Bulletin 77-08: Assurance of Safety and Safeguards During an Emergency – Locking Systems

                               UNITED STATES 
                       NUCLEAR REGULATORY COMMISSION 
                    OFFICE OF INSPECTION AND ENFORCEMENT 
                          WASHINGTON, D. C. 20555 
                                     
                              December 28, 1977

                                                         IE Bulletin 77-08 

ASSURANCE OF SAFETY AND SAFEGUARDS DURING AN EMERGENCY - LOCKING SYSTEMS 

Description of Circumstances: 

Under emergency conditions, prompt ingress into certain safety-related areas
must be assured to enable safe shutdown of a nuclear power plant, and 
unimpeded egress from all parts of the facility must be assured in the 
interest of life safety. The circumstances described below indicate that 
prompt ingress and unimpeded egress under emergency conditions may not be 
assured at all nuclear power plants. 

At one nuclear power plant, upon loss of offsite power resulting in a scram 
of the reactor, all electrically locked doors to vital areas failed for lack
of auxiliary power. (Although, the electrical circuit blue prints indicated 
that the electrical locking system was connected to the vital bus to provide
uninterrupted auxiliary power, the control console for the locking system 
had not in fact been so connected.) This failure delayed ingress by 
operations personnel into several safety-related areas because they had to 
await arrival of a guard with the one immediately available key. Other 
security keys were at the facility but were either secured or held by a 
person who was unaware of what the keys would unlock. 

Concurrent with the above situation, three employees were isolated without 
an adequate emergency escape route available to them. The two accessible 
doors on that level had been secured, one by a failed electrical locking 
device and the other by a lock which could be opened only by the 
grand-master key which they did not possess. Further, the second door was 
blocked from the opposite side. The only other escape route which could be 
considered was an unenclosed stairwell leading to other levels, but it was 
blocked by hot water flowing from the turbine floor above. The employees 
telephoned for assistance and were released by a guard who came through the 
cable spreading room and opened the failed door from within. 



                                  1 of 4 
.

IE Bulletin No. 77-08                                    December 28, 1977 

During an NRC inspection at another nuclear power plant it was observed that
two exterior emergency exit doors were chained and padlocked from within. 
Although the padlocks were of the "breakable" shackle type, substantial 
force would be required to break them and unimpeded egress in an emergency 
was not assured. 

At a third nuclear plant, a technician conducting tests accidently caused a 
scram, turbine trip, and loss of station power. Some electrical locking 
devices securing safety-related areas were supplied only from non-vital 
buses which were stripped of their loads in the process of transferring to 
secondary power sources. The electrical locking devices failed and delayed 
the ingress of additional plant personnel to assist in the shutdown of the 
plant. 

Finally, information available to the NRC indicates that licensees at many 
other nuclear power plants utilize or plan to utilize electrical locking 
devices for vital areas, protected areas, and non-security areas. Some of 
the plants do not have auxiliary power for a portion of or all of the 
electrical locking systems, and these systems could fail in such a way that 
prompt ingress or unimpeded egress would not be assured. 

Discussion of Applicable Requirements: 

Appendix E of 10 CFR Part 50 provides that (a) the capability for plant 
evacuation, and (b) the capability for facility reentry in order to mitigate
the consequences of an accident or, if appropriate, to continue operations, 
must be assured. 

Electrical locks not provided with auxiliary power cannot be maintained in 
an operable condition (10 CFR 73.55(g)(1)), and electrical locks which fail 
in the open mode are not providing the required locking (73.55(d)(7)). It 
should be noted that the NRC is currently reviewing amended Security Plans 
submitted in response to the requirements of 10 CFR 73.55. That review will 
encompass prompt emergency ingress and unimpeded egress through security 
related doors in conjunction with positive access controls at facilities 
having an operating license. 



                                  2 of 4 
.

IE Bulletin No. 77-08                                    December 28, 1977 

The National Fire Protection Association Standard NFPA 101 is a generally 
accepted national standard known as the "Life Safety Code." NFPA 101 is the 
basis of certain regulations of the Occupational Safety and Health 
Administration (29 CFR 1910) and the fire regulations and life safety codes 
of a significant number of States. This standard addresses in detail the 
number, locations, widths, and routes to emergency exits. It further details
safety requirements for stairwell escape routes, describes route and exit 
markings, and specifically instructs against the installation of a lock or 
other fastening on an emergency exit that would prevent escape from the 
inside of the building. 

Action to be Taken by Licensee and Permit Holders: 

1.   Survey your facility and facility plans to determine whether the 
     following situations exist: 

     a.   Prompt emergency ingress into electrically locked safety-related 
          areas by essential personnel is assured in any postulated 
          occurrence through the combined use of features (1), (2), and (3) 
          below or the equivalent. 

          (1)  Provide reliable and uninterruptable auxiliary power to the 
               entire electrical locking system, including its controls; and
               
          (2)  Provide the electrical locking devices, which are required to
               fail in the secure mode for security purposes, with secure 
               mechanical means and associated procedures to override the 
               devices upon loss of both primary and auxiliary power (e.g., 
               key locks with keys held by appropriate personnel who know 
               when and how to use them); and 

          (3)  Provide periodic tests of all locking systems and mechanical 
               overrides to confirm their operability and their capability 
               to switch to auxiliary power. 

     b.   Unimpeded emergency egress is assured from all parts of your 
          facilities, the security hardware and systems are designed and 
          installed so as to not degrade life safety, and such hardware and 
          systems are in conformance with applicable (State/Local) fire 
          regulations and life safety codes. 



                                  3 of 4 
.

IE Bulletin 77-08 December 28, 1977 

          2.   Review existing emergency plans and procedures to assure that
               prompt emergency ingress and unimpeded emergency egress are 
               fully and effectively addressed for any postulated 
               occurrence. 

          3.   Assure that prompt emergency ingress and unimpeded egress 
               through security doors at facilities with an operating 
               license are thoroughly described in submittals pursuant to 10 
               CFR 73.55. 

          4.   In the event that surveys or reviews required by action items
               1 and 2 establish that the facility does not meet the 
               requirements noted in these items, holders of an operating 
               license shall provide a written report to the appropriate NRC
               Regional Office within 45 calendar days of receipt of this 
               Bulletin. The required report will clearly describe all 
               identified problem areas together with proposed corrective 
               actions. Holders of construction permits will respond in like
               manner within 60 calendar days of receipt of this Bulletin. 
               If your facility is in full conformance with the requirements
               noted, no response to this Bulletin is required. 

Approved by GAO, B180225 (R0072); clearance expires 7-31-80. Approval was 
given under a blanket clearance specifically for identified generic 
problems. 



                                  4 of 4