05000334/LER-2017-001, Regarding Inadequate Tornado Missile Protection Identified Due to Nonconforming Design Conditions

Regarding Inadequate Tornado Missile Protection Identified Due to Nonconforming Design Conditions

ML17110A191
Person / Time
Site:	Beaver Valley
Issue date:	04/18/2017
From:	Richey M FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-17-127 LER 17-001-00
Download: ML17110A191 (7)

LER-2017-001, Regarding Inadequate Tornado Missile Protection Identified Due to Nonconforming Design Conditions

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii)(A), Common Cause Inoperability 10 CFR 50.73(a)(2)(ix)(A)(1)
3342017001R00 - NRC Website

text

. FENOC' RrstEnergy Nuclear Operating Company Marty L. Richey Site Vice President April 18, 2017 L-17-127 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Beaver Valley Power Station, Unit Nos. 1 and 2 BV-1 Docket No. 50-334, License No. DPR-66 BV-2 Docket No. 50-412, License No. NPF-73 LER 2017-001-00 10 CFR 50.73 Beaver Valley Power Station P.O. Box 4 Shippingport, PA 15077 724-682-5234 Fax: 724-643-8069 Enclosed is Licensee Event Report (LER) 2017-001-00, "Beaver Valley Power Station Unit 1 and Unit 2 Inadequate Tornado Missile Protection Identified Due to Non-conforming Design Conditions". This event is being reported in accordance with 10 CFR 50.73(a)(2)(i)(B), 10 CFR 50.73(a)(2)(ii)(B), 10 CFR 50.73(a)(2)(v)(A), 10 CFR

50. 73(a)(2)(vii)(A), and 10 CFR 50. 73(a)(2)(ix)(A)(1 ).

There are no regulatory commitments contained in this submittal. Any actions discussed in this document that represent intended or planned actions are described for the NRC's information, and are not regulatory commitments.

If there are any questions or if additional information is required, please contact Mr. Brian D. Kremer, Manager, Regulatory Compliance at 724-682-4284.

s:D:~~~

M1JL.Ric.\\

Enclosure - LER 2017-001-00 cc:

Mr. D. H. Dorman, NRC Region I Administrator Mr. J. A. Krafty, NRC Senior Resident Inspector Ms. B. Venkataraman, NRR Project Manager INPO Records Center (via INPO Consolidated Event System)

Mr. L. Winker (BRP/DEP)

NRC FORM366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMS: NO. 3150--0104 EXPIRES: 10/31/2018 (11-2015)

Estimated burden per response to comply with this mandatory collection request 80

~*flt~

.. ~~

hours. Reported lessons learned are incorporated Into the licensing process and fed i~?

back to industry. Send comments regarding burden estimate to the FOIA, Privacy and

~. ':./:

Information Collections Branch [f-5 F53), U.S. Nuclear Regulatory Commission,

'lo f

LICENSEE EVENT REPORT (LER)

Washington, DC 2055!>-0001, or by internet e-mail to lnfocollects.Resource@nrc.gov, (See Page 2 for required number of and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means digits/characters for each block) used to impose an information collection does not display a currenlly valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Beaver Valley Power Station Unit Number 1 05000334 1 OF 6

4. TITLE Inadequate Tornado Missile Protection Identified Due to Non-Conforming Design Conditions

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED I

SEQUENTIAL I REV FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR NUMBER NO.

MONTH DAY YEAR Beaver Valley Power Station Unit 2 05000412

02.

23 2017 2017 - 001 00 4

18 2017 FACILITY NAME DOCKET NUMBER None

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)

D 20.2201 Cb)

D 20.2203(a)(3)(il D 50.73(a)(2)(ii)(A)

D 50.73(a)(2)(viii)(A)

Mode 1 D 20.2201 (d)

D 20.2203(a)(3)(ii)

[8J 50.73(a)(2)(ii)(B)

D 50.73(a)(2)(viii)(B)

D 20.2203(a)(1)

D 20.2203(a)(4l D so.73(a)(2)(iii)

[8J 50.73(a)(2)(ix)(A)

D 20.2203(a)(2)(i)

D 50.36(c){1)(i)(A)

D 50.73(a)(2)(iv)(A)

D 50.73(a)(2)(x) 1 O. POWER LEVEL D 20.2203(a){2)(ii)

D 50.36(c)(1)(ii)(A)

[8J 50.73(a)(2)(v)(A)

D 73.71(a)(4) 100 D 20.2203(a)(2)(iii)

D so.36(c)(2)

D 50.73(a)(2)(v)(B)

D 73.71(a)(5)

D 20.2203(a)(2)(iv)

D so.46(a)(3)(ii)

D 50.73(a)(2)(v)(C)

D 73.77(a)(1)

D 20.2203(a)(2)(v)

D 50.73(a)(2)(i)(A)

D 50.73(a)(2)(v)(D)

D 73.77(a)(2)(i)

D 20.2203(a)(2)(vi)

[8J 50.73(a)(2)(i)(B)

[8J 50. 73(a)(2)(vii)

D 73.77(a)(2)(ii)

D 50.73(a)(2)(i)(C)

D OTHER Specffy in Abstract below or in Energy Industry Identification System (EllS) codes identified in the in the text as [XX].

CONDITIONS PRIOR TO OCCURENCE Beaver Valley Power Station Unit 1 (BV-1) and Unit 2 (BV-2) were in Mode 1 at 100% Power There were no Structures, Systems, or Components (SSCs) that were inoperable at the start of the event that contributed to the event.

DESCRIPTION OF EVENT

In order to address the concerns outlined in NRC Regulatory Information Summary (RIS) 2015-06 "TORNADO MISSILE PROTECTION", an evaluation of tornado missile vulnerabilities and their potential impact on Technical Specification (TS) plant equipment was conducted. This evaluation concluded that the following Structures, Systems, and Components (SSCs) are potentially vulnerable to tornado generated missiles:

The steam discharge flow paths to atmosphere for the Beaver Valley Power Station Unit 1 (BV-1) and Unit 2 (BV-2) Main Steam [SB] Safety Valves [SV] (MSSVs) (reference TS 3.7.1) are potentially vulnerable to tornado generated missiles. A tornado could generate missiles capable of striking the steam exhaust piping of the MSSVs potentially crimping the piping resulting in reduced steam flow exhaust capacity. In the worst case, (based on multiple missile strikes), all fifteen MSSVs at each Unit (five per steam line) [SB] could be rendered inoperable. On February 23, 2017, the BV-1 and BV-2 TS required MSSVs were declared inoperable and Enforcement Guidance Memorandum (EGM) 15-002 Rev 1 "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," was applied. Compensatory measures were*

implemented within the time allowed by the applicable Limiting Condition(s) for Operation and the MSSVs were then declared Operable but nonconforming.

The BV-2 MSSVs exhaust piping is less vulnerable to horizontal missile strikes than the BV-1 MSSVs exhaust piping due to the four sided concrete structure around the steam exhaust piping. The steam discharge flow paths to atmosphere of the BV-1 and BV-2 Atmospheric Dump Valves (ADVs) [RV] (Reference TS 3.7.4) are potentially vulnerable to tornado generated missiles. A tornado could generate missiles capable of striking the steam exhaust piping of the ADVs potentially crimping the piping resulting in reduced steam flow capacity. In the worst case, (based on multiple missile strikes), all TS required ADVs at each Unit could be rendered inoperable. On February 23, 2017, the BV-1 and BV-2 TS required ADVs were declared inoperable and EGM 15-002 Rev 1 was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition for Operation and the associated ADVs were then declared Operable but nonconforming.

The BV-2 ADVs exhaust piping is less vulnerable to horizontal tornado missiles strikes than the BV-1 ADVs exhaust piping due to the four sided concrete structure around the steam exhaust piping.

Unrelated to RIS 2015-06, on March 31, 2017, the BV-1 Residual Heat Release Valve [RV] (RHRV) was included in BV TS 3.7.4 under administrative control per NRG Administrative Letter 98-10 titled "DISPOSITIONING OF TECHNllCAL SPECIFICATIONS THAT ARE INSUFFICIENT TO ASSURE PLANT SAFETY". On March 31, 2017, the required RHRV was declared inoperable and EGM 15-002 Rev 1 was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition for Operation and the BV-1 RHRV was declared Operable but nonconforming.

A follow-up NRG 10 CFR 50.72 notification was not required for the addition of the BV-1 RHRV to the TS 3.7.4 under administrative control based on the guidance contained in EGM 15-002, Rev 1. The initial tornado missile non-conformances were previously reported in a 10 CFR 50. 72 notification to the NRG on February 23, 2017 in EN 52571.

As part of plant walk downs conducted to support the evaluation of tornado missile vulnerabilities, two BV-2 tornado missile barrier doors [DR] were initially found to be open. Specifically, Auxiliary Building door (A-35-5A) was found open, and Fuel Building door (F-66-3), was found partially open. These two doors were then closed and latched. These two doors are now maintained closed and latched except when opened under administrative controls.

Auxiliary Building door (A-35-5A) is fabricated from heavy steel plate and is intended to protect portions of the Primary Component Cooling water (CCP) [CC] trains from tornado missiles striking and consequentially disabling, in the worst case, both trains of CCP. As a result, both trains of CCP are postulated to be unable to perform their core decay heat removal function. This non-conformance has been corrected by closing and latching the Auxiliary Building door (A-35-5A).

Note that a normally closed rolling corrugated steel door, which is not a missile barrier door, is in series with Auxiliary Building door (A-35-5A).

Fuel Building door (F-66-3) is fabricated from heavy steel plate and is intended to prevent irradiated fuel damage as a result of tornado generated missiles passing through a normally closed non-missile Decontamination Building [NE]

corrugated rolling steel door. Tornado missiles could then enter into the Fuel Building [ND] thru the door (F-66-3)_ opening.

In the worst case, tornado generated missiles could then strike irradiated spent fuel assemblies in process of being moved in the fuel pool or to transfer casks. This non-conformance has been corrected by closing and latching the fuel building door.

An Operations standing order for Auxiliary Building door (A-35-5A) was issued in the interim to maintain the correct door configuration as closed and latched following usage.

The Severe Weather Abnormal Operating Procedure (AOP) [AOP 1/20M-53C.4A.75.1, Acts of Nature - Severe Weather]

was revised to verify Auxiliary Building door (A-35-5A) and Fuel Building door (F-66-3) door are closed and latched. This AOP was also revised to include additional controls for the (F-66-3) Fuel Building door. The additional controls include suspending irradiated fuel assembly movement in the spent fuel pool and/or suspending fuel transfer cask activities in the fuel building upon notification of a tornado watch if the door is unlatched or open.

The potential tornado missile vulnerabilities for the steam discharge flow paths of the MSSVs and ADVs (discussed above) are being addressed in accordance with EGM 15-002 Rev 1 and DSS-ISG-2016-01 (NRG enforcement discretion and interim guidance documents). Immediate compensatory measures were taken to reduce the likelihood and mitigate the potential consequences of tornado generated missiles.

CAUSE OF EVENT

Cause of exhaust piping non-conformance These conditions were part of the original plant design and have existed since the initial construction and licensing of the plants. BV-1 and BV-2 received their operating licenses in 1976 and 1987, respectively.

The design of the BV-1 and BV-2 MSSVs and the ADVs (including the RHRV), as described in the Updated Final Safety Analysis Reports (UFSAR), does not address the fact that these exhaust stacks are not protected against tornado missiles. However, the UFSARs do address that missile protection is provided for the MSSVs and ADVs themselves. As stated in BV-2 UFSAR Table 3.2-1, in addition to the ADVs and MSSVs being missile protected, the auxiliary feed water pump [BAJ steam exhaust piping is missile protected. It could not be determined if the existing configuration of the vent stacks was evaluated during the original design and licensing process, or if this condition was considered acceptable due to the low likelihood of damage to the exhaust stacks from tornado generated missiles.

Based on the above, the apparent cause of steam flow discharge flow paths of the BV-1 and BV-2 MSSVs and ADVs not being tornado missile protected was a lack of clarity during the plant's original design and licensing. This led to an inadequate understanding of the tornado missile protection regulatory requirements.

Cause of Open Missile Doors The importance of the function of tornado missile barriers was not identified in plant processes such that site personnel could implement the requirements for missile barrier protection. The importance of protecting against tornado generated missiles was not adequately translated throughout Beaver Valley programs, processes, and training to site personnel.

There was no standard for labeling of doors in regards to hazard barrier requirements.

The conditions where the doors were open and unlatched was pre-existing but previously un-recognized. A previous opportunity to label the doors in response to RIS 2001-09 "Control of Hazard Barriers" was not capitalized on at the time.

Labeling of hazard barriers was instituted following RIS 2001-09. However, tornadoes were not considered. Therefore, the barriers remained unlabeled, and site personnel were not alerted to their function. After the function of the doors for tornado missile protection was recognized, administrative controls were established to normally maintain both doors in the closed and latched position.

Therefore, the apparent cause for the two doors being not closed and latched is the importance of the function of tornado missile barriers was not identified in plant processes such that site personnel could implement the requirements for missile barrier protection.

ANALYSIS OF EVENT

There were no actual consequences resulting from these non-conforming conditions. A tornado that could produce the design basis missiles is highly unlikely. There are no actual safety consequences impacting plant safety since neither BV-1 nor BV-2 has experienced any onsite tornado missile event in at least the past three years. The probability of tornado missiles causing multiple MSSVs or ADVs or CCP trains to become inoperable is also very low. In addition, the probability of tornado missiles causing fuel assembly damage greater than currently assumed in accident analysis is also very low.

The plant risk associated with the tornado missile exposure of the steam flow discharge paths of the BV-1 MSSVs and ADVs, the steam flow discharge paths of the BV-2 MSSVs and ASDVs, and the two BV-2 tornado missile barrier doors being found open is considered to be very low. This is based on the probability of tornado-generated missiles hitting the maximum (bounding) unprotected target area being significantly smaller than the baseline Core Damage Frequencies of the effective BVPS Probabilistic Risk Assessment (PRA) models.

These conditions are being reported in accordance with the following 10 CFR 50. 73 criteria:

• 1 OCFR 50.73(a)(2)(i)(B) for any condition which was prohibited by the plant's Technical Specifications. [Both BV-1 and BV-2 for MSSVs/ ADVs and CCP system potentially being inoperable for longer than TS completion times.]

• 1 OCFR 50. 73(a)(2)(ii)(B) for any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety. [All BV-1 and BV-2, MSSVs, ADVs, and the BV-2 CCP system potentially having both trains inoperable, and due to the potential for the irradiated fuel assembly damage to be greater than analyzed due to tornado missile strike(s).]

• 1 OCFR 50. 73(a)(2)(v)(A) for any condition that could have prevented the fulfillment of the safety function of systems that are needed to shut down the reactor and maintain it in a safe shut down condition. [All BV-1 and BV-2 MSSVs, ADVs and both trains of BV-2 CCP potentially being inoperable.]

• 10CFR 50.73(a)(2)(vii)(A) for any event where a single cause or condition caused at least two independent trains to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shut down condition. [All BV-1 and BV-2 for MSSVs, I ADVs, and both trains of BV-2 CCP potentially being inoperable due to same causes (i.e.

tornado missiles).]

• 10CFR 50.73(a)(2)(ix)(A)(1) for any event or condition that as a result of a single cause could have prevented the fulfillment of a safety function for two or more trains or channels in different systems that are needed to shutdown the reactor and maintain it in a safe shutdown condition. [All BV-1 and BV-2, MSSVs, ADVs, and both trains of BV-2 CCP potentially being inoperable due to same causes (i.e. tornado missiles).]

Based on the above, the safety significance of the defined license basis non-conforming conditions identified is very low.

These conditions were also reported to the NRC in EN 52571 under 10 CFR 50.72(b)(3)(ii)(B),

and 10 CFR 50.72(b)(3)(v)(A).

CORRECTIVE ACTIONS

1. Revise BV-1/BV-2 operating manual procedure 1/20M-53C.4A.75.1 to specifically mention the MSSV/ADV exhaust piping as being vulnerable to tornado generated missiles, and provide guidance for plant operators to check these first for damage following a tornado or when identifying potential missiles around the site before a possible tornado.

2. The non-conformances which include the BV-1 and BV-2 MSSVs/ADVs exhaust piping may be addressed through physical plant modifications, industry approved risk evaluation, or another method in compliance with the plants licensing basis.

3. BV-2 Doors A-35-5A and F-66-3 have been labeled as tornado missile doors that will remain normally closed and latched.

4. AOP 1/20M-53C.4A.75.1, Acts of Nature - Severe Weather, has been revised to confirm doors (A-35-5A) and (F-66-3) are closed and latched upon receipt of a Tornado Watch.

5. BV-1 / BV-2 Procedure 1/2-ADM-2021 "Control of Penetrations (Including HELB Doors)" has been requested to be revised to include a list of tornado missile barrier doors.

6. Preventive Maintenance (PM) tasks for BV-2 doors (A-35-5A) and (F-66-3) have been requested to be created.

The Corrective actions listed above will be tracked by applicable condition reports and/ or Notifications associated with these events.

PREVIOUS SIMILAR EVENTS

A review of previous BVPS LERs in the past three years was conducted for issues related to removing/maintaining tornado missile barriers during plant operation. The following LER was determined to be similar to these events:

BV-1 and BV-2 LER 2014-005-00 "Containment equipment hatch missile shield removal inadvertently results in exceeding Technical Specification 3.6.1 required completion times".

CR 2017-01959, CR 2017-01963, AND CR 2017-03608 Page 6

of 6