Estimated Critical Positions (ECPs)

Content

• Introduction
• Notice Summary
• Applicability
• Summary of Events
• Event Descriptions
• Significance of Events
• Causes of Events at DOE and NRC-Licensed Facilities
• Site-Specific Corrective Actions
• References

Introduction

This notice is one in a series of publications issued by the Office of Nuclear and Facility Safety to share nuclear safety information throughout the Department of Energy complex. For more information, contact Dick Trevillian, Office of Operating Experience Analysis and Feedback, Office of Nuclear and Facility Safety, U.S. Department of Energy, Washington, DC 20585, telephone (301) 903-3074. No specific action or responses are required solely as a result of this notice.

Safety Notices are distributed to U.S. Department of Energy Program Offices, Field Offices, and contractors who have responsibility for the operation and maintenance of nuclear and related facilities, and to other organizations involved in nuclear safety. Written requests to be added to or deleted from the distribution of Safety Notices should be sent to: BR Richard L. Trevillian, EH-33, Room E-460 GTN, U.S. Department of Energy, Washington, DC 20585.

The ESH Office of Information Management maintains a file of Safety Notices and supporting information. Copies can be obtained by contacting the Office of Information Management at (301) 903-0449 or by writing to the Office of Information Management, U.S. Department of Energy, EH-72/Suite 100, CXXI/3, Washington, DC 20585.

Notice Summary

This notice presents lessons learned in determining the estimated critical position (ECP) prior to reactor startup. The calculational models used in predicting ECP shave inherent approximations and uncertainties. An occasional missed ECP caused by these approximations and uncertainties is expected. While many of the missed ECPs discussed in this Safety Notice did not present a safety concern, all of them resulted in extending the shutdowns of DOE research reactors and therefore affected the research projects in progress. Of more concern are those ECPs missed due to incorrect assumptions, incorrect calculations, lack of awareness of the state of the reactor, operator inattention during startup, or inadequate procedures for calculating the ECPs.

Applicability

This notice applies to all Department of Energy (DOE) Category A and Category B reactor facilities that require the calculation of an ECP prior to startup. No specific action or response is required as a result of this notice.

Summary of Events

During reactor startup operations, reactor operators, procedural controls, and Reactor Protection Systems (RPSs) are all relied upon to limit and prevent rapid power increases. The operator is trained and required to monitor instrumentation closely and to anticipate criticality whenever the control rods are being withdrawn from the core. During a three-year period (July 1989 to July 1992) there have been at least ten reported occurrences at DOE reactors in which criticality occurred, or would have occurred had startup operations continued, outside the tolerance limits of the ECP. Reactor operator and procedural controls either prevented, or should have prevented, most of these occurrences. Again, uncertainties inherent in the calculations caused some of the missed ECPs. Operators responded correctly in most of these events. On one occasion, a miscalculated ECP contributed to the event, but was not responsible for the operator's failure to monitor and anticipate criticality.

ECPs missed due to approximations and uncertainties in the ECP calculations are expected and are usually not a safety concern. However, ECPs missed due to incorrect assumptions, incorrect calculations, or inadequate procedures for calculating the ECPs are a safety concern. ECPs missed for these reasons may indicate that personnel do not sufficiently understand the core physics associated with the core loading arrangement or that operators have not been adequately trained. Operators need to be aware of the tolerance limits associated with the ECP and understand that criticality can occur outside these limits.

Event Descriptions

Between July 1989 and July 1992, there were at least ten reported "off-normal" occurrences at DOE reactor facilities where criticality occurred outside the limits of the ECP. (These ten occurrences were identified employing "text string" searches performed on DOE's Occurrence Reporting and Processing System.¹All related events may not necessarily have been identified.) Because of the uncertainties associated with calculating ECPs, an occasional missed shim prediction is to be expected.

On five separate occasions at one DOE facility, operators stopped startup operations and scrammed the reactor when they realized that criticality would occur outside the limits associated with the ECP.^2-6 In each case, the missed ECP was due to uncertainties inherent in modeling the core loading arrangement. In several of these cases, the operators were aware of the increased probability that criticality might occur outside the ECP tolerance limits because of xenon transients.

The other five occurrences of missed ECPs are more important because other factors were involved beyond simple calculational or modeling uncertainties. (Two of the five events occurred at the same facility.) These ECPs were missed due to calculational errors, lack of independent verification, inattention to the status of the reactor, or operators not being aware of the tolerance limits associated with the ECP. These five events are discussed below.

At one facility, after completing repairs on a valve, reactor startup operations commenced and the shim control cylinders were withdrawn to the upper limit of the ECP.⁷ Based on the response of the startup instrumentation, the operators determined that the reactor was critical. Power was raised and stabilized. At the higher power level, operators realized that the shim positions were outside the ECP tolerance limits and shut the reactor down. Because essentially no changes were made to the core configuration during the shutdown (repairing the valve required the removal and reinsertion of an experiment), the shutdown was extended to fully understand the event. In reviewing the xenon restart model, personnel found a bias for predicting criticality at shim positions further inserted than the actual positions where criticality would occur. Further compounding the discrepancies in this case was the contribution of photoneutrons from the beryllium reflector. Contributions from this source at 10^-5 times the full power level were no longer negligible and made the reactor appear to be critical when it was actually slightly subcritical.

At a second facility, the reactor was shut down when the reactor went critical before the control rods reached the lower ECP tolerance limit.⁸ Because the reactor had just completed refueling, xenon transients were not a contributor. In this case, personnel incorrectly assumed that control rod burnup would not contribute to the calculation of the ECP for the current cycle because the effects of control rod burnup were negligible for the previous cycle. Personnel also failed to factor in to the calculation the effects of replacing an auxiliary control rod. Omitting the effects for control rod burnup was the direct cause of this occurrence. The root cause was the lack of an adequate procedure to predict critical rod position.

At a third facility, personnel determined that the deviation between the actual critical configuration and the ECP exceeded the administrative limit.⁹ This deviation was of concern because only minor loading changes had been made. The accumulation of small tolerance errors made in estimating the reactivity worth of the two sub-assemblies installed during the shutdown caused the discrepancies between the ECP and the actual critical position. Two months later at this same facility, personnel again determined that the extrapolated critical position (determined from inverse count rate measurements) would deviate from the ECP by more than the administrative limit.¹⁰ The operators curtailed reactor startup and lowered all of the control rods into their least reactive position. The ECP calculation, which was not independently reviewed, contained a mathematical error.

Finally, at a fourth facility, the reactor was being brought to critical for steady-state operation by an operator-trainee under the direct supervision of a qualified operator and the supervisor-in-charge.¹¹ Normally, operators stop withdrawing the control rods at a level of 10,000 counts on the startup channel to confirm that the steady-state instrumentation is operating properly. After completing this task, operators raise the stead-state power trip level from 0.11 W to 110 kW. On this occasion, the qualified operator and the supervisor- in-charge were distracted. The operator-trainee continued to withdraw the control/shutdown rod (C/S No. 1) without stopping to check the instrumentation or to change the steady-state power trip level. The reactor scrammed at a power level of 0.11 W.

There were several contributing causes to this event. First, no tolerance limits were required or given with the ECP. The estimate of the critical position given to the operators was C/S No. 1 fully withdrawn and C/S No. 2 withdrawn 12 inches. The supervisor-in-charge and the qualified operator did not consider the possibility that the reactor could reach critical before C/S. No. 1 was fully withdrawn. The actual critical position, based on the reactor period at the time of the scram, occurred with C/S. No. 1 about 44 in. withdrawn and C/S No. 2 fully inserted. (The active core height is 48 in.) Although this was a lot of rod movement between the actual critical position and the ECP, the difference in reactivity worth between the two positions was small (about 0.35%). Another contributing cause to this event was the failure to provide any cautions on the startup data sheet that the reactor could go critical before the control rods reached the ECP. In addition, formal pre-operational training on the procedural steps for startup and the instruments to be monitored was not given to the operator-trainee. Finally, the supervisor-in-charge and the qualified reactor operator were not adequately attentive to the status of the reactor and the trainee's actions to prevent the overshoot in power.

Significance of Events

Missing an ECP in itself is generally not a significant Occurrence. The purpose of determining an ECP (and its associated tolerance limits) is to ensure that the control rods are above the rod insertion limits when the reactor reaches critical. The rod insertion limits specify how far the control rods may be inserted into the core for a given power level. Missing an ECP can be significant, however, if the ECP is missed by a large margin or if the operators are unaware that the ECP was missed and continue to raise power.

Figure 1 shows a typical total worth pattern for the accumulated rod movement (integral rod worth) and a typical worth pattern for each inch of rod travel (differential rod worth). As shown by these curves, there are regions where withdrawing the control rods slightly can have a big impact on the reactivity of the core (i.e., regions of high worth).

Missing the ECP by a large margin could indicate a misunderstanding of the core physics, an error in the model used to calculate the ECP, or an error in the actual calculation of the ECP. If operators are unaware that the ECP is missed and continue to raise power, the miss is significant because it may place a demand on a safety system, may not ensure that an adequate shutdown margin exists, may increase the added worth of an ejected control rod, or may create local core power peaking factors that are greater than those specified in the Technical Specifications or considered in the plant safety analyses. Missing an ECP could also indicate inadequate training of either the operators or the person performing the ECP calculations, missing or faulty procedures, or failure to follow procedures.

FIGURE 1 TYPICAL ROD WORTH PATTERNS FOR INTEGRAL ROD WORTH AND DIFFERENTIAL ROD WORTH is not available in this document. If you would like to obtain a copy of it, you may contact the Nuclear Safety Information Center at (301) 903-0449 or by writing to NSIC, U.S. Department of Energy, EH-15/Suite 100, CXXI/3, Washington, DC 20585.

Causes of Events at DOE and NRC-Licensed Facilities

A review of Nuclear Regulatory Commission (NRC)-licensed power reactor operating experience reveals many instances where the ECP has significantly deviated from the actual critical position.^12-22 Most of these events resulted from human performance errors (e.g., inadequate procedures, erroneous input of data, failure to properly follow procedures, inadequate training and supervision, and inadequate administrative controls). Breakdowns in human performance could indicate deficiencies in the quality assurance and quality control programs for the proper maintenance of ECP procedures and the quality of training received by plant personnel in the use of these procedures.

There appear to be three principal causes for missed ECP events at DOE and NRC-licensed facilities. First, operators have failed to adhere to the precautions in their procedures which direct them during control rod withdrawal to anticipate the possibility of achieving criticality before reaching the ECP. Second, procedures used to calculate ECPs have provided operators with inadequate guidance. Finally, procedural inadequacies in the administration of the plant's on-the-job training program contributed to several events.

An event of potential interest to operators of DOE reactor facilities occurred at Fermi 2 in early July 1986. (Fermi 2 is a commercial boiling-water reactor operated by Detroit Edision Company.) This incident illustrates what can happen when procedural and administrative breakdowns occur. The incident began when a reactor operator committed a serious error in removing control rods from the reactor core to initiate reactor startup. He moved 11 control rods fully out of the reactor core instead of moving each rod one step (about 6 in.). As a result, the reactor achieved criticality sooner than called for in the procedure. The NRC's investigation of the incident revealed a breakdown in the performance of control room personnel, in the management of control room activities, and in the evaluation of the incident by plant personnel immediately after it occurred. Three violations were associated with this event: (1) personnel failed to follow the rod movement procedure and to properly document the position of control rods during startup; (2) licensee management's did not adequately supervise the startup activities, shift turnover procedures were inadequate, and the control rod problem was not properly documents; and (3) the plant resumed reactor startup without fully evaluating the problem with control rod movement.^23,24

Site-Specific Corrective Actions

Startup procedures should include precautions to alert operators to anomalous core conditions or any prior operating history that has been known to impact the accuracy of the ECP. When an ECP is suspected of being inaccurate, inverse multiplication plots should be used to monitor the approach to criticality.

Because personnel at one DOE facility routinely review the ECP calculational model for errors or improvements when an ECP is missed, the staff was able to identify a bias in the calculation. Other DOE facilities should consider following this example by routinely evaluating their respective calculational models. A review of the models should include (1) reviewing ECP calculations (and any applicable computer cords), (2) changing core configurations or eliminating known deficiencies within the computer program or hand calculations, (3) considering the possibility that computer-generated data could be erroneous following a computer malfunction, and (4) reviewing techniques used for the interpolation of curves and data. Adequate training in the proper use of these computer programs and adequate quality control could significantly reduce the likelihood of introducing inaccuracies into the ECP calculation.

Title 10, Part 70 70.52 of the Code of Federal Regulations (CFR) requires "all persons in the United States" (with exceptions) to report all inadvertent criticalities to the NRC within 1 hour. Even though DOE facilities are exempt from following 10 CFR 70, DOE Order 5480.4, "Environmental Protection, Safety, and Health Protection Standards," references 10 CFR 70 for good practice and general information purposes.²⁵ The intent of 70.52 requires facilities to report all criticalities that occur outside the calculated ECP limits. Operators of DOE reactor facilities should review their criteria for reporting missed ECPs to determine whether the occurrences are indeed "off-normal" events, and therefore, reportable to the DOE.

Finally, as a result of these types of events, DOE's Office of Nuclear Energy (DOE-NE) has provided guidance to all of DOE-NE reactor facilities to ensure that two independent ECPs are calculated prior to startup.²⁶ All DOE reactor facilities should ensure that (1) proper procedures exist for calculating and transmitting the ECPs (and the tolerance limits) to the operators, (2) uncertainties are estimate and accounted for, and (3) the recent guidance from DOE-NE has been implemented.

In summary, ECPs are provided with a confidence interval, but criticality can occur outside this interval. Operators need to understand and be constantly aware that criticality can occur before or after the ECP limits are reached. In so doing, operators can remain attentive to plant conditions and take appropriate action if need be, thereby limiting unnecessary challenges to safety systems.

References

1. User's Manual, Occurrence Reporting and Processing System (ORPS), DOE/ID-10319, Draft, March 1991.

2. DOE UOR No. 4347, "Delay of Reactor Startup to Evaluate Physics Models for Shim Positions," March 1, 1990.

3. DOE Occurrence Report ID--EGG-ATR-1990-0013, "Missed Critical Rod Prediction," February 8, 1991.

4. DOE Occurrence Report IE--EGG-ATR-1991-0003, "Missed Shim Prediciton for Cycle 92A-2," February 8, 1991.

5. DOE Occurrence Report IE--EGG-ATR-1991-1008, "Missed Critical Rod Prediction," March 24, 1992.

6. DOE Occurrence Report IE--EGG-ATR-1992-0021, "Missed Critical Rod Prediction," August 6, 1992.

7. DOE UOR No. 5158, "Loss of Operating Time to Evaluate Missed Prediction of Shim Positions," June 1, 1990.

8. DOE Occurrence Report CH-BH-BNL-GFBR-1991-1001, "Inaccurate Prediction of Critical Rod Position for Cycle #257," February 24, 1992.

9. DOE Occurrence Report CH-AA-ANLW-EBR-1991-1006, "Failure to Meet Core Reactivity Administrative Requirements," September 11, 1991.

10. DOE Occurrence Report CH-AA-ANLW-EBR-1991-1010, "Reactor Shutdown Due to Wrong Estimated Critical Position," October 30, 1991.

11. DOE Occurrence Report CH-AA-ANLW-TREAT-1992-1003, "Scram During Startup for Steady State Operation," June 8, 1992.

12. AEOD Engineering Evaluation Report, Unexpected Criticality Due to Incorrect Calculation and Failure to Follow Procedures, AEOD/E602, January 16, 1986.

13. Report to Congress on Abnormal Occurrences, NUREG- 0090, Vol. 8, No. 1, January-March 1985.

14. "Inadvertent Criticality Events at Oskarshamn and at U.S. Nuclear Power Plants," NRC Information Notice No. 88-21, May 9, 1988.

15. "Reactor Trip Following Earlier Than Anticipated Criticality," Palo Verde Unit 1, LER 528/88-016, Rev. 3, May 25, 1990.

16. "Reactor Trip," Virgil C. Summer Nuclear Station, LER 395/85-003, March 27, 1985.

17. "Reactor Criticality With Control Rods Below Minimum Insertion Limits," McGuire Nuclear Station, Unit 2, LER 370/85-014, June 28, 1985.

18. "Reactivity Anomaly," Palisades, LER 255/80-032, September 23, 1980.

19. "Reactivity Anomaly During Reactor Startup," Oconee Unit 1, LER 269/80-23, August 25, 1980.

20. "Operator Error Leads to a Reactor Trip on Source Range High Flux," Vogtle, Unit 1, LER424/87-032, July 6, 1987.

21. "Reactor Scram During Cold Startup - High Upscale IRM," Washington Nuclear Plan, Unit 2, LER 397/85-061, Rev. 1, April 11, 1986.

22. "Voluntary Report on Re-Criticality," Grand Gulf, LER 416/91-016, February 13, 1992.

23. "Operating Experiences," Nuclear Safety, 28(1): 113 (January-March 1987).

24. Report to Congress on Abnormal Occurrences, NUREG- 0090, Vol. 8, No. 4, October-December 1985.

25. DOE Order 5480.4, Attachment 3, 2.f(2)(g)(h).

26. "Estimated Critical Position (ECP) Calculations," DOE Memorandum NE-47, GTN, October 22, 1991.