05000237/LER-2015-003
| Dresden Nuclear Power Station, Unit 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material |
| 2372015003R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
PLANT AND SYSTEM IDENTIFICATION
Dresden Nuclear Power Station (DNPS), Unit 2, is a General Electric Company Boiling Water Reactor with a licensed maximum power level of 2957 megawatts thermal. The Energy Industry Identification System codes used in the text are identified as [XX].
A. Plant Conditions Prior to Event:
Unit: 02 Reactor Mode: 1 Event Date: 09-04-2015 Event Time: 08:10 CDT Mode Name: Power Operation Power Level: 100 percent
B. Description of Event:
On 9/4/15 at 08:10, Security received an alarm that both the U2 Reactor Building (RB) [NG] 570' elevation and the U2 Turbine Building (TB) [NM] 570' elevation interlock doors were open. Upon arrival at the interlock, Security attempted to close the U2 TB side door. Security contacted the Main Control Room (MCR) at 08:35 stating that both U2 RB/TB 570' elevation interlock doors were unintentionally opened simultaneously by workers and were still both sitting approximately 1/2" open.
Operators dispatched to investigate the situation found both doors slightly open with the door locking mechanism latch pins extended. Operators closed both doors a short time later by utilizing the bypass button located on each door's locking mechanism, and an Operations Supervisor verified power was available to both interlock doors. Throughout the duration of the event, RB differential pressure remained at -0.65" water column. TS 3.6.4.1 Condition A Required Action (RA) A.1 was entered at 08:10 CDT when Security received their alarm as Secondary Containment was inoperable. TS 3.6.4.1 Condition A RA A.1 was exited at 08:49 CDT when both doors were verified closed, which restored Secondary Containment to operable status. Secondary Containment was inoperable for 39 minutes.
The safety significance of this event was low. Reactor Building dp was maintained throughout the event. However, due to the inability to immediately close either door, this event is considered a Safety System Functional Failure for Secondary Containment. The event is being reported under 10 CFR 50.73 (a)(2)(v)(C), "any event or condition that could have prevented the fulfillment of the safety function of ...systems that are needed to control the release of radioactive material".
C. Cause of Event:
The cause of this event has been determined to be a design flaw that allowed simultaneous opening of the doors. Once opened, the interlock pins, designed to prevent opening of one door with the other open, deployed preventing closure of the doors until the interlock mechanism was bypassed. The design of the 570' elevation interlock doors is such that both doors sit in an unlocked position and only become locked on a valid 'open' signal from the opposite door. On an `open' signal from the opposite door, a solenoid in the overhead door locking mechanism energizes which engages the door locking latch pin through the eyelet tab mounted on the door frame. The solenoid will stay energized keeping the door in a locked position until a valid `closed' signal is received from the opposite door. On a valid 'closed' signal the solenoid deenergizes allowing the door locking latch pin to disengage and unlock the door. The 'open' and `closed' signals come from a switch located in the door jamb. There is one known design vulnerability associated with this type of interlocking design. If both doors are opened at the exact same time, neither will be locked out by their associated latch pin. The solenoids and latch pins will still function as designed on a valid `open' signal from the opposite door, but the timing is such that the doors will already have begun to open before the latch pins can engage to lock the door.
Further, if both doors go open simultaneously and the latch pins engage as designed, as occurred in this event, neither door will be able to close until manually reset by an Operator. The latch pins only disengage when a valid 'closed' signal is received from the opposite door. If both doors open at the same time, the latch pins will not lock the opposite door through its eyelet tab, but rather will prevent the door from fully closing due to the pin blocking the eyelet tab. The door locking mechanisms are equipped with bypass buttons that defeat the interlocking function by deenergizing the solenoid and disengaging the latching pin. The bypass feature on the door locking mechanisms allow for re-establishment of Secondary Containment.
D. Safety Analysis:
The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment System (SBGT) [BH] and closure of certain valves [V] whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment, and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be operable, or that take place outside primary containment.
Updated Final Safety Analysis Report (UFSAR) Section 6.2.3.1 provides that the safety objective of the secondary containment system, in conjunction with other engineered safeguards and nuclear safety systems, is to limit the release of radioactive materials so that offsite doses resulting from a postulated DBA will remain below 10 CFR 100 guideline values.
The safety significance of this event was low. Reactor Building dp was maintained throughout the event. However, due to the inability to immediately close either door, this event is considered a Safety System Functional Failure for Secondary Containment.
E. Corrective Actions:
- Bypass of the interlock mechanism and closure of doors
- Removal of the interlock from use until modification can be completed.
- Planned modification of the interlock mechanism to remove the identified vulnerability
F. Previous Occurrences:
Previous occurrences with other interlocks between the Reactor Building and Turbine Building had led to previous Licensee Event Reports. These interlocks have been previously modified and prevented recurrence since November 2014. The 570' elevation interlock previously failed in 2008. The corrective action was to re-inforce expectation of visual verification of door position prior to opening an interlock door.
G. Component Failure Data:
Manufacturer Model S/N Type LockTronic Challenger 1427 Electric Lock