05000265/LER-2009-001
| Docket Number Sequential Revmonth Day Year Year Month Day Year Quad Cities Unit 1 05000254Number No. | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2652009001R00 - NRC Website | |
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
EVENT IDENTIFICATION
Failure of Common Unit EDG Auxiliaries to Transfer Power Sources to Support Unit 2 Results in Condition Prohibited by Technical Specifications
A. CONDITION PRIOR TO EVENT
� �Unit: 2 Event Date: March 25, 2009 Event Time: 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br /> �Reactor Mode: 1 Mode Name: Power Operation Power Level: 96% � �Unit: 2 Discovery Date: April 10, 2009 Discovery Time: 1604 hours0.0186 days <br />0.446 hours <br />0.00265 weeks <br />6.10322e-4 months <br /> �Reactor Mode: 1 Mode Name: Power Operation Power Level: 96%
B. DESCRIPTION OF EVENT
On March 25, 2009, a walk down was performed on the 1/2 EDG by the System Engineer. During this walk down the System Engineer noted that the blue, "Transfer Power Available," light [IL] in the 1/2 EDG room was not illuminated.
The System Engineer notified the main control room and the Unit Supervisor (US) directed an Equipment Operator (EO) to immediately respond. When the replacement bulb [IL] was screwed-in, the bulb "flashed" and then immediately burned-out (1200 hrs). Initial troubleshooting by the System Engineer and the EO identified that the cause of the failure was the bulb socket [LF]. Shift supervision was notified and a work order was initiated to replace the bulb socket. Further actions were not taken at that time because it was believed the circuit was "indication only and no control functions were impacted. Unknown to the EO, System Engineer, US, and the Shift Manager, a fuse had also blown when the light bulb "flashed" causing the associated 1/2 EDG transfer interlock [IEL] circuit to be disabled keeping the Unit 1/2 EDG auxiliaries preferentially aligned to Unit 1. The purpose of this interlock is to power feeds in the event of a Unit 2 LOOP/LOCA, concurrent with degraded offsite power voltage to Unit 1.
On April 10, 2009, at 1604 hours0.0186 days <br />0.446 hours <br />0.00265 weeks <br />6.10322e-4 months <br />, Operations surveillance, "Unit 1/2 Emergency Diesel Generator Load Test," was being performed per the station surveillance schedule. When the Unit 1/2 EDG Output Breaker [BKR] to Unit 2 Bus [BU] 23-1 was closed, Operations personnel in the main control room noted that the Diesel Generator Cooling Water (DGCW) [LB] pump [P] run indication [El] did not transfer from the Unit 1 feed to the Unit 2 feed as expected, but rather remained aligned to Unit 1. All of the 1/2 EDG auxiliaries remained running and aligned to Unit 1 rather than transferring to Unit 2 as designed. The EDG was shut down for troubleshooting and the system was declared inoperable.
The "Unit 1/2 Emergency Diesel Generator Load Test," surveillance is performed in accordance with the requirements of Tech Specs SR 3.8.1.2 and SR 3.8.1.3. Both of these specifications contain a note relative to the testing of the Unit 1/2 (common) EDG. The notes states, "A single test of the common DG at the specified Frequency will satisfy �NRC FORM 366A (9-2007) PRINTED ON RECYCLED PAPER the Surveillance for both units." The Quad Cities test methodology of the system ensures that every month both Unit feeds are tested. At approximately half-way through the surveillance, the EDG output is taken off from Unit 1 Bus 13 1 and sequenced on to Unit 2 Bus 23-1. This sequence is done to verify that the EDG can supply loads to both Units Division I ECCS [BJ] [BN] [BM] [BO] equipment. At the point whereby the power output breaker to Bus 23-1 is closed, the normal operation of the EDG support systems is to transfer from their Unit 1 power feeds to their Unit 2 power feeds. This transfer is controlled by the Auxiliary Control Power Logic circuit [3RLY]. The Unit 1/2 EDG support systems controlled by this logic include DG Cooling Water (DGCW) pump and its associated cubicle cooler [CLR], DG Fuel Oil Transfer Pump, and DG Ventilation Fan [FAN].
Troubleshooting was initiated following the failed 1/2 EDG monthly performance test. Voltage measurements of the 1/2 EDG transfer logic circuit power identified that a fuse was blown. The transfer logic monitors which 1/2 EDG output breaker (Unit 1 or Unit 2) is closed, and then initiates the power supply transfer for the 1/2 EDG auxiliaries to the Unit with the closed output breaker. Since the fuse had been blown, there was no 125 VDC [EJ] logic power available to the transfer interlock circuit which would allow the 1/2 EDG auxiliaries to automatically transfer their power supplies when supporting a Unit 2 LOOP/LOCA with a concurrent Unit 1 degraded voltage condition.
The results of the troubleshooting also determined that there were no problems with the light bulb socket. As a result, it was determined that the act of replacing the indication light bulb on March 25, 2009 had apparently created a short within the light socket that caused the fuse to blow. This unidentified blown fuse resulted in the 1/2 EDG being Tech Spec "inoperable" from March 25, 2009 (1200) to April 11, 2009 (0234) when the fuse was subsequently replaced and power to the circuit was restored. The total inoperable time was approximately 16.5 days. This condition is prohibited by TS 3.8.1.B, since the 1/ 2 EDG was inoperable for greater than 7 days, and no additional actions were taken at that time. This blown fuse and its consequences was a condition that was not readily apparent to the individuals involved on March 25, 2009, and the failure to identify this condition was the main contributor to this event.
With the malfunctioning 1/ 2 EDG transfer logic condition known on April 10, 2009, it was further determined that on March 31, 2009, from 0104 hours0.0012 days <br />0.0289 hours <br />1.719577e-4 weeks <br />3.9572e-5 months <br /> to 0144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br />, and again from 0836 hours0.00968 days <br />0.232 hours <br />0.00138 weeks <br />3.18098e-4 months <br /> to 1218 hours0.0141 days <br />0.338 hours <br />0.00201 weeks <br />4.63449e-4 months <br />, the Unit 2 EDG was rendered inoperable to perform surveillances per, Tech Spec SR 3.8.1.2 and SR 3.8.1.3, for monthly start and load testing. While in this inoperable condition for the Unit 2 EDG, concurrent with the inoperable condition of the Unit 1/2 EDG, Unit 2 had no operable EDGs, therefore resulting in exceeding TS 3.8.1.E (restore an inoperable EDG within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).
C. CAUSE OF EVENT
The cause of the circuit failure was the blown fuse which was a direct result of inserting the replacement light bulb in the light socket in the Unit 1/2 EDG Auxiliary Services Transfer Logic. The socket is not of a design whereby a resistor [EM] precludes such failures. Since the socket design may not be fault tolerant, corrective actions have been assigned to review this issue and perform plant changes if necessary.
A root cause evaluation of the event was performed to investigate the organizational performance in regard to the decision-making following the loss of indication of power to the 1/2 EDG auxiliaries on March 25, 2009. In particular the root cause was to determine how Operations challenged the conclusion that the loss of the light bulb was only an "indication" issue. The cause of this event is that key Operations shift personnel did not adequately question and challenge critical information provided by subject matter experts. This is an Operations organizational issue that resulted in an acceptance of assumptions and subject matter expert input without adequate investigation or confirmation of information used to make operability decisions. This cause resulted in an ineffective challenge and oversight of an abnormal condition (loss light indication monitoring capability of a control power circuit) by Operations I _ II _ and Engineering personnel. This subsequently resulted in the past operation or condition prohibited by the plant Technical Specifications as described in this LER.
D. SAFETY ANALYSIS
The 1/ 2 EDG auxiliaries transfer logic circuit circuitry was installed in 1992 as a modification that forces the auxiliaries to transfer to the Unit being powered by the 1/2 EDG. This feature was added as a "defense in depth" enhancement measure against a potential event whereby Unit 2 experienced a LOOP/LOCA condition, coincident with a degraded voltage condition on Unit 1. With Unit 1 in a degraded voltage condition, the 1/ 2 EDG auxiliaries (DG Cooling Water (DGCW) pump and its associated cubicle cooler, DG Fuel Oil Transfer, and DG Ventilation Fan) if not transferred from the degraded power from Unit 1 to a Unit 2 power supply, may not function properly. The transfer logic ensures the Unit 1/2 EDG support systems have available power at a proper voltage to operate and support the EDG emergency operation for Unit 2 Division I ECCS systems. These conditions provide assurance that the system is capable to supply power to the ECCS in various combinations of accident circumstances. This 1992 transfer logic installation was performed in response to NRC reviews surrounding degraded voltage (Electrical Distribution System Functional Inspections — EDSFI). The 1992 1/ 2 EDG auxiliaries transfer logic upgrade was necessary since the original design degraded voltage load-shedding scheme was Unit specific.
The disabled 1/2 EDG transfer interlock circuit between March 25, 2009 and April 11, 2009 had the following effect on Quad Cities Station:
If a Unit 2 LOOP/LOCA with degraded offsite power voltage to Unit 1 had occurred, the 1/2 EDG auxiliary loads would have been powered by a Unit 1 bus with degraded voltage for approximately five (5) minutes. This configuration does not meet Tech Spec operability requirements for the 1/2 EDG to power Unit 2 safety-related equipment.
On March 31, 2009 the Unit 2 EDG was made Tech Spec inoperable for approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the conduct of surveillance tests. This resulted in two of two required EDGs being Tech Spec inoperable to power Unit 2 safety-related equipment.
During discovery of this event (during the surveillance run on 4/10/09), the 1/ 2 EDG and auxiliaries were able to be satisfactorily started from the normally supplied Unit (Unit 1). The Unit 1/ 2 EDG was also successfully transferred to Unit 2 while the auxiliaries remained powered from Unit 1. At no time when the 1/ 2 EDG was determined Tech Spec inoperable, did the Station have an actual degraded voltage condition. In addition the Station Blackout EDGs [EK] were available during this time period as backup power. Furthermore, the design basis LOOP/LOCA was not impacted by this condition because the loss of all voltage transfer logic was still fully operable. The affect of this condition was limited to the unlikely scenario of a LOOP/LOCA on Unit 2 with a degraded voltage condition on Unit 1.
A risk assessment was performed that bounded this event by considering a worst case scenario which was beyond degraded voltage condition existed. The incremental change in core damage probability was determined to be 3.57E 07, which is well below the incremental change limit of 1.0E-06 (non-risk significance criterion). The incremental change in core damage probability is extremely small since Quad Cities Station would have to experience a degraded offsite power condition on Unit 1 and a simultaneous LOOP/LOCA on Unit 2.
� On March 31, 2009 the Unit 2 EDG was made Tech Spec inoperable during the conduct of surveillance tests. This resulted in two of two required EDGs being Tech Spec inoperable to power Unit 2 safety-related equipment. During this time period when the 1/ 2 EDG plus the Unit 2 EDG were simultaneously inoperable (approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), the core damage probability was 3.62E-07, which is also below the incremental change limit 1.0E-06 (non-risk significance criterion). As a result, the safety significance of this event is also very low.
Based on the above, the overall safety significance of this event is minimal.
E. CORRECTIVE ACTIONS
Immediate:
1. Both positive and negative FU3 fuses for the interlock circuit power were replaced.
2. Replaced the interlock circuit power available lamp [IL]. The lamp illuminated indicating power was available with the replacement of the blown fuse.
Follow-up:
1. Develop and implement Operations procedural guidance on expectations related to a questioning attitude of abnormal plant conditions.
2. Develop and implement a comprehensive plan that includes specific observation content and schedule for Operation Management to observe, coach, and correct behaviors related to a questioning attitude and the use of subject matter experts.
3. Reinforce expectations for Operations and Engineering related to questioning attitude and use of subject matter experts during evaluation of abnormal plant conditions.
4. Develop and implement an operating procedure for, "Control Panel Light Bulb and LED [IL] Replacement.
5. Evaluate whether 1/2 EDG auxiliary equipment power supply transfer logic circuit should be revised to provide an enhanced mechanism to alert the operators of the loss of 1/2 EDG auxiliary equipment power supply transfer logic.
6. Add verification of light indication to Operator rounds.
7. Determine if the existing light socket circuit design should be modified to be fault tolerant to minimize the potential of blowing fuses during bulb replacement.
F. PREVIOUS OCCURRENCES
The station event database, LERs, EPIX, and NPRDS were reviewed for similar events. Based on the event causes and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly prevented this event (for which this event was caused by an ineffective challenge of abnormal conditions (loss light indication monitoring capability of a control power circuit).
- Station Event Database — On February 10, 2009, it was determined that the light sockets in the local control stations for Limitorque operators [20V1 are powered from the control circuits, but are not isolated by fuses, hence, short circuits in failed light sockets have occurred and impacted the valve control circuits. The light sockets typically fail during the change out of burned out bulbs. Due to the potential of adversely impacting safety related circuits, motor operated valve circuit breakers are being opened prior to replacing light bulbs in the local control stations. Therefore, it was recommended that LED replacement bulbs be utilized instead of the current incandescent bulbs since they have a significantly longer bulb life and would reduce the number of � times these bulbs need to be replaced. The scope of this event is limited to the equipment issues associated with this event and is not related to an ineffective challenge of abnormal conditions.
- Station Event Database — On January 28, 2009, the closed local indication light bulb for Unit 1 HPCI [BJ] steam inlet isolation MOV 1-2301-3 was found unlit. The bulb socket was loose so the bulb was not swapped with a new bulb since possibility existed for making HPCI inoperable if the socket was to short out the Local Controller. Through alternate indications in the Control Room, it was determined that this was an indication issue only, and that it did not affect the operability of the Unit 1 HPCI system which was confirmed by subsequent quarterly IST testing. As a result a work request was issued to ensure Electrical Maintenance was present when changing the bulb and that parts were available if the socket needed to be changed. The scope of this event is limited to the equipment issues associated with this event and is not related to an ineffective challenge of abnormal conditions.
- Station Event Database - On April 20, 2008, while preparing to perform a work order, the 2B Reactor Building [VA] Supply Fan failed to stop running after the Control Room attempted to open the breaker. When the 2B Reactor Building Supply Fan failed to trip, Operations entered QGA 300 and Technical Specification 3.6.4.1 Condition A on loss of negative differential pressure. Troubleshooting identified that the breaker (S058) had failed to open because a wire that supplies control power to the trip coil [94RLY] had broken free from a butt splice connecting it to the trip coil. The red light is in the trip circuit for the breaker, and the lack of light indication was a symptom of the broken wire. With the broken wire to the trip coil, the breaker trip function was lost. Corrective actions included revising Station 480V and 4KV breaker racking-in procedures to add a statement that lack of red light indication during breaker closure could be symptom of an inoperable breaker trip function, and communications and training for Operations concerning the red light function. Although this event is similar to the subject of this LER since poor troubleshooting resulted in a wrong disposition for the loss of light indication, the scope of corrective actions for this event was limited to 480V and 4KV breaker closure light indication issues, and did not focus on the general topic of this LER: ineffective challenge of abnormal conditions resulting in loss of light indication monitoring capability of a control power circuit.
- EPIX — None identified.
- LER — No relevant Station LERs were identified.
G. COMPONENT FAILURE DATA
EDG auxiliaries transfer logic indicating lamp socket is a General Electric, Model No: CR103C6102.
There is no required maintenance on the indicating lamp; it is classified as Run To Failure. The fact that the circuit failed was a direct result of replacing the lamp (bulb) whereby the resultant current surge caused the fuse to burn out.
The circuitry as a whole is surveillance tested monthly to ensure proper operation.
�NRC FORM 366A (9-2007) PRINTED ON RECYCLED PAPER