05000254/LER-2015-007, Regarding Loss of Main Control Room Envelope Boundary Due to Damper Inspection

Regarding Loss of Main Control Room Envelope Boundary Due to Damper Inspection

ML15222A247
Person / Time
Site:	Quad Cities
Issue date:	07/24/2015
From:	Darin S Exelon Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
SVP-15-053 LER 15-007-00
Download: ML15222A247 (6)

LER-2015-007, Regarding Loss of Main Control Room Envelope Boundary Due to Damper Inspection

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(8) 10 CFR 50.73(a)(2)(viii) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
2542015007R00 - NRC Website

text

~Exelon Generation July 24, 2015 10 CFR 50.73 SVP-15-053 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555 Quad Cities Nuclear Power Station, Units 1 and 2 Renewed Facility Operating License Nos. DPR-29 and DPR-30 NRC Docket Nos. 50-254 and 50-265

Subject:

Licensee Event Report 254/2015-007-00, "Loss of Main Control Room Envelope Boundary Due to Damper Inspection" Enclosed is Licensee Event Report (LER) 254/2015-007-00, "Loss of Main Control Room Envelope Boundary Due to Damper Inspection," for Quad Cities Nuclear Power Station, Unit 1.

This report is submitted in accordance with 10 CFR 50.73 (a)(2)(v)(D) which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

There are no regulatory commitments contained in this letter.

Should you have any questions concerning this report, please contact Mr. W. J. Beck at (309) 227-2800.

Respectfully, Scott Darin Site Vice President Quad Cities Nuclear Power Station cc:

Regional Administrator - NRC Region Ill NRC Senior Resident Inspector - Quad Cities Nuclear Power Station

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 01/31/2017 102-214)

,*'""*°*Estimated

, the NRC may not conduct or sponsor, and a person is not required to respond to. the information collection.

13. PAGE Quad Cities Nuclear Power Station Unit 1 05000254 1O 5

4. TITLE Loss of Main Control Room Envelope Boundary Due to Damper Inspection

5. EVENT.DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED YER NUMBER NO.

MONTH DAY

. YEAR Quad Cities Nuclear Power Station Unit 2 05000265 FACILIT-NAME DOCKET NUMBER P5IXJ 015 2015 -

007

- 00, jJ0 J

2 42015 N/A N/A

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply) o] 20.2201(b)

[] 20.2203(a)(3)(i) 0] 50.73(a)(2)(i)(C)

[] 50.73(a)(2)(vii) o] 20.2201(d) 0] 20.2203(a)(3)(ii) 0] 50.73(a)(2)(ii)(A) 0] 50.73(a)(2)(viii)(A) o] 20.2203(a)(1) 0] 20.2203(a)(4) 0] 50.73(a)(2)(ii)(8) 0] 50.73(a)(2)(viii)(g) o] 20.2203(a)(2)(i) 0] 50.36(c)(1)(i)(A) 0] 50.73(a)(2)(iii) 0] 50.73(a)(2)(ix)(A)

10. POWER LEVEL 0] 20.2203(a)(2)(ii)

[] 50.36(c)(1)(ii)(A) 0] 50.73(a)(2)(iv)(A) 0] 50.73(a)(2)(x) o] 20.2203(a)(2)(iii) 0] 50.36(c)(2) 0] 50.73(a)(2)(v)(A) 0] 73.71 (a)(4)

O] 20.2203(a)(2)(iv) 0] 50.46(a)(3)(ii) 0] 50.73(a)(2)(v)(B)

EJ 73.71(a)(5) 100 o] 20.2203(a)(2)(v) 0] 50.73(a)(2)(i)(A) 0] 50.73(a)(2)(v)(C) 0] OTHER o] 20.2203(a)(2)(vi) 0 50.73(a)(2)(i)(B) 0] 50.73(a)(2)(v)(D)

Specify in Abstract below or in

_____________________________________________________________________________NRC___FoNRCForm66A

12. LICENSEE CONTACT FOR THIs LERCAS YTM OPNN ACTURER TO EPIX FACTURER TOEPIX D

NA DUCT N/A N

14. SUPPLEMENTAL REPORT EXPECTED

15. EXPECTED MOTHI AY YEAR SI

~

SUBMISSION El YES (If yes, complete 15. EXPECTED SUBMISSION DATE)

[

NO DATE N/A N/A N/A ABSTRACT On May 27, 2015, at 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br />, the Main Control Room (MCR) received an unexpected "Control Room HVAC Train 'A' Trouble" alarm. A fire damper inspection was being performed that opened a Control Room HVAC ductwork access hatch that caused the alarm. The hatch was opened and immediately shut, re-establishing the boundary of the Control Room Envelope (CRE). The Control Room Emergency Ventilation (CREV) system was declared inoperable due to opening the ventilation duct hatch without prior administrative controls in place. As a result, Technical Specification 3.7.4, Condition C, was entered and subsequently exited within approximately one minute.

The cause of the inadvertent CRE breach was the design drawing contained in the work package that was reviewed during the Plant Barrier Impairment (PBI) screening did not adequately define the boundaries of the CRE.

Corrective actions included reviewing all open PBI packages. Associated Control Room boundary drawings and procedures will be revised to correctly annotate the proper CRE boundary to include the MCR ventilation ductwork access hatch.

The safety significance of this event was minimal. Given the impact on the MCR envelope, this report is submitted (for Units 1 and

2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(D), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

NRC FORM 366 (02-2014)

PLANT AND SYSTEM IDENTIFICATION

General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EllS) codes are identified in the text as [XX].

EVENT IDENTIFICATION Opening a ventilation duct hatch to facilitate a fire damper inspection without administrative controls in place, caused the Control Room Emergency Ventilation (CREV) system to be declared inoperable, and resulted in a loss of the Main Control Room Envelope boundary.

A.

CONDITION PRIOR TO EVENT

Unit: 1 / 2 Event Date: May 27, 2015 Event Time: 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br /> Reactor Mode: 1 / 1 Mode Name: Power Operation / Power Operation Power Level: 100%/i 100%

B.

DESCRIPTION OF EVENT

On May 27, 2015, at 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br />, the Main Control Room (MCR) [NA] received an unexpected "Control Room HVAC [VI] Train 'A' Trouble" alarm [ALM]. At that time, Mechanical Maintenance was starting to perform a ventilation system fire damper [DMP] visual inspection of two fire dampers located inside the Control Room Heating Ventilation and Air Conditioning (HVAC) ductwork [DUCT].

In order to inspect one of the fire dampers, a MCR ventilation ductwork access hatch was opened which caused a noticeable change in the MCR air pressure and resulted in the Train 'A' alarm. Operations immediately sent staff to check the A HVAC train (directly across the hall from the MCR), and discovered Maintenance personnel on ladders in the hallway.

Maintenance confirmed that they had opened the hatch, completed their inspection, and closed the hatch just prior to Operations arrival. The "Control Room HVAC Train 'A' Trouble" alarm was in effect for 39 seconds per the Station Events Recorder.

Since the access hatch was opened, the Control Room Emergency Ventilation (CREV) system was declared inoperable at 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br /> due to opening a ventilation duct hatch to facilitate fire damper inspection without administrative controls. The hatch was opened, the damper was inspected, and the hatch was closed, re-establishing the boundary of the Control Room Envelope (CRE). As a result, Technical Specification 3.7.4, Condition C, was entered and subsequently exited within approximately one (1) minute.

On May 27, 2015, at 1737 hours0.0201 days <br />0.483 hours <br />0.00287 weeks <br />6.609285e-4 months <br />, ENS#51093 was made to the NRC under 10 CFR 50.72(b)(3)(v)(D) to report this event as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

An investigation of this event was performed which determined the Plant Barrier Impairment (PBI) Permit for the fire damper inspection work order was in error. The Mechanical Maintenance inspections of the fire dampers were not identified as having the potential to affect the ventilation function for the MCR. Only the fire and security functions were listed as being applicable to the PBI. The PBI ventilation reviewer failed to identify that the access hatch was part of the CRE boundary since the associated design drawing contained in the work package did not adequately define boundaries of the CRE. In addition, the Operations review failed to identify or question if the work required the hatch to be opened. Although Technical Specification (TS) Bases for Section 3.7.4 allows the CRE boundary to be opened intermittently under administrative controls, these controls were not in place prior to the work being

performed, and as a result, an unplanned entry into TS 3.7.4, Condition C (90 day completion time for inoperable CRE boundary) was inadvertently entered for approximately one (1) minute.

Given the impact on the MCR envelope, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(D), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

C.

CAUSE OF EVENT

The cause of the inadvertent CRE breach was the design drawing contained in the work package that was reviewed during the PBI screening did not adequately define boundaries of the CRE. A contributing cause was a weak questioning attitude and lack of technical and operational rigor during the review of the PBI did not identify the required CRE breach. In addition, the PBI Ventilation Barrier Desktop Guide did not have adequate details on the CRE boundary including its ductwork access hatches. As a result, the ventilation portion of the PBI permit was filled out incorrectly. The incorrect PBI permit allowed the workers to perform the work without prior notification to Control Room personnel. Control Room personnel could have instituted proper administrative controls prior to the work had they been notified.

D.

SAFETY ANALYSIS

System Design

Habitability systems are provided to ensure that control room operators are able to remain in the MCR and operate the plant safely under normal conditions and to maintain the plant in a safe condition under accident conditions. The worst-case design basis accident (DBA) for habitability considerations is postulated as a loss of coolant accident (LOCA) with main steam isolation valve leakage at Technical Specification limits.

Per Updated Final Safety Analysis Report (UFSAR) Section 6.4.2, the Control Room HVAC systems are capable of maintaining the control room atmosphere suitable for occupancy throughout the duration of a DBA. The HVAC systems are capable of both automatic and manual transfer from the normal operating mode to the isolation mode.

Transfer of the Control Room HVAC systems to the emergency (pressurization) mode of operation is not a fully automatic operation, since some Control Room HVAC system components must be manually started to operate the Control Room HVAC systems in the emergency (pressurization) mode. The manual actions required when placing the Control Room HVAC system into the pressurization mode following an accident include: (1) starting the refrigeration compressor unit; and (2) starting one air filtration unit booster fan.

Per UFSAR Section 6.4.2.1, the Control Room Emergency Zone (Control Room Envelope) is defined as the following areas: the main control room, the cable spreading room, the auxiliary electrical equipment room, which surrounds the old computer room; and the Train B HVAC equipment room. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The operability of the CRE boundary must be maintained to ensure that the in-leakage of unfiltered air into the CRE will not exceed the in-leakage assumed in the DRA analysis for the MCR occupants.

UFSAR Section 6.4.2.4 provides that potential adverse interactions between the control room ventilation zone and adjacent zones that may allow the transfer of toxic or radioactive gases into the control room are minimized by maintaining the control room at a slightly positive pressure with respect to adjacent areas during normal conditions.

During accident conditions, the control room is pressurized to at least 1/8-inch water gauge above the pressure in adjacent areas. In addition, both the intake dampers and the dampers which isolate the emergency zone area are

actuated automatically by the reactor building ventilation system high radiation alarm, high drywell pressure, low reactor vessel water level, high main steam line flow, detection of toxic gas, or high radiation levels in the drywell or refueling floor.

Safety Impact The access hatch utilized by Mechanical Maintenance to inspect the fire damper is inside the CRE boundary served by the MCR emergency ventilation system. If the unfiltered in-leakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 remn TEDE), or inadequate protection of GRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable.

Per TS Bases 3.7.4, Condition C, during the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of the DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional.

The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> completion time is reasonable based on the low probability of a DBA occurring during this time period and the use of mitigating actions.

The primary purpose of the access hatch is to ensure the CRE boundary is intact.

Although the CRE was momentarily inoperable per TS 3.7.4, Condition C for approximately one (1) minute, there was no DBA condition in progress requiring isolation of the CRE. Furthermore, the CRE function was restored shortly after the event wh~en the access hatch was immediately closed, re-establishing the boundary of the CRE.

Per UFSAR Section 6.4.4.1, Radiological Protection, the control room emergency zone will be filtered with outdoor air no later than 40 minutes following a LOCA. Procedural requirements are in place for Operations for manually starting the Air Filtering Unit (AFU) associated with the Control Room HVAC system within 40 minutes of a LOCA. Operators are also trained on the procedures that require the manual start of this system.

The Control Room HVAC system was restored to operable status in approximately one (1) minute after being declared inoperable. This is consistent with ensuring the UFSAR requirement for the Control Room HVAC system could be started with 40 minutes following a LOCA.

The maintenance activity was in the hallway adjacent to the MCR where there is reasonable assurance that Operations personnel would have communicated to Mechanical Maintenance (via public address announcements and from personnel who would be traversing to/from the MCR) the need to close the access hatch in any accident scenario. The access hatch is a hinged access hatch, easily swung closed and restored by personnel. The work package already contained steps to close and restore the barrier (hatch).

The safety significance of this event was minimal since the event occurred for less than one (1) minute and procedure requirements and training are in place to ensure the manual action of starting AFU associated with the Control Room HVAC system within 40 minutes of a LOCA. As a result, the system safety function of the CRE would have been maintained throughout the event.

The engineering analysis that was performed demonstrated this event did not constitute a Safety System Functional Failure (SSFF). (Reference NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying Notes, Engineering analyses.) As such, this event will not be reported in the NRC Performance Indicator (PI) for safety system functional failures since

an engineering analysis was performed which determined that the system was capable of performing its safety function during this event when the CRE was momentarily breached.

Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the GRE and does not include it in the model; hence, the CRE access hatch opening did not contribute to an increase in risk. There was no effect on Fire Risk since the access hatch is located in the hallway outside the MCR door and the hallway is not in the Fire PRA Model.

Also, a Security Officer was posted at the access hatch during the hatch opening to ensure the access hatch could be closed for the CRE boundary, security and the fire barrier functions. The fire barrier was maintained so there was additional assurance that there was no effect on Fire Risk.

In conclusion, the overall safety significance and impact on risk of this event were minimal.

E.

CORRECTIVE ACTIONS

Immediate:

1. The fire damper inspection was suspended and the inspection hatch was closed.

2.

An immediate extent of condition review of all open PBI packages was performed.

3.

All PBIs were re-verified with regards to barrier function review prior to authorization.

Follow-up:

1. Other barrier types for PBIs will be reviewed for guidance inadequacies.

2.

Performance expectations will be reinforced in Engineering and Operations.

3.

Revise Control Room boundary drawings to correctly annotate the proper CRE boundary to include the MCR ventilation ductwork access hatch.

4.

Update the CRE Habitability Program Procedure, and Ventilation Barrier Desktop Guide to address the CRE, including its boundaries, such as ductwork, hatches, and isolation dampers.

F.

PREVIOUS OCCURRENCES

The station events database, LE~s, and INPO Consolidated Event System (ICES) were reviewed for similar events at the Quad Cities Nuclear Power Station. This event was attributed to the design drawing did not adequately define boundaries of the CRE. Based on the cause of this event and the associated corrective actions, the event listed below, although similar in topic, is not considered a significant station experience that would have directly contributed to preventing this event.

• LER 254/2014-005-00, 02/13/15, Main Control Room Door Unable to Close Causes Loss of Control Room Envelope Boundary (12/1 5/1 4) - The south MCR door was unable to be fully closed due to a failure of the closer mechanism. The cause of the MCR door closer mechanism failure was a manufacturing defect of the pinion gear.

This previous event, although also involving a loss of the CRE boundary was caused by a failed door operator and not caused by a drawing error, hence is not directly applicable to the event of this current LER.

G.

COMPONENT FAILURE DATA

Failed Equipment: N/A Component Manufacturer: N/A Component Model Number: N/A Component Part Number: N/A This event was not required to be reported to ICES as a Failure Report.