05000348/LER-2016-009

LER-2016-009, Tornado Missile Vulnerabilities Result in Condition Prohibited by Technical Specifications

Joseph M. Farley Nuclear Plant
Event date:	12-7-2016
Report date:	2-2-2017
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
3482016009R00 - NRC Website

LER 16-009-00 for Joseph M. Farley Nuclear Plant, Units 1 and 2 Regarding Tornado Missile Vulnerabilities Result in Condition Prohibited by Technical Specifications

ML17033B232
Person / Time
Site:	Farley
Issue date:	02/02/2017
From:	Madison D R Southern Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-17-0009 LER 16-009-00
Download: ML17033B232 (7)

Reported lessons teamed are incorporated into the licensing process and led back to industry.

Send coents renaming burden esbmate to the FOIA, Privacy and Information Collections Branch sail (53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internal e-m lo InfocoLlects.Resourceenrc. . and to the Desk Officer, Office ol Information and Regulatory Affairs, NEOB-10202, (31 104). Orme of Management and Budget, Washington, DC 20503.11a means used to impose an intonation collecbon does not dmplay a 4:nub/valid ONE control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the intonation collection.

Joseph M. Farley Nuclear Plant, Unit 1 05000- 348 No,

PLANT AND SYSTEM IDENTIFICATION

Westinghouse - Pressurized Water Reactor

A. UNIT STATUS AT TIME OF EVENT

Unit 1, Mode 1, 100 percent power Unit 2, Mode 1, 100 percent power No plant transients were associated with this event. Thus, no structures, systems, or components (SSC) were inoperable at the start of this event which contributed to this condition.

Background NRC documents:

Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," provides guidance to exercise enforcement discretion when an operating power reactor licensee does not comply with a plant's current site-specific licensing basis for tornado-generated missile protection. Specifically, discretion would apply to the applicable Technical Specification (TS) Limiting Condition(s) for Operation (LCO) that would require a reactor shutdown or mode change in the event a licensee could not meet TS LCO required action(s) within the TS completion time.

Interim Staff Guidance DSS-ISG-2016-01, "Clarification of Licensee Actions in Receipt of Enforcement Discretion Per Enforcement Guidance Memorandum EGM 15-002," provides interim staff guidance to facilitate staff understanding of expectations for consistent oversight associated with implementing enforcement discretion for tornado missile protection noncompliance(s) per EGM 15-002.

Appendix A to DSS-ISG-2016-01 provides guidance for acceptable initial and comprehensive compensatory measures for licensee use in implementing the enforcement discretion outlined in EGM 15-002. The licensee should declare (log) the utilization of EGM 15-002, inform the resident inspector, and enter the issue into the corrective action program. For initial compensatory measures, it is expected that the measures listed are already in place at sites that may be affected by severe weather, such as tomados and/or hurricane force winds. The measures should be verified as current and readily deployable within a very short timeframe.

B. DESCRIPTION OF EVENT

On 12/7/16 during the evaluation of protection of Technical Specification (TS) equipment from damage from tornado generated missiles, Farley site engineering identified nonconforming conditions in the plant design such that the specified TS equipment did not meet the current design basis for protection against tornado generated missile impacts. Specifically, the Unit 1 and Unit 2 Service Water (SW) [BI] pumps could be rendered inoperable due to a tornado generated missile strike on the Service Water Intake Structure (SWIS) intake and exhaust ventilation hoods. This vulnerability was not included in the site's tornado missile risk analysis (TORMIS).

The SWIS intake and exhaust ventilation hoods, located on the roof of the SWIS, could be crimped as a result of a tornado missile strike, thus reducing air flow and challenging the performance of their heating and cooling safety functions. In addition, if the SWIS ventilation hoods were damaged or removed by a tornado missile strike, rainwater may enter the area below the hoods. The SWIS batteries and breakers internet e-mail to Infocollects.Resourcefitnrc , and to the Desk Officer, Off ce of Information and Regulatory Affairs, NEOB-10202, .1 r ti:14),. Office .o Management arid Budget, Washington, DC 29503. It a means used to mpose an *mat on ccilection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person Is not reqi:red to respond to, the intormaton collection Joseph M. Farley Nuclear Plant, Unit 1 05000- 348 n YEAR SEOUEhr AL Ni.,V3i.R C.

D.

for the 1C and 2C SW pump motors could be rendered inoperable due electrical shorts caused by intrusion of rainwater.

Subsequent evaluations on 1/26/17 resulted in the determination that the emergency diesel generator (EDG) fuel oil storage tank (FOST) [DC] vents were also not adequately protected from tornado generated missiles. Each EDG FOST is provided with a 1-inch vent pipe that extends above the ground and is exposed to tornado missiles. If these vent pipes were hit by a tornado missile they could become crimped and impede the transfer of fuel oil thereby resulting in failure of the associated EDGs to perform their safety functions.

These SSCs were declared inoperable and EGM 15-002 was invoked. To meet the intent of EGM 15-002 to restore the SW Pumps to an operable but degraded / non-conforming (OBDN) status, existing measures were verified as current and readily deployable for both units and were implemented as initial compensatory measures within the allowed time by the applicable LCOs. These measures included actions to take if needed as described in severe weather procedures, and monitoring of system parameters on the MCB in accordance with annunciator response procedures. In addition, new Compensatory Measures were established to inspect, protect, and restore function to the ventilation hoods and affected areas in the SWIS, and similar measures are being established for the FOST vent pipes.

CAUSE OF EVENT

This condition is an original plant design legacy issue. Due to the historical nature of this vulnerability, a specific cause has not been identified.

REPORTABILITY ANALYSIS AND SAFETY ASSESSMENT

This event is reportable as required by:

'

• 10 CFR 50.73(a)(2)(i)(B) for a condition that is prohibited by Technical Specifications.

• 10 CFR 50.73(a)(2)(v)(D) for a condition that at the time of discovery could have prevented the fulfillment of a safety function of structures or systems needed to mitigate the consequences of an accident.

• 10 CFR 50.73(a)(2)(ii)(B) for an event or condition that results in the plant being in an unanalyzed condition that significantly degrades plant safety.

As documented in EGM 15-002, tornado missile scenarios that may lead to core damage are very low probability events because safety-related SSCs are typically designed to withstand effects of tomados.

For a tornado missile-induced scenario to occur, a tornado would have to hit the site and result in the generat on of missiles that would hit and fail vulnerable, unprotected safety-related equipment, and/or unprotected safety-related subcomponents in a manner that is non-repairable and non-recoverable. In addition, because plants are designed with redundancy and diversity, the tornado missiles would have to affect mulliple trains of safety systems and/or means of achieving safe shutdown.

The NRC has completed a generic risk analysis of potential tornado missile protection noncompliances to examine the risk s:gnificance of these scenarios. This assessment documents a conservative, bounding-type analysis of the risk significance for plant facilities. The generic analysis assumed that core damage would occur if a tornado hit a plant located in the most active tornado region in the country and Reported lessons learned are incorporated into the Ircersng process and led back to industry.

Send comments roguing burden estimate to the FOIA, Privacy and Information Collections Branch (1.5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to trifccollects.Resourceeruc.gov, arid to the Desk Of5cer, Office of Information and Regulatory Affairs, NEB0202, (3150-0104),. Moe of Management end Budget Washington, DC 20503. II a means used to [moose an mlortnahon osllectuxi does not display a curie* valid OMB control number, the NRC. may not conduct or sponsor, and a person Is not reqL, red to respond to, the information collection.

Joseph M. Farley Nuclear Plant, Unit 1 05000- 348 .. YEAR SEOUENT1AL No.

that it caused a tornado-generated missile to fail all emergency core cooling equipment at the plant with no ability to recover. Given this conservative assumption, the staff's study established that the core damage frequency (CDF) associated with tornado missile-related noncompliances are well below CDFs requiring immediate regulatory action. In summary, the generic bounding risk analysis performed by the NRC concluded that this issue is of low risk significance.

During a postulated design basis tornado, the conditions documented could have resulted in a loss of function for the SW pumps or a loss of the safety function for the EDGs. The SW pumps mitigate the effects of postulated accidents by providing essential plant cooling to safety related systems and components, including those required for emergency core cooling. The EDGs are used to mitigate the effects of a loss of offsite power by providing an emergency AC power source. This condition had no actual safety consequences impacting plant or public safety as Farley did not experience an actual tornado missile event. Compensatory measures were and continue to be in place to mitigate the effects of a tornado missile strike. Also, only three of six exhaust ventilator fans are required to handle the heating load of the pump room. This redundancy reduces the risk of the postulated conditions from occurring during a tornado missile event. Therefore, enforcement discretion until June 10, 2018, will not impose significant additional risk to public health and safety.

E. CORRECTIVE ACTION

A risk based evaluation will be performed or a plant modification will be undertaken to establish compliance with the site's tornado missile protection design basis.

F. ADDITIONAL INFORMATION

1) Previous Similar Events: No other similar previous events have been reported.

2) Commitment Information: This report does not create any licensing commitments.