05000254/LER-2015-006
| Quad Cities Nuclear Power Station Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Initial Reporting | |
| ENS 51021 | 10 CFR 50.72(b)(3)(v)(C), Loss of Safety Function - Release of Radioactive Material |
| 2542015006R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
EVENT IDENTIFICATION
A Unit 1/2 EDG room door and a Unit 1 RB door, as part of a secondary containment interlock (identified as the personnel interlock to the 1/2 EDG room) were opened simultaneously and caused a loss of secondary containment (inoperable) per Technical Specification (TS) 3.6.4.1, Condition A.
A. CONDITION PRIOR TO EVENT
Unit: 1 / 2 Event Date: April 28, 2015 Event Time: 0935 hours0.0108 days <br />0.26 hours <br />0.00155 weeks <br />3.557675e-4 months <br /> Reactor Mode: 1 / 1 Mode Name: Power Operation / Power Operation Power Level: 100% / 100%
B. DESCRIPTION OF EVENT
On April 28, 2015, at 0935 hours0.0108 days <br />0.26 hours <br />0.00155 weeks <br />3.557675e-4 months <br />, the control room [NA] was notified that the 1/2 EDG [EK] room manual side door [DR] (0-0020-155) and the Unit 1 RB [NG] side door (0-0020-154), as a part of the personnel interlock [IEL] to the 1/2 EDG room, were open simultaneously. The 1/2 EDG manual interlock door was closed immediately and the secondary containment boundary was immediately reestablished. An Operations Field Supervisor was dispatched to investigate the interlock issue. Operations administratively controlled the interlock. The failure of this interlock caused a temporary loss of secondary containment (inoperable) per Technical Specification (TS) 3.6.4.1, Condition A.
Operators verified the RB (secondary containment) differential pressure remained negative during this event.
At the time of this event, Equipment Operators were transitioning from the 1/2 EDG room into the personnel interlock to the 1/2 EDG room. The first Operator verified the 1/2 EDG room manual side door was closed after passing through by challenging the door and then proceeded to open the Unit 1 RB door. As the RB door opened, the differential pressure caused the 1/2 EDG room door to reopen. The second operator immediately closed the 1/2 EDG room manual side door. The door opening was approximately 2 inches wide and occurred for approximately 1 second.
After discussions with the individuals involved and a walkdown of the area, it is suspected that the mechanical latch on the 1/2 EDG room side door intermittently failed to fully latch into the strike. The logic of the door was made up through the door strike, which is attached to the frame. The latch is supposed to come into contact with the strike holding the door closed and satisfying the logic.
Secondary containment remained available and functional during the event since the secondary containment interlock was immediately restored by closing the 1/2 EDG room manual side door, and since the RB differential pressure was maintained during the event. A review of the Station Event Recorder verified the RB low differential pressure alarms [PDA] were not received during this event. The RB is a common volume to both Units 1 and 2, and an interlock failure can impact the secondary containment for both units.
Initial troubleshooting was completed on April 28, 2015, and the 1/2 EDG door latch was investigated and tested.
Without jeopardizing secondary containment the latch failure was not able to be recreated at that time.
On April 28, 2015, at 1350 hours0.0156 days <br />0.375 hours <br />0.00223 weeks <br />5.13675e-4 months <br />, ENS #51021 was made to the NRC under 10 CFR 50.72(b)(3)(v)(C), to report this event as an event or condition that could have prevented the fulfillment of a safety function.
Given the impact on the secondary containment, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(C), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material.
C. CAUSE OF EVENT
The event involved the mechanical latch on the 1/2 EDG room door that had failed to fully engage into the strike, RB door was opened while the vent fan in the 1/2 EDG room was running pulled the 1/2 EDG room door open.
Without the latch fully engaged into the strike, the 1/2 EDG room door was not able to remain closed while the RB door was opened. The 1/2 EDG room door was immediately closed and secondary containment was reestablished.
The apparent cause of the interlock failure on April 28, 2015, was determined to be the 1/2 EDG room door failed to remain closed due to inadequate design of the interlocks. Loss of power to the door strike, limit switch failure, or relay failure could allow one door to open while an opposite door is opened. A redundant locking mechanism is needed to remove this single point vulnerability.
The extent of condition applies to all interlock doors that employ door strikes to secure a door shut. No other secondary containment interlock doors use door strikes in this manner.
D. SAFETY ANALYSIS
System Design The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment System (SBGTS) [BH] and closure of certain valves [V] whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.
Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CFR 100 guideline values.
The secondary containment interlocks are designed to provide personnel access to the RB from the turbine building (TB) while maintaining a negative differential pressure in the RB. The doors are designed with relay logic so that only one door can be opened at a time. A red light near each door illuminates when one of the doors is open.
UFSAR Section 6.2.3.2.1 describes this specific airlock (personnel interlock to the 1/2 EDG room): "A personnel airlock located on the east side of the reactor building (595 foot elevation) provides access between the reactor building, the Unit 1/2 EDG building, the Unit 1/2 trackway equipment airlock, and the outside. A trackway airlock located adjacent to the personnel airlock provides access for large equipment and rail cars.
The personnel interlock to the 1/2 EDG room contains four separate doors (the personnel door to the 1/2 trackway equipment interlock, the door to the Unit 1 RB, the 1/2 EDG room manual side door, and a door to the outside). The personnel door to the 1/2 trackway equipment interlock, and the door to the Unit 1 RB contain a power open/power close operator, relays and limit switches controlling logic, and magnetic door locks. When the push-buttons are pressed, relays are energized and contacts prevent operation of either opposite door. This also de-energizes magnetic locks allowing the door to unseal from the frame. The 1/2 EDG room manual side door contains the same logic but is only controlled by a strike and internal limit switch.
Safety Impact Both Units 1 and 2 share a common RB (secondary containment). When the manual 1/2 EDG and Unit 1 RB interlock doors were opened simultaneously, this caused a momentary loss of secondary containment.
TS 3.6.4.1, Action A.1, requires restoration of secondary containment to operable status within four hours. This four hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during Modes 1, 2, and 3, since the probability of an accident occurring during this short period where secondary containment is inoperable is minimal.
The primary purpose of the secondary containment is to minimize the ground level release of airborne radioactive materials and to provide a controlled, elevated release of the building atmosphere under accident conditions. An engineering analysis was performed to demonstrate that during the short (momentary) time that both doors of the corresponding interlock were simultaneously opened, the doors were not open sufficiently long enough to cause a RB low differential pressure alarm, hence no loss of secondary containment differential pressure occurred. Secondary containment would have sufficiently contained radioactive materials during a (Loss of Coolant Accident) LOCA such that all current dose limits would remain to be met. As a result, the system safety function of secondary containment would have been maintained throughout the event. Therefore, the dose consequence from postulated releases from the RB during this short duration would remain to be bounded by the existing design basis LOCA dose analysis. The safety significance of this event was minimal.
The engineering analysis that was performed demonstrated this event did not constitute a Safety System Functional Failure (SSFF). (Reference NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying Notes, Engineering analyses.) As such, this event will not be reported in the NRC Performance Indicator (PI) for safety system functional failures since an engineering analysis was performed which determined that the system was capable of performing its safety function during this event when both doors of the secondary containment interlock were momentarily simultaneously opened.
Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the secondary containment and does not include it in the model, hence the as-found conditions did not contribute to an increase in risk. In addition, the physical integrity of the secondary containment structure was never compromised and the primary containment function was never lost.
Although secondary containment was momentarily inoperable per TS 3.6.4.1, Condition A, when the interlock doors were opened simultaneously due to a malfunctioning door, there was no DBA condition in progress, and secondary containment function was restored immediately when one of the doors was closed. RB differential pressure was maintained during the event.
In conclusion, the overall safety significance and impact on risk of this event were minimal.
E. CORRECTIVE ACTIONS
Immediate:
1. The doors were closed and administratively controlled/secured, and secondary containment was re- established.
2. Troubleshooting was completed that determined that the 1/2 EDG room manual side door failure was intermittent.
3. Administratively controlled the 1/2 EDG room manual side door by requiring shift approval to enter in accordance with a sign on the door. The sign will be removed following installation of the corrective modification.
Follow-up:
1. Obtain verification that the currently installed latch is continuing to function properly.
2. Revise the frequency of the interlock door preventive maintenance (PM) from one year to six months and continuing bi-weekly walkdowns to support system reliability requirements.
3. Replace the currently installed 1/2 EDG room manual side door.
4. Install a modification on the interlock doors (Unit 1 RB side door, 1/2 EDG room manual side door, and personnel door to the Unit 1/2 trackway equipment interlock) to address single point vulnerabilities.
F. PREVIOUS OCCURRENCES
The station events database, LERs, and INPO Consolidated Event System ICES were reviewed for similar events at Quad Cities Nuclear Power Station. This event was a failure of a secondary containment interlock door caused by mechanical latch that failed to fully engage into the strike, although did engage far enough to make up the electrical logic, which allowed two interlock doors to be opened simultaneously. Based on the conditions of this event, causes, and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly contributed to preventing this event.
- LER 254/2012-004-00, 11/05/12, Breach in Secondary Containment (09/06/12) - Two doors in the Unit 2 RFP interlock had been opened simultaneously. The HRSS-side door opened unexpectedly while the RB-side door was open due to a malfunctioning door latch. The HRSS door was immediately shut. The apparent cause was the HRSS-side door latching mechanism was not fully engaged while coupled with its crash bar that may have been bumped. Since the HRSS door has a different style of latch than the interlock doors of the current LER, this previous event is not directly applicable to this current LER.
- LER 254/2014-002-00, 06/02/14, Reactor Building Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment (04/1/14) - Both doors in the secondary containment interlock on the 595 foot elevation from the Unit 2 Reactor Feed Pump room to the Reactor Building were opened simultaneously. The cause of the interlock failure was due to a malfunctioning interlock door hydraulic actuator and time delay relays had allowed the second door to open before the first door was secured. Corrective actions included replacing the failed actuator, adjusting the limit switch, and a set point change to resolve relay time delay issues. Since the design of the interlock is different from the HPCI interlock, the previous interlock failure event is not directly applicable to the event of this current LER.
- LER 254/2014-003-00, 07/17/14, HPCI Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment (05/22/14) - Both Unit 1 HPCI Secondary Containment interlock doors were found open at the same time. The apparent cause of the interlock failure was due to a bent locking bolt resulting in misalignment of the interlock plungers on the TB-side door. The mechanical interlock device could be defeated inadvertently in this condition. Corrective actions included replacing the bent locking bolt and realigning the TB-side doors. This is the same failure mechanism as identified in this current LER. However, prior to the event of 05/22/14 there had been no failures of the HPCI interlock doors that were attributed to a bent locking bolt for the past 21 years. With the limited information that was available at the time, replacing the bent locking bolt was deemed adequate. Due to lack of past failures of this locking bolt, it was not expected at the time that the strength of the replacement bolt installed would not be sufficient and failure would occur only 9 months later, hence this previous event is not directly applicable to this current LER.
- LER 254/2015-002-00, 04/06/15, HPCI Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment (02/10/15) - Both doors in the secondary containment interlock between the RB Unit 1 HPCI room and the Unit 1 TB were opened simultaneously. The cause of the interlock failure was due to a bent locking bolt with insufficient strength to withstand the standard practice of challenging that fire doors are locked closed after passing through them. The bent locking bolt caused its door plungers to not engage allowing its door to open while the opposite door in the interlock was being opened. Corrective actions included repairing the bent locking bolt on the TB-side passive door and realigning the TB-side doors to ensure the plungers would be functional.
The locking bolt will be replaced with a higher strength assembly. Since this failure was due to a bent locking bolt with insufficient strength, this previous event is not directly applicable to this current LER.
G. COMPONENT FAILURE DATA
Failed Equipment: Electric Door Strike Component Manufacturer: Folger Adam Security Inc.
Component Model Number: 310 RP Strike Component Part Number: N/A This event has been reported to ICES as Failure Report No. 316390.