05000237/LER-2015-003, Regarding Turbine Building to Reactor Building Interlock Doors Open Simultaneously
| ML15306A447 | |
| Person / Time | |
|---|---|
| Site: | Dresden  |
| Issue date: | 10/30/2015 |
| From: | Marik S Exelon Generation Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 15-0061 LER 15-003-00 | |
| Download: ML15306A447 (5) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2372015003R00 - NRC Website | |
text
~Exeton Generation Dresden Generating Station 6500 North Dresden Road Morris, IL 60450 www.exelencorp.com 10 CFR 50.73 SVPLTR # 15-0061 October 30, 2015 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Dresden Nuclear Power Station, Unit 2 and 3 Renewed Facility Operating License Nos. DPR-19 and DPR-25 NRC Docket No. 50-237 and 50-249
Subject:
Licensee Event Report 237/2015-003-00 Unit 2 Turbine Building to Reactor Building Interlock Doors Open Simultaneously Enclosed is Licensee Event Report 237/2015-003-00, "Unit 2 Turbine Building to Reactor Building Interlock Doors Open Simultaneously." This report describes an event which is being reported in accordance with 10 CFR 50.73(a)(2)(v)(C), any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material.
There are no regulatory commitments contained in this submittal.
Should you have any questions concerning this letter, please contact Mr. Bruce Franzen at (815) 416-2800.
Respectfully, Shane M. Marik Site Vice President Dresden Nuclear Power Station Enclosure: Licensee Event Report 237/2015-003-00 cc:
Regional Administrator - NRC Region Ill NRC Senior Resident Inspector - Dresden Nuclear Power Station SUez-
NRC FORM 366 U.S. NucLEIAR REGULATORY COCMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 01/31/2017 (02-2014)
'**,,,.,,Estimated
, the NRC may not conduct or sponsor, and a person is not required to respond to, the intorrmation collection.
- 1. FACILITY NAME [2.
DOCKET
- 6. LER NUMBER 1
- 3. PAGE IIISEQUENTIAL REV YEAR NUMBER NO.
Dresden Nuclear Power Station, Unit 2 05000237 YERj 2
OF 4
Ij 2015 003 00
NARRATIVE
PLANT AND SYSTEM IDENTIFICATION
Dresden Nuclear Power Station (DN PS), Unit 2, is a General Electric Company Boiling Water Reactor with a licensed maximum power level of 2957 megawatts thermal. The Energy Industry Identification System codes used in the text are identified as [XX].
A.
Plant Conditions Prior to Event:
Unit: 02 Event Date: 09-04-2015 Event Time: 08:10 CDT Reactor Mode: 1 Mode Name: Power Operation Power Level: 100 percent B.
Description of Event
On 9/4/15 at 08:10, Security received an alarm that both the U2 Reactor Building (RB) [NG] 570' elevation and the U2 Turbine Building (TB) [NM] 570' elevation interlock doors were open. Upon arrival at the interlock, Security attempted to close the U2 TB side door. Security contacted the Main Control Room (MCR) at 08:35 stating that both U2 RB/TB 570' elevation interlock doors were unintentionally opened simultaneously by workers and were still both sitting approximately 1/2" open.
Operators dispatched to investigate the situation found both doors slightly open with the door locking mechanism latch pins extended. Operators closed both doors a short time later by utilizing the bypass button located on each door's locking mechanism, and an Operations Supervisor verified power was available to both interlock doors. Throughout the duration of the event, RB differential pressure remained at -0.65" water column. TS 3.6.4.1 Condition A Required Action (RA) A.1 was entered at 08:10 CDT when Security received their alarm as Secondary Containment was inoperable. TS 3.6.4.1 Condition A RA A.1 was exited at 08:49 CDT when both doors were verified closed, which restored Secondary Containment to operable status. Secondary Containment was inoperable for 39 minutes.
The safety significance of this event was low. Reactor Building dp was maintained throughout the event. However, due to the inability to immediately close either door, this event is considered a Safety System Functional Failure for Secondary Containment. The event is being reported under 10 CFR 50.73 (a)(2)(v)(C), "any event or condition that could have prevented the fulfillment of the safety function of...systems that are needed to control the release of radioactive material".
C.
Cause of Event
The cause of this event has been determined to be a design flaw that allowed simultaneous opening of the doors. Once opened, the interlock pins, designed to prevent opening of one door with the other open, deployed preventing closure of the doors until the interlock mechanism was bypassed. The design of the 570' elevation interlock doors is such that both doors sit in an unlocked position and only become locked on a valid 'open' signal from the opposite door. On an
'open' signal from the opposite door, a solenoid in the overhead door locking mechanism energizes which engages the door locking latch pin through the eyelet tab mounted on the door frame. The solenoid will stay energized keeping the door in a locked position until a valid 'closed' signal is received from the opposite door. On a valid 'closed' signal the solenoid deenergizes allowing the door locking latch pin to disengage and unlock the door. The 'open' and 'closed' signals come from a switch located in the door jamb. There is one known design vulnerability associated with this type of interlocking design. If both doors are opened at the exact same time, neither will be locked out by their associated latch pin. The solenoids and latch pins will still function as designed on a valid 'open' signal from the opposite door, but the timing is such that the doors will already have begun to open before the latch pins can engage to lock the door.
Further, if both doors go open simultaneously and the latch pins engage as designed, as occurred in this event, neither door will be able to close until manually reset by an Operator. The latch pins only disengage when a valid 'closed' signal is received from the opposite door. If both doors open at the same time, the latch pins will not lock the opposite door through its eyelet tab, but rather will prevent the door from fully closing due to the pin blocking the eyelet tab. The door locking mechanisms are equipped with bypass buttons that defeat the interlocking function by deenergizing the solenoid and disengaging the latching pin. The bypass feature on the door locking mechanisms allow for re-establishment of Secondary Containment.
D.
Safety Analysis
The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment System (SBGT) [BH] and closure of certain valves [V]
whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.
Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CER 100 guideline values.
The safety significance of this event was low. Reactor Building dp was maintained throughout the event. However, due to the inability to immediately close either door, this event is considered a Safety System Functional Failure for Secondary Containment.
E.
Corrective Actions
S 0
Bypass of the interlock mechanism and closure of doors Removal of the interlock from use until modification can be completed.
Planned modification of the interlock mechanism to remove the identified vulnerability F.
Previous Occurrences
Previous occurrences with other interlocks between the Reactor Building and Turbine Building had led to previous Licensee Event Reports. These interlocks have been previously modified and prevented recurrence since November 2014. The 570' elevation interlock previously failed in 2008. The corrective action was to re-inforce expectation of visual verification of door position prior to opening an interlock door.
G.
Component Failure Data
Manufacturer Model SIN Type LockTronic Challenger 1427 Electric Lock NRC FORM O66A (02-2014)
~Exeton Generation Dresden Generating Station 6500 North Dresden Road Morris, IL 60450 www.exelencorp.com 10 CFR 50.73 SVPLTR # 15-0061 October 30, 2015 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Dresden Nuclear Power Station, Unit 2 and 3 Renewed Facility Operating License Nos. DPR-19 and DPR-25 NRC Docket No. 50-237 and 50-249
Subject:
Licensee Event Report 237/2015-003-00 Unit 2 Turbine Building to Reactor Building Interlock Doors Open Simultaneously Enclosed is Licensee Event Report 237/2015-003-00, "Unit 2 Turbine Building to Reactor Building Interlock Doors Open Simultaneously." This report describes an event which is being reported in accordance with 10 CFR 50.73(a)(2)(v)(C), any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of radioactive material.
There are no regulatory commitments contained in this submittal.
Should you have any questions concerning this letter, please contact Mr. Bruce Franzen at (815) 416-2800.
Respectfully, Shane M. Marik Site Vice President Dresden Nuclear Power Station Enclosure: Licensee Event Report 237/2015-003-00 cc:
Regional Administrator - NRC Region Ill NRC Senior Resident Inspector - Dresden Nuclear Power Station SUez-
NRC FORM 366 U.S. NucLEIAR REGULATORY COCMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 01/31/2017 (02-2014)
'**,,,.,,Estimated
, the NRC may not conduct or sponsor, and a person is not required to respond to, the intorrmation collection.
- 1. FACILITY NAME [2.
DOCKET
- 6. LER NUMBER 1
- 3. PAGE IIISEQUENTIAL REV YEAR NUMBER NO.
Dresden Nuclear Power Station, Unit 2 05000237 YERj 2
OF 4
Ij 2015 003 00 NARRATIVE
PLANT AND SYSTEM IDENTIFICATION
Dresden Nuclear Power Station (DN PS), Unit 2, is a General Electric Company Boiling Water Reactor with a licensed maximum power level of 2957 megawatts thermal. The Energy Industry Identification System codes used in the text are identified as [XX].
A.
Plant Conditions Prior to Event:
Unit: 02 Event Date: 09-04-2015 Event Time: 08:10 CDT Reactor Mode: 1 Mode Name: Power Operation Power Level: 100 percent B.
Description of Event
On 9/4/15 at 08:10, Security received an alarm that both the U2 Reactor Building (RB) [NG] 570' elevation and the U2 Turbine Building (TB) [NM] 570' elevation interlock doors were open. Upon arrival at the interlock, Security attempted to close the U2 TB side door. Security contacted the Main Control Room (MCR) at 08:35 stating that both U2 RB/TB 570' elevation interlock doors were unintentionally opened simultaneously by workers and were still both sitting approximately 1/2" open.
Operators dispatched to investigate the situation found both doors slightly open with the door locking mechanism latch pins extended. Operators closed both doors a short time later by utilizing the bypass button located on each door's locking mechanism, and an Operations Supervisor verified power was available to both interlock doors. Throughout the duration of the event, RB differential pressure remained at -0.65" water column. TS 3.6.4.1 Condition A Required Action (RA) A.1 was entered at 08:10 CDT when Security received their alarm as Secondary Containment was inoperable. TS 3.6.4.1 Condition A RA A.1 was exited at 08:49 CDT when both doors were verified closed, which restored Secondary Containment to operable status. Secondary Containment was inoperable for 39 minutes.
The safety significance of this event was low. Reactor Building dp was maintained throughout the event. However, due to the inability to immediately close either door, this event is considered a Safety System Functional Failure for Secondary Containment. The event is being reported under 10 CFR 50.73 (a)(2)(v)(C), "any event or condition that could have prevented the fulfillment of the safety function of...systems that are needed to control the release of radioactive material".
C.
Cause of Event
The cause of this event has been determined to be a design flaw that allowed simultaneous opening of the doors. Once opened, the interlock pins, designed to prevent opening of one door with the other open, deployed preventing closure of the doors until the interlock mechanism was bypassed. The design of the 570' elevation interlock doors is such that both doors sit in an unlocked position and only become locked on a valid 'open' signal from the opposite door. On an
'open' signal from the opposite door, a solenoid in the overhead door locking mechanism energizes which engages the door locking latch pin through the eyelet tab mounted on the door frame. The solenoid will stay energized keeping the door in a locked position until a valid 'closed' signal is received from the opposite door. On a valid 'closed' signal the solenoid deenergizes allowing the door locking latch pin to disengage and unlock the door. The 'open' and 'closed' signals come from a switch located in the door jamb. There is one known design vulnerability associated with this type of interlocking design. If both doors are opened at the exact same time, neither will be locked out by their associated latch pin. The solenoids and latch pins will still function as designed on a valid 'open' signal from the opposite door, but the timing is such that the doors will already have begun to open before the latch pins can engage to lock the door.
Further, if both doors go open simultaneously and the latch pins engage as designed, as occurred in this event, neither door will be able to close until manually reset by an Operator. The latch pins only disengage when a valid 'closed' signal is received from the opposite door. If both doors open at the same time, the latch pins will not lock the opposite door through its eyelet tab, but rather will prevent the door from fully closing due to the pin blocking the eyelet tab. The door locking mechanisms are equipped with bypass buttons that defeat the interlocking function by deenergizing the solenoid and disengaging the latching pin. The bypass feature on the door locking mechanisms allow for re-establishment of Secondary Containment.
D.
Safety Analysis
The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment System (SBGT) [BH] and closure of certain valves [V]
whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.
Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CER 100 guideline values.
The safety significance of this event was low. Reactor Building dp was maintained throughout the event. However, due to the inability to immediately close either door, this event is considered a Safety System Functional Failure for Secondary Containment.
E.
Corrective Actions
S 0
Bypass of the interlock mechanism and closure of doors Removal of the interlock from use until modification can be completed.
Planned modification of the interlock mechanism to remove the identified vulnerability F.
Previous Occurrences
Previous occurrences with other interlocks between the Reactor Building and Turbine Building had led to previous Licensee Event Reports. These interlocks have been previously modified and prevented recurrence since November 2014. The 570' elevation interlock previously failed in 2008. The corrective action was to re-inforce expectation of visual verification of door position prior to opening an interlock door.
G.
Component Failure Data
Manufacturer Model SIN Type LockTronic Challenger 1427 Electric Lock NRC FORM O66A (02-2014)