05000254/LER-2011-001

LER-2011-001, Loss of Both Divisions of Residual Heat Removal System

Quad Cities Nuclear Power Station Unit 1
Event date:	04-19-2011
Report date:	06-20-2011
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2542011001R00 - NRC Website

PLANT AND SYSTEM IDENTIFICATION

General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EllS) codes are identified in the text as [XX].

EVENT IDENTIFICATION

Loss of Both Divisions of Residual Heat Removal. System

B. DESCRIPTION OF EVENT

On April 19, 2011 at 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br />, Operators in the area of the Unit 1 EDGCWP [LB] cubicle cooler [CLR], reported a leak of approximately 3 gpm. The system was not in operation at the time the water leak was found. Technical Specification (TS) Limiting Condition of Operation (LCO) 3.7.2 and 3.8.1 were entered, and the Unit 1 EDGCWP and Unit 1 Emergency Diesel Generator (EDG) [EK] (Division II) were declared inoperable. At 1510 hours0.0175 days <br />0.419 hours <br />0.0025 weeks <br />5.74555e-4 months <br />, the 1/2 EDGCWP was lined up to the Unit 1 Emergency Core Cooling (ECCS) [BM, BO] Room Coolers.

At this time, Division I RHR [BO] was also inoperable for planned maintenance on the Division I RHR room cooler. In the event of a LOOP/LOCA scenario, both Divisions of RHR would not have been able to perform their safety functions, since Division I RHR was impacted by the ongoing room cooler maintenance, and Division II RHR would not have had an operable on-site emergency power source (Unit 1 EDG). Note that at the time of discovery, offsite power was available to Division II RHR as well as the Division I and Division II Core Spray [BM] systems.

A walkdown of the EDGCWP cubicle cooler revealed the leak was from a hole in the heat exchanger return water header. This hole measured approximately 0.2" x 0.4" in size.

At 1816 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.90988e-4 months <br />, the Division I RHR system room cooler planned maintenance was completed and Division I RHR was declared operable.

On April 21, 2011 at 0416 hours0.00481 days <br />0.116 hours <br />6.878307e-4 weeks <br />1.58288e-4 months <br />, the Unit 1 EDG and EDGCWP was declared Operable after successful post- maintenance testing was completed on the repair to the Unit 1 EDGCWP cubicle cooler return header. Technical Specification LCOs 3.7.2 and 3.8.1 were exited. With an operable on site emergency power source (Unit 1 EDG), Division II RHR was operable. With both Division I and Division II RHR operable, the safety function was restored.

This loss of both Divisions of RHR event represents a safety system functional failure (SSFF) for Unit 1 based on 10 CFR 50.73(a)(2)(v)(D), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

C. CAUSE OF EVENT

The apparent cause of the leak on the heat exchanger return water header for the Unit 1 EDWCWP cubicle cooler is excessive corrosion on the piping caused by raw water conditions. A lack of thorough preventive maintenance (PM) inspections allowed this heat exchanger [HX] to deteriorate and leak. The raw water conditions caused under-deposit corrosion. This heat exchanger return water header is a vertical run of piping, which is not usually susceptible to this type of corrosion condition. The cause of the through wall leak is due to under-deposit corrosion with stagnant water in the piping during idle conditions.

The basis for the apparent cause of the leak is the four (4) year cleaning/inspection frequency of this design of cooler has not been as rigorous as the cleaning/inspection that has been performed on other room coolers. The work instructions for this cooler cleaning/inspection should have required the use of UT measurements on normally inaccessible piping inside the cooler. UT measurements would have provided evidence of wall thinning on the heat exchanger return water header prior to the through wall leak. Neither the performance centered maintenance template for heat exchangers, nor the program for NRC Generic Letter (GL) 89-13, Safety Related Heat Exchangers, requires UT measurements on this type of piping.

Contributing to this cause is this particular cubicle cooler, manufactured by Aerofin, is not designed with an inlet or outlet area that can be fully opened to allow inspection of all of the tubes and tube sheet. The design of the cubicle cooler is sufficient for performing its design function of maintaining temperature conditions in the cubicle/vault.

However, the design does not allow for inspection for possible inner diameter (ID) pitting or wall thinning that can occur due to exposure to the harsh raw water environment.

The extent of condition of this issue indicated that there are two specific existing programs at the station that deal with raw water issues on piping and in systems. The first program is the raw water program which performs UT on select raw water piping throughout the plant to determine if there are areas that are degrading. The cubicle cooler piping is actually part of a heat exchanger and is, therefore, outside the scope of the raw water program. In addition, the raw water program is not designed to predict or prevent all leaks under all conditions.

The second program is GL 89-13, Safety Related Heat Exchangers, which specifically deals with heat exchangers in a raw water environment. GL 89-13 requires inspections, cleaning, and testing on raw water heat exchangers at the station. The current program basis provides that pinhole leaks do not affect the structural integrity of the pipe, and that small leaks are insignificant in comparison to high system flows.

As a result, neither the raw water program nor the GL 89-13 program would have identified the leaking section of the cubicle cooler heat exchanger as susceptible to a through wall leak.

EDGCWP cubicle coolers, and the Unit 1 and Unit 2 Residual Heat Removal Service Water (RHRSW) [BI] pump [P] cubicle coolers. Therefore, these coolers are also susceptible to the same type of failure mode. A change to the cleaning/inspection PMs will be performed to ensure that the supply and return header piping is being inspected. The Unit 1, Unit 2 and Unit 1/2 EDGCWP cubicle coolers are also planned for replacement. The 2C RHRSW cubicle cooler coil was replaced in 2003.

D. SAFETY ANALYSIS

Safety Impact On April 19, 2011, at 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br />, a water leak was discovered on the Unit 1 EDGCWP room cooler. As a result, the Unit 1 EDG (Division II) was declared inoperable and TS LCO 3.8.1 was entered.

At this time, Division I Residual Heat Removal (RHR) was inoperable for planned maintenance on the Division I RHR room cooler. In the event of a LOOP/LOCA scenario, RHR would not have been able to perform its safety function (i.e., Division I RHR was impacted by the ongoing room cooler maintenance and Division II RHR would not have had an operable on-site emergency power source).

However, it should be noted that at the time of discovery, offsite power was available to Division II RHR as well as the Division I and Division II Core Spray systems, and at 1816 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.90988e-4 months <br /> (about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after discovery), the Division I RHR system room cooler was restored and Division I RHR was declared operable.

Although the required RHR function was not operable for a short period of time, this did not create any actual plant or safety consequences since the Unit was not in an accident or transient condition requiring use of RHR during this period of time.

In evaluating the impact of the EDGCWP cooler leak with respect to the heat removal function, it was determined the through wall leak did not significantly affect the heat removal capacity. Since the leak was on the heat exchanger return water header and water had already passed through the cooler, it did not affect the ability of the cubicle cooler to perform its function. The cubicle cooler has a design flow rate of 12 gpm. Prior to the leak the flow rate through the cubicle cooler was 15 gpm. If the entire 15 gpm had leaked from the cooler, the EDGCWP had sufficient margin to provide the minimum required 1404 gpm of total cooling water flow. The leak did not affect the ability of the EDGCWP from performing its design function of providing cooling water flow to both the cubicle cooler and to the Unit 1 EDG.

In evaluating the impact of the EDGCWP cooler leak with respect to the potential for flooding, the 3 gpm leak from the cubicle cooler could cause a flooding concern inside the associated 1D RHRSW vault containing the Unit 1 EDGCWP and the 1D RHRSW pump. With a 3 gpm leak rate into the vault the water level would rise at a rate of 0.5714 inches per hour. Per calculation QDC-0030-M-0072 (Determination of Allowable Leakage Rates for RHRSW Vaults Flood Protection), the RHRSW pump would be available up to a water level of 20 inches, while the EDGCWP would be available up to a water level of 16 inches.

Considering ECCS equipment mission times, a water level of 20 inches of water (height of the RHRSW pump) would occur at 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> which is less than the RHRSW mission time of 30 days, and a water level of 16 inches (height of the EDGCWP) would be expected to occur at 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br />, which is less than the EDGCWP (EDG) mission time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In the absence of operator action, it is estimated that the EDGCWP would have been impacted in approximately 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br /> due to the flooding condition. The ensuing leakage rate and water level rise in the RHRSW vault would not have allowed the post-accident mission times to be met. While the RHRSW vault is equipped with a sump, the associated pump is not safety-related and is not powered by an on-site emergency power source (EDG). Therefore, no credit is given to the RHRSW vault sump under design basis accident conditions (LOOP/LOCA).

The cubicle cooler leakage rate and water level rise in the RHRSW vault would have caused the EDGCWP (Division II) and 1D RHRSW pump (Division II) to become unavailable after a sufficient amount water (28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br />) had flooded the RHRSW vault. The flooding of the EDGCWP would have caused the Unit 1 EDG (Division II) to become unavailable and in turn cause the 1D and 1A RHRSW pumps (both Division II) and the Division II RHR pumps to become unavailable due to loss of their Division II emergency power supplies.

Concurrently with the initiating event of the EDGCWP cubicle cooler leak, the Division I RHR was inoperable and unavailable due to planned maintenance on the Division I RHR room cooler. In the event of a LOOP/LOCA scenario, Division I RHR would not have been able to perform its safety function since the associated room cooler is required to ensure the Division I RHR pump remained available.

As a result, in the event of a LOOP/LOCA scenario, the Division II RHR/RHRSW would not have had an available on- site emergency power source, and since the Division I RHR was impacted by the ongoing room cooler maintenance, both Divisions of RHR were simultaneously unavailable. This event, therefore, constitutes an overall loss of safety function of RHR (which was caused by the potential for flooding in the 1D RHRSW vault).

The safety significance of this event is considered minimal since, although no credit is given for operator action, the annunciator response procedure (QOA 900-7 H-6) requires operator action to drain water from the vault, and it is reasonable to assume this action would occur prior to impacting equipment unavailability at 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br />.

Risk Insights.

When reviewing this event against the Probabilistic Risk Assessment (PRA) for the station, the PRA risk impact of the event was calculated to be very low, and risk impact was concluded as being insignificant.

In conclusion, the cubicle cooling function could still be met during this event, but the flooding concern would not allow the UFASAR/safety analysis mission times to be met, therefore the potential existed for a loss of RHR safety function.

However, overall, the risk impact of the event was determined to be insignificant.

E. CORRECTIVE ACTIONS

Immediate:

1. Repaired the through wall leak in the Unit 1 EDGCWP cubicle cooler return water header.

Follow-up:

1. Replace the Unit 1 EDGCWP cubicle cooler to address a minimum wall location found on the return water header on the cooler.

2. Replace the Unit 1/2 and Unit 2 EDGCWP cubicle coolers to address where similar through wall leak failures could occur.

3. Develop a PM for the all EDGCWP cubicle coolers to require a UT measurement to be performed on the supply and return header on a periodic basis to determine if the piping is approaching minimum wall.

4. Develop a PM for all the RHRSW cubicle coolers to require a UT measurement to be performed on the supply and return header on a periodic basis to determine if the piping is approaching minimum wall.

5. Evaluate the latent organizational weakness identified and the gap between the raw water program and the GL 89-13 Heat Exchanger program, and develop an overall approach to plant raw water piping issues.

F. PREVIOUS OCCURRENCES

The station events database, LERs, EPIX, and NPRDS were reviewed for similar events at Quad Cities. Specifically, this event was an Aerof in, Type C cooling coil return water header leak due to excessive corrosion caused by raw water conditions with stagnant water in the piping during idle conditions. There were no previous similar occurrences identified at Quad Cities Station that involved leakage or corrosion issues inside of a heat exchanger supply or return header of this type. Also, there were no previous similar occurrences identified at Quad Cities Station that involved vertical runs of pipes such as is the case with this event.

Based on the causes of this event and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly contributed to preventing this event.

• Station Events Database — IR 576993 (01/09/07) Replace 1/2 DGCWP Cubicle Cooler Pipe Flanges - During a cooling inspection, significant corrosion was discovered on the flange faces on the cooler inlet line. The flanges were replaced with the corrosion limited to the flange area and no significant corrosion was found inside the piping areas. Changes to the run times of the % DGCWP were made as a result of this condition, so that stagnant water was not present in the pipe and water was flushed out periodically. This flange corrosion is very close in proximity to the heat exchanger supply header. The apparent mode of the 01/09/07 failure is not applicable to this LER event since no significant corrosion was found inside the piping areas, nor inside any vertical runs of pipe within the Aerof in cooling coil.

G. COMPONENT FAILURE DATA

The component that failed was an Aerof in, Type C cooling coil.

This event has been reported to EPIX as Failure Report No. 1101.