ML13004A331
| ML13004A331 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 10/21/2010 |
| From: | Lawrence Criscione NRC/RES/DRA |
| To: | David Beaulieu Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML130040225 | List:
|
| References | |
| FOIA/PA-2012-0259 | |
| Download: ML13004A331 (9) | |
Text
Criscione, Lawrence From: Criscione, Lawrence Sent: Thursday, October 21, 2010 10:13 AM To: Beaulieu, David
Subject:
Yesterday's markup Attachments: IN Reactivity.doc; graphs.pdf
- Dave, Attached is the electronic copy of the markup I gave you yesterday.
Although I agree with you that for most users the added details are "nice to know" and not necessarily "need to know",
for any utility wishing to conduct training on the incident the added information is necessary. If the added information had made it into an inspection report or an INPO SER, I would not believe that it needs to be included here. Keep in mind though that this incident is different than most:
- The reactivity management aspects of the events were not captured in the licensee's Corrective Action Program in 2003 and the NRC resident inspectors were never made aware of the incident so it does not appear in any inspection reports from 2003
" The utility still has not reported the event to INPO and so the details of the incident do not appear in an INPO SER or any other industry document
" Although the NRC did capture some aspects of the event in a 2007 inspection report, the details and significance of the reactivity management issues had not yet been elucidated. The 01 interviews were not conducted until 2008. The additional information obtained by the NRC through their 2008 and 2009 investigation efforts have never been released in a public inspection report.
The normal "process" has broken down with regard to this incident. Normally, the details I am requesting that you add would be shared with the industry by INPO in a much more detailed analysis and time line than the five sentences I am providing. Since this event is likely to never be reported to INPO, I believe that it is important that the NRC provide the nuclear licensees with some of the facts necessary to adequately include the incident in their lesson plans for training licensed operators.
Also attached to this email is a two page graph of plant parameters during the incident with important milestones.
Although I believe it is important for the licensees to have these graphs, I understand that you cannot included them under the current Information Notice structure. I am providing them to you though because it is handy information for understanding the incident. A picture really is worth a thousand words and the picture these graphs paint is a concise two page summary of the event.
Please let me know ifyou have any questions.
- Thanks, Lawrence S. Criscionc Reliability &Risk Engineer RES/DRA/OEGIB Church Street Building Mail Stop 2A07 (301)251-7603 1X
UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, DC 20555-001 NRC INFORMATION NOTICE 2010-XX: OPERATOR PERFORMANCE ISSUES INVOLVING REACTIVITY MANAGEMENT AT NUCLEAR POWER PLANTS ADDRESSEES All holders of operating licenses for nuclear power reactors under the provisions of Title 10 of the Code of FederalRegulations (10 CFR) Part 50, "Domestic Licensing of Production and Utilization Facilities," except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor.
PURPOSE The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice (IN)to inform addressees of events in which deficiencies with reactivity management planning and implementation resulted in transients or unexpected conditions. The NRC expects recipients to review the information for applicability to their facilities and to consider actions, as appropriate, to avoid similar problems. Suggestions contained in this IN are not NRC requirements; therefore, no specific action or written response is required.
DESCRIPTION OF CIRCUMSTANCES Callaway Plant During a Callaway Plant shutdown in October 2003, the control room operators did not effectively control reactivity during low-power operations. The event began on the morning of October 20, 2003, when the Callaway Plant experienced an inverter failure on a safety-related bus that put the unit in a 24-hour technical specification action to restore the inverter or be in Mode 3 (hot standby) within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The next morning, operators initiated a plant shutdown at approximately 10 percent per hour. With the main turbine on line and with turbine bypass valves closed, operators attempted to stabilize the plant at approximately 8-percent power. Per procedure, operators opened the turbine drain valves, which increased main steam flow, reducing reactor coolant temperature and adding positive reactivity. In addition, negative reactivity was being inserted by xenon buildup, decreasing reactor power. The net effect was that reactor coolant temperature decreased by approximately 10 degrees Fahrenheit over a half-hour period. Operators did not withdraw control rods or dilute boron concentration to stabilize reactor power or reactor coolant temperature. As a result of the lowering temperature, the pressurizer level lowered enough to cause letdown to isolate and the reactor coolant temperature went below the minimum temperature for criticality for several minutes. With power at approximately 5 percent, the operators manually tripped the main turbine. Tripping the main turbine reduced main steam flow, increasing reactor coolant temperature and adding negative ML101810282
IN 2010-XX Page 2 of 5 reactivity, which together with the addition of negative reactivity by xenon buildup, caused the reactor to become subcritical. Tripping the main turbine permitted the turbine bypass valves to open and control steam pressure, causing reactor coolant temperature and pressurizer level to return to normal, Operators did not insert the control rods until almost 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the reactor became subcritical.
A subsequent review of this plant shutdown found that control room operators did not effectively control reactivity to maintain the reactor in the desired condition during low-power operations by properly anticipating, controlling, and responding to changing plant parameters. Operators did not use control rods or boron concentration-two means that operators can directly control the amount and timing of reactivity changes-to adjust for reactivity changes by xenon buildup and reactor coolant temperature changes. As a result, (1) operators did not effectively stabilize and hold the plant at a low power level, (2) operators did not shut down the reactor in a deliberate manner (e.g., by inserting control rod banks), but rather the reactor became subcritical because of xenon buildup and the increase in reactor coolant temperature resulting from the operators manually tripping the main turbine, and (3) operators did not insert control rods for nearly 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the reactor became subcritical to provide assurance that the reactor remained shut down. As reactor power transitioned into the source range with the control rods still at their last critical rod heights the reactor operators placed cooling tower blowdown in service, lowered intake flow, and raised letdown system flow. The performance of these activities indicates the reactor operators might not have realized the reactor was no longer critical. Due to the subcritical multiplication afforded by the control rods remaining at their critical rod heights, reactor power was in the source range for 45 minutes before the first channel of source range nuclear instruments energized. After receiving an alarm indicating the reactor was in the source range there was an additional 40 minute delay before control rods were inserted. During this time the operators prioritized alignment of the feed system for shutdown operation and establishment of containment minipurge over insertion of the control rods.
Operator performance in not effectively controlling reactivity was attributable, in part, to weaknesses with management oversight, training, and procedural guidance. The just-in-time training did not cover plant operations below 10-percent power and did not include operation after the point where the operators tripped the main turbine. The reactivity management plan did not address the possibility that the expected reactivity change from tripping the main turbine together with the xenon buildup could cause the reactor to become subcritical. The licensee's initial post-shutdown review did not identify and evaluate the atypical manner that the reactor became subcritical and whether operators sufficiently anticipated and accounted for xenon.
This omission delayed application of the lessons learned to operator qualification and requalification training and significantly delayed procedure changes to address weaknesses in operator control of reactivity during low-power operation. Additional information is available in "Callaway Plant-NRC Integrated Inspection Report 05000483/2007003," dated August 2, 2007, which can be found on the NRC's public Web site in the Agencywide Documents Access and Management System (ADAMS) under Accession No. ML072140876.
River Bend Station On March 8, 2008, with River Bend Station at 25-percent power, control room operators were withdrawing control rods to increase reactor power. The operating procedure for plant startup directs operators to withdraw control rods a using a withdrawal sequence specified in a
IN 2010-XX Page 3 of 5 reactivity control plan that is provided to them by licensee reactor engineering. However, the dedicated reactor operator at the controls stated an incorrect target position when reading aloud a rod movement step in the reactivity control plan. As a result, this operator individually withdrew six consecutive rods to position 24 rather than the target position 20 specified in the reactivity control plan. The dedicated peer-check reactor operator did not identify that the stated target position was incorrect because he could not readily see the reactivity control plan that was resting on the lap of the reactor operator at the controls, The operator at the controls halted the withdrawal of the seventh rod at position 18 after the dedicated peer-check reactor operator identified the error. The licensee determined that the reactor operator at the controls and the peer-checker did not follow the procedures to prevent human performance errors and that the senior reactor operator did not maintain effective oversight of the activity. Additional information is available in "River Bend Station-NRC Integrated Inspection Report 0500045812008002," dated May 9, 2008 (ADAMS Accession No. ML081300838).
Diablo Canyon Power Plant, Unit 2 In August 2009, Diablo Canyon Power Plant Unit 2 was shut down in order to troubleshoot and repair a main transformer bushing. In preparation for the shutdown, the control room operators performed simulator training on a ramp downpower using a draft copy of a ramp plan provided via e-mail by reactor engineering. Before the actual shutdown, a revised ramp plan was provided by reactor engineering, approved by the operations manager, and issued in the shift orders. This revised ramp plan was also e-mailed to all shift members. The oncoming shift foreman and shift manager did not review the approved ramp plan located in the shift orders nor did they review the ramp plan as part of the reactivity brief. Operators began the ramp downpower using the original (unapproved) draft ramp plan. After the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the downpower, the control room operator questioned plant conditions that were inconsistent with the simulator scenario and contacted the reactor engineer. The reactor engineer provided a copy of the approved ramp plan. No reactivity manipulations outside of the approved plan had been made, Operators continued the downpower using the approved ramp plan.
The licensee performed an apparent cause evaluation and determined that the shift foreman did not validate that the ramp plan in use was the same as the one that the operations manager had approved. Licensee corrective actions included revising existing procedures to require validation of the ramp plan by the shift foreman and shift manager during the reactivity briefing.
Additional information is available in "Diablo Canyon Power Plant-NRC Integrated Inspection Report 05000275/2009005 and 05000323/2009005," dated February 3, 2010 (ADAMS Accession No. ML100341199).
Arkansas Nuclear One On April 25, 2010, following the completion of a refueling outage, Arkansas Nuclear One, Unit 1 was at approximately 20-percent reactor power determined by heat balance (approximately 30-percent reactor power indicated on nuclear instrumentation (NI)) and holding to allow instrumentation and controls (I&C) technicians to calibrate the NI, which involves adjusting the gain on the NI excore detectors so that NI indicated reactor power level matches the reactor power determined by heat balance. To prevent the integrated control system (ICS) from automatically moving control rods in response to the changing input of NI reactor power level from the gain adjustment, the calibration procedure first directs a control room operator to place
IN 2010-XX Page 4 of 5 the control rod station in manual. The I&C technician who was implementing the procedure stated to a control room operator, "We are ready to place ICS to manual." The control room operator responded, "ICS is in manual." However, this exchange did not result in the operator placing the control rod station in manual and it remained in automatic. When I&C technicians subsequently adjusted the gain on the Nls, control rods automatically withdrew for approximately 38 seconds and resulted in an automatic reactor trip because of high reactor power (49.55 percent NI indicated reactor power) and high RCS pressure. The rapid event succession did not afford operators time to complete diagnosis of the rod withdrawal and initiate manual corrective action.
The causes of the event included failure to follow the NI calibration procedure, miscommunication between the I&C technician and the reactor operator, failure to conduct a pre-job brief, and lack of supervisory oversight. Additional information is available in "Arkansas Nuclear One-NRC Integrated Inspection Report 05000313/2010003 and 05000368/2010003,"
dated August 5, 2010 (ADAMS Accession No. ML102180209).
BACKGROUND The following are related NRC generic communications:
" NRC IN 92-39, "Unplanned Return to Criticality during Reactor Shutdown," dated May 13, 1992, discussed events involving unplanned returns to criticality caused by the cooldown of the reactor coolant system during reactor shutdowns (ADAMS Accession No. ML031200314).
" NRC IN 96-69, "Operator Actions Affecting Reactivity," dated December 20, 1996, highlighted several events in which poor command and control during reactivity evolutions have led to unanticipated and unintended plant conditions (ADAMS Accession No. ML031050475).
DISCUSSION One of the most important responsibilities of an on-duty licensed reactor operator and senior reactor operator is reactivity management in order to maintain the reactor in the desired condition, consistent with plant technical specifications, by properly anticipating, controlling, and responding to changing plant parameters. Reactivity management involves establishing and implementing procedures for operators to use in determining the effects on reactivity of plant changes, and to operate the controls associated with plant equipment that could affect reactivity. Although there.is no specific NRC requirement, before conducting planned evolutions involving reactivity changes (e.g., power decreases and increases), many licensee reactor engineering staffs prepare a reactivity management plan that helps control room operators maintain the reactor in the desired condition by providing expected plant responses and expected alarms. Required training is expected to give licensed operators an understanding of facility operating characteristics during steady-state and transient conditions, including causes and effects of temperature, pressure, coolant chemistry, and load changes, as well as, operating limitations and their bases. Licensee post-transient reviews are important for determining the cause of transients or unexpected plant responses and for taking corrective actions, such as procedure changes and training, to prevent recurrence.
IN 2010-XX Page 5 of 5 During one of the events discussed above, after the reactor became subcritical through xenon buildup and a reactor coolant temperature increase, operators delayed inserting control rods to establish adequate shutdown margin for nearly 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. NRC IN 92-39 discusses an event in which, after the operators brought the reactor subcritical by inserting control rods, an inadvertent unplanned return to criticality occurred because operators delayed actions to continue inserting control rods while changing shifts. Although not specifically required, licensees may revise procedures and train operators so that, after the reactor becomes subcritical, the operators will proceed without delay to establish adequate shutdown margin by inserting control rods or adding boron.
CONTACT This IN requires no specific action or written response. Please direct any questions about this matter to the technical contact listed below or to the appropriate Office of Nuclear Reactor Regulation project manager.
Timothy J. McGinty, Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation Technical Contact: Geoffrey Miller 817-860-8141 qeoffrey.miller(.nrc.gov Note: NRC generic communications may be found on the NRC public Web site, http://www.nrc.gov, under Electronic Reading Room/Document Collections.
ML101810282 OFFICE BC:DRP:R-IV Tech Editor IOLS:DIRS BC:IOLB:DIRS D:DIRS NAME GMilier Chsu WVick JMcHale FBrown DATE 9/4/10e-mail OFFICE BC:SRXB:DSS OGC(NLO) ........
NAME AUtses __'
DATE .....
OFFICE LA:PGCB&NRR PM:PGCB:NRR BC:PGCB:NRR" D:PR:NRR '_-
NAME CHawes DBeaulieu SRosenber. T'MGinty _ _ _
OFFICE _
Tavg, AT and IRNI signals during the October 21. 2003 Passive Reactor Shutdown at Callaway Plant TT Turbine Trip, MTCO Minimum Temperature for Critical Operations, POAH = Point of Adding Heat, NFHR = Non Fission Heat Rate 9:42 9:45 9:48 9:51 9:54 9:57 10:00 10:03 10:06 10:09 10:12 10:15 10:18 10:21 10:24 10:27 10:30 10:33 10:36 10:39 10:42
... .. ..... .. . . .. . . ~ ~ ~ ~. .~. ..~~~~~
'....~~~..
. . . .' - - - - - _ -. . .
- _ _ * . . - -
LA.
55S F
___ i-A I i
- Iavg
- /~
-
linear scale,SFdiii;ii i'erc~e 5 F/division)lL TT
- i J,* "f Turbine
- -
?- trip (TT-) occured....at 10:12:35.
.... The resultant
,...n o dTv rise5in 7F
-- .. 555 Tavg I 55 0 FF in 550 F MTCO ---------- ...........-
......... ._ .
with no steam demand caused the reactor to passively shut down' 1,10 F AT -..... . ........ : -.::-0.---------------
- .---.. **" ' ' I * ; - ' Non Fission Heat Rate (N FHR)' !0
- 6T (linear scale, 5% rated power/division).. Non Fiso Heat Rate NR 10%
5% ~'~for this shutdown was 1.75%- -o qj 10:02
'dilution to water, TT:0: Durbingte Tavg lowered prearatos 9 Fkept to compensate trippangth anddesine, for the buildup 3 ofalowrng turin load hep Xenon-135. i (log AT PA scale, Arun offset10:23to lie ontoa(RNI
'I poetraces .- 0 r.E-0ing Arod 10:23, total powe 0
,counteract the increasing Xenon-135 due to a negative coefficient for power reactivity, stabilized at the NFHR as fission Ef I 1-071 E-07 'U TT: The operators manually tripped the turbine at 6%power with Tavg at 550 F. As Tavg rose to 557 F, power dropped below the POAH U Ci. - fission power decayed exponentially (-0.15 dpm SUR) while AT power approached the NFHR asymptotically. and SUR approached -1/3 dpm. 'U EU I.E-08 .... --- _
--- ----- ----- i.E-08 as r
"T to 10:18: Until 10:18, the operators were still recovering Letdown. It appears the operators did not notice the reactor shutting down as they made no efforts to either keep it critical or actively shut it down. I E-09 ". . . . .-. . . . . . .... .. . ... - ~-- ---- ----- ,E09 10:18 to 10:23: By 10:18, fission power was less than 1/6 of what it had been when the turbine was tripped and could not be safely recovered without performing a reactor startup. Operators take no action to actively drive the shutdown i.E-1O *not---"--..-- - - - - - - - - - - - - - - - - - - - - - - - - -. ...- - .- - ..-- ;E-1O i10:23 to 10:39: As reactor power lowers at -0.28 decades per minute (dpm) from the POAH into the source range, AT is 1.E-11 :stable
- - at 1.75%
- - (the NFHR)
- - and- the -Power - Range - Nuclear - Instruments
- - -(PRNIs)
- steady
- - - out at - 1%- due
- to- decay
- - gammas. - - - -
Background:
With the reactor operating at 100% power, a safety related electrical inverter failed at 07:21 on October 20, 2003 placing the plant in a 24-hr action statement (the plant had 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to either repair the inverter or begin shutting down). In anticipation of having to shut down the plant, at 01-00 on October 21, 2003 the operators began lowering power at nominally 10%/hour. By 07:21 the reactor was already below 39% rated power; the inverter was still not yet repaired and the plant now entered a new action statement to have the reactor fully shutdown within six hours (13:21). If the inverter were to be repaired during this new 6-hr action statement, the reactor shutdown could still be aborted.
The reactor was at 9% power when the operators quit lowering reactor power at 09:35. it is not known why the reactor operators discontinued the load reduction at this point, but repairs to the failed inverter were still in progress and the reactor shutdown was three hours ahead of schedule so it is likely the delay occurred to give the electricians some more time to repair the inverter. At this point, the operators had been lowering reactor power at about 10%/hour for over nine hours.
In their attempt to hold reactor power constant, the operators failed to adequately account for transient Xenon-135. Over the next 25 minutes, average reactor coolant temperature (Tavg) lowered 9 F. The crew was experiencing faulty indications on some of the steam line drain valves and believed the excessive cooldown was being caused by some open steam line drains. While they focused on troubleshooting the steam line drain valves, Tavg lowered to below 551 F, the Minimum Temperature for Critical Operations (MTCO). Along with the lowering reactor coolant temperature, Pressurizer water level (Lpzr) was also lowering and a Letdown system isolation occurred on low Lpzr at 09:59 causing the crew to enter the off-normal procedure for "Loss of Letdown". The operators tripped the turbine to assist in recovering Tavg. The rapid rise in Tavg following the turbine trip caused the reactor to passively shut down. In the confusion resulting from the loss of Letdown, the problems with the steam line drain valves and being below the MTCO, the operators apparently failed to notice the reactor shutdown and took no measures to actively insert negative reactivity until 12:04 (111 minutes after the manual turbine trip).
Rod Heights and IRNI Currents during Oct. 21, 2003 Shutdown at Callaway Plant 1.E*00 230 220 1.E01 03 Average reactor coolant temperature ('avg) begins to depart 1:48iOblivious to any concerns for reactor power being inthe source range 210 from reference temperature (Tref) due to operators not *=with no SRNIs energized and with the control rdstlattheir last Critica adequately compensating for the build-up of Xenon.135, , Rod Heights, the Reactor Operators perform ancillary tasks associated 200
.E-02 , goes below the Minimum Temp with the plant shutdown (e.g, stopping unnecessary feed and condensate
-pumps, raising Letdown flow to 120 gpm) while informally relying on for Critical Operations (MTCO) and the transient Xenon-135 to prevent the reactor from restarting, 80 Letdown system isolates, Off-normal E 1.E-03 procedure for "Loss of Letdown" entered. 1F1:iReactor Operators stop one of the three condensate pumps. 170 2
'10:13- Reactor Operators trip. the turbine. .:11 Tavg rises 4 Finthe next two- 5i Alarm recieved inControl from first SRNI enerzing, Room 160 Z ca E-04 -I- --- _ -F -..-- minutes allowing Xenon-135 to passively shut down the reactor. i-8Alarm from second
,I i
..
,: i :,..-
,, .Letdown flow restored to75 gm and off-normal'
__,
SRNI energizing.
150 R
_- ,procedure for "Loss of Letdown" exited, bi*4.Start Motor Driven 140 9 E . . ---. I I Feed Pump, 2 \! *O._23*Reactor *power I *'passively lowers below the Point of Adding Heat and ', 0:42'Start 1: . Containmento ontainment
- ' Start Up Rate approaches anominal -11 testifying thatý '_ 120
\Minpurge, M_ 120 1.Ea I 4 -i 4,-heknewthereactorwasshutdown,nth (b,,,)(C) nnot , Minp_ . 2
, I , adequately explain why he did not direc he controro'ds be inserted. 1,5jStop Main 110 (9
",E,\7 o r, Ifeed Pump. 10 Z - ' '100 7Bank rd) ' Despite testifying that higher precendent rocedure dthem from Csteady at 102 steps I actively driving the reactor shutdown, the (b)(7)(C) as performing 90
',m 9:36 I ffrom until 12:04'
- I\ p Tower blowdown inservice, stopping routine activities (e.g, placing Cooling I.'0 - *' an Intake pump) as reactor power passively transited into the source range.[8
-I 1E-8 I , ... . I I /
-:3!
-RI DETECTOR CHI LOG 0 I1lt- , Reactor power enters the source range. Because of the abnormally high 1.E-09 subtcritical multiplication afforded by having the control rods still at their 60
- IRDETECTOR CH2 LOG
.9 last Critical Rod Heights (CRH), the Source Range Nuclear Instruments RR B A OI I SRNIS) do not energize for another 45 minutes, 50
- CTRL ROD BANKBAVG POS 40
--CTRL ROD BANK CAVG POS K U' 1 40II I.E-II -- CTRLRODBANKDAVGPOS 20 CTLRDBNKAGPSL LL 1 :" . - -Ij , __ ___ 20
= =, - , - :, I I I III I II I I I I C CIII
,I i I I I I I I iII I 10 1.E.12 0 The reactor passively shut down shortly after the main turbine was tripped at 10:13. No negative reactivity was actively inserted until 12:04. Upper management did not expect the reactor to shut down at 10:13 and the control rods may have been left withdrawn to give management the impression the reactor was being actively shut down at noon. Until February 2007, no one outside of the control room was aware that when the control rods were inserted at 12:04 the reactor had already been shutdown for over 106 minutes,