05000254/LER-2015-007
| Quad Cities Nuclear Power Station Unit 1 | |
| Event date: | 05-27-2015 |
|---|---|
| Report date: | 07-24-2015 |
| Initial Reporting | |
| ENS 51093 | 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident, 10 CFR 50.72(b)(3)(xiii), Loss of Emergency Preparedness |
| 2542015007R00 - NRC Website | |
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
EVENT IDENTIFICATION
Opening a ventilation duct hatch to facilitate a fire damper inspection without administrative controls in place, caused the Control Room Emergency Ventilation (CREV) system to be declared inoperable, and resulted in a loss of the Main Control Room Envelope boundary.
A. CONDITION PRIOR TO EVENT
Unit: 1 / 2 Event Date: May 27, 2015 Event Time: 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br /> Reactor Mode: 1 / 1 Mode Name: Power Operation / Power Operation Power Level: 100% / 100%
B. DESCRIPTION OF EVENT
On May 27, 2015, at 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br />, the Main Control Room (MCR) [NA] received an unexpected "Control Room HVAC [VI] Train 'A' Trouble" alarm [ALM]. At that time, Mechanical Maintenance was starting to perform a ventilation system fire damper [DMP] visual inspection of two fire dampers located inside the Control Room Heating Ventilation and Air Conditioning (HVAC) ductwork [DUCT]. In order to inspect one of the fire dampers, a MCR ventilation ductwork access hatch was opened which caused a noticeable change in the MCR air pressure and resulted in the Train 'A' alarm. Operations immediately sent staff to check the A HVAC train (directly across the hall from the MCR), and discovered Maintenance personnel on ladders in the hallway. Maintenance confirmed that they had opened the hatch, completed their inspection, and closed the hatch just prior to Operations arrival. The "Control Room HVAC Train 'A' Trouble" alarm was in effect for 39 seconds per the Station Events Recorder.
Since the access hatch was opened, the Control Room Emergency Ventilation (CREV) system was declared inoperable at 0952 hours0.011 days <br />0.264 hours <br />0.00157 weeks <br />3.62236e-4 months <br /> due to opening a ventilation duct hatch to facilitate 'fire damper inspection without administrative .controls. The hatch was opened, the damper was inspected, and the hatch was closed, re-establishing the boundary of the Control Room Envelope (CRE). As a result, Technical Specification 3.7.4, Condition C, was entered and subsequently exited within approximately one (1) minute.
On May 27, 2015, at 1737 hours0.0201 days <br />0.483 hours <br />0.00287 weeks <br />6.609285e-4 months <br />, ENS #51093 was made to the NRC under 10 CFR 50.72(b)(3)(v)(D) to report this event as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
An investigation of this event was performed which determined the Plant Barrier Impairment (PBI) Permit for the fire damper inspection work order was in error. The Mechanical Maintenance inspections of the fire dampers were not identified as having the potential to affect the ventilation function for the MCR. Only the fire and security functions were listed as being applicable to the PBI. The PBI ventilation reviewer failed to identify that the access hatch was part of the CRE boundary since the associated design drawing contained in the work package did not adequately define boundaries of the CRE. In addition, the Operations review failed to identify or question if the work required the hatch to be opened. Although Technical Specification (TS) Bases for Section 3.7.4 allows the CRE boundary to be opened intermittently under administrative controls, these controls were not in place prior to the work being performed, and as a result, an unplanned entry into TS 3.7.4, Condition C (90 day completion time for inoperable CRE boundary) was inadvertently entered for approximately one (1) minute.
Given the impact on the MCR envelope, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(D), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
C. CAUSE OF EVENT
The cause of the inadvertent CRE breach was the design drawing contained in the work package that was reviewed during the PBI screening did not adequately define boundaries of the CRE. A contributing cause was a weak questioning attitude and lack of technical and operational rigor during the review of the PBI did not identify the required CRE breach. In addition, the PBI Ventilation Barrier Desktop Guide did not have adequate details on the CRE boundary including its ductwork access hatches. As a result, the ventilation portion of the PBI permit was filled out incorrectly. The incorrect PBI permit allowed the workers to perform the work without prior notification to Control Room personnel. Control Room personnel could have instituted proper administrative controls prior to the work had they been notified.
D. SAFETY ANALYSIS
System Design Habitability systems are provided to ensure that control room operators are able to remain in the MCR and operate the plant safely under normal conditions and to maintain the plant in a safe condition under accident conditions. The worst-case design basis accident (DBA) for habitability considerations is postulated as a loss of coolant accident (LOCA) with main steam isolation valve leakage at Technical Specification limits.
Per Updated Final Safety Analysis Report (UFSAR) Section 6.4.2, the Control Room HVAC systems are capable of maintaining the control room atmosphere suitable for occupancy throughout the duration of a DBA. The HVAC systems are capable of both automatic and manual transfer from the normal operating mode to the isolation mode.
Transfer of the Control Room HVAC systems to the emergency (pressurization) mode of operation is not a fully automatic operation, since some Control Room HVAC system components must be manually started to operate the Control Room HVAC systems in the emergency (pressurization) mode. The manual actions required when placing the Control Room HVAC system into the pressurization mode following an accident include: (1) starting the refrigeration compressor unit; and (2) starting one air filtration unit booster fan.
Per UFSAR Section 6.4.2.1, the Control Room Emergency Zone (Control Room Envelope) is defined as the following areas: the main control room, the cable spreading room, the auxiliary electrical equipment room, which surrounds the old computer room; and the Train B HVAC equipment room. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The operability of the CRE boundary must be maintained to ensure that the in-leakage of unfiltered air into the CRE will not exceed the in-leakage assumed in the DBA analysis for the MCR occupants.
UFSAR Section 6.4.2.4 provides that potential adverse interactions between the control room ventilation zone and adjacent zones that may allow the transfer of toxic or radioactive gases into the control room are minimized by maintaining the control room at a slightly positive pressure with respect to adjacent areas during normal conditions.
During accident conditions, the control room is pressurized to at least 1/8-inch water gauge above the pressure in adjacent areas. In addition, both the intake dampers and the dampers which isolate the emergency zone area are actuated automatically by the reactor building ventilation system high radiation alarm, high drywell pressure, low reactor vessel water level, high main steam line flow, detection of toxic gas, or high radiation levels in the drywell or refueling floor.
Safety Impact The access hatch utilized by Mechanical Maintenance to inspect the fire damper is inside the CRE boundary served by the MCR emergency ventilation system. If the unfiltered in-leakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable.
Per TS Bases 3.7.4, Condition C, during the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of the DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> completion time is reasonable based on the low probability of a DBA occurring during this time period and the use of mitigating actions.
The primary purpose of the access hatch is to ensure the CRE boundary is intact. Although the CRE was momentarily inoperable per TS 3.7.4, Condition C for approximately one (1) minute, there was no DBA condition in progress requiring isolation of the CRE. Furthermore, the CRE function was restored shortly after the event when the access hatch was immediately closed, re-establishing the boundary of the CRE.
Per UFSAR Section 6.4.4.1, Radiological Protection, the control room emergency zone will be filtered with outdoor air no later than 40 minutes following a LOCA. Procedural requirements are in place for Operations for manually starting the Air Filtering Unit (AFU) associated with the Control Room HVAC system within 40 minutes of a LOCA. Operators are also trained on the procedures that require the manual start of this system.
The Control Room HVAC system was restored to operable status in approximately one (1) minute after being declared inoperable. This is consistent with ensuring the UFSAR requirement for the Control Room HVAC system could be started with 40 minutes following a LOCA.
The maintenance activity was in the hallway adjacent to the MCR where there is reasonable assurance that Operations personnel would have communicated to Mechanical Maintenance (via public address announcements and from personnel who would be traversing to/from the MCR) the need to close the access hatch in any accident scenario. The access hatch is a hinged access hatch, easily swung closed and restored by personnel. The work package already contained steps to close and restore the barrier (hatch).
The safety significance of this event was minimal since the event occurred for less than one (1) minute and procedure requirements and training are in place to ensure the manual action of starting AFU associated with the Control Room HVAC system within 40 minutes of a LOCA. As a result, the system safety function of the CRE would have been maintained throughout the event.
The engineering analysis that was performed demonstrated this event did not constitute a Safety System Functional Failure (SSFF). (Reference NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying Notes, Engineering analyses.) As such, this event will not be reported in the NRC Performance Indicator (PI) for safety system functional failures since an engineering analysis was performed which determined that the system was capable of performing its safety function during this event when the CRE was momentarily breached.
Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the CRE and does not include it in the model; hence, the CRE access hatch opening did not contribute to an increase in risk. There was no effect on Fire Risk since the access hatch is located in the hallway outside the MCR door and the hallway is not in the Fire PRA Model.
Also, a Security Officer was posted at the access hatch during the hatch opening to ensure the access hatch could be closed for the CRE boundary, security and the fire barrier functions. The fire barrier was maintained so there was additional assurance that there was no effect on Fire Risk.
In conclusion, the overall safety significance and impact on risk of this event were minimal.
E. CORRECTIVE ACTIONS
Immediate:
1. The fire damper inspection was suspended and the inspection hatch was closed.
2. An immediate extent of condition review of all open PBI packages was performed.
3. All PBIs were re-verified with regards to barrier function review prior to authorization.
Follow-up:
1. Other barrier types for PBIs will be reviewed for guidance inadequacies.
2. Performance expectations will be reinforced in Engineering and Operations.
3. Revise Control Room boundary drawings to correctly annotate the proper CRE boundary to include the MCR ventilation ductwork access hatch.
4. Update the CRE Habitability Program Procedure, and Ventilation Barrier Desktop Guide to address the CRE, including its boundaries, such as ductwork, hatches, and isolation dampers.
F. PREVIOUS OCCURRENCES
The station events database, LERs, and INPO Consolidated Event System (ICES) were reviewed for similar events at the Quad Cities Nuclear Power Station. This event was attributed to the design drawing did not adequately define boundaries of the CRE. Based on the cause of this event and the associated corrective actions, the event listed below, although similar in topic, is not considered a significant station experience that would have directly contributed to preventing this event.
- LER 254/2014-005-00, 02/13/15, Main Control Room Door Unable to Close Causes Loss of Control Room Envelope Boundary (12/15/14) - The south MCR door was unable to be fully closed due to a failure of the closer mechanism. The cause of the MCR door closer mechanism failure was a manufacturing defect of the pinion gear.
This previous event, although also involving a loss of the CRE boundary was caused by a failed door operator and not caused by a drawing error, hence is not directly applicable to the event of this current LER.
G. COMPONENT FAILURE DATA
Failed Equipment: N/A Component Manufacturer: N/A Component Model Number: N/A Component Part Number: N/A This event was not required to be reported to ICES as a Failure Report.