05000313/LER-2016-003
| Arkansas Nuclear One, Unit 1 | |
| Event date: | 08-24-2016 |
|---|---|
| Report date: | 10-19-2016 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 3132016003R00 - NRC Website | |
| ML17163A272 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 06/09/2017 |
| From: | Anderson R L Entergy Operations |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 1CAN061702 LER 16-003-01 | |
| Download: ML17163A272 (9) | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the
A. Background
In accordance with the Arkansas Nuclear One, Unit 1 (ANO-1), Safety Analysis Report (SAR), structures, systems, and components (SSCs) important to safety should be designed to withstand the effects of natural phenomenon such as tornados without loss of capability to perform the specified safety functions. In this respect, ANO-1 has previously applied the guidance of Regulatory Guide (RG) 1.76, "Design Basis Tornado for Nuclear Power Plants" (April 1974), with respect to the assumed tornado-induced wind speed of 300 miles per hour (mph).
Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," provides guidance for exercising enforcement discretion when an operating power reactor licensee does not comply with a plant's current site-specific licensing basis for tornado-generated missile protection. Specifically, enforcement discretion would apply to the applicable technical specification (TS) limiting condition(s) for operation (LCO), which would require a reactor shutdown or mode change, if a licensee could not complete TS LCO Required Action(s) within the stated TS Completion Time.
Interim Staff Guidance DSS-ISG-2016-01, "Clarification of Licensee Actions in Receipt of Enforcement Discretion per Enforcement Guidance Memorandum EGM 15-002," includes additional information intended to facilitate an understanding of the expectations for consistent NRC oversight associated with implementing enforcement discretion for tornado missile protection non-compliance(s) per EGM 15-002.
Appendix A to DSS-ISG-2016-01 includes guidance for acceptable initial and follow-up comprehensive compensatory measures for licensee use in implementing the enforcement discretion outlined in EGM 15-002.
The licensee is expected to document (log) the utilization of EGM 15-002, inform the NRC resident inspector, and enter the issue into the corrective action program. With respect to initial compensatory measures, it is expected that the measures listed in Appendix A are already in place at sites that may be affected by severe weather, such as tornadoes and/or hurricane force winds. The measures provided should be verified as current and readily deployable within a very short timeframe (the shortest timeframe could, in some scenarios, be dictated by a TS LCO 3.0.3 Completion Time of one hour).
B. Plant Status At the stated dates/times the conditions were discovered, Arkansas Nuclear One, Unit 1 (ANO-1), was operating in Mode 1 at 100% power. There were no other structures, systems, or components (SSCs) that were inoperable at the time that contributed to the event.
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
C. Event Description
ANO conducted walk downs and design verifications as extent of condition activities in response to compromised external flood boundaries, which were previously identified at the station (reference LER 14-001-00, dated May 5, 2014 (ML14125A483)). The extent of condition review was expanded to include other design vulnerabilities, including those associated with tornado missile hazards.
In June of 2016, a list of potential tornado missile protection vulnerabilities was developed to evaluate whether differences between design documentation and actual plant configuration existed with respect to areas SSCs important to safety that could be impacted by tornado missiles. On June 13, 2016, a tornado missile vulnerability was identified for ANO-1 Door 77 (entrance to an electrical penetration room from the Turbine Building), which was reported in LER 2016-002-00, dated August 11, 2016 (ML16224A767).
On August 24, 2016, a design vulnerability was identified for postulated tornado missiles entering the ANO-1 Cable Spreading Room from the Turbine Building by penetrating the hollow metal door or potentially from spalling of the block wall separating Rooms 96 and 97. A tornado could generate multiple missiles capable of striking the ANO-1 Cable Spreading Room and rendering certain components on both safety related trains inoperable.
On September 11, 2016, a design vulnerability was identified for postulated tornado missiles entering the ANO-1 Controlled Access area from the Turbine Building by penetrating block walls and hollow metal doors, and striking safety related cables. A tornado could generate multiple missiles capable of striking components in this area and rendering both safety related Emergency Feedwater (EFW) trains inoperable.
On September 15, 2016, a design vulnerability was identified for postulated tornado missiles entering ANO-1 Rooms 99 and 100 from the Turbine Building and striking vital switchgear in the rooms. A tornado could generate multiple missiles capable of striking vital ANO-1 electrical distribution equipment and rendering both safety related AC electrical trains inoperable.
Enforcement discretion per EGM 15-002 has been implemented for each of these identified issues and appropriate compensatory actions taken. Each condition identified was entered into the ANO corrective action program. The guidance provided in EGM 15-002, with reference to Appendix A of DSS-ISG-2016-01, was utilized to address the TS operability aspects of these conditions.
D. Event Causes The identified conditions are design legacy issues. The cause of this issue was unclear and changing regulatory requirements during original plant licensing that led to an inadequate understanding of the regulatory guidance with respect to tornado missile protection design requirements.
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
05000-313
E. Corrective Actions
The following corrective actions were completed upon identification of each individual vulnerability:
- The ANO directive (COPD-038) for implementing the respective enforcement discretion was completed for each identified condition. The actions completed ensure compliance with the requirements of EGM 15-002.
- The status of the affected TS components was documented in the Station Log.
- The NRC resident inspector and the ANO-1 Operating crews were briefed with respect to the equipment that could be potentially affected during a site tornado event and the compensatory actions identified to both minimize the potential for tornado missiles during severe weather and to mitigate the consequences of potential tornado missiles.
The following corrective actions are being taken to further address the condition: Note that EGM 15-002 requires follow-up actions to be completed within 60 days following tornado vulnerability identification which resulted in application of the enforcement discretion. These actions are in addition to those established upon initial identification of a tornado missile vulnerability and intended to provide a discernable, safety beneficial change, when compared with the initially established compensatory measures.
- Appropriate procedures and directives have been revised to address both the individual SSC impacts per area identified and the aggregate impact of the tornado missile conditions (assuming all vulnerable areas were equally impacted by a single tornado). The intent of this action is to provide a single location of information where Operators can identify all potentially affected equipment and identify redundant or compensating safe shutdown equipment which can minimize tornado effects.
- Short term plant changes are ongoing with the intent of minimizing the potential of tornado missile impacts with respect to these vulnerable areas, while permanent modifications and licensing basis changes are being evaluated and developed. For example, some non-grouted barriers (shield walls) are being filled in the interim, effective in attenuating tornado missile velocity prior to target impingement. A permanent shield barrier is also being prepared for installation at one potential tornado missile access point.
- Operations personnel remain abreast of the tornado missile vulnerabilities and the established compensatory measures. Operations personnel are fully trained with respect to preparation for and the mitigation of natural events such as tornados. Procedures currently available cover events such as natural emergencies (includes tornado events), loss of offsite power, station blackout, and FLEX (diverse and flexible coping strategies) for beyond design basis events, along with the aforementioned ANO directive (COPD-038).
Longer term corrective actions include development and installation of plant modifications which bring affected areas into compliance with tornado missile protection standards as applicable to the ANO-1 licensing basis.
Additional options include the application of Revision 1 of RG 1.76, or the use of other evaluation methods such as the Tornado Missile code (TORMIS) or the Tornado Missile Risk Evaluator (TMRE), either of which would require a license amendment request and subsequent NRC approval.
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
05000-313 F. Safety Consequences:
ANO-1 is required to be protected from tornado generated missiles as applied within the unit's design and licensing basis. For the identified vulnerabilities, a tornado event of sufficient magnitude could challenge the operability and availability of important instrumentation and redundant safety related equipment. The most significant potential nuclear safety aspects that could be affected by a tornado that is assumed to produce multiple high-velocity missiles is the loss of both EFW trains (utilized for post-trip decay heat removal) and the loss of redundant AC power sources.
The regulation in 10 CFR 50.36(c)(2) outlines LCOs in the TSs. Certain TSs contain LCO statements that include action statements (required actions and their associated completion time) to provide constraints on the length of time components or systems may remain inoperable or out of service before the plant must be shut down or other compensatory measures must be taken. Such time constraints are based on the safety significance of the component or system being removed from service.
EGM 15-002, in providing the basis for granting the enforcement discretion states that, in general, tornado missile scenarios that may lead to core damage are very low probability events because safety-related SSCs are typically designed to withstand the effects of tornados. For a tornado missile induced scenario to occur, a tornado would have to impact the site and result in the generation of missiles that would contact and fail vulnerable, unprotected safety related equipment and/or unprotected safety related subcomponents in a manner that is not immediately repairable or recoverable. In addition, because plants are designed with redundancy and diversity, the tornado missiles would have to affect multiple trains of safety systems and/or means of achieving safe shutdown.
EGM-15-002 states that the NRC completed a generic risk analysis of potential tornado missile protection non compliances to examine the risk significance of these scenarios. The generic nature of this analysis did not afford the staff the capability to assess plant-specific tornado missile protections which likely exist at many reactors that would result in lower risk determinations, and it did not consider the plant-specific nature of the non-compliances or the redundancies of SSCs. The generic analysis assumed that core damage would occur if a tornado impacted a plant located in the most active tornado region in the country, and a tornado-generated missile was generated which results in the loss of all emergency core cooling equipment at the plant with no ability to recover.
Further, the study did not account for a number of conservatisms. For example, whereas the study assumed the failure of redundant systems due to tornado-generated missiles, actual spatial configurations of redundant systems at a plant could lower the probability of complete system failures as a result of tornado generated missiles.
Additionally, some tornado generated missiles may not cause system failures at all or may cause failures that are repairable or recoverable within a reasonable time frame.
In summary, EGM 15-002 stated that the generic bounding risk analysis performed by the NRC concluded that this issue is of low risk significance. Therefore, enforcement discretion until June 10, 2018, would not impose significant additional risk to public health and safety.
This condition had no actual safety consequences impacting plant or public safety since ANO has not experienced a tornado missile event.
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
05000-313 G. Basis for Reportability:
This event is reportable pursuant to the following criteria:
10 CFR 50.73(a)(2)(ii)(B): Any event or condition that resulted in the nuclear plant being in an unanalyzed condition that significantly degraded plant safety.
10 CFR 50.73(a)(2)(v)(A): Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition.
Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to remove residual heat.
Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
The guidance provided in NUREG 1022 states under 10 CFR 50.73(a)(1):
The holder of an operating license for a nuclear power plant (licensee) shall submit a Licensee Event Report (LER) for any event of the type described in this paragraph within 60 days after the discovery of the event.
H. Additional Information:
10 CFR 50.73(b)(5) states that this report shall contain reference to "any previous similar events at the same plant that are known to the licensee." NUREG 1022 reporting guidance states that term "previous occurrences" should include previous events or conditions that involved the same underlying concern or reason as this event, such as the same root cause, failure, or sequence of events.
A review of the ANO corrective action program and LERs for the previous three years was performed. Aside from identified herein were a result of extent of condition evaluations of plant SSCs with respect to potential tornado design vulnerabilities. These vulnerabilities are legacy issues which are being addressed within the time frame allotted by EGM 15-002.