05000389/LER-2004-002, Regarding Reactor Auxiliary Building Missile Shield Doors Not Closed

Regarding Reactor Auxiliary Building Missile Shield Doors Not Closed

ML043480279
Person / Time
Site:	Saint Lucie
Issue date:	12/03/2004
From:	Jefferson W Florida Power & Light Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-2004-278 LER 04-002-00
Download: ML043480279 (6)

LER-2004-002, Regarding Reactor Auxiliary Building Missile Shield Doors Not Closed

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
3892004002R00 - NRC Website

text

-

0 FPL Florida Power & Light Company, 6501 S. Ocean Drive, Jensen Beach, FL 34957 December 3, 2004 L-2004-278 10 CFR § 50.73 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Re:

St. Lucie Unit 2 Docket No. 50-389 Reportable Event: 2004-002-00 Date of Event: October 4, 2004 Reactor Auxiliary Building Missile Shield Doors Not Closed The attached Licensee Event Report 2004-002 is being submitted pursuant to the requirements of 10 CFR § 50.73 to provide notification of the subject event.

Very truly yours, William Je n, Jr.

Vice President St. Lucie Nuclear Plant WJ/KWF Attachment an FPL Group company

.;

" Z

-:

I--

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 0613012007 (6-2004)

, the NRC may not conduct or sponsor.

and a person Is not required to respond to, the information collection.

1. FACILITY NAME [2. DOCKET NUMBER [iAGE St. Lucie Unit 2 05000389 Page 1 of 5

4. TITLE Reactor Auxiliary Building Missile Shield Doors Not Closed

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR SEQUENTIAL REVISION MONTH DAY YEAR FACLITY NAME T DOCKELINUMdUL iI~i~i~iI0~i 200 NUMBER NUMBER____________

10 l04 l 2004 2004 - 002 00 12 03 2004 FA=

NAME gDXKLNUMBLR

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply) 3 0

20.2201 (b) 0 20.2203(a)(3)(i)

El 50.73(a)(2Xi)(C)

El 50.73(a)(2)(vii) o 20.2201(d)

E 20.2203(a)(3)(ii)

El 50.73(a)(2)(ii)(A) 0 50.73(a)(2)(viii)(A) o 20.2203(a)(1) 0 20.2203(a)(4) 0 50.73(a)(2)(ii)(B) 0 50.73(a)(2)(viii)(B) o 20.2203(a)(2)(i) 0 50.36(c)(1)(i)(A) a 50.73(a)(2)(iii) 0 50.73(a)(2)(ix)(A)

10. POWER LEVEL 0

20.2203(a)(2)(ii) 0 50.36(c)(1)(ii)(A)

El 50.73(a)(2)(iv)(A) 0 50.73(a)(2)(x) 000 El 20.2203(a)(2)(iii) 0 50.36(c)(2) 0 50.73(a)(2)(v)(A)

El 73.71(a)(4) o 20.2203(a)(2)(iv) 0 50.46(a)(3Xii) 0 50.73(a)(2)(v)(B) 0 73.71(a)(5)

El 20.2203(a)(2)(v)

El 50.73(a)(2)(i)(A) 0 50.73(a)(2)(v)(C) 0 OTHER Specfy In Absvtract below or in l

20.2203(a)(2)(vi) 0D 50.73(a)(2)(i)(B) 0 50.73(a)(2)(v)(D)

N C Form 366A

12. LICENSEE CONTACT FOR THIS LER NAME TELEPHONE NUMBER (tnrdude Area Code)

Kenneth W. Frehafer, Licensing Engineer (772) 467 -

7748CAUSE SYSTEM COMPONENT MANUFACTURER RETPORETPIXLE

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTLE

14. SUPPLEMENTAL REPORT EXPECTED

_15.

EXPECTED MONTH YEAR YES SUBMISSION (If yes, complete EXPECTED SUBMISSION DATE).

X NO DATE ABSTRACT (Umit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)

On October 4, 2004, St. Lucie Unit 2 was shutdown in Mode 3 preparing to start up after Hurricane Jeanne. A condition report was issued on the east side RAB 62 feet elevation exterior doors that were found open.

The subsequent investigation determined that the exterior doors were credited as missile shields.

The apparent reason for this condition was attributed to lack of procedural guidance to ensure that the missile shield doors are kept closed during normal plant operations and severe weather conditions.

The missile shield doors were closed, and future corrective actions include procedure changes and training.

The risk assessment for this condition concluded that the open missile shields had no adverse effect on the health and safety of the public.

NRC FORM 366 (1-2001)

1U.S. NUCLEAR REGULATORY COMMISSION (6-2004)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION

1. FACILITY NAME NUMBER

6. LER NUMBER

3. PAGE

.YEAR SEQUENTIAL REVISION St. Lucie Unit 2 05000389 Page 2 of 5 2004 002 00 TEXT (If more space Is required, use additional copies of NRC Form 366A) (17)

Description of the Event On October 4, 2004, St. Lucie Unit 2 was shutdown in Mode 3 and preparing for the restart from Hurricane Jeanne when a condition report was initiated on a September 26, 2004 discovery that the Unit 2 reactor auxiliary building (RAB) had two exterior doors EEIIS:NF:DR] on the 62' elevation east of the control room open such that the associated interior double doors were exposed.

FPL subsequently determined that the exterior doors were missile shields.

A subsequent walkdown on Unit 1 noted that similar missile shields were closed and padlocked.

Not having these Unit 2 missile shields closed exposed safety-related equipment to tornado-induced missiles.

The doors with open missile shields in question have been identified as door RA-107 that provides access to the component cooling water (CCW) surge tank room, and door RA-109 that provides access to the heating and ventilation room.

Cause of the Event

The missile shields in question have likely been opened for many years, according to interviews with cognizant plant personnel.

Plant procedure AP 0005753 "Severe Weather Preparations" step 17 of Checklist 2A reads: "...close [RAE] outside doors and roof hatches..." on the 62' for HVS 5A & 5B room exit to roof (Unit 2), Control room A/C exit to roof (Unit 1), and the CCW Surge tank area exit to roof.

However, the procedure does not specify that the missile shields should be closed.

Additionally, no procedural guidance has been provided to ensure that these shields are closed after opening to enter any one of the affected rooms.

Normally, Operations personnel enter these rooms for daily surveillance.

However, no one has closed the shields due to the lack of procedural controls and the lack of knowledge for the function of the shields.

Based on this assessment, the most apparent reason for this condition is attributed to lack of procedural guidance to ensure the shields are kept closed during normal plant operations and severe weather conditions.

Analysis of the Event

It has been reported that these missile doors could have been open for the past several years.

Assuming that this was the case, a tornado missile could have penetrated the doors and affected the safety-related components at least in the last two hurricane warnings issued for the plant site as a result of Hurricanes Frances and Jeanne.

No damage to any of the components located in these rooms was reported; however, during these two hurricanes conditions were favorable for causing damage to the safety-related components located in these rooms.

During the time the missile shields were not in place, Unit 2 was in a condition prohibited by the Technical Specifications (TS), and therefore, this condition was reportable under 10 CFR 50.73(a)(2)(i)(B).

This is because the control room envelope could have been challenged during shutdown operations after a potential tornado missile.

The missile could have penetrated the inner walls of heating and ventilation room, making the control room ventilation system inoperable for a period of time longer than allowed by TS 3.7.7.

If the missile would have impacted or penetrated the floor affecting MCC 2B5, several Technical Specification components could have been rendered inoperable as well.

Also, a missile impacting or penetrating the CCW surge tank room floor could have made the pressurizer heater bus 2A3 and the bank of diesel-backed pressurizer heaters included in TS 3.4.3 inoperable.

i

,c '1., ';.

U.S. NUCLEAR REGULATORY COMMISSION (6-2004)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION

1. FACILITY NAME

- 2.

DOCKER

6. LER NUMBER

3. PAGE AR UENTIAL REVISION SEAR UMER NUMBER St. Lucie Unit 2 05000389

.Page 3 of 5 2004 002 00 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)-

During the time the missile shields were not in place, an unanalyzed condition that significantly affected plant safety was in existence.

The plant systems located inside the reactor auxiliary building are protected against the effects of tornado missiles by the outside walls of the building and any features provided for missile protection. With the required missile protection features unavailable, no protection is afforded for the components and systems inside the RAB.

The absence of missile shields increases the probability of a missile strike that would challenge the control room envelope, both trains of control room ventilation, electrical equipment room ventilation, and the heating and ventilation control board.

For this reason, the unanalyzed condition is considered to significantly compromise plant safety, and this condition was also reportable under 10 CFR 50.73(a)(2)(ii)(B).

This condition also could have prevented fulfillment of a safety function, and is also reportable under 10 CFR 50.73(a)(2)(v). A tornado missile challenging the heating and ventilation room could have damaged the ventilation plenum for fans HVS-5A and HVS-5B, which supply the electrical equipment rooms.

Loss of ventilation to these rooms would result in ambient temperatures increasing beyond component established design limits, adversely affecting essential electrical equipment for both safety trains during a safe shutdown.

Furthermore, a missile penetrating or impacting the block wall between the heating and ventilation room and the control room could have adversely affected both trains of controls for the control room emergency ventilation system.

The missile could also affect several safety-related components in the chemical volume control system (CVCS), shutdown cooling, safety injection, and control room ventilation systems.

Analysis of Safety Significance A tornado missile that penetrates the CCW surge tank room could potentially disable the CCW surge tank and/or associated piping and valves.

The CCW system would have been capable of performing its specified functions during a safe shutdown following a tornado event, and therefore, the CCW system was operable as required by the Technical Specifications.

The CCW surge tank is required to accommodate a system swell associated with a 200F temperature increase for the CCW system during shutdown operation.

The tank is also designed to provide sufficient net positive suction head (NPSH) for CCW pump operation.

For a loss of the tank produced by a tornado missile, both functions could still be performed by the CCW system since sufficient NPSH would still be available with a disabled tank, and only spillover of inventory would occur during inventory swelling with shutdown operation. A safe shutdown condition would have been achieved with an inoperable CCW surge tank and associated piping/valves.

A missile striking the CCW surge tank room could also affect the north side air intake of the control room emergency ventilation system or air intake radiation monitors RE-26-61 and RE-26-62.

A missile strike could affect the diesel backed pressurizer heater bus 2A3.

The missile could also penetrate the room and impact or penetrate the wall between the air conditioner room and the CCW surge tank room resulting in breach of the control room envelope and the possible failure of one control room air conditioner.

A missile penetrating the heating and ventilation room could have disabled one of the electrical equipment room fans (HVS-5A or 5B), or could affect the common ductwork from these supply fans.

The most limiting case would be the failure of the common header ductwork.

Under this scenario, the electrical equipment rooms would lose ventilation, and ambient temperatures would exceed temperature design limits for safety-related equipment located in these rooms.

The effects over time could includeU.S. NUCLEAR REGULATORY COMMISSION (6-2004)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION

1. FACILITY NAME

,2.

DOCKET

6. LER NUMBER

3. PAGE YAR' SEQUENTIAL I REVISION NUMBER NUMBER St. Lucie Unit 2 -

05000389 Page 4 of 5 2004 -

002 00 TEXT (If more space Is required, use additional copies of NRC Fomn 366A) (17) loss of safety-related equipment due to high ambient temperatures.

The tornado missile could also penetrate the doors of the heating and ventilation room and then penetrate or impact the block wall between the heating and ventilation room and the control room, thereby, potentially causing an interaction with the heating and ventilation control board and one train of instrumentation cabinets in the control room.

Of concern is the heating and ventilation control board panel which contains both trains of control room HVAC equipment. Other components that could be affected by a tornado missile penetrating the heating and ventilation room and the inner walls of the control room include control room emergency ventilation train HVE-13B or HVE-13A.

However, due to train separation, the missile is not expected to affect both trains simultaneously. The missile could also affect MCC 2B5 that feeds several safety-related components in the chemical volume control system (CVCS), shutdown cooling, safety injection, and control room ventilation systems.

In order to assess the effect on plant safety for the loss of any of the above components given a tornado missile strike on the heating and ventilation room, a risk analysis was performed.

This analysis looked at the missile impact frequency for the heating and ventilation room doors (l.OE-06/yr), and estimated the increase in core damage frequency assuming loss of the MCC 2B5 and the HVS-5A and 5B fans.

The analysis assumed a conditional core damage probability given a missile strike conservatively estimated to be 1.OE-3 (using the Unit 2 online risk monitor program dated October 18, 2004, with MCC 2B5, HVS 5A and HVS 5B being out of service yields a value of 3.33E-4).

Based on this assessment, the increase in core damage frequency was conservatively estimated to be l.OE-9/yr.

Based on this analysis, it is concluded that the plant consequences due to missile shield doors being open, l.OE-9/yr, are not risk significant; there is plenty of margin from the estimated core damage frequency to the risk significant threshold of l.OE-6/yr.

Therefore, the evaluated condition does not represent a significant threat to plant safety.U.S. NUCLEAR REGULATORY COMMISSION (6-2004)

LICENSEE EVENT REPORT (LER).

TEXT CONTINUATION

1. FACILITY NAME

2. DOCKET

6. LER NUMBER

3. PAGE N U M B E R SEQUENTIAL REVISION 050 I

NUMBER NUMBER St. Lucie Unit 2 05000389 l I

Page 5 of 5 2004 -

002 00 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

Corrective Actions

1. The missile shield doors were closed and locked.

2. The Unit 1 and 2 RAB 62 feet elevation exterior doors were tagged to identify them as missile barriers.

3. Plant procedure AP will be revised by and Unit 2 missile and CCW surge tank 0005753 "Severe Weather Preparations" step 17 of Checklist 2A March 31, 2005, to direct plant personnel to verify that Unit 1 shield doors at the 62 feet elevation (heating and ventilation rooms to roof) are closed in preparation for severe weather.

4. Plant procedures will be identified and revised by March 31, 2005, to direct plant personnel to close both Unit 1 and Unit 2 missile shield doors at the 62 feet elevation (heating and ventilation and CCW surge tank rooms to roof) right after they have been opened for any activities inside the affected rooms.

5. A training brief will be provided by March 31, 2005 for Operations, Engineering and Maintenance personnel to explain the importance of ensuring that the missile shield doors at the 62 feet elevation (heating and ventilation and CCW surge tank rooms to roof) are maintained closed at all times.

Additional Information

None Failed Components Identified Component:

Manufacturer:

Model Number:

Similar Events

None n/a n/a n/a