05000528/LER-2012-001
| Docket Number Sequential Revmonth Day Year Year Month Day Yearnumber No. (Pvngs) Unit 2 05000529 | |
| Event date: | 04-19-2005 |
|---|---|
| Report date: | 05-7-2012 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 5282012001R00 - NRC Website | |
All times are Mountain Standard Time and approximate unless otherwise indicated.
1. REPORTING REQUIREMENT(S):
This LER is being submitted pursuant to 10 CFR 50.73 (a)(2)(i)(B) as an operation prohibited by Technical Specification (TS) 3.1.7, Regulating Control Element Assembly (CEA) Insertion Limits. The Limiting Condition for Operation (LCO) for this TS requires that the power dependent insertion limit (PDIL) alarm circuit to be OPERABLE. If the Required Action and associated Completion Time are not met for LCO 3.1.7 Condition D, then LCO 3.1.7 Condition E requires that the plant be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The PDIL alarm setpoint was incorrectly set and the PDIL alarm circuit was determined to be inoperable since April 19, 2005, which exceeds the required action completion time.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The control element drive mechanism control system (CEDMCS) (EIIS: AA) provides control signals and motive power to the coils of the magnetic jacks in the 89 control element drive mechanisms (CEDMs) (EIIS: AA) which move, hold, and release the CEAs (EIIS: AA). The CEAs absorb neutrons to control reactivity.
CEAs are grouped in shutdown, regulating, and part-strength groups. Shutdown CEA groups remain fully withdrawn during reactor operation to ensure the capability to rapidly shutdown the reactor during anticipated operational occurrences evaluated in the plant safety analysis.
Regulating and part-strength CEA groups are positioned to control core flux distribution and reactivity and are normally fully withdrawn during power operations. Limits on regulating CEA group insertion have been established and all CEA positions are monitored and controlled during power operation to ensure that power distribution and reactivity limits related to power peaking, ejected CEA worth, reactivity insertion rate, and shutdown margin are preserved. These insertion limits are referred to as the PDILs.
Core operating limits for each reload cycle are established and documented in the Core Operating Limits Report (COLR) as required by TS 5.6.5. PDIL Alarm circuits are provided to ensure the operating limits on allowable CEA insertion as a function of reactor power are maintained consistent with the requirements of the COLR. The PDIL alarm circuit alerts operators to CEAs that are outside required insertion limits. In response, operators ensure either CEA positions are restored or actions are taken to limit thermal power or thermal power increases as specified in TSs. The PDIL alarm circuit is not credited in the safety analysis and it does not directly control any of the safety functions in the safety analysis.
For an inoperable PDIL alarm circuit, TS LCO 3.1.7 Condition D requires verification that each regulating CEA group position is within its insertion limits within one hour of discovery and every four hours thereafter, until the PDIL alarm circuit is restored.
The PDIL alarms are generated using the PDIL alarm setpoint programmed into the software of the plant monitoring system (PMS) computers. The PMS is comprised of two independent computer systems designated as the plant computer (PC) and the core monitoring computer (CMC). The PC and CMC functions related to the PDIL alarm circuits are fully redundant and each provides the same alarm capabilities.
CEA position indication is provided by three separate instruments for each of the CEAs. Two safety-related reed switch position transmitter (RSPT) indications and one computer generated pulse counter position indication are provided for each CEA. The RSPTs measure CEA position via magnetically actuated reed switches located on the CEDM housing and input to the plant protection system to provide safety related reactor protection system functions and CEA position indications in the Control Room. The PMS computers generate pulse counter CEA position indications by counting CEDM coil movement electrical pulses at the CEDMCS cabinets and provide indications and alarms in the control room and CEA positions for use in the core operating limit supervisory system (COLSS) calculations. Each pulse that is counted indicates 0.75 inches of CEA travel. The pulse counted CEA positions are used as inputs for the PDIL alarm circuits.
3. INITIAL PLANT CONDITIONS:
On March 8, 2012, all three units were in Mode 1, with Units 1 and 2 operating at 100 percent power and Unit 3 at 95 percent power during power coast down for a scheduled refueling outage. There were no structures, systems, or components inoperable at the time of the event that contributed to the event.
4. EVENT DESCRIPTION:
On March 8, 2012, at 1752, all Palo Verde units entered TS LCO 3.1.7, Regulating CEA Insertion Limits, Condition D, when the PDIL alarm setpoint for each unit was determined to be non-conservative.
During an investigation of an event described in LER 2-2012-001, Palo Verde personnel determined that the Regulating CEA PDIL alarm setpoint was incorrectly set at 144 inches since April 19, 2005, when the specified CEA fully withdrawn position was changed from greater than or equal to (>/=)144.75 inches to >1=147.75 inches.
Changes which altered the fuel configuration began in 1993, when the fuel inconel spacer grid assembly was replaced with a redesigned inconel spacer grid assembly called the during Cycle 6 and Unit 3 during Cycle 5. The Guardian grid raised the active fuel region by 1.589 inches. The reload analysis report (RAR) for those fuel cycles concluded that the change in the location of the active fuel region relative to the core internals would not impact the results for the various accident analyses and no changes to the CEA Insertion Limits were required with the installation of the new Guardian grid fuel assembly.
On April 19, 2005, changes were made to the COLR figures for CEA Insertion Limits versus Thermal Power to revise the CEA Group insertion limits by changing the fully withdrawn position to >1=147.75 inches. The change added a note to the COLR figures which specified the fully withdrawn CEA position as >1=147.75 inches. Corresponding changes should have been made to the PDIL alarm setpoint; however, the PDIL alarm setpoint remained at 144 inches. Since the PDIL alarm setpoint remained unchanged, the PDIL alarm circuit would not provide operators with an alarm when the limit was exceeded.
Corrective actions were performed in all three units to change the PDIL alarm setpoint to 147 inches, which allowed each unit to exit TS LCO 3.1.7 Condition D, on March 11, 2012.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
This condition did not adversely affect plant safety or the health and safety of the public. The condition did not result in any challenges to the fission product barriers or result in any releases of radioactive materials. The safety limits for Departure from Nucleate Boiling Ratio (DNBR) and fuel peak centerline temperature were not exceeded as a result of this event.
An engineering evaluation was performed with the minimum PDIL alarm setpoint of 144 inches to determine the impact on CEA scram worth and the potential impact to the safety analysis, as well as the impact to flux distribution on core power peaking. The evaluation determined that the impact of the incorrect PDIL alarm setpoint was bounded by the assumptions made in the safety analyses with respect to CEA positions at 144.75 inches vs.
the specified COLR limit of 147.75 inches and did not impact the safe operation of the units.
Therefore, there were no actual adverse safety consequences as a result of this condition.
Additionally, the condition did not impact the safety related plant protection system functions performed by the core protection calculators (CPCs) and CEA Calculators (CEACs) which provide the Linear Heat Rate and DNBR reactor trip functions. Based upon these conclusions, the incorrect PDIL alarm setpoint did not adversely affect plant safety or the health and safety of the public.
The CEA safety functions were not affected by the inoperable PDIL alarm circuits. The circuits provide an alarm function only and do not fulfill a safety function credited in the safety analysis. Therefore, this event would not have prevented the fulfillment of a safety function to safely shutdown the reactor and did not result in a safety system functional failure as described by 10 CFR 50.73(a)(2)(v).
6. CAUSE OF THE EVENT:
The cause of the event was a failure to revise the PDIL alarm setpoint in the software for the CMC and PC computers following changes to the COLR requirements which specified the fully withdrawn position for regulating CEAs.
The root cause for failing to change the PDIL alarm setpoint was determined to be the figures for the Core Operating Limits Report (COLR) were not directly tied to any basis document.
Contributing to this event was the lack of clear procedural guidance for making COLR changes.
7. CORRECTIVE ACTIONS:
As an immediate corrective action, PDIL alarm setpoint in the software for the CMC and PC for all three units were changed to 147 inches for the PDIL. This corrective action allowed each unit to exit TS LCO 3.1.7 on March 11, 2012.
Additionally, the following corrective actions are planned:
- Develop and institute a Safety Analysis Basis Document (SABD) for the COLR.
- Revise Setpoint Checklist SABD (SABD-5.04.06) to include the checks on PMS PDIL files.
- Enhance procedural guidance for COLR changes.
8. PREVIOUS SIMILAR EVENTS:
No prior similar events were identified in which PDIL alarm circuits were inoperable because changes to the COLR were not incorporated into the PDIL alarm setpoint.