05000254/LER-2015-008

LER-2015-008, Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment

Quad Cities Nuclear Power Station Unit 1
Event date:	06-19-2015
Report date:	08-17-2015
Initial Reporting
ENS 51165	10 CFR 50.72(b)(3)(v)(C), Loss of Safety Function - Release of Radioactive Material
2542015008R00 - NRC Website

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Pnvacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

PLANT AND SYSTEM IDENTIFICATION

General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

EVENT IDENTIFICATION

A Unit 1/2 EDG room door and a Unit 1 RB door, as part of a secondary containment interlock (identified as the personnel interlock to the 1/2 EDG room) were opened simultaneously and caused a loss of secondary containment (inoperable) per Technical Specification (TS) 3.6.4.1, Condition A.

A. CONDITION PRIOR TO EVENT

Unit: 1 / 2 Reactor Mode: 1 / 1 Event Date: June 19, 2015 Event Time: 0153 hours0.00177 days <br />0.0425 hours <br />2.529762e-4 weeks <br />5.82165e-5 months <br /> Mode Name: Power Operation / Power Operation Power Level: 100% / 100%

B. DESCRIPTION OF EVENT

On June 19, 2015, at 0153 hours0.00177 days <br />0.0425 hours <br />2.529762e-4 weeks <br />5.82165e-5 months <br />, the control room [NA] was notified that the 1/2 EDG [EK] room manual side door [DR] (0-0020-155) and the Unit 1 RB [NG] side door (0-0020-154), as a part of the personnel interlock [IEL] to the 1/2 EDG room, were open simultaneously. The 1/2 EDG manual interlock door was closed immediately and the secondary containment boundary was immediately reestablished. An Operations Field Supervisor was dispatched to investigate the interlock issue. Operations administratively controlled the interlock. The failure of this interlock caused a temporary loss of secondary containment (inoperable) per Technical Specification (TS) 3.6.4.1, Condition A.

Operators verified the RB (secondary containment) differential pressure remained negative during this event.

At the time of this event, an Equipment Operator was transitioning from the 1/2 EDG room into the personnel interlock to the 1/2 EDG room. The Operator verified the 1/2 EDG room manual side door was closed after passing through by challenging the door and then proceeded to open the Unit 1 RB door. As the RB door opened, the differential pressure caused the 1/2 EDG room door to reopen. The Operator immediately closed the 1/2 EDG room manual side door. The door opening was approximately 12 inches wide before being immediately closed.

After discussions with the individuals involved and a walkdown of the area, it was suspected that the mechanical latch on the 1/2 EDG room side door intermittently failed to fully latch into the strike. The logic of the door was made up through the door strike, which is attached to the frame. The latch is supposed to come into contact with the strike holding the door closed and satisfying the logic.

Secondary containment remained available and functional during the event since the secondary containment interlock was immediately restored by closing the 1/2 EDG room manual side door, and since the RB differential pressure was maintained during the event. The RB is a common volume to both Units 1 and 2, and an interlock failure can impact the secondary containment for both units.

Initial troubleshooting was completed on June 19, 2015, and the 1/2 EDG door latch was investigated and tested.

Without jeopardizing secondary containment the latch failure was not able to be recreated at that time.

On June 19, 2015, at 0903 hours0.0105 days <br />0.251 hours <br />0.00149 weeks <br />3.435915e-4 months <br />, ENS#51165 was made to the NRC under 10 CFR 50.72(b)(3)(v)(C), to report this event as an event or condition that could have prevented the fulfillment of a safety function.

Given the impact on the secondary containment, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(C), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material.

C. CAUSE OF EVENT

The event involved the mechanical latch on the 1/2 EDG room door that had failed to fully engage into the strike, RB door was opened pulled the 1/2 EDG room door open. Without the latch fully engaged into the strike, the 1/2 EDG room door was not able to remain closed while the RB door was opened. The 1/2 EDG room door was immediately closed and secondary containment was reestablished.

The apparent cause of the interlock failure on June 19, 2015, was determined to be the 1/2 EDG room door failed to remain closed due to inadequate design of the interlocks. Loss of power to the door strike, limit switch failure, or relay failure could allow one door to open while an opposite door is opened. A redundant locking mechanism is needed to remove this single point vulnerability.

The extent of condition applies to all interlock doors that employ door strikes to secure a door shut. No other secondary containment interlock doors use door strikes in this manner.

D. SAFETY ANALYSIS

System Design The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby. Gas Treatment System (SBGTS) [BH] and closure of certain valves [V] whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.

Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CFR 100 guideline values.

The secondary containment interlocks are designed to provide personnel access to the RB from the turbine building (TB) while maintaining a negative differential pressure in the RB. The doors are designed with relay logic so that only one door can be opened at a time. A red light near each door illuminates when one of the doors is open.

UFSAR Section 6.2.3.2.1 describes this specific airlock (personnel interlock to the 1/2 EDG room): "A personnel airlock located on the east side of the reactor building (595 foot elevation) provides access between the reactor building, the Unit 1/2 EDG building, the Unit 1/2 trackway equipment airlock, and the outside. A trackway airlock located adjacent to the personnel airlock provides access for large equipment and rail cars.

The personnel interlock to the 1/2 EDG room contains four separate doors (the personnel door to the 1/2 trackway equipment interlock, the door to the Unit 1 RB, the 1/2 EDG room manual side door, and a door to the outside). The personnel door to the 1/2 trackway equipment interlock, and the door to the Unit 1 RB contain a power open/power close operator, relays and limit switches controlling logic, and magnetic door locks. When the push-buttons are pressed, relays are energized and contacts prevent operation of either opposite door. This also de-energizes magnetic locks allowing the door to unseal from the frame. The 1/2 EDG room manual side door contains the same logic but is only controlled by a strike and internal limit switch.

Safety Impact Both Units 1 and 2 share a common RB (secondary containment). When the manual 1/2 EDG and Unit 1 RB interlock doors were opened simultaneously, this caused a momentary loss of secondary containment.

TS 3.6.4.1, Action A.1, requires restoration of secondary containment to operable status within four hours. This four hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during Modes 1, 2, and 3, since the probability of an accident occurring during this short period where secondary containment is inoperable is minimal.

The primary purpose of the secondary containment is to minimize the ground level release of airborne radioactive materials and to provide a controlled, elevated release of the building atmosphere under accident conditions. An engineering analysis was performed to demonstrate that during the short (momentary) time that both doors of the corresponding interlock were simultaneously opened, the doors were not open sufficiently long enough to cause a RB low differential pressure alarm, hence no loss of secondary containment differential pressure occurred. Secondary containment would have sufficiently contained radioactive materials during a (Loss of Coolant Accident) LOCA such that all current dose limits would remain to be met. As a result, the system safety function of secondary containment would have been maintained throughout the event. Therefore, the dose consequence from postulated releases from the RB during this short duration would remain to be bounded by the existing design basis LOCA dose analysis. The safety significance of this event was minimal.

The engineering analysis that was performed demonstrated this event did not constitute a Safety System Functional Failure (SSFF). (Reference NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying Notes, Engineering analyses.) As such, this event will not be reported in the NRC Performance Indicator (PI) for safety system functional failures since an engineering analysis was performed which determined that the system was capable of performing its safety function during this event when both doors of the secondary containment interlock were momentarily simultaneously opened.

Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the secondary containment and does not include it in the model, hence the as-found conditions did not contribute to an increase in risk. In addition, the physical integrity of the secondary containment structure was never compromised and the primary containment function was never lost.

Although secondary containment was momentarily inoperable per TS 3.6.4.1, Condition A, when the interlock doors were opened simultaneously due to a malfunctioning door, there was no DBA condition in progress, and secondary containment function was restored immediately when one of the doors was closed. RB differential pressure was maintained during the event.

In conclusion, the overall safety significance and impact on risk of this event were minimal.

E. CORRECTIVE ACTIONS

Immediate:

1. The doors were closed, administratively controlled/secured, and secondary containment was re-established.

2. Troubleshooting was completed that determined that the 1/2 EDG room manual side door failure was intermittent.

3. Administratively controlled the 1/2 EDG room manual side door by requiring shift approval to enter in accordance with a sign on the door. The sign will be removed following installation of the corrective modification.

Follow-up:

1. Verified the currently installed latch is continuing to function properly.

2. Revise the frequency of the interlock door preventive maintenance (PM) from one year to six months and continuing bi-weekly walkdowns to support system reliability requirements.

3. Replace the currently installed 1/2 EDG room manual side door.

4. Install modifications on the interlock doors (Unit 1 RB side door, 1/2 EDG room manual side door, and personnel door to the Unit 1/2 trackway equipment interlock) to address single point vulnerabilities:

a. Add a time delay to energize the relay logic — complete b. Prevent limit switch failure bypassing the interlock from allowing one door to open when the opposite door is already open — in progress c. Prevent loss of DC power to the door circuit and prevent magnetic lock failure from allowing one door to open when the opposite door is already open — in progress

F. PREVIOUS OCCURRENCES

The station events database, LERs, and INPO Consolidated Event System ICES were reviewed for similar events at Quad Cities Nuclear Power Station. This event was a failure of a secondary containment interlock door caused by mechanical latch that failed to fully engage into the strike, although did engage far enough to make up the electrical logic, which allowed two interlock doors to be opened simultaneously. Based on the conditions of this event, causes, and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly contributed to preventing this event.

• LER 254/2015-006-00, 06/24/15, Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment (04/28/15) - Both the Unit 1/2 emergency diesel generator (EDG) room manual side door and the Unit 1 reactor building (RB) side door, as a part of the personnel interlock to the 1/2 EDG room, were opened simultaneously.

The event involved the mechanical latch on the 1/2 EDG room door that had failed to fully engage into the strike, although it did engage far enough to make up the electrical logic. The apparent cause of the interlock failure was determined to be the 1/2 EDG room door failed to remain closed due to inadequate design of the interlocks.

Corrective actions included increasing the preventive maintenance frequency on the interlock door, the door will be replaced, and a modification will be performed to address single point vulnerabilities. This previous event is directly applicable to this current LER; however, due to the limited amount of time between this same failure on 04/28/15 and the latest failure of 06/19/15, the final corrective actions had not yet been implemented.

G. COMPONENT FAILURE DATA

Failed Equipment: Electric Door Strike Component Manufacturer: Folger Adam Security Inc.

Component Model Number: 310 RP Strike Component Part Number: N/A This event has been reported to ICES as Failure Report No. 317243.