05000458/LER-2017-009

LER-2017-009, Potential Loss of Safety Function of Secondary Containment due to Unsecured Personnel Door

Docket Number
Event date:	09-27-2017
Report date:	11-13-2017
Reporting criterion:	10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material
4582017009R00 - NRC Website

LER 17-009-00 for River Bend, Unit 1 Regarding Potential Loss of Safety Function of Secondary Containment due to Unsecured Personnel Door

ML17325A996
Person / Time
Site:	River Bend, Docket Number
Issue date:	11/13/2017
From:	Maguire W F Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RBF1-17-0138, RBG-47800 LER 17-009-00
Download: ML17325A996 (6)

comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.goy, and to the Desk Officer, Office of Information and Regulatory Affairs, used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000-458 2017 009 00

REPORTED CONDITION

On September 27, 2017, at approximately 10:00 a.m. CDT, with the plant operating at 85 percent power, a door (**DR**) in the auxiliary building [NF] pressure boundary was left unsecured by an employee entering the building. The employee failed to fully close the door, and then did not properly challenge the door to confirm its security prior to leaving the area. A security officer responded to the resulting alarm, and fully closed the door approximately four minutes later.

This event is being reported in accordance with 10 CFR 50.73(a)(2)(v)(C) as an event that could have caused the loss of the safety function of the secondary containment pressure boundary.

BACKGROUND

The auxiliary building is part of the secondary containment pressure boundary. The event for which credit is taken for secondary containment is a loss of coolant accident. The secondary containment performs no active function in response to this event. However, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis, and that fission products entrapped within the secondary containment structures will be treated prior to discharge to the environment.

The access doors in the auxiliary building pressure boundary have no redundancy. That is, each passageway contains only one door, not two doors in an airlock arrangement. As such, one unsecured door compromises the integrity of the pressure boundary.

CAUSAL ANALYSIS

The door was mis-operated by a contract worker with significant experience at River Bend, who had successfully traversed such doors in the past. The pre-job brief for the work to be performed in the auxiliary building did not include a specific discussion of secondary containment doors.

Four workers were traversing the door sequentially. The first worker swiped the card reader to open the door, and all the following workers swiped the card reader before entering the building to assure security accountability. The last person entering the door is responsible for closing it properly to secure the boundary. In this instance, the last person was being assisted by the previous worker who pulled on the door handle, while the last worker pulled on the door lock hand wheel. The worker pulling on the hand wheel inadvertently rotated it, causing the latch bolts to extend slightly.

The latch bolts contacted the door frame outside of their receivers, preventing the door from being closed completely.

Thinking that the door was properly closed, the worker holding the hand wheel rotated it fully, and the worker pulling the handle failed to notice that the door was not in contact with the seating surface in the frame. The worker then made an effort to assure the door's security by pushing in the open direction, but failed to move it. They then departed the area, leaving the door unsecured.

comments.regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000-458 2017 009 00 Since the worker had sufficient experience with watertight doors to know their proper operation, this event is considered a skill-based error caused by over-confidence and improper assumptions. Having successfully used such doors numerous times, the worker was confident in the ability to do so. The effort to check the door's security by pushing it failed, likely due to its heavy mass.

CORRECTIVE ACTION TO PREVENT RECURRENCE

The following actions have been completed to prevent a recurrence of this event. These actions are documented in the , station's corrective action program.

A briefing memorandum was issued from the general manager to site personnel.

Tamper alarms were installed on all watertight doors in the secondary containment boundary to provide an audible indication that the door is open. Administrative controls have been instituted to schedule routine battery replacements.

PREVIOUS OCCURRENCE EVALUATION

A similar event was reported by RBS in LER 050/458-2013-002-00. On September 19, 2013, at approximately 1437 CDT, with the plant operating at 100% power, the same door was left unsecured by an employee entering the auxiliary building. Upon closing the door, the employee mistakenly rotated the hand wheel while pulling on it, caused the latch bolts to extend partially. The latch bolts then contacted the door frame outside the receivers, blocking the door open slightly. The employee did not notice that the door was slightly open when he rotated the hand wheel to the "closed" position, and then did not properly challenge the door to confirm its security prior to leaving the area. A security officer responded to the resultant alarm, and fully closed the door approximately four minutes later. One of the corrective actions taken in response to that event was to update the computer-based training module used in the process for granting unescorted access to the site to include specific material related to the operation of watertight secondary containment doors. The skill-based error of failing to assure the security of the door occurred despite having successfully performed the task numerous times in the past. Both workers at the scene failed to adequately self-check their actions.

An additional corrective action in 2013 was to procure a commercially-available audible door tamper alarm that could be installed without any modification to the door itself, as well as other similar doors in the auxiliary building. These alarm modules were maintained for approximately two years, but no rigorous programmatic control was put into place at the time to assure their continued functionality, and the alarms modules were eventually removed.

SAFETY SIGNIFICANCE

The River Bend Updated Safety Analysis Report describes the sequence of events postulated to occur following a loss of coolant accident (LOCA). Part of that analysis is a projection of the maximum radiation dose received by a person at the site boundary. The LOCA dose calculation assumes that the standby gas treatment system is initiated 20 minutes into the event, and that secondary containment is at the required negative pressure within 30 minutes, such that filtration may be credited. As such, the safety function of secondary containment is maintained as long as the boundary is secured (or comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Inf ocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the informatiort collection.

05000-458 2017 009 00 capable of being secured) within 20 minutes of the time of the security alarm. Since the subject door was secured within approximately four minutes of the time of the alarm, the safety function of secondary containment was actually maintained. This event was of minimal significance with respect to the health and safety of the public.

(NOTE: Energy Industry Identification System component function identifier and system name of each component or system referred to in the LER are annotated as (**XX**) and [XX], respectively.)