05000254/LER-2014-002
| Quad Cities Nuclear Power Station Unit 1 | |
| Event date: | 04-01-2014 |
|---|---|
| Report date: | 06-02-2014 |
| Initial Reporting | |
| ENS 49984 | 10 CFR 50.72(b)(3)(v)(C), Loss of Safety Function - Release of Radioactive Material |
| 2542014002R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
EVENT IDENTIFICATION
Both doors in the secondary containment interlock between the Reactor Building and the Unit 2 Reactor Feed Pump room were opened simultaneously and caused a loss of secondary containment.
A. CONDITION PRIOR TO EVENT
Unit: 1 / 2 Event Date: April 1, 2014 Event Time: 1357 hours0.0157 days <br />0.377 hours <br />0.00224 weeks <br />5.163385e-4 months <br /> Reactor Mode: 1 / 4 Mode Name: Power Operation / Cold Shutdown Power Level: 100% / 0%
B. DESCRIPTION OF EVENT
On April 1, 2014 at 1357 hours0.0157 days <br />0.377 hours <br />0.00224 weeks <br />5.163385e-4 months <br />, an Instrument Maintenance Technician notified the Main Control Room (MCR) [NA] that both doors [DR] in the secondary containment [NG] interlock [IEL] on the 595 foot elevation between the Reactor Building (RB) [NG] and the Unit 2 Reactor Feed Pump (RFP) [SK] room (located inside the turbine building (TB)) [NM] were opened simultaneously. The failure of this interlock caused a loss of secondary containment per Technical Specification (TS) 3.6.4.1, Condition A. The doors were immediately reclosed, and the secondary containment boundary was immediately reestablished. Operators verified the RB (secondary containment) differential pressure was maintained operable at greater than 0.10 inch of vacuum water gauge.
The Operations Field Supervisor was then dispatched to the interlock to investigate the condition. It was determined that the condition that led to both doors being open simultaneously could be recreated. An Equipment Operator was then stationed at the interlock to maintain control until the interlock could be taken out of service for investigation and repair.
Secondary containment remained available and functional during the event since the secondary containment interlock was immediately restored by closing the doors and since the RB differential pressure was maintained during the event. A review of the Station Event Recorder (SER) verified that RB low differential pressure alarms were not received during this event. The RB is a common volume to both Units 1 and 2, and an interlock failure can impact the secondary containment for both units.
On April 1, 2014, at 1739 hours0.0201 days <br />0.483 hours <br />0.00288 weeks <br />6.616895e-4 months <br />, ENS #49984 was made to the NRC under 10 CFR 50.72(b)(3)(v)(C), to report this event as an event or condition that could have prevented the fulfillment of a safety function.
Upon investigation, it was determined the event occurred when an individual pressed the interlock pushbutton [JS] on the outside of the RB interlock door (2-0020-152). The RB door magnets released allowing the door to open slightly.
The hydraulic actuator did not engage as required to allow the door to continue to fully open. Shortly after the RB door was opened slightly, a second individual pressed the pushbutton on the outside of the TB interlock door (2-0030- 119). The TB door proceeded to open despite the RB door already being slightly open.
The sequence leading to the failed interlock is as follows: When the RB door pushbutton was pressed, the door interlock relay (DL-2) [2] energized resulting in the isolation of the TB door and energizing the motor operator relay (MO-2). MO-2 immediately de-energized the RB door locking magnets and sent a signal to start the door actuator to open the door. However, the actuator did not start and did not open the door further. Limit switch LS-2 did not register the RB door leaving the closed position. When the pushbutton was released, relays DL-2 and MO-2 began to time delay de-energize since there was no seal-in from LS-2. Due to the time delay settings, the TB door open circuit was reactivated before the RB door locking magnets had re-energized. Since the actuator was not functioning, neither the magnets nor the actuator were holding the RB door completely closed. Before the magnets could energize to hold the door closed, the TB door pushbutton was pressed, opening the TB door while the RB door remained slightly open.
On April 2, 2014, the RB door hydraulic actuator was replaced and the limit switch was adjusted. The interlock then functioned normally.
Given the impact on the secondary containment, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(C), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material.
C. CAUSE OF EVENT
The malfunctioning hydraulic actuator on RB door (2-0020-152) was determined to be the apparent cause of the interlock failure. The power-close function of the actuator is designed to push the door closed into the locking magnet which should be energized. Had the RB door actuator operated as designed, the door would have opened, engaging the limit switch to keep the TB door circuit deactivated. The power-close feature would then have forced the RB door closed, sealing the interlock before the TB door could be opened.
A contributing cause to the interlock failure was time delay relays had allowed the second door to open before the first door was secured. Based on the settings for the DL-2 and MO-2 time delays, the TB door circuit could be active for as long as two seconds before the RB door locking magnet is energized. This time difference is normally overcome by the hydraulic actuator which power-closes the door and holds it closed until the magnets energize. However, the failure of the hydraulic actuator uncovered the design weakness, allowing for both interlock doors to be open at the same time.
D. SAFETY ANALYSIS
System Design The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment System (SBGTS) [BH] and closure of certain valves [V] whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.
Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CFR 100 guideline values.
The secondary containment interlocks are designed to provide personnel access to the RB from the TB while maintaining a negative differential pressure in the RB. The Unit 2 RFP interlock doors are normally secured closed by energized electromagnets. The doors are operated by a pushbutton near each door that de-energize the electromagnets and start a hydraulic actuator to open the door. The doors are designed with relay logic so that only one door can be opened at a time. A red light near each door illuminates when one of the doors is open.
Safety Impact Both Units 1 and 2 share a common RB (secondary containment). When both RFP interlock doors were opened simultaneously, this caused a momentary loss of secondary containment.
TS 3.6.4.1, Action A.1, requires restoration of secondary containment to operable status within four hours. This four hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during Modes 1, 2, and 3, since the probability of an accident occurring during this short period where secondary containment is inoperable is minimal.
The primary purpose of the secondary containment is to minimize the ground level release of airborne radioactive materials and to provide a controlled, elevated release of the building atmosphere under accident conditions. An engineering analysis was performed to demonstrate that during the short (momentary) time that both doors of the corresponding interlock were simultaneously opened, the doors were not open sufficiently long enough to cause a RB low differential pressure alarm, hence no loss of secondary containment differential pressure occurred. Secondary containment would have sufficiently contained radioactive materials during a LOCA such that all current dose limits would remain to be met. As a result, the system safety function of secondary containment would have been maintained throughout the event. Therefore, the dose consequence from postulated releases from the RB during this short duration would remain to be bounded by the existing design basis LOCA dose analysis. The safety significance of this event was minimal.
The engineering analysis that was performed demonstrated this event did not constitute a Safety System Functional Failure (SSFF). (Reference NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying Notes, Engineering analyses.) As such, this event will not be reported in the NRC Performance Indicator (PI) for safety system functional failures since an engineering analysis was performed which determined that the system was capable of performing its safety function during this event when both doors of the secondary containment interlock were momentarily simultaneously opened.
Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the secondary containment and does not include it in the model, hence the as-found conditions did not contribute to an increase in risk. In addition, the physical integrity of the secondary containment structure was never compromised and the primary containment function was never lost.
Although secondary containment was momentarily inoperable per TS 3.6.4.1, Condition A, when the Unit 2 RFP interlock doors were opened simultaneously due to a malfunctioning actuator, there was no DBA condition in progress, and secondary containment function was restored immediately when one of the doors was closed. RB differential pressure was maintained during the event.
In conclusion, the overall safety significance and impact on risk of this event were minimal.
E. CORRECTIVE ACTIONS
Immediate:
1. An Equipment Operator was stationed to control egress through the failed interlock until the interlock was taken out of service for repair.
2. Replaced the failed hydraulic actuator on the RB door with a new actuator, and the limit switch was adjusted.
Follow-up:
1. Determine if a PM is needed to replace the door actuator at a regular frequency.
2. Implement a set point change to resolve the relay time delay issue.
F. PREVIOUS OCCURRENCES
The station events database, LERs, and INPO Consolidated Event System ICES were reviewed for similar events at Quad Cities Nuclear Power Station. This event was a failure of a secondary containment interlock door actuator failure which caused two interlock doors to be open simultaneously. Based on the conditions of this event, causes, and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly contributed to preventing this event.
- Station Issue Report (IR) 1345004, Reactor Building Interlock Door Opened with Other Door Open (3/23/12) - The RB and TB doors in the Unit 2 RFP interlock had been opened simultaneously. Later when the doors were inspected, the actuators, magnets, and logic were found to be functioning normally. It was suspected that the RB door actuator had overheated from excessive use the previous day resulting in the malfunction. The condition could not be replicated, so the true cause could not be identified. This previous event, although similar to this LER event where both the RB and TB doors opened simultaneously in the Unit 2 RFP interlock, did not identify a failed actuator as the cause. Hence this past interlock failure event is not directly applicable to the event of this current LER.
- LER 254/2012-004-00, 11/05/12, Breach in Secondary Containment (09/06/12) - Two doors in the Unit 2 RFP interlock had been opened simultaneously. The HRSS-side door opened unexpectedly while the RB-side door was open due to a malfunctioning door latch. The HRSS door was immediately shut. The apparent cause was the HRSS-side door latching mechanism was not fully engaged while coupled with its crash bar may have been bumped. The HRSS door has since been welded closed. Since the HRSS door has a different style of latch than the interlock doors of this current LER, and may have also been bumped, this event is not directly applicable to this current LER.
G. COMPONENT FAILURE DATA
Failed Equipment: Hydraulic Door Actuator Component Manufacturer: Keane Monroe Component Model Number: KM2500 Component Part Number: N/A This event has been reported to ICES as Failure Report No. 311049.