05000254/LER-2014-005
| Quad Cities Nuclear Power Station Unit 1 | |
| Event date: | 12-15-2014 |
|---|---|
| Report date: | 02-13-2015 |
| Initial Reporting | |
| ENS 50678 | 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident, 10 CFR 50.72(b)(3)(xiii), Loss of Emergency Preparedness |
| 2542014005R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
EVENT IDENTIFICATION
A loss of the Control Room Envelope boundary occurred when the Main Control Room Door was unable to be closed due to a failure of its closure mechanism.
A. CONDITION PRIOR TO EVENT
Unit: 1 / 2 Event Date: December 15, 2014 Event Time: 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br /> Reactor Mode: 1 / 1 Mode Name: Power Operation / Power Operation Power Level: 100% / 100%
B. DESCRIPTION OF EVENT
On December 15, 2014 at 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br />, the south Main Control Room (MCR) [NA] door [DR] was unable to be fully closed due to a failure of the closer mechanism. Technical Specification (TS) 3.7.4, Condition C, was entered due to the inoperable Control Room Envelope (CRE). Procedure QCOA 5750-17, "Breach in the Control Room Envelope Boundary," was entered. A security guard was stationed to provide controlled access to the MCR. Although the south MCR door is a fire barrier, no fire watch was needed because the control room is continuously occupied. The arm linkage on the door closer was disconnected, allowing the door to be closed.
On December 15, 2014 at 0910 hours0.0105 days <br />0.253 hours <br />0.0015 weeks <br />3.46255e-4 months <br />, TS 3.7.4, Condition C, was exited after procedure QCOS 5750-15, "Containment and Control Room Ventilation Boundary Smoke Test," was completed satisfactorily.
On December 15, 2014, at 1258 hours0.0146 days <br />0.349 hours <br />0.00208 weeks <br />4.78669e-4 months <br />, ENS #50678 was made to the NRC under 10 CFR 50.72(b)(3)(v)(D), to report this event as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
On December 15, 2014, at 1930 hours0.0223 days <br />0.536 hours <br />0.00319 weeks <br />7.34365e-4 months <br />, the MCR door closer mechanism was replaced.
The subsequent investigation concluded that the Apparent Cause of the MCR door closer mechanism failure was a manufacturing defect of the pinion gear [GR].
Given the impact on the main control room envelope, this report is submitted (for Units 1 and 2) in accordance with the requirements of 10 CFR 50.73 (a)(2)(v)(D), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
C. CAUSE OF EVENT
An inspection of the damaged closer mechanism revealed that three gear teeth in the rack and pinion housing had broken free from the pinion gear. The pinion gear is a single forged metal component. The teeth in the piston rack showed damage consistent with that which would occur if metal debris were lodged within meshed gears. It can be reasonably concluded that one or more of the broken pinion gear teeth were captured between the sliding rack and rotating pinion gear resulting in the binding failure that prevented the door from closing.
Vendor data indicated that the closer mechanism is maintenance-free for the life of the component and it is rated for 10 million duty cycles. Under normal use, the closer device is designed to last the life of the plant without preventive maintenance. As such, prior to the event the door closer mechanism had no Preventive Maintenance (PM) tasks.
Leaking hydraulic fluid from damaged bleed-off valve stems is the common failure mode for the closer mechanism, and up until this failure, was the only failure mode experienced at the station. The type of failure experienced under this LER is not recognized as a normal mode of failure. Therefore, based on industry and operational experience, it was concluded that the Apparent Cause of the MCR door failure was a manufacturing defect of the pinion gear.
D. SAFETY ANALYSIS
System Design Habitability systems are provided to ensure that control room operators are able to remain in the MCR and operate the plant safely under normal conditions and to maintain the plant in a safe condition under accident conditions. The worst-case design basis accident (DBA) for habitability considerations is postulated as a loss-of-coolant accident (LOCA) with main steam isolation valve leakage at TS limits. The control room is included in the CRE boundary. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The operability of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the DBA analysis for the MCR occupants.
Updated Final Safety Analysis Report (UFSAR) Section 6.4.2.4 provides that potential adverse interactions between the control room ventilation zone and adjacent zones that may allow the transfer of toxic or radioactive gases into the control room are minimized by maintaining the control room at a slightly positive pressure with respect to adjacent areas during normal conditions. During accident conditions, the control room is pressurized to at least 1/8-inch w.g.
above the pressure in adjacent areas. In addition, both the intake dampers and the dampers which isolate the emergency zone area are actuated automatically by the reactor building ventilation system high radiation alarm, high drywell pressure, low reactor vessel water level, high main steam line flow, detection of toxic gas, or high radiation levels in the drywell or refueling floor.
Safety Impact The south MCR door (0-0075-89) is a security door, an Essential Fire Protection (EFP) fire door, and is part of the CRE boundary served by the MCR emergency ventilation system. If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable.
Per TS Bases 3.7.4, Action C, during the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions.
The primary purpose of the MCR door is to ensure the CRE boundary is intact. Although the CRE was momentarily inoperable per TS 3.7.4, Condition C, when the MCR door was unable to be fully closed due to a malfunctioning closer mechanism, there was no DBA condition in progress requiring isolation of the control room envelope.
Furthermore, the CRE function was restored shortly after the event when the closer linkage was disconnected, the door was confirmed closed, and successfully smoke tested.
Risk Insights The plant Probabilistic Risk Assessment (PRA) model gives no credit to the CRE and does not include it in the model, hence the as-found MCR door conditions did not contribute to an increase in risk. A security guard was posted at the door during the inoperable time period to ensure the door was maintained closed for the CRE boundary, security and the fire barrier functions. Because the fire barrier was maintained there was no effect on Fire Risk either.
In conclusion, the overall safety significance and impact on risk of this event were minimal.
E. CORRECTIVE ACTIONS
Immediate:
1. Posted a security guard to control MCR access, disconnected the MCR door arm linkage to allow full closure of the door, and successfully smoke tested the door boundary.
Follow-up:
1. Replaced the door closer mechanism.
2. Establish a PM task to replace the closer mechanism.
F. PREVIOUS OCCURRENCES
The station events database, LERs, and INPO Consolidated Event System ICES were reviewed for similar events at Quad Cities Nuclear Power Station. This event was a failure of a door closer mechanism which caused the MCR door to remain in the partially open position which resulted in a loss of the CRE boundary. Based on the conditions of this event, causes, and associated corrective actions, the events listed below, although similar in topic, are not considered significant station experiences that would have directly contributed to preventing this event.
- Station Issue Report (IR) 1159478, South Control Room Door Issue (01/06/11) - Due to historical door latching issues, the latch assembly, fingers, and hydraulic closer were recommended to be replaced. Corrective actions included replacing the closer mechanism. This issue did not affect the sealing capability of the door. The door was degraded but remained functional and operable. This previous issue, although similar to this current LER event, did not identify a failed MCR door closer mechanism that resulted in a loss of the CRE boundary as the cause of the issue. Hence this past issue is not directly applicable to the event of this current LER.
- LERs - A review of LERs at Quad Cities Nuclear Power Station did not identify any events that were associated with this type of event.
G. COMPONENT FAILURE DATA
Failed Equipment: Door Closer Mechanism Component Manufacturer: LCN Component Model Number: 4040 Component Part Number: N/A This event has been reported to ICES as Failure Report No. 314363.