05000373/LER-2017-004

LER-2017-004, Secondary Containment Inoperable Due to Interlock Doors Open

Lasalle County Station, Unit 1
Event date:	02-16-2017
Report date:	04-17-2017
Reporting criterion:	10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
3732017004R00 - NRC Website

LER 17-004-00 for LaSalle County, Unit 1, Regarding Secondary Containment Inoperable Due to Interlock Doors Open

ML17107A089
Person / Time
Site:	LaSalle
Issue date:	04/17/2017
From:	Trafton W J Exelon Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RA17-036 LER 17-004-00
Download: ML17107A089 (5)

comments regarding burden estimate to the Information Services Branch (1--2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. LER NUMBER 2. DOCKET NUMBER - 00

PLANT AND SYSTEM IDENTIFICATION

LaSalle County Station Unit 1 and Unit 2 are each a General Electric Boiling Water Reactor with 3546 Megawatts Thermal Rated Core Power. The secondary containment is the reactor building, common to both reactor units, which contains the reactor auxiliary and serving equipment for the two reactors. The secondary containment access doors, or air-locks, provide a means for personnel and equipment to enter or exit the reactor building without breaching secondary containment integrity.

CONDITION PRIOR TO EVENT

Unit(s): 1 / 2 Reactor Mode(s): 2 / 5

DESCRIPTION OF EVENT

Event Date: February 16, 2017 Event Time: 0835 CST Mode(s) Name: Startup/Refueling Power Level: 5 percent/0 percent On February 16, 2017, Unit 1 was in Mode 2 for plant startup at 5 percent power, and Unit 2 was defueled for a planned refueling outage with movement of irradiated fuel (MIF) in progress. At 0835 CST, both air-lock doors of the Unit 1 reactor building to the chemistry corridor (doors 225 and 226) were opened simultaneously for approximately five seconds during personnel ingress. The employee immediately secured both doors in the interlock and notified the Main Control Room (MCR).

Shift Operations personnel subsequently blocked access until repairs could be made, and MIF activities were immediately suspended.

While both interlock doors were open, Technical Specifications (TS) Surveillance Requirement (SR) 3.6.4.1.2 to verify one secondary containment access door closed was not met. Secondary containment was declared inoperable for the period of time that both interlock doors were open. Reactor building differential pressure, as observed in the MCR, remained less than -0.25 inches vacuum water gauge at all times. TS 3.6.4.1 Required Action (RA) A.1 to restore secondary containmdnt to OPERABLE status within four hours was entered and exited. TS 3.6.4.1 RA C.1 to immediately suspend MIF in secondary containment was entered and exited.

CAUSE OF EVENT

The most probable cause of the interlock failure was the intermittent failure of a circuit board which is designed to prevent more than one door to be open at a time. Similar previous interlocked door circuit board failures have been identified, through formal failure analysis, to have been caused by degraded relays integral to the circuit board. This interlock had used an upgraded style of circuit board that had been installed less than a week earlier on February 10, 2017. The door was satisfactorily tested by Mechanical Maintenance, but the failure could not be reproduced. A causal investigation for an event in 2016 identified relays on the circuit cards as the specific cause of the failures. Corrective actions from the 2016 investigation had been ongoing to upgrade interlock door circuit cards with ones that had improved relays.

REPORTABILITY AND SAFETY ANALYSIS

This event is reportable in accordance with 10 CFR 50.73(a)(2)(v)(C) and 10 CFR 50.73(a)(2)(v)(D) as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material or mitigate the consequences of an accident. These doors are ground elevation personnel air-lock between the common diesel generators' corridor to the Unit 2 reactor building. The secondary containment access doors, or air-locks, provide a means for personnel and equipment to enter or exit the reactor building without breaching secondary containment integrity. This is necessary so that the negative pressure can be maintained.

The safety significance of this event was minimal, since the reactor building to outside differential pressure remained negative throughout the period that the secondary containment was inoperable. The secondary containment was inoperable for approximately five seconds, which was significantly less than the four-hour Completion Time to restore secondary containment to operable status allowed by TS 3.6.4.1 Required Action A.1.

2017 004 comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555.0001, or by e-mail to used to impose an information collection does not dsplay a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. LER NUMBER 2. DOCKET NUMBER - 00 004 The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from the primary containment following a Design Basis Accident (DBA). A technical evaluation determined that the inadvertent simultaneous opening of secondary containment doors for less than 30 seconds are bounded by the existing drawdown analysis and dose calculations and will not result in a failure of a safety system function needed to control the release of radioactive material to the environment. The time that both doors were simultaneously opened for this event was approximately five seconds, which is & 2 Secondary Containment Air-lock Doors.") This event did not result in the reactor enclosure differential pressure dropping below the design bases set point of -0.25 inches vacuum water gauge. Both the inner and outer doors were promptly closed by station personnel, which ended the event. This event did not involve any kind of door or air-lock material condition preventing door closure. Additionally, both the inner and outer doors were closed by normal expected means and were capable of remaining closed as designed.

The computed dose for EC 396711 was based on the door opening during the 780 second time period prior to Standby Gas Treatment (SBGT) system drawdown and filtration. This discounts the initial 120 seconds of an event where no release takes place, in accordance with calculation L-003068, "Re-Analysis of Loss of Coolant Accident (LOCA) Using Alternative Source Terms.

The approximate five second opening of the secondary containment doors is bounded by calculation L-003068. Should an event occur, in which both secondary containment doors were open simultaneously for 30 seconds or less, it would result in a potential dose increase of approximately 3.85 percent. The 3.85 percent decrease in margin is inconsequential in comparison to the 10 CFR 100 regulatory limits.

EC 396711 also evaluated the pressure impact on the secondary containment and the ability of the SBGT system to achieve the TS required negative pressure. The results of the evaluation show SBGT would restore secondary containment pressure within three minutes which is well below the 15 minute maximum drawdown time required by TS.

Based on the short duration of door opening (approximately five seconds), no material condition preventing door closure or maintaining the doors closed, and attendance by knowledgeable personnel who closed the doors immediately, the secondary containment safety function was maintained.

CORRECTIVE ACTIONS

The door was satisfactorily tested by Mechanical Maintenance and returned to service on February 18, 2017. Numerous additional informal interlock door checks wer.e performed by the subject matter expert following the return to service of the door interlock, and the interlock circuitry performed as expected without issue.

Corrective actions from the previous causal investigations had been ongoing to upgrade interlock door circuit cards with ones that had improved relays. This door set used a circuit card from the improved lot supplied by the vendor that had been installed on this door set on February 10, 2017. The station continues to work with the circuit card vendor to evaluate the failure analysis and determine if additional actions are warranted.

PREVIOUS OCCURRENCES

The interlock that failed had the new style circuit card with improved relays replaced less than a week prior to this event as an action created from a previous failure. Corrective actions from previous events had been ongoing to upgrade interlock door circuit cards with ones that had improved relays. These corrective actions were the result of causal investigations with previous events as follows.

On January 18, 2017, Unit 1 was in Mode 1 at 100 percent power, and Unit 2 was in Mode 1 at 100 percent power with MIF in progress. At 2056 hours0.0238 days <br />0.571 hours <br />0.0034 weeks <br />7.82308e-4 months <br /> CST, both air-lock doors of the Unit 2 reactor building 710-foot elevation three-way air-lock opened simultaneously for approximately five seconds during personnel ingress. The most probable cause of the interlock failure was 2017 used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

- 00 the intermittent failure of the relays on the door controller circuit card based on previous history with these circuit boards.

Previous events and prior causal investigations have indicated degradations in the relays for these circuit cards, and the corrective actions to replace interlock door circuit cards was ongoing at the time this event occurred. The controller circuit card was replaced, which restored the interlock functionality on January 19, 2017.

On February 17, 2016, Unit 2 was in Mode 1 at 100 percent power and Unit 1 was in Mode 5 for a refueling outage with no fuel movements or operation with the potential to drain the reactor vessel (OPDRV) in progress. At 1035 hours0.012 days <br />0.288 hours <br />0.00171 weeks <br />3.938175e-4 months <br /> CST, both air-lock doors of the Unit 2 Chemistry Lab corridor to Unit 2 reactor building were open at the same time for approximately five seconds.

The cause was failure of the relays on the door controller circuit card. The controller circuit card was replaced, which restored the interlock functionality. Corrective actions included determination of the cause of vendor quality issues with the controller circuit card relays and procurement of a more reliable controller circuit card following cause identification of the relay failures from vendor analysis.

On February 17, 2015, Unit 1 was in Mode 1 at 100 percent power and Unit 2 was in Mode 5 for a refueling outage with no fuel movements in progress. Activities involving OPDRVs were in progress in the secondary containment on Unit 2. At 1145 hours0.0133 days <br />0.318 hours <br />0.00189 weeks <br />4.356725e-4 months <br /> CST, it was reported that both air-lock doors between the Unit 1 diesel generator corridor and the Unit 1 reactor building were open at the same time for approximately five to ten seconds. The cause was a failure of a controller circuit card in the door interlock logic. The circuit card was replaced, which restored the interlock functionality. Corrective actions included a cause determination for the premature controller circuit card failures and replacing the card with more reliable models.

On December 12, 2014, both Units 1 and 2 were in Mode 1 at 100 percent power with no fuel movements in progress. At 1324 hours0.0153 days <br />0.368 hours <br />0.00219 weeks <br />5.03782e-4 months <br /> CST, it was reported that both air-lock doors between the Unit 2 diesel generator corridor and the Unit 2 reactor building were open at the same time for approximately ten seconds. The cause was a degradation of the door closure mechanism, and the contributing cause was a less than robust design of the door interlock assembly. Corrective actions from the previous occurrences to identify, procure and install a more robust interlock assembly design were in progress at the time of the event.

Additional corrective actions, including periodic preventative maintenance to inspect, tighten, and replace fasteners as necessary, were in place but did.not preclude this event. This event did not involve a door controller circuitry reliability issue.

On February 18, 2014, Unit 1 was in Mode 5 with fuel moves in progress during a refueling outage, and Unit 2 was in Mode 1 at 100 percent power. At 1820 hours0.0211 days <br />0.506 hours <br />0.00301 weeks <br />6.9251e-4 months <br /> CST, it was reported that both air-lock doors between the Unit 2 diesel generator corridor and the Unit 2 reactor building were open at the same time for approximately three seconds. The cause of the event was degradation of the door closure mechanism and door frame seal. A contributing cause was a less than robust design of the door interlock assembly. Corrective actions from the previous occurrences to identify, procure and install a more robust interlock assembly design were still in progress at the time of the event. Additional corrective actions included creating a periodic preventative maintenance task to inspect, tighten, and replace fasteners as necessary. This event did not involve a door controller circuitry reliability issue.

COMPONENT FAILURE DATA

Manufacturer: Security Door Controls (SDC) Device: UR2-4 Controller Card Component ID: 1695558 2017

3. LER NUMBER

004