05000423/LER-2003-002
| Event date: | 01-16-2003 |
|---|---|
| Report date: | 03-13-2003 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 4232003002R00 - NRC Website | |
1. Event Description On January 16, 2003, while operating in Mode 1 at 100% power, an engineering evaluation concluded that the fire safe shutdown strategy may not be adequate for fire scenarios which assume the loss of all AC power.
Specifically, certain postulated fires in the control room, cable spreading room or instrument rack room require that operators control the plant from the auxiliary shutdown panel and other remote locations. For these fire scenarios, both offsite and onsite AC power are assumed lost. The fire safe shutdown strategy assumes that power is manually restored 30 minutes later. As part of an engineering evaluation, it was concluded that this loss of offsite power with delayed emergency diesel generator (EDG) [DG] availability could result in a pressure/temperature transient to the reactor coolant pump (RCP) [P] seal [SEAL] return lines resulting in their failure. This failure would cause increased flow from the reactor coolant system [AB] beyond the make-up strategy established in the fire safe shutdown procedures and would also challenge the boration strategies. Since the fire safe shutdown strategy has been determined to be inadequate, this constitutes an unanalyzed condition that could significantly degrade plant safety and is being reported in accordance with 10CFR50.73(a)(2)(ii)(B). It is noted that a station blackout (SBO) scenario could also produce this pressure/temperature transient. However, the SBO event is bounded by previous analysis.
2. Cause This condition is historical in nature dating to the original design of the RCP seal return lines and the development of the fire safe shutdown strategies. The apparent cause is a failure to recognize that a pressure/temperature transient at the RCP seal return lines could occur as part of the fire safe shutdown strategy.
3. Assessment of Safety Consequences Fires in the control room, cable spreading room or instrument rack room have the potential to degrade shutdown capability from the control room. If control room functions became substantially degraded, the control room would be abandoned and plant shutdown would be accomplished at designated alternate shutdown locations. The limited set of plant indications that are available at these alternate locations may not support timely diagnosis and mitigation of the event. Additionally, procedures for shutdown from these alternate control locations do not currently anticipate and address the significant challenges associated with the failure of the RCP seal return lines.
The safety significance of this condition is considered low. It should be noted that the assumptions for mitigating these conditions are judged to be acceptable for slowly developing fires where the event continues to be managed from the control room for an extended period of time. The fire scenario of concern in this case is a rapidly developing fire of significant magnitude which forces an evacuation of the control room shortly after detection and commencement of safe shutdown from alternate plant locations. Based on the very low probability of occurrence of this type of fire and based on the availability of fire detection systems and suppression capability in the specified areas, the safety significance of this condition is considered low.
4. Corrective Action Upon discovery of this condition, compensatory actions to minimize risk of fire in the areas of concern were implemented. These compensatory measures will remain until needed Emergency Operating Procedure revisions, plant modifications, or further analysis are made to address this condition.
Resolution options are under development and are being addressed in accordance with the Millstone Corrective Action Program.
5. Previous Occurrences No previous similar events/conditions were identified.
Energy Industry Identification System (EDS) codes are identified in the text as [XX].