05000265/LER-2009-001, Failure of Common Unit EDG Auxiliaries to Transfer Power Sources
| ML091670096 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  (DPR-030) |
| Issue date: | 06/09/2009 |
| From: | Tulon T Exelon Generation Co, Exelon Nuclear |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| SVP-09-029 LER 09-001-00 | |
| Download: ML091670096 (7) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2652009001R00 - NRC Website | |
text
Exekn.
Exelon Generation Company, LLC www.exeloncorp.com Nuclear Ouad Cities Nuclear Power Station 22710 206t' Avenue North Cordova, I L 61242-9740 June 9, 2009 SVP-09-029 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555 Quad Cities Nuclear Power Station, Unit 2 Renewed Facility Operating License No. DPR-30 NRC Docket No. 50-265
Subject:
Licensee Event Report 265/09-001, "Failure of Common Unit EDG Auxiliaries to Transfer Power Sources to Support Unit 2" Enclosed is Licensee Event Report (LER) 265/09-001, "Failure of Common Unit EDG Auxiliaries to Transfer Power Sources to Support Unit 2," for Quad Cities Nuclear Power Station, Unit 2.
This report is submitted in accordance with the requirements of the Code of Federal Regulations, Title 10, Part 50.73(a)(2)(i)(B), which requires the reporting of any operation or condition which was prohibited by the plant's Technical Specifications.
There are no regulatory commitments contained in this letter.
Should you have any questions concerning this report, please contact Mr. W. J. Beck at (309) 227-2800.
Respectfully, Timothy, Tulon Site Vice President Quad Cities Nuclear Power Station cc:
Regional Administrator - NRC Region III NRC Senior Resident Inspector - Quad Cities Nuclear Power Station
NFRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 08/31/2010
'9-2007)
, the NRC may digits/characters for each block) not conduct or sponsor, and a person is not required to respond to, the infnrmatinn cnllp.ntinn.
- 3. PAGE Quad Cities Nuclear Power Station Unit 2 05000265 1 OF 6
- 4. TITLE Failure of Common Unit EDG Auxiliaries to Transfer Power Sources to Support Unit 2
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED M SEQUENTIAL I REV FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR NUMBER NO.
MONTH DAY YEAR Quad Cities Unit 1 05000254 lFACILITY NAME DOCKET NUMBER 03 25 09 2009 001 -
00 06 09 2009 N/A N/A
- 9. OPERATING MODE
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)
El 20.2201(b)
El 20.2203(a)(3)(i)
El 50.73(a)(2)(i)(C)
El 50.73(a)(2)(vii)
El 20.2201(d)
El 20.2203(a)(3)(ii)
El 50.73(a)(2)(ii)(A)
El 50.73(a)(2)(viii)(A)
[I 20.2203(a)(1)
El 20.2203(a)(4)
El 50.73(a)(2)(ii)(B)
El 50.73(a)(2)(viii)(B)
C] 20.2203(a)(2)(i)
[I 50.36(c)(1)(i)(A)
El 50.73(a)(2)(iii)
El 50.73(a)(2)(ix)(A)
- 10. POWER LEVEL El 20.2203(a)(2)(ii)
El 50.36(c)(1)(ii)(A)
El 50.73(a)(2)(iv)(A)
El 50.73(a)(2)(x)
[3 20.2203(a)(2)(iii)
[I 50.36(c)(2)
[I 50.73(a)(2)(v)(A)
El 73.71 (a)(4) 96%
El 20.2203(a)(2)(iv)
C3 50.46(a)(3)(ii)
Cl 50.73(a)(2)(v)(B)
El 73.71(a)(5)
El 20.2203(a)(2)(v)
El 50.73(a)(2)(i)(A)
El 50.73(a)(2)(v)(C)
El OTHER El 20.2203(a)(2)(vi)
U 50.73(a)(2)(i)(B)
El 50.73(a)(2)(v)(D)
Specify in Abstract below or in the Surveillance for both units." The Quad Cities test methodology of the system ensures that every month both Unit feeds are tested. At approximately half-way through the surveillance, the EDG output is taken off from Unit 1 Bus 13-1 and sequenced on to Unit 2 Bus 23-1. This sequence is done to verify that the EDG can supply loads to both Units Division I ECCS [BJ] [BN] [BM] [BO] equipment. At the point whereby the power output breaker to Bus 23-1 is closed, the normal operation of the EDG support systems is to transfer from their Unit 1 power feeds to their Unit 2 power feeds. This transfer is controlled by the Auxiliary Control Power Logic circuit [3RLY]. The Unit 1/2 EDG support systems controlled by this logic include DG Cooling Water (DGCW) pump and its associated cubicle cooler [CLR], DG Fuel Oil Transfer Pump, and DG Ventilation Fan [FAN].
Troubleshooting was initiated following the failed 1/2 EDG monthly performance test. Voltage measurements of the 1/2 EDG transfer logic circuit power identified that a fuse was blown. The transfer logic monitors which 1/2 EDG output breaker (Unit 1 or Unit 2) is closed, and then initiates the power supply transfer for the 1/2 EDG auxiliaries to the Unit with the closed output breaker. Since the fuse had been blown, there was no 125 VDC [EJ] logic power available to the transfer interlock circuit which would allow the 1/2 EDG auxiliaries to automatically transfer their power supplies when supporting a Unit 2 LOOP/LOCA with a concurrent Unit 1 degraded voltage condition.
The results of the troubleshooting also determined that there were no problems with the light bulb socket. As a result, it was determined that the act of replacing the indication light bulb on March 25, 2009 had apparently created a short within the light socket that caused the fuse to blow. This unidentified blown fuse resulted in the 1/2 EDG being Tech Spec "inoperable" from March 25, 2009 (1200) to April 11, 2009 (0234) when the fuse was subsequently replaced and power to the circuit was restored. The total inoperable time was approximately 16.5 days. This condition is prohibited by TS 3.8.1.B, since the 1/ 2 EDG was inoperable for greater than 7 days, and no additional actions were taken at that time. This blown fuse and its consequences was a condition that was not readily apparent to the individuals involved on March 25, 2009, and the failure to identify this condition was the main contributor to this event.
With the malfunctioning 1/2 EDG transfer logic condition known on April 10, 2009, it was further determined that on March 31, 2009, from 0104 hours0.0012 days <br />0.0289 hours <br />1.719577e-4 weeks <br />3.9572e-5 months <br /> to 0144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br />, and again from 0836 hours0.00968 days <br />0.232 hours <br />0.00138 weeks <br />3.18098e-4 months <br /> to 1218 hours0.0141 days <br />0.338 hours <br />0.00201 weeks <br />4.63449e-4 months <br />, the Unit 2 EDG was rendered inoperable to perform surveillances per, Tech Spec SR 3.8.1.2 and SR 3.8.1.3, for monthly start and load testing. While in this inoperable condition for the Unit 2 EDG, concurrent with the inoperable condition of the Unit 1/2 EDG, Unit 2 had no operable EDGs, therefore resulting in exceeding TS 3.8.1.E (restore an inoperable EDG within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).
C.
CAUSE OF EVENT
The cause of the circuit failure was the blown fuse which was a direct result of inserting the replacement light bulb in the light socket in the Unit 1/2 EDG Auxiliary Services Transfer Logic. The socket is not of a design whereby a resistor [EM] precludes such failures. Since the socket design may not be fault tolerant, corrective actions have been assigned to review this issue and perform plant changes if necessary.
A root cause evaluation of the event was performed to investigate the organizational performance in regard to the decision-making following the loss of indication of power to the 1/2 EDG auxiliaries on March 25, 2009. In particular the root cause was to determine how Operations challenged the conclusion that the loss of the light bulb was only an "indication" issue. The cause of this event is that key Operations shift personnel did not adequately question and challenge critical information provided by subject matter experts. This is an Operations organizational issue that resulted in an acceptance of assumptions and subject matter expert input without adequate investigation or confirmation of information used to make operability decisions. This cause resulted in an ineffective challenge and oversight of an abnormal condition (loss light indication monitoring capability of a control power circuit) by Operations
and Engineering personnel. This subsequently resulted in the past operation or condition prohibited by the plant Technical Specifications as described in this LER.
D.
SAFETY ANALYSIS
The 1/ 2 EDG auxiliaries transfer logic circuit circuitry was installed in 1992 as a modification that forces the auxiliaries to transfer to the Unit being powered by the 1/2 EDG. This feature was added as a "defense in depth" enhancement measure against a potential event whereby Unit 2 experienced a LOOP/LOCA condition, coincident with a degraded voltage condition on Unit 1. With Unit 1 in a degraded voltage condition, the 1/2 EDG auxiliaries (DG Cooling Water (DGCW) pump and its associated cubicle cooler, DG Fuel Oil Transfer, and DG Ventilation Fan) if not transferred from the degraded power from Unit 1 to a Unit 2 power supply, may not function properly. The transfer logic ensures the Unit 1/2 EDG support systems have available power at a proper voltage to operate and support the EDG emergency operation for Unit 2 Division I ECCS systems. These conditions provide assurance that the system is capable to supply power to the ECCS in various combinations of accident circumstances. This 1992 transfer logic installation was performed in response to NRC reviews surrounding degraded voltage (Electrical Distribution System Functional Inspections - EDSFI). The 1992 1/2 EDG auxiliaries transfer logic upgrade was necessary since the original design degraded voltage load-shedding scheme was Unit specific.
The disabled 1/2 EDG transfer interlock circuit between March 25, 2009 and April 11, 2009 had the following effect on Quad Cities Station:
If a Unit 2 LOOP/LOCA with degraded offsite power voltage to Unit 1 had occurred, the 1/2 EDG auxiliary loads would have been powered by a Unit 1 bus with degraded voltage for approximately five (5) minutes. This configuration does not meet Tech Spec operability requirements for the 1/2 EDG to power Unit 2 safety-related equipment.
On March 31, 2009 the Unit 2 EDG was made Tech Spec inoperable for approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the conduct of surveillance tests. This resulted in two of two required EDGs being Tech Spec inoperable to power Unit 2 safety-related equipment.
During discovery of this event (during the surveillance run on 4/10/09), the 1/2 EDG and auxiliaries were able to be satisfactorily started from the normally supplied Unit (Unit 1). The Unit 1/ 2 EDG was also successfully transferred to Unit 2 while the auxiliaries remained powered from Unit 1. At no time when the 1/2 EDG was determined Tech Spec inoperable, did the Station have an actual degraded voltage condition. In addition the Station Blackout EDGs [EK]
were available during this time period as backup power.
Furthermore, the design basis LOOP/LOCA was not impacted by this condition because the loss of all voltage transfer logic was still fully operable. The affect of this condition was limited to the unlikely scenario of a LOOP/LOCA on Unit 2 with a degraded voltage condition on Unit 1.
A risk assessment was performed that bounded this event by considering a worst case scenario which was beyond the safety analysis. This assessment conservatively assumed the 1/2 EDG would be unavailable to support a Unit 2 LOOP/LOCA for approximately 396 hours0.00458 days <br />0.11 hours <br />6.547619e-4 weeks <br />1.50678e-4 months <br /> (from March 25, 2009 to April 11, 2009), while a concurrent Unit 1 degraded voltage condition existed. The incremental change in core damage probability was determined to be 3.57E-07, which is well below the incremental change limit of 1.OE-06 (non-risk significance criterion). The incremental change in core damage probability is extremely small since Quad Cities Station would have to experience a degraded offsite power condition on Unit 1 and a simultaneous LOOP/LOCA on Unit 2.
On March 31, 2009 the Unit 2 EDG was made Tech Spec inoperable during the conduct of surveillance tests. This resulted in two of two required EDGs being Tech Spec inoperable to power Unit 2 safety-related equipment. During this time period when the 1/ 2 EDG plus the Unit 2 EDG were simultaneously inoperable (approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), the core damage probability was 3.62E-07, which is also below the incremental change limit 1.OE-06 (non-risk significance criterion). As a result, the safety significance of this event is also very low.
Based on the above, the overall safety significance of this event is minimal.
E.
CORRECTIVE ACTIONS
Immediate:
- 1. Both positive and negative FU3 fuses for the interlock circuit power were replaced.
- 2.
Replaced the interlock circuit power available lamp [IL]. The lamp illuminated indicating power was available with the replacement of the blown fuse.
Follow-up:
- 1. Develop and implement Operations procedural guidance on expectations related to a questioning attitude of abnormal plant conditions.
- 2.
Develop and implement a comprehensive plan that includes specific observation content and schedule for Operation Management to observe, coach, and correct behaviors related to a questioning attitude and the use of subject matter experts.
- 3.
Reinforce expectations for Operations and Engineering related to questioning attitude and use of subject matter experts during evaluation of abnormal plant conditions.
- 4.
Develop and implement an operating procedure for, "Control Panel Light Bulb and LED [IL] Replacement."
- 5.
Evaluate whether 1/2 EDG auxiliary equipment power supply transfer logic circuit should be revised to provide an enhanced mechanism to alert the operators of the loss of 1/2 EDG auxiliary equipment power supply transfer logic.
- 6.
Add verification of light indication to Operator rounds.
- 7.
Determine if the existing light socket circuit design should be modified to be fault tolerant to minimize the potential of blowing fuses during bulb replacement.
F.
PREVIOUS OCCURRENCES
The station event database, LERs, EPIX, and NPRDS were reviewed for similar events. Based on the event causes and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly prevented this event (for which this event was caused by an ineffective challenge of abnormal conditions (loss light indication monitoring capability of a control power circuit).
Station Event Database - On February 10, 2009, it was determined that the light sockets in the local control stations for Limitorque operators [20VJ are powered from the control circuits, but are not isolated by fuses, hence, short circuits in failed light sockets have occurred and impacted the valve control circuits. The light sockets typically fail during the change out of burned out bulbs. Due to the potential of adversely impacting safety related circuits, motor operated valve circuit breakers are being opened prior to replacing light bulbs in the local control stations. Therefore, it was recommended that LED replacement bulbs be utilized instead of the current incandescent bulbs since they have a significantly longer bulb life and would reduce the number of
times these bulbs need to be replaced. The scope of this event is limited to the equipment issues associated with this event and is not related to an ineffective challenge of abnormal conditions.
Station Event Database - On January 28, 2009, the closed local indication light bulb for Unit 1 HPCI [BJ]
steam inlet isolation MOV 1-2301-3 was found unlit. The bulb socket was loose so the bulb was not swapped with a new bulb since possibility existed for making HPCI inoperable if the socket was to short out the Local Controller. Through alternate indications in the Control Room, it was determined that this was an indication issue only, and that it did not affect the operability of the Unit 1 HPCI system which was confirmed by subsequent quarterly lST testing. As a result a work request was issued to ensure Electrical Maintenance was present when changing the bulb and that parts were available if the socket needed to be changed. The scope of this event is limited to the equipment issues associated with this event and is not related to an ineffective challenge of abnormal conditions.
Station Event Database - On April 20, 2008, while preparing to perform a work order, the 2B Reactor Building [VAI Supply Fan failed to stop running after the Control Room attempted to open the breaker. When the 2B Reactor Building Supply Fan failed to trip, Operations entered QGA 300 and Technical Specification 3.6.4.1 Condition A on loss of negative differential pressure. Troubleshooting identified that the breaker (S058) had failed to open because a wire that supplies control power to the trip coil [94RLY] had broken free from a butt splice connecting it to the trip coil. The red light is in the trip circuit for the breaker, and the lack of light indication was a symptom of the broken wire. With the broken wire to the trip coil, the breaker trip function was lost. Corrective actions included revising Station 480V and 4KV breaker racking-in procedures to add a statement that lack of red light indication during breaker closure could be symptom of an inoperable breaker trip function, and communications and training for Operations concerning the red light function. Although this event is similar to the subject of this LER since poor troubleshooting resulted in a wrong disposition for the loss of light indication, the scope of corrective actions for this event was limited to 480V and 4KV breaker closure light indication issues, and did not focus on the general topic of this LER: ineffective challenge of abnormal conditions resulting in loss of light indication monitoring capability of a control power circuit.
EPIX - None identified.
LER - No relevant Station LERs were identified.
G.
COMPONENT FAILURE DATA
EDG auxiliaries transfer logic indicating lamp socket is a General Electric, Model No: CR103C6102.
There is no required maintenance on the indicating lamp; it is classified as Run To Failure. The fact that the circuit failed was a direct result of replacing the lamp (bulb) whereby the resultant current surge caused the fuse to burn out.
The circuitry as a whole is surveillance tested monthly to ensure proper operation.PRINTED ON RECYCLED PAPERPRINTED ON RECYCLED PAPER