved calculation, many licensees are having the calculation performed by a computer. This method reduces the amount of data manipulation required as well as the chances of introducing mathemat-ical errors. However, this method is still subject to human error since these programs require some data input. Errors could also be introduced when these programs are updated periodically to reflect changing core configurations or eliminating known deficiencies within the program. Also, computer generated data could be erroneous following a computer malfunction. Adequate training in the proper use of these computer programs, and adequate quality control could significantly reduce the likelihood of introducing inaccuracies into the ECRP ,

calculation.

1 In addition to the ECRP calculation, there are other means available to the reactor operator to estimate where the core could be expected to go critical during a reactor startup. One method generally used by most PWR reactor.

operators is a rule of thumb which is based upon the average number of times the initial source range instrumentation reading doubles to estimate the source i range reading at the time of criticality. Usually criticality can be expected to occur when the source range instrumentation reading increases to approxi-mately four to five times its initial value at the beginning of a reactor startup.

Another indication available only to most Westinghouse PWR operators to alert them that the reactor is close to criticality is the source range high neutron flux trip permissive. The purpose of this permissive is to allow continued power escalation by permitting the operator to block the source range high neutron flux trip. In general, when the operator is allowed to block the source range high neutron flux trip, the reactor is close to being critical or has already achieved criticality. When the operator blocks the source range high neutron flux trip, it also automatically turns off the power supply to the source range nuclear instrumentation to prevent damage to the detectors from the high neutron and gamma flux produced in the core. Also, some licensees may use inverse multiplication plots to monitor the approach to criticality during a reactor startup. In this method, periodic countrate readings are obtained from the source range nuclear instrumentation in order to calculate inverse countrate ratios and then they are plotted against their corresponding control rod bank positions. The data on the plot are then extrapolated to obtain the

' expected control rod bank position where the inverse countrate ratio is equal to zero. This is the point where criticality can be expected to occur.

W- During reactor startup, the startup rate and source range nuclear instrumen-tation are the primary sources of information available to the reactor operator to determine core criticality for most PWRs. Criticality is the condition where the core neutron population from one generation compared to the preceding generation remains the same. In general, to detennine the point where the core has achieved criticality during a reactor startup, the core is first taken to the super-critical condition; e.g., an increasing core neutron population from one generation compared to the preceding generation. The super-critical core condition is characterized by a constant positive reading on the startup rate meters and an increasing core power level as indicated on the source range instrumentation without any control rod movement or change in RCS boric acid concentration. Negative reactivity is then added to the core in the fonn of control rod insertion to maintain the reactor at a constant power level.

To limit the amount of reactivity insertion rate for most Westinghouse-designed plants, the control rod drive mechanisms (CRDMs) are wired into preselected bank configurations which are not altered during core life. This prevents the CRDMs from being automatically withdrawn in other than their respective banks.

Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and only in their proper withdrawal sequence.

The rate of reactivity insertion is limited by the speed the CRDMs can be withdrawn from the core. For this facility, the maximum CRDM withdrawal speed is 45 inches per minute which corresponds to 72 rod steps per minute.

In the event of a continuous control rod bank withdrawal accident, the following automatic features in most Westinghouse-designed PWRs would provide core protection to terminate the transient:

Source Range High Neutron Flux Reactor Trip Intermediate Range High Neutron Flux Reactor Trip Power Range High Neutron Flux Reactor Trip (low setting)

Power Range High Neutron Flux Reactor Trip (high setting)

Control rod bank withdrawal stops are also provided on high intermediate range flux level and high power range flux level to discontinue rod bank withdrawal and prevent actuation of the intermediate and power range high neutron flux level trips. The high core positive rate reactor trip provides core protection against a rod ejection accident. Other nuclear steam supply system vendors have similar automatic features that provide core protection against a continuous control rod bank withdrawal accident.

During a reactor startup, the reactor operator, the procedural controls, and the RPS are relied upon to limit and prevent rapid power increases. The reactor operator is trained and required by administrative procedure to closely monitor instrumentation and to anticipate criticality whenever control rods are being withdrawn from the core. Administrative controls are also used to limit the rate at which the reactor operator can bring the core up in power. For this facility, the maximum startup rate allowed by the procedure is 1 DPM. For the February 28, 1985 event, the reactor operator and procedural control should e have prevented the occurrence. Contributing to the event, but not justifying the operator's failure to monitor and anticipate criticality, was a miscalcu-lated ECRP which was in error by approximately 128 rod bank steps.

Uncontrolled rod bank withdrawal from a subcritical core condition is an analyzed condition II fault of moderate frecuency in Summer's USAR (Ref. 3).

Faults that fall into this category resulting in reactor shutdown do not propa-gate to core serious faults, and do not cause fuel damage. The limiting condition analyzed for this type of fault was the simultaneous withdrawal of two sequential control rod banks having the maximum combined worth at maximum withdrawal speed. This corresponds to a reactivity insertion rate of 105 PCM per second. Core protection relied upon for this fault is supplied by the power range high neutron flux reactor trip (low setting). Results from Sunner's USAR show that the power range high neutron flux reactor trip (low setting) would activate at 35 percent indicated reactor power. The peak actual core power attained, limited by the Dopplar effect, was about 60 percent of rated core' thermal power. The minimum departure from nucleate boiling ratio (DNBP) value remained in excess of the required value of 1.30. The reactivity insertion rate for the February 28, 1985 event was determined to be less than 10 PCM per second and the peak indicated reactor power level attained was 6 percent. Thus, the reactivity insertion rate for the February 28, 1985 was less severe than the transient analyzed in the USAR.

The actual safety consequences of the February 28, 1985 event were minimal. It is estimated that if the PPS failed to trip the reactor when the positive rate o

trip signal was generated, the power level in the core for control rod bank D at 76 rod steps would have peaked at approximately 32 percent core thermal power due to the Doppler effect. Also, although criticality was achieved at 128 rod bank steps below the ECRP, the control rods were above the rod inser-tion limits. However, the event is significant because the reactor was not being properly controlled by the operators during plant startup. Concerns do arise on the ability of current ECRP procedures to accurately predict the core critical rod bank position to ensure criticality will occur above the rod insertion limits.

For the February 28, 1985 event, the major contributor to the miscalculation of the ECRP was the incorrect determination of the reactivity worth of Xenon (Ref. 4). Sumer, and other licensees, use the power block history method to calculate the equivalent power for determining Xenon and Samarium reactivity effects. Core power level readings are logged periodically in order to describe the previous core power history. Xenon reactivity is based upon the average core power per hour for 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> prior to shutdown. Samarium

, reactivity is based upon the average power per day for 8 days prior to shutdown. In determining the reactivity worth of Xenon and Samarium, each logged entry has a different coefficient or multiplier associated with it. The entries nearest to the time of shutdown are the most heavily weighted.

However, the power block method of determining equivalent power level for estimating Xenon and Samarium reactivities is not very accurate when previous reactor operation is intermittent at widely varying power levels. Review of past ECRPs by the licensee revealed that when using nonequilibrium RCD and the power block method of determining Xenon reactivity worth, estimated critical positions have been in error by more than 50 rod bank steps. Using this calculational procedure accounted for approximately two-thirds of the total e error in the ECRP calculation for the February 28, 1985 event. The remaining third was due to inappropriate use of the control rod worth curves. It was found that the procedures provided no guidance for determining which rod worth curve to use for a particular time in core life.

In addition to the inaccuracies in the licensee's ECRP procedure, concerns also arose regarding the licensee's administration of the plant's on-the-job training program which allowed an operator trainee, with no previous reactor startup experience, to attempt to operate the control rod drive system to bring the reactor critical. As evident from review of the February 28, 1985 event, the operator trainee lacked the basic skills and kn wledge required to accom-plish this task. The skills and knowledge required to perform this task are identified in the licensee's task analysis and include such knowledge as the administrative limits for startup rate, the definition of a critical reactor, and the interpretation of the estimated critical position. Allowing the operator trainee to perform the actual task prior to receiving the required basic knowledge and skills is indicative of a deficiency in administrative controls which does not address the proper sequencing of learning objectives for on-the-job training of personnel. The plant specific task analysis also identified providing on-the-job training as a task required for the senior licensed operator job position. However, the plant training program did not provide adequate instruction to senior licensed operators in the adminis-tration, conduct, and techniques of on-the-job training. In addition, plant administrative procedures did not adequately address the responsibilities of the senior licensed operators in the administration of on-the-job training programs. These three deficiencies, which could have also contributed to the

startup rate event, were identified by an NRC special inspection team during a followup review of the February 28, 1985 event (Ref. 5).

To prevent recurrence, the licensee took the following corrective actions prior to the next reactor startu (1) performed a reliability check of the source range instrumentation, (2)p: verified the RCS boric acid concentration (3) re-vised the ECRP procedures to provide improved guidance for data usage and limitations for determination of core conditions, and (4) initiated the use of inverse multiplication plots to monitor the approach to criticality. Although the corrective actions taken by the licensee appeared to be adequate, they were not sufficient to prevent another occurrence on May 11, 1985 (see Operating Experience section in this report).

OPERATING EXPERIENCE AE00 reviewed the operating experience and found several instances where the actual critical rod bank position deviated significantly from the predicted ECRP calculation. On May 11, 1985, with Virgil C. Sunner Unit 1 in a reactor startup, the core was made critical with the control rods below the rod inser-tion limits (Ref. 6). For zero power, that limit is 118 rod steps on bank C.

The actual critical rod position observed was 69 rod steps on bank C. The predicted crf>tical position was 65 rod steps on bank D. Since the control rod banks are operated in a 100 step overlap, the total error in rod bank position was 124 rod bank steps. If a power transient occurred while the rods were below the rod insertion limits, local DNB limits could have been exceeded.

Unlike the positive rate trip event at Summer on February 28, 1985, in which improperly calculated Xenon concentration was identified as the major cause of

>= the reactivity error, the May 11, 1985 startup was being conducted during a Xenon-free core condition. Review of the ECRP revealed that.it was improperly calculated, but a combination of errors led to nearly the same result as a proper calculation. It was determined that an incorrect revision of the ECRP procedure was used. The licensee had instituted the practice of performing inverse multiplication plots to monitor the approach to criticality; however, review of the records indicated that the data were improperly extrapolated.

Proper application of the inverse multiplication procedure should have prevented the event. Once criticality below the rod insertion limits was determined, the operators promptly initiated emergency boration and fully inserted the control rods. The source (or scurces) of the reactivity error have not been identified.

On May 17, 1985, with McGuire Unit 2 in startup, the core was made critical with the control rods below the rod insertion limits (Refs. 7 and 8). For zero power, that limit was 47 rod steps on bank C. The actual critical position was 26 rod steps on bank C. The predicted critical position was 38 rod steps on bank D. It was suspected that the Xenon prediction program was in error because this reactor startup was being conducted under peak Xenon core conditions and a recent Xenon-free reactor startup had been accomplished with a very accurate ECRP.

The McGuire station uses a computer program to predict the Xenon concentration for input to the ECRP calculation. Coefficients or multipliers in the program are modified to reflect changes in the configuration of the core or are modified because of known deficiencies within the program. The coefficients in

the McGuire Unit 2 core cycle 2 Xenon prediction program were derived from McGuire Unit I core cycle 2 coefficients because it was essentially an identical core. However, there had been no peak Xenon reactor startups following the last revision to this program through the end of Unit I core cycle 2, and this was the first peak Xenon reactor startup on Unit 2 core cycle 2. Review of the last revision to this program detennined that it was based upon erroneous information. This was not discovered during Unit 1 core cycle 2 operation since there were no additional peak Xenon starts on this core. Thus, the erroneous information was inadvertently transmitted to the Unit 2 core cycle 2 Xenon prediction program. When the reactor was determined to be critical below the rod insertion limits, the control rods were inserted, RCS boric acid concentration was increased, and core shutdown margin was verified.

On August 23, 1984, Turkey Point Unit 3 was restarted after a 14-hour shutdown u (Ref. 9). Two ECRP calculations were independently performed. Both calcula-7 '

tions were in good agreement requiring the addition of approximately 280 gallons of boric acid solution to the RCS to make the reactor critical with control bank D at 100 rod steps. The calculated boration was accomplished and a reactor startup was commenced. The reactor did not reach criticality until control rod bank D had been withdrawn to 192 rod steps. The 92 rod bank step difference was first believed to be due to a rapidly decreasing Xenon concentration compounded by the effects of operating the reactor with one dropped rod for approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. However, review of the ECRP procedure by the inspector revealed numerous procedural discrepancies which could have introduced inaccuracies into the ECRP calculation.

The inspector's review of additional ECRP calculations revealed similar p occurrences where the ECRP deviated significantly from the actual critical position. On April 24, 1984, af ter a startup of Turkey Point Unit 3, the actual critical rod bank height was 85 rod steps below the ECRP calculated and on May 12, 1984, the actual critical rod bank height was 145 rod steps below the ECRP calculated. The licensee was aware of the inaccuracy of the ECRP calculations and instituted the use of inverse multiplication plots to monitor the approach to criticality. However, review of these plots indicated that F, most did not accurately predict the reactor critical rod bank heights. For example, one plot performed in conjunction with a Unit 3 startup on August 23, 1984, indicated that the reactor could not achieve criticality even if all rod banks were fully withdrawn. However, criticality was reached with bank D at 192 rod steps. The ECRP calculation predicted criticality at 100 rod steps on bank D. Due to the failure to develop accurate ECRP and inverse multiplication plot procedures, the licensee was issued a notice of violation.

On October 31, 1984, Turkey Point Unit 4 was restarted (Ref. 10). Prior to the startup, two independent ECRP calculations were performed in accordance with the licensee's operating procedures. Both calculations indicated that a reduc-tion in RCS boric acid concentration was necessary to obtain criticality with control rod bank D at 100 rod steps. The initial dilution was made and the resultant RCS boric acid concentration was detennined to be 1530 parts per million (PPM). With this concentration, the ECRP predicted criticality to occur on bank D at 93 rod steps. Control rods were withdrawn to achieve criticality. At 93 rod steps on bank D, the reactor was nnt critical. The control rod bank was withdrawn to 113 rod steps and the reactor still remained subcritical. Af ter verifying the boric acid concentration and ECRP

calculation, the licensee pulled control rod bank D incrementally to add additional positive reactivity above that which the ECRP calculated was necessary for criticality. At 180 rod bank steps, the reactor remained subcritical and the startup was terminated.

Subsequent review of the inverse multiplication plot revealed that, based on control rod bank position, source range power level, and integral rod worth data, the reactor could not be made critical at a boric acid concentration of 1530 PPM. Another dilution was made and criticality was achieved at 135 rod steps on bank D.

.On May 15, 1985, the inspector reviewed the ECRP calculations performed for a Turkey Point Unit 3 reactor startup (Ref. 11). The ECRP calculation was based on an average RCS temperature of 525*F. .However, the actual temperature was 535*F. This introduced an error into the ECRP calculation of approximately 100 PCM. Further review revealed that the licensee had no criteria by which to detemine if the difference between calculated temperature and actual tempera-ture could adversely affect the ECRP accuracy. An additional discrepancy was identified in that the ECRP calculation sheet did not record the date and time of the shutdown. This omission increased the possibility that improper shut-down times could be used in required calculations. The licensee had developed and implemented a computer program that prints a reactivity poison report at the time of a reactor trip. This information will improve the accuracy of the ECRP calculations. However, the licensee has yet to develop a mechanism to alert personnel to the possible inaccuracies in the computer generated poison reports that can result when the computer has gone off-line. This could introduce varying errors of unknown magnitude into the ECRP calculation.

>,. On April.13, 1985, with Davis-Besse Unit 1 in a reactor startup, the reactor went critical on regulating rod group 2 at approximately 80% withdrawn which was before it was predicted to go critical based upon a computer printout (Ref. 12). The printout indicated an estimated critical position of 73%

withdrawn on regulating rod group 3. The regulating rods were fully inserted into the core and RCS boric acid concentration was increased so that the reactor would go critical within the limits of the ECRP calculation.

On April 25, 1985, with Davis-Besse Unit 1 in a reactor startup, the regulating rods were withdrawn to the maximum allowable estimated rod position and the reactor did not go critical (Ref.12). Upon reviewing the computer printout of the ECRP calculation, it was discovered that an input value for power history was incorrect. Based upon the incorrect value, it appeared that the reactor had tripped at 12 a.m. on April 24, 1985, whereas it had actually tripped at 4 a.m. on April 24, 1985. The power history input was corrected and the reactor went critical within the range specified by the corrected ECRP calculation.

A restart of Surry Unit I was attempted approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after the reactor trip on January 26, 1985 (Ref. 13). All shutdown and control rod banks were fully withdrawn, but the reactor remained subcritical. It was detennined that an unplanned boration occurred after the reactor tripped when the volume control tank was emptied and the charging pumps automatically took suction from the refueling water storage tank. This caused the ECRP calculation to be in error since it did not take into account the increase in RCS boric acid concen-tration. During the subsequent startup conducted at 2:30 a.m. on January 27,

1985, the administrative rod position limit of 81 rod steps on bank D was exceeded as calculated by the ECRP procedure. The actual critical position was c '102 rod steps on bank D. The control rods were not reinserted, nor was the ECRP calculation reevaluated as required by procedure. The actual critical rod bank position, again, exceeded the administrative limits during a restart conducted on January 28, 1985. A notice of violation was issued to the li-censee for not following procedures. It was also recomended by the inspectors that the ECRP procedure be reviewed and/or revised to improve the accuracy of the calculation in light of the recent operating experience at the Surry Nuclear Generating station.

There were a number of premature criticalities at BWR facilities resulting in short period scrams. These short period scrams occurred under a wide variety of circumstances; however, they did have the following factors in common:

an accurate ECRP was not made prior to the approach to criticality, a control rod was being withdrawn in a high worth region of the core, and control rods were being pulled from the core in a continuous withdrawal.

Review of these events indicate that extremely high rod notch worths can be encountered under core conditions of peak Xenon with no moderator voids requiring the withdrawal of significantly more control rods than is normally required to reach criticality. In 1977, IE issued a circular (Ref. 14) to all licensees of operating BWRs describing these events and suggesting that startup m- procedures and practices be reviewed to assure that the licensee's operating staff has adequate information to perform reactor startups under peak Xenon with no moderator void core conditions. In 1979, due to recurrences of short period scram events at BWRs, IE issued.a bulletin (Ref.15) requiring that operating BWR licensees take immediate action to prevent recurrence of this type of event.

The most recent event that occurred at a BWR facility was on July 1,1985 at the Fenni Unit 2 Nuclear Power Station (Ref.16). During the reactor startup, the reactor operator misread the control rod pull sequence sheet and withdrew the first 11 rods in group 3 to the fully withdrawn position. The pull sheet required the rods to be only withdrawn to the "04" position. Upon withdrawing the lith control rod to the fully withdrawn position, a steadily increasing countrate was obtained on the source range instrumentation. Since the nuclear instrumentation was giving an indication that the reactor.had achieved criticality, the operator reviewed the pull sheet and discovered his error.

The group 3 control rods were reinserted into the core to their proper bank position. The cause of the event was failure to follow procedures in moving the control rods (i.e., they were moved to the full out position, instead of being moved in discrete steps). In addition, the pull sheet was poorly designed and was different from the pull sheet used during training at the Fermi simulator. Thus, this may have confused the operator and contributed to the operator error.

Analysis of the February 28, 1985 Sumer event and related operating experience shows that the actual safety consequences of these events were minimal. This

is because of the inherent design characteristics of light water reactors (i.e., Doppler and moderator temperature coefficients), in combination with conservative design margins, and the RPS which serves to limit and prevent rapid power ~ increases. Most of the operating experience presented in this report was obtained through IE inspection reports. Of the events reviewed, the cause for the ECRP differing from the actual critical position could be attributed to the following: (1) inadequate ECRP procedures, (2) failure to adhere to procedures, or (3) inaccurate input of data. These three identified causes could indicate deficiencies in several licensees' quality control and training programs for the proper maintenance and use of ECRP procedures.

Reportability of Premature Criticality Events There is not a requirement to report premature criticality events because of the difficulty in defining the events that are sufficiently significant to i

warrant reporting. In general, the staff has concluded that premature criticality events that are significant enough to warrant reporting will result in a reactor scram. Since there is already a requirement to report all reactor scrams, a separate requirement to report premature criticality events is not needed.

FINDINGS AND. CONCLUSIONS The root cause for the February 28, 1985 event was failure of the licensee to be fully aware of plant status, to closely monitor the appropriate instrumenta-tion, and to anticipate criticality whenever control rods are being withdrawn as required by station procedures. If the licensed operator had been attentive and had monitored the appropriate instrumentation during the reactor startup, g the approach to criticality would have been recognized and appropriate action initiated to terminate the rapid increase in reactor power level.

Contributing to the event was a calculated ECRP which was in error by approxi-mately 128 rod bank steps. The error in the ECRP calculation resulted primarily from procedural inadequacies. The first concerns the use of the power block method of determining equivalent power level for estimating Xenon and Samarium concentrations. It was determined that this method is not very accurate when previous reactor operation was intermittent at widely varying power levels. Review of past ECRPs conducted by the licensee revealed that when using nonequilibrium RCD and the power block method of detemining Xenon worth, estimated critical positions have been in error by a considerable margin. Th l other procedural inadequacy identified was that there was no guidance to detennine which rod worth curve to use for a particular time in core life. As a result, an inaccurate value for the control rod worth was used in the ECRP calculation.

Other po ential contributing factors to the February 28, 1985 event were identified as deficiencies in the licensee's administration of the plant's on-the-job training program. Review of the high startup rate event indicates that the operator trainee lacked the basic skills and knowledge required to perform a reactor startup. Sufficient administrative controls should be established ".o ensure that proper sequencing of learning objectives are maintained throughout the on-the-job training period. This should prevent trainees from performing the task prior to receiving the proper instruction in the basic skills and knowledge needed to accomplish the task. In addition,

plant training programs should give adequate instruction to licensed operators in the administration of on-the-job training.

The purpose of performing an ECRP is to ensure that the control rods are above the rod insertion limits when criticality is achieved. Plant operation with the control rods below the rod insertion limits, when combined with a power transient, could result in exceeding DNB limits. In addition, it cannot be assured that the core will remain shut down following a reactor trip based upon the assumptions used in accident analysis.

The ECRP calculation usually requires the use of many reactivity worth curves, tables, and other data in order to perform the calculation. Thus, there is a potential for data to be incorrectly applied to the calculation and result in an inaccurate ECRP. Extreme care should be taken to verify that the input data for the calculation are up-to-date and accurate. In addition, each ECRP calcu-lational procedure is based on a set of assumptions and therefore is subject to limitations and may not as accurately predict the core critical position for one set of core conditions as' for another. Startup procedures should include precautions to alert the operators to certain core conditions or prior

. operating history that has been known to impact the accuracy of the ECRP. When an ECRP is suspected of being inaccurate, inverse multiplication plots should be used to monitor the approach to criticality.

Because the ECRP procedure can be an involved calculation, many plants are resorting to having this calculation performed by computer. This method would

. increase the accuracy of ECRPs by reducing the chances of introducing mathe-matical errors due to data manipulation as well as reducing the amount of input data required. However, these programs are still subject to human error since w some amount of input information is needed, und these programs are updated periodically to reflect changing core configurations and to correct known deficiencies within the program. Operating experience shows that there have been several occasions where these programs were supplied with erroneous information. Quality assurance and quality control programs should be reviewed to verify that they address the maintenance, documentation, and control of these computer programs.

Review of the operating experience shows that there have been many instances where the ECRP has significantly deviated from the actual critical position.

The root causes of most of these events appear to be human factors which were manifested in the form of inadequate procedures, erroneous input of data, failure to properly follow procedures, inadequate training and supervision, and inadequate administrative controls (deficiencies in tne quality assurance and quality control programs). The operating experience at other plants suggests that deficiencies identified at the Sununer plant may also exist at other PWR facilities.

Operating experience also shows that there have been many premature criticali-ties at BWR facilities. In most of those events, an accurate ECRP was not made prior to the approach to criticality. Furthermore, in each case, a rod was being pulled in a high worth region and, believing that the reactor was very subcritical, the operator was pulling a rod on continuous withdrawal. IE issued a bulletin and a circular to BWR licensees 6 and 8 years ago, respect-ively, describing the circumstances surrounding these events and requiring the licensees to review their current startup procedures to prevent a recurrence.

-=

_ 14 -

The February 28, 1985 event at Sumer and related operating experience indicate that licensee operator training programs may need to be reviewed in order to minimize the potential for premature or inadvertent criticality. Training for operators should use up-to-date plant ECRP procedures, plant data, and form sheets whenever possible to familiarize operators with the proper use of these procedures. This should prevent unnecessary confusion and possible calcula-tional error in situations where plant procedures and/or form sheets differ from those used in training. Also, simulator training should include reactor startups from a variety of plant conditions (i.e., Xenon free, peak Xenon, steady-state, and intemittent power operations). This would ensure that operators have been exposed to varying plant conditions which could impact the accuracy of the ECRP calculation.

Premature criticality events that are sufficiently significant to warrant report to the NRC will result in a reactor scram. Since all reactor scrams are reportable, a separate requirement to report premature criticality events is not needed. Analysis of the February 28, 1985 Summer event and related operating experience shows that the actual safety consequences of these events are minimal. This is because of the inherent design characteristics of light water reactors, in combination with conservative design margins, and the RPS which serves to limit and prevent rapid power increases. Thus, it is concluded that the need for licensees to report premature criticality events does not appear to be warranted.

An industrial organization has issued a report covering some of the recent premature criticality events that have occurred at PWRs and BWRs. Licensees are currently following up on its recomendations.

3..,..

(

REFERENCES

1. Licensee Event Report 85-003, South Carolina Electric and Gas Company, Virgil C. Summer Unit 1, Docket No. 50-395,-dated March 27, 1985.

2. NUREG-0090, Vol. 8, No. 1, " Report to Congress on Abnormal Occurrences,"

dated August 1985.

t

3. Updated Safety Analysis Report (USAR), Virgil C. Summer Unit 1 Docket No. 50-395, dated August 2, 1985.

4. U.S. Nuclear Regulatory Commission, Inspection and Enforcement Inspection Report No. 50-395/85-12, dated March 26, 1985.

5 U.S. Nuclear Regulatory Commission, Inspection and Enforcement Inspection Report No. 50-395/85-30, dated August 16, 1985.

6. U.S. Nuclear Regulatory Commission, Inspection and Enforcement Inspection Report No. 50-395/85-27, dated May 23, 1985.

7. Licensee Event Report 85-014, Duke Power Company, McGuire Nuclear Station Unit 2,, Docket No. 50-370, dated June 28, 1985.

8. U.S. Nuclear Regulatory Commission, Inspection and Enforcement Inspection Report Nos. 50-369/85-20 and 50-370/85-21, dated June 20, 1985.

9. U.S. Nuclear Regulatory Commission, Inspection and Enforcement inspection Report Nos. 50-250/84-28 and 50-251/84-29, dated January 28, 1985.

10. U.S. Nuclear Regulatory Commission, Inspection and Enforcement Inspection Report Nos. 50-250/84-35 and 50-251/84-36, dated February 19, 1985.

11. U.S. Nuclear Regulatory Commissien, Inspection and Enforcement Inspection Report No. 50-250/85-13 and 50-251/85-13, dated July 10, 1985.

12. U.S. Nuclear Regulatory Commission, Inspection and Enforcement Inspection Report No. 50-346/85-09, dated May 28, 1985.

13. U.S. Nuclear Regulatory Commission, inspection and Enforcement Inspection Report Nos. 50-280/85-01 and 50-281/85-01, dated March 1, 1985. i

14. IE Circular No. 77-07,

Subject:

Short Period during Reactor Startup, dated April 12, 1977.

15. IE Bulletin No. 79-12,

Subject:

Short Feriod Scrams at BWR Facilities, dated May 31, 1979.

16. Preliminary Notification of Event or Unusual Occurrence No. PNO-!!!-85-58, Detroit Edison Company, Fermi Unit 2, Docket No. 50-341, dated. July 15, 1985. j

,