05000254/LER-2014-004
| Quad Cities Nuclear Power Station Unit 1 | |
| Event date: | 11-18-2014 |
|---|---|
| Report date: | 01-16-2015 |
| Initial Reporting | |
| ENS 50622 | 10 CFR 50.72(b)(3)(v)(C), Loss of Safety Function - Release of Radioactive Material |
| 2542014004R00 - NRC Website | |
Reported lessons leamed are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EllS) codes are identified in the text as [XX].
EVENT IDENTIFICATION
Both doors in the secondary containment interlock between the Unit 1 Reactor Building and the Unit 2 Turbine Building were opened simultaneously and caused a loss of secondary containment.
A. CONDITION PRIOR TO EVENT
Unit: 1 / 2 Event Date: November 18, 2014 Event Time: 0900 hours0.0104 days <br />0.25 hours <br />0.00149 weeks <br />3.4245e-4 months <br /> Reactor Mode: 1 / 1 Mode Name: Power Operation / Power Operation Power Level: 100% / 100%
B. DESCRIPTION OF EVENT
On November 18, 2014 at 0900 hours0.0104 days <br />0.25 hours <br />0.00149 weeks <br />3.4245e-4 months <br />, Chemistry personnel notified the control room [NA] that both the Unit 1 reactor building (RB) [NG] (0-0020-177) and the Unit 2 turbine building (TB) [NM] (2-0030-178) doors [DR] for the 647 foot elevation secondary containment [NG] interlock [IEL] were opened simultaneously. The Unit 2 TB door opened and closed immediately without assistance while the Unit 1 RB door was open. The failure of this interlock caused a loss of secondary containment per Technical Specification (TS) 3.6.4.1, Condition A. The Field Supervisor was dispatched to investigate the interlock issue and found that the issue was intermittent. Operators staged signage and ropes to administratively control the interlock closed until repairs were performed.
Secondary containment remained available during the event because the secondary containment interlock was immediately restored by closing the doors, and the RB differential pressure was maintained throughout the event. A review of the Station Event Recorder (SER) verified the RB low differential pressure alarms [PDA] were not received during the event. The RB is a common volume to both Units 1 and 2, and an interlock failure can impact the secondary containment for both units.
On November 18, 2014, 1229 hours0.0142 days <br />0.341 hours <br />0.00203 weeks <br />4.676345e-4 months <br />, ENS #50622 was made to the NRC under 10 CFR 50.72(b)(3)(v)(C), to report this event as an event or condition that could have prevented the fulfillment of a safety function.
At the time of this event, a Chemistry technician performing rounds planned to transverse through the 647 foot elevation interlock from Unit 1 to Unit 2. They held the button [JS] for the Unit 1 RB interlock door for several seconds, and the door did not open as expected. The technician then noted that the open indication light [IL] was lit, heard buzzing from the actuator, and that the door had unseated slightly from the door jam (indicating that the magnets had disengaged). After several seconds of holding the door button, the Chemistry technician released the button. The light went out, but the door did not reseat against the jam as expected. The Chemistry technician lightly touched the door TB door open a few inches briefly without assistance and then close. They immediately stopped work and contacted Operations to report the event.
Operations identified the magnet for the TB door was malfunctioning intermittently which allowed the TB door to open while the U1 RB door was open. After interviews with the individuals involved, it was concluded that this condition occurred due to a malfunction of the magnets for the TB door.
Subsequently, the lower magnet on the TB door was adjusted 1/4 inch to ensure good connection between the door and the frame. The interlock then functioned normally.
The investigation concluded that the apparent cause of the interlock failure was a magnet on the Unit 2 TB door that was found backed out due to inadequate design of the interlocks. If the TB door had a redundant locking mechanism, backing up a failure of the magnets, the door would not have inadvertently opened.
Given the impact on the secondary containment, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(C), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material.
C. CAUSE OF EVENT
The apparent cause of the interlock failure was the door magnets on the Unit 2 TB door did not fully engage to hold the door closed due to inadequate design of the interlocks. A magnet on the Unit 2 TB door was found to be backed out. This does not allow sufficient connection between the door and the direct current (DC) magnet to hold the door closed. An improved magnetic lock would prevent this failure.
Interlock door single point vulnerabilities were identified as, loss of 125VDC power to the door circuit, relay failure [RLY], or a magnetic lock failure, which could cause one door to open when the opposite door is open. Therefore, a redundant locking mechanism would remove the single point vulnerability.
D. SAFETY ANALYSIS
System Design The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment System (SBGTS) [BH] and closure of certain valves [V] whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.
Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CFR 100 guideline values.
The secondary containment interlocks are designed to provide personnel access to the RB from the TB while maintaining a negative differential pressure in the RB. The interlock doors are normally secured closed by energized electromagnets. The 647 foot elevation interlocks contain three separate doors. One provides personnel access to Unit 1 RB (0-0020-177), one provides personnel access to the Unit 2 RB (2-0020-176), and the last provides personnel access to the Unit 2 TB (2-0030-178). The doors are operated by a pushbutton near each door that de- energizes the electromagnets and starts a hydraulic actuator to open the door. The doors are designed with relay logic so that only one door can be opened at a time. A red light near each door illuminates when one of the doors is open.
Safety Impact Both Units 1 and 2 share a common RB (secondary containment). When both interlock doors were opened simultaneously, this caused a momentary loss of secondary containment.
TS 3.6.4.1, Action A.1, requires restoration of secondary containment to operable status within four hours. This four hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during Modes 1, 2, and 3, since the probability of an accident occurring during this short period where secondary containment is inoperable is minimal.
The primary purpose of the secondary containment is to minimize the ground level release of airborne radioactive materials and to provide a controlled, elevated release of the building atmosphere under accident conditions. An engineering analysis was performed to demonstrate that during the short (momentary) time that both doors of the corresponding interlock were simultaneously opened, the doors were not open sufficiently long enough to cause a RB low differential pressure alarm, hence no loss of secondary containment differential pressure occurred. Secondary containment would have sufficiently contained radioactive materials during a LOCA such that all current dose limits would remain to be met. As a result, the system safety function of secondary containment would have been maintained throughout the event. Therefore, the dose consequence from postulated releases from the RB during this short duration would remain to be bounded by the existing design basis LOCA dose analysis. The safety significance of this event was minimal.
The engineering analysis that was performed demonstrated this event did not constitute a Safety System Functional Failure (SSFF). (Reference NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying Notes, Engineering analyses.) As such, this event will not be reported in the NRC Performance Indicator (PI) for safety system functional failures since an engineering analysis was performed which determined that the system was capable of performing its safety function during this event when both doors of the secondary containment interlock were momentarily simultaneously opened.
Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the secondary containment and does not include it in the model, hence the as-found conditions did not contribute to an increase in risk. In addition, the physical integrity of the secondary containment structure was never compromised and the primary containment function was never lost.
Although secondary containment was momentarily inoperable per TS 3.6.4.1, Condition A, when the interlock doors were opened simultaneously due to a malfunctioning interlock, there was no DBA condition in progress, and secondary containment function was restored immediately when one of the doors was closed. RB differential pressure was maintained during the event.
In conclusion, the overall safety significance and impact on risk of this event were minimal.
E. CORRECTIVE ACTIONS
Immediate:
1. Placed interlock doors under administrative control.
Follow-up:
1. Adjusted the lower magnet on the TB door 1/4 inch to ensure good connection between the door and the frame.
2. Implement a modification to the 647 foot elevation interlock doors that addresses single point vulnerabilities (loss of 125VDC power to the door circuit, relay failure, or a magnetic lock failure).
3. Shorten the associated preventative maintenance frequency from 12 months to 6 months.
F. PREVIOUS OCCURRENCES
The station events database, LERs, and INPO Consolidated Event System (ICES) were reviewed for similar events at Quad Cities Nuclear Power Station. This event was a failure of a secondary containment interlock door magnet failure which caused two interlock doors to be open simultaneously. Based on the conditions of this event, causes, and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly contributed to preventing this event.
- LER 254/2012-004-00, 11/05/12, Breach in Secondary Containment (09/06/12) - Two doors in the Unit 2 Reactor Feed Pump (RFP) interlock had been opened simultaneously. The High Radiation Sample Station (HRSS) side door opened unexpectedly while the RB side door was open due to a malfunctioning door latch. The HRSS door was immediately shut. The apparent cause was the HRSS side door latching mechanism was not fully engaged while coupled with its crash bar may have been bumped. The HRSS door has since been welded closed. Since the HRSS door has a different style of latch than the interlock doors of this current LER, and may have also been bumped, this event is not directly applicable to this current LER.
- LER 254/2014-002-00, 06/02/14, Reactor Building Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment (04/01/14) - Both doors in the secondary containment interlock on the 595 foot elevation from the Unit 2 RFP room to the RB were open simultaneously. The doors were immediately reclosed, and secondary containment was immediately reestablished. The cause of the secondary containment loss of differential pressure event was due to a failed interlock door actuator that caused the both doors to open simultaneously. Corrective actions included replacing the failed actuator and adjusting the limit switch. This previous event, although similar to this current LER event where both the RB and TB doors opened simultaneously, did not identify a failed magnet as the cause. Hence this past interlock failure event is not directly applicable to the event of this current LER.
- LER 254/2014-003-00, 07/17/14, HPCI Interlock Doors Opened Simultaneously Cause Loss of Secondary Containment (05/22/14) - Both doors in the secondary containment interlock to the High Pressure Coolant Injection (HPCI) room from the TB were opened simultaneously. The doors were immediately reclosed, and the secondary containment boundary was reestablished. The cause of the interlock failure was due to a bent locking bolt resulting in misalignment of the interlock plungers on the TB side door. The mechanical interlock device could be defeated inadvertently in this condition. This previous event, although similar to this current LER event where both the RB and TB doors opened simultaneously, did not identify a failed magnet as the cause. Hence this past interlock failure event is not directly applicable to the event of this current LER.
G. COMPONENT FAILURE DATA
Failed Equipment: Round Magnetic Door Lock Component Manufacturer: Tee Jay Doors Component Model Number: N/A Component Part Number: TJ001000 This event has been reported to ICES as Failure Report No. 313863.