05000313/LER-2016-002

LER-2016-002, Tornado Missile Vulnerability Resulting in Condition Prohibited By Technical Specifications

Arkansas Nuclear One, Unit 1
Event date:	06-13-2016
Report date:	08-11-2016
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
3132016002R00 - NRC Website

LER 16-002-00 for Arkansas Nuclear One, Unit 1, Regarding Tornado Missile Vulnerability Resulting in Condition Prohibited By Technical Specifications

ML16224A767
Person / Time
Site:	Arkansas Nuclear
Issue date:	08/11/2016
From:	Warren C C Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
1CAN081603 LER 16-002-00
Download: ML16224A767 (9)

A. Background

Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado- Generated Missile Protection Noncompliance," provides guidance to exercise enforcement discretion when an operating power reactor licensee does not comply with a plant's current site-specific licensing basis for tornado-generated missile protection. Specifically, discretion would apply to the applicable technical specification (TS) limiting condition(s) for operation (LCO) which would require a reactor shutdown or mode change; if a licensee could not meet TS LCO required action(s) within the TS completion time.

Interim Staff Guidance DSS

• lSG-2016.01, "Clarification of Licensee Actions in Receipt of Enforcement Discretion Per Enforcement Guidance Memorandum EGM 15-002," provides interim staff guidance (ISG) intended to facilitate NRC staff understanding of the expectations for consistent oversight associated with implementing enforcement discretion for tornado missile protection noncompliance(s) per EGM 15-002.

Appendix A to DSS-ISG-2016-01 provides guidance for acceptable initial and comprehensive compensatory measures for licensee use in implementing the enforcement discretion outlined in EGM 15-002. The licensee is expected to document (log) the utilization of EGM 15-002, inform the resident inspector, and enter the issue into the corrective action program. For initial compensatory measures, it is expected that the measures listed are already in place at sites that may be affected by severe weather, such as tornadoes and/or hurricane force winds. The measures provided should be verified as current and readily deployable within a very short timeframe (the shortest timeframe could, in some scenarios, be dictated by a (TS) 3.0.3 completion time of one hour).

B. Plant Status At the time the condition was discovered, ANO-1 was operating in Mode 1 at 100% power.

There were no other structures, systems, or components that were inoperable at the time that contributed to the event.

C. Event Description

ANO conducted walk downs and design verifications as extent of condition activities in response to compromised external flood boundaries which were previously identified at the station. See LER 14-001-00 dated May 5, 2014 (ML14125A483).

In June 2016, as part of the extent of condition actions, a list of potential tornado missile protection vulnerabilities was being created to determine if there were any differences between design documentation and actual plant configuration for areas that could be impacted by tornado missiles. On June 13, 2016, a tornado generated missile vulnerability was identified for Door 77 and some of the Safety Related Systems, Structures or Components (SSCs) in the Unit 1 Upper South Electrical Penetration Room. Specifically, there is a potential deficiency associated with the missile shield wall inside this room. A horizontal tornado generated missile could penetrate the hollow metal door and then penetrate the unqualified concrete masonry unit (CMU) wall before striking safety related cables.

Follow-up field inspection confirmed the block wall to be 12 inches thick with some ungrouted cells and the original design requires 18 inches of grouted block wall for missile barriers therefore the wall was not qualified to withstand all postulated missile strikes. The cabling supplying the following components that could be impacted by a tornado missile:

• Reactor Protection System (RPS) Channel C: (hot leg temperature from Loop B of the Reactor Coolant System (RCS) and the power range).

• Engineered Safeguards Actuation System (ESAS) Analog Channel 3: (Reactor Building (RB) Pressure signal and 'B' Loop RCS Pressure signal).

• Emergency Feedwater Initiation and Control (EFIC) Channel C: (low and high range level and pressure signals from each of the two steam generators).

• Main Steam Line Isolation (MSLI) Valves.

The RPS initiates a reactor trip, if necessary, to protect core fuel design limits and the RCS pressure boundary during abnormalities while the ESAS initiates necessary safety systems, based on the values of selected unit parameters to protect against violating core design limits and to mitigate accidents. The EFIC system instrumentation is designed to protect against the consequences of a simultaneous blowdown of bother steam generators. One of the signals that the EFIC instrumentation generates is MSLI.

Unit 1 TS 3.3.1 addresses the RPS system required actions and completion times. TS 3.3.5 addresses the actions and completion times associated with ESAS. Unit 1 TS 3.3.11 provides the required actions and completion times for the EFIC system. This includes the MSLI signals.

This condition was entered into the ANO corrective action program. The immediate actions were performed for these components as required by the TSs. The guidance provided in EGM 15-002 was utilized to address the prompt operability and reportability of this condition.

D. Event Causes This is a design legacy issue. The cause of this issue was a lack of clarity and changing requirements during the original licensing of the plant that led to inadequate understanding of the original regulatory guidance.

E. Corrective Actions

The following corrective actions have been completed to address this condition:

ANO directive Enforcement Discretion (COPD-038) was implemented in preparation for use of EGM 15-002. Actions were completed to comply with the requirements of EGM 15-002.

Log entries were made documenting the inoperability and subsequent transition to operable but nonconforming equipment status for the affected SSCs. The initial briefing actions were also completed and logged including NRC resident brief.

• All cells of the CMU missile shield wall located inside Door 77 in Room 144 were grouted.

• Completed a calculation that verified the fully grouted 12 inch CMU wall will stop penetration of the applicable tornado generated missiles.

The following corrective actions are being taken to further address this condition:

Prepare an Engineering Change (EC) to enhance the wall to meet design basis for tornado missile loading. In lieu of preparing this EC, a Risk Base Evaluation may be performed to address this vulnerability.

Implement the EC to enhance the wall to meet design basis tornado missile loadings.

In lieu of installing this EC, submit a Risk Based Evaluation for required regulatory approvals.

F. Safety Consequences:

Unit 1 is required to be protected from tornado generated missiles as applied within the unit's design and licensing basis. The safety-related instrumentation required to mitigate the consequences of a tornado event could have potentially been affected by this condition.

During a postulated design basis tornado, this could have resulted in the loss of one or more of the SSCs listed above under Event Description.

The regulation in 10 CFR 50.36(c)(2) outlines LCOs in the TSs. Certain TSs contain LCO statements that include action statements (required actions and their associated completion time) to provide constraints on the length of time components or systems may remain inoperable or out of service before the plant must be shut down or other compensatory measures must be taken. Such time constraints are based on the safety significance of the component or system being removed from service.

EGM 15-002, in providing the basis for granting the enforcement discretion states that, in general, tornado missile scenarios that may lead to core damage are very low probability events because safety-related SSCs are typically designed to withstand the effects of tornados. For a tornado missile induced scenario to occur, a tornado would have to impact the site and result in the generation of missiles that would contact and fail vulnerable, unprotected safety related equipment and/or unprotected safety related subcomponents in a manner that is not immediately repairable or recoverable. In addition, because plants are designed with redundancy and diversity, the tornado missiles would have to affect multiple trains of safety systems and/or means of achieving safe shutdown.

EMG 15-002 states that the NRC completed a generic risk analysis of potential tornado missile protection non compliances to examine the risk significance of these scenarios. The generic nature of this analysis did not afford the staff the capability to assess plant-specific tornado missile protections which likely exist at many reactors that would result in lower risk determinations, and it did not consider the plant-specific nature of the non-compliances or the redundancies of SSCs. The generic analysis assumed that core damage would occur if a tornado hit a plant located in the most active tornado region in the country and that it caused a tornado-generated missile to fail all emergency core cooling equipment at the plant with no ability to recover.

Further, the study did not account for a number of conservatisms. For example, whereas the study assumed the failure of redundant systems due to tornado generated missiles, actual spatial configurations of redundant systems at a plant could lower the probability of complete system failures as a result of tornado generated missiles. Additionally, some tornado generated missiles may not cause system failures at all or may cause failures that are repairable or recoverable within a reasonable time frame.

In summary, EGM 15-002 stated that the generic bounding risk analysis performed by the NRC concluded that this issue is of low risk significance. Therefore, enforcement discretion until June 10, 2018, will not impose significant additional risk to public health and safety.

This condition had no actual safety consequences impacting plant or public safety since ANO has not experience a tornado missile event.

G. Basis for Reportability:

This event is reported pursuant to the following criteria:

10 CFR 50.73(a)(2)(i)(B): Any operation or condition which was prohibited by the plant's Technical Specifications.

The guidance provided in NUREG 1022 states:

An LER is required if a condition existed for a time longer than permitted by the TS (i.e., greater than the total allowable restoration and shutdown outage time (or completion time in the STS)), even if the condition was not discovered until after the allowable time had elapsed and the condition was rectified immediately upon discovery.

H. Additional Information:

10 CFR 50.73(b)(5) states that this report shall contain reference to "any previous similar events at the same plant that are known to the licensee." NUREG-1022 reporting guidance states that term "previous occurrences" should include previous events or conditions that involved the same underlying concern or reason as this event, such as the same root cause, failure, or sequence of events.

A review of the ANO corrective action program and Licensee Event Reports for the previous three years was performed. No previous similar events were identified.

Energy Industry Identification System (El IS) codes and component codes are identified in the text of this report as [XX].