05000331/LER-2016-001

LER-2016-001, Two Instances of Both Doors in Secondary Containment Airlock Opened Concurrently

Duane Arnold Energy Center
Event date:	06-19-2016
Report date:	8-18-2016
Reporting criterion:	10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material
Initial Reporting
ENS 52022	10 CFR 50.72(b)(3)(v)(C), Loss of Safety Function - Release of Radioactive Material
3312016001R00 - NRC Website

LER 16-001-00 for Duane Arnold Energy Center Regarding Two Instances of Both Doors in Secondary Containment Airlock Opened Concurrently

ML16232A600
Person / Time
Site:	Duane Arnold
Issue date:	08/18/2016
From:	Vehec T A NextEra Energy Duane Arnold
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NG-16-0165 LER 16-001-00
Download: ML16232A600 (6)

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

I. Description of Event:

On June 19, 2016 at 1533, while operating at 82% power, the Control Room Supervisor (CRS) was notified that Door-281 and Door-282, both in Secondary Containment Airlock 153, had been opened concurrently during performance of STP 3.6.4.1-02, "Secondary Containment Airlock Verification," Revision 15, Step 7.1.1.e. This step directed the technician to attempt to open the inner door while the outer door was open The doors being open at the same time caused a failure to meet SR 3.6.4.1.2 to verify that either the outer door(s) or the inner door(s) in each Secondary Containment access opening are closed. The identified condition caused Secondary Containment to be considered inoperable per TS LCO 3.6.4.1. The technician involved immediately closed the doors upon encountering this unexpected condition. This action allowed SR 3.6.4.1.2 to be met, and restored Secondary Containment to an operable status.

On June 29, 2016 at 0940, while operating at 100% power, the CRS was notified that Door- 239A and Door-246, both in Secondary Containment Airlock 222, the Reactor Building Railroad Airlock, had been opened concurrently. The doors being open at the same time caused a failure to meet SR 3.6.4.1.2 to verify that either the outer door(s) or the inner door(s) in each Secondary Containment access opening are closed. The identified condition caused Secondary Containment to be considered inoperable per TS LCO 3.6.4.1. The individuals involved immediately closed their respective doors upon encountering this unexpected condition. This action allowed SR 3.6.4.1.2 to be met, and restored Secondary Containment to an operable status.

Each of the above events resulted in an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> reportable event. In both cases, the Resident Inspector was notified, and an Event Notification was made pursuant to 10 CFR 50.72(b)(3)(v)(C). (References EN #52022 and EN #52053). Secondary containment leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis and that fission products entrapped within the secondary containment structure will be treated by the Standby Gas Treatment System prior to discharge to the environment.

A Secondary Containment door airlock utilizes an interlock device with an adjustable permanent magnet (mounted on the door), and an electromagnet (on the door frame) arranged in an electrical circuit so that door(s) are held closed and/or are allowed to open after a pushbutton is depressed.

Immediately following the event on June 19, troubleshooting adjusted an interlock magnet and by 1651 hours0.0191 days <br />0.459 hours <br />0.00273 weeks <br />6.282055e-4 months <br /> post-maintenance testing had been performed satisfactorily per Surveillance Test Procedure (STP) 3.6.4.1-02, Secondary Containment Airlock Verification.

Duane Arnold Energy Center Immediately following the event on June 29, troubleshooting found the electromagnet on Door-239A was not consistently locking the door due to loose fasteners, and the pushbutton contacts of Door- 246 were fouled, causing intermittent actuation of the door logic. The Door-239A fasteners were tightened and at 1108 hours0.0128 days <br />0.308 hours <br />0.00183 weeks <br />4.21594e-4 months <br /> post-maintenance testing was performed satisfactorily per Surveillance Test Procedure (STP) 3.6.4.1-02, Secondary Containment Airlock Verification. The Door-246 pushbuttons were subsequently replaced.

There were no radiological releases associated with these two events. There were no other structures, systems or components inoperable at the start of either event that contributed to the event.

II. Assessment of Safety Consequences:

There were no actual safety consequences associated with these events; the potential safety consequences were minimal. In each case, both doors on the airlock were open simultaneously for less than 10 seconds, and were able to be closed immediately upon discovery of the condition. There were no radiological releases associated with these events.

These events will not be reported as safety system functional failures as engineering analysis has determined the system is capable of performing its safety function during events when the airlock is open for less than 10 seconds. The site's post-LOCA dose calculation does not credit secondary containment integrity for mitigation of on-site and off-site doses for the first 5 minutes of the event.

Therefore, these events are bounded by the existing dose calculation.

Neither event resulted in a safety system functional failure. There were no automatically or manually initiated safety system responses.

III. Cause of Event:

Technical Specifications Surveillance Requirement SR 3.6.4.1.2 requires one inner or one outer secondary containment airlock door to be closed at all times. A Root Cause Evaluation was conducted in August 2016 which determined the root causes of the events on June 19 and 29, 2016 were:

• (June 19) Inadequate procedural guidance which directed the user to attempt to open one airlock door while the other was already open (i.e., in effect, the user was instructed to actively challenge the door interlocks).

• (June 29) The secondary containment breach due to simultaneous opening of airlock doors was attributed to the equipment design not being able to prevent the simultaneous opening of one inner and one outer door at all times, under all possible conditions.

In general, the root cause noted that in recent plant history the most common resolution activity identified for the above and similar airlock events was re-adjustment of the permanent magnet, with magnet rotation being cited as one issue.

IV. Corrective Actions:

The corrective actions to preclude recurrence of the June 19, 2016 event have been completed.

These are:

• Modification of STP 3.6.4.1-02, the Secondary Containment Airlock Verification surveillance procedure, to perform the interlock test with one of the two doors closed at all times.

• Removal of the airlock interlock logic testing from STP 3.6.4.1-02.

Additional corrective actions will include development of new Preventive Maintenance (PM) actions that will perform the interlock logic testing and maintenance removed from STP 3.6.4.1-02 (above) without challenging the secondary containment. Implementation of this PM will be on a schedule and frequency commensurate with door use.

As noted, for the June 29, 2016 event the Door-239A fasteners were tightened, which allowed for successful completion of the surveillance test. Interim and compensatory corrective actions for the event have also been completed. These were replacement of the Door-246 pushbuttons and the installation of cameras at the Railroad Airlock (Airlock 222) doors, with monitors showing the view of the opposite camera. Personnel had been previously instructed on how to use the monitors when they were installed at the Reactor Building Access Control Airlock in 2015.

The corrective actions to preclude recurrence of the June 29, 2016 event will be the following:

• Door entry pushbuttons and key logic relays at high traffic airlocks will be replaced.

• Enamel will be added to permanent magnets at high traffic doors to assist in reducing/preventing magnet rotation.

Completion of the above actions will be tracked by the site Corrective Action Program.

V. Additional Information:

Previous Similar Occurrences:

A review of DAEC Licensee Event Reports from the past five years identified six similar occurrences meeting reportability requirements: reference LER 2013-006, LER 2014-002, EIIS System and Component Codes:

I EL Interlock Reporting Requirements:

These two events are each being reported pursuant to 10CFR50.73(a)(2)(v)(C).