05000389/LER-2004-002
| Event date: | 10-04-2004 |
|---|---|
| Report date: | 12-03-2004 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 3892004002R00 - NRC Website | |
2. DOCKET1. FACILITY NAME 6. LER NUMBER 3. PAGENUMBER
Description of the Event
On October 4, 2004, St. Lucie Unit 2 was shutdown in Mode 3 and preparing for the restart from Hurricane Jeanne when a condition report was initiated on a September 26, 2004 discovery that the Unit 2 reactor auxiliary building (RAB) had two exterior doors [EIIS:NF:DR] on the 62' elevation east of the control room open such that the associated interior double doors were exposed. FPL subsequently determined that the exterior doors were missile shields. A subsequent walkdown on Unit 1 noted that similar missile shields were closed and padlocked.
Not having these Unit 2 missile shields closed exposed safety-related equipment to tornado-induced missiles. The doors with open missile shields in question have been identified as door RA-107 that provides access to the component cooling water (CCW) surge tank room, and door RA-109 that provides access to the heating and ventilation room.
Cause of the Event
The missile shields in question have likely been opened for many years, according to interviews with cognizant plant personnel. Plant procedure AP 0005753 "Severe Weather Preparations" step 17 of Checklist 2A reads: "...close [RAB] outside doors and roof hatches..." on the 62' for HVS 5A & 5B room exit to roof (Unit 2), Control room A/C exit to roof (Unit 1), and the CCW Surge tank area exit to roof. However, the procedure does not specify that the missile shields should be closed.
Additionally, no procedural guidance has been provided to ensure that these shields are closed after opening to enter any one of the affected rooms. Normally, Operations personnel enter these rooms for daily surveillance. However, no one has closed the shields due to the lack of procedural controls and the lack of knowledge for the function of the shields. Based on this assessment, the most apparent reason for this condition is attributed to lack of procedural guidance to ensure the shields are kept closed during normal plant operations and severe weather conditions.
Analysis of the Event
It has been reported that these missile doors could have been open for the past several years. Assuming that this was the case, a tornado missile could have penetrated the doors and affected the safety-related components at least in the last two hurricane warnings issued for the plant site as a result of Hurricanes Frances and Jeanne. No damage to any of the components located in these rooms was reported; however, during these two hurricanes conditions were favorable for causing damage to the safety-related components located in these rooms.
During the time the missile shields were not in place, Unit 2 was in a condition prohibited by the Technical Specifications (TS), and therefore, this condition was reportable under 10 CFR 50.73(a)(2)(i)(B).� This is because the control room envelope could have been challenged during shutdown operations after a potential tornado missile. The missile could have penetrated the inner walls of heating and ventilation room, making the control room ventilation system inoperable for a period of time longer than allowed by TS 3.7.7. If the missile would have impacted or penetrated the floor affecting MCC 2B5, several Technical Specification components could have been rendered inoperable as well. Also, a missile impacting or penetrating the CCW surge tank room floor could have made the pressurizer heater bus 2A3 and the bank of diesel-backed pressurizer heaters included in TS 3.4.3 inoperable.
St. Lucie Unit 2 05000389 During the time the missile shields were not in place, an unanalyzed condition that significantly affected plant safety was in existence. The plant systems located inside the reactor auxiliary building are protected against the effects of tornado missiles by the outside walls of the building and any features provided for missile protection. With the required missile protection features unavailable, no protection is afforded for the components and systems inside the RAB. The absence of missile shields increases the probability of a missile strike that would challenge the control room envelope, both trains of control room ventilation, electrical equipment room ventilation, and the heating and ventilation control board. For this reason, the unanalyzed condition is considered to significantly compromise plant safety, and this condition was also reportable under 10 CFR 50.73(a)(2)(ii)(B).
This condition also could have prevented fulfillment of a safety function, and is also reportable under 10 CFR 50.73(a)(2)(v). A tornado missile challenging the heating and ventilation room could have damaged the ventilation plenum for fans HVS 5A and HVS-5B, which supply the electrical equipment rooms. Loss of ventilation to these rooms would result in ambient temperatures increasing beyond component established design limits, adversely affecting essential electrical equipment for both safety trains during a safe shutdown. Furthermore, a missile penetrating or impacting the block wall between the heating and ventilation room and the control room could have adversely affected both trains of controls for the control room emergency ventilation system. The missile could also affect several safety-related components in the chemical volume control system (CVCS), shutdown cooling, safety injection, and control room ventilation systems.
Analysis of Safety Significance A tornado missile that penetrates the CCW surge tank room could potentially disable the CCW surge tank and/or associated piping and valves. The CCW system would have been capable of performing its specified functions during a safe shutdown following a tornado event, and therefore, the CCW system was operable as required by the Technical Specifications. The CCW surge tank is required to accommodate a system swell associated with a 20°F temperature increase for the CCW system during shutdown operation. The tank is also designed to provide sufficient net positive suction head (NPSH) for CCW pump operation. For a loss of the tank produced by a tornado missile, both functions could still be performed by the CCW system since sufficient NPSH would still be available with a disabled tank, and only spillover of inventory would occur during inventory swelling with shutdown operation. A safe shutdown condition would have been achieved with an inoperable CCW surge tank and associated piping/valves.
A missile striking the CCW surge tank room could also affect the north side air intake of the control room emergency ventilation system or air intake radiation monitors RE-26-61 and RE-26-62. A missile strike could affect the diesel backed pressurizer heater bus 2A3. The missile could also penetrate the room and impact or penetrate the wall between the air conditioner room and the CCW surge tank room resulting in breach of the control room envelope and the possible failure of one control room air conditioner.
A missile penetrating the heating and ventilation room could have disabled one of the electrical equipment room fans (HVS-5A or 5B), or could affect the common ductwork from these supply fans. The most limiting case would be the failure of the common header ductwork. Under this scenario, the electrical equipment rooms would lose ventilation, and ambient temperatures would exceed temperature design limits for safety-related equipment located in these rooms. The effects over time could include St. Lucie Unit 2 05000389 loss of safety-related equipment due to high ambient temperatures. The tornado missile could also penetrate the doors of the heating and ventilation room and then penetrate or impact the block wall between the heating and ventilation room and the control room, thereby, potentially causing an interaction with the heating and ventilation control board and one train of instrumentation cabinets in the control room. Of concern is the heating and ventilation control board panel which contains both trains of control room HVAC equipment. Other components that could be affected by a tornado missile penetrating the heating and ventilation room and the inner walls of the control room include control room emergency ventilation train HVE-13B or HVE- 13A. However, due to train separation, the missile is not expected to affect both trains simultaneously. The missile could also affect MCC 2B5 that feeds several safety-related components in the chemical volume control system (CVCS), shutdown cooling, safety injection, and control room ventilation systems.
In order to assess the effect on plant safety for the loss of any of the above components given a tornado missile strike on the heating and ventilation room, a risk analysis was performed. This analysis looked at the missile impact frequency for the heating and ventilation room doors (1.0E-06/yr), and estimated the increase in core damage frequency assuming loss of the MCC 2B5 and the HVS-5A and 5B fans. The analysis assumed a conditional core damage probability given a missile strike conservatively estimated to be 1.0E-3 (using the Unit 2 online risk monitor program dated October 18, 2004, with MCC 2B5, HVS 5A and HVS 5B being out of service yields a value of 3.33E-4). Based on this assessment, the increase in core damage frequency was conservatively estimated to be 1.0E-9/yr.
Based on this analysis, it is concluded that the plant consequences due to missile shield doors being open, 1.0E-9/yr, are not risk significant; there is plenty of margin from the estimated core damage frequency to the risk significant threshold of 1.0E-6/yr. Therefore, the evaluated condition does not represent a significant threat to plant safety.
St. Lucie Unit 2 05000389
Corrective Actions
1. The missile shield doors were closed and locked.
2. The Unit 1 and 2 RAB 62 feet elevation exterior doors were tagged to identify them as missile barriers.
3. Plant procedure AP 0005753 "Severe Weather Preparations" step 17 of Checklist 2A and Unit 2 missile shield doors at the 62 feet elevation (heating and ventilation and CCW surge tank rooms to roof) are closed in preparation for severe weather.
4. Plant procedures will be identified and revised by March 31, 2005, to direct plant personnel to close both Unit 1 and Unit 2 missile shield doors at the 62 feet elevation (heating and ventilation and CCW surge tank rooms to roof) right after they have been opened for any activities inside the affected rooms.
5. A training brief will be provided by March 31, 2005 for Operations, Engineering and Maintenance personnel to explain the importance of ensuring that the missile shield doors at the 62 feet elevation (heating and ventilation and CCW surge tank rooms to roof) are maintained closed at all times.
Additional Information
None Failed Components Identified Component: n n/a Manufacturer: n n/a Model Number: n n/a Similar Events None