05000321/LER-2017-004

LER-2017-004, Tornado Missile Vulnerabilities Result in Condition Prohibited by Technical Specifications

Edwin I. Hatch Nuclear Plant Unit 1
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
3212017004R00 - NRC Website

LER 17-004-00 for Edwin I. Hatch Regarding Safety Relief Valves' as Found Settings Resulted in Not Meeting Tech Spec Surveillance Criteria

ML17236A290
Person / Time
Site:	Hatch
Issue date:	08/24/2017
From:	Vineyard D R Southern Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-17-1435 LER 17-004-00
Download: ML17236A290 (5)

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Edwin I. Hatch Nuclear Plant Unit 1 05000-321

Event Description

Each of the five Hatch Nuclear Plant Emergency Diesel Generators (EDGs) have a buried diesel fuel oil storage tank that is vented to the atmosphere through a single pipe. On August 31, 2015, this ventilation piping was verified to extend 5 feet above grade for each EDG fuel oil storage tank. Therefore, in the event a tornado generated missile struck the unprotected piping, each fuel oil storage system would be susceptible to degradation based on either water intrusion or lack of available ventilation to the tank. This condition caused the EDGs and their associated fuel oil storage system to be considered inoperable. However, due to implementing compensatory measures as required by Enforcement Guidance Memorandum (EGM) 15-002, the affected equipment was declared operable but non-conforming.

On March 30, 2017 at approximately 0922 EST, with Unit 1 at 97 percent rated thermal power and Unit 2 at 100 percent rated thermal power, it was identified that based on the revised EGM 15-002, Revision 1, the EDG fuel oil storage ventilation pipe extending approximately 5 feet above grade was reportable due to its nonconformance with tornado generated missile protection requirements.

Event Cause Analysis This condition is a legacy design issue. Due to the historical nature of this vulnerability, a specific cause has not been identified.

Safety Assessment This event is reportable per 10 CFR 50.73(a)(2)(i)(B) as condition prohibited by Technical Specifications, per 10 CFR 50.73(a)(2)(ii)(B) as an event or condition that resulted in the plant being in an unanalyzed condition that significantly degraded plant safety, and per 10 CFR 50.73(a)(2)(v)(D) as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

The diesel generator fuel oil system consists of five independent trains of equipment with each train supplying fuel oil to its respective diesel generator. The standby ac power supply consists of five diesel generators and supplies standby power to the 4160-V emergency service buses. The fuel oil system is composed of storage tanks, day tanks, transfer pumps, and associated piping, valves, filters, and controls. Transfer capability between storage tanks of different trains is provided by a transfer header.

The fuel supply for the diesel engines consists of five 40,000-gallon main fuel storage tanks. These storage tanks have 8 feet of ground cover and are separated from adjacent tanks by 8 feet. The storage tanks can supply any diesel engine. Additionally, each diesel generator is equipped with a 1000-gallon capacity day tank.

Each main tank is equipped with two 100 percent capacity fuel oil transfer pumps which are supplied power from different division sources. Each of these redundant pumps may discharge into one of the five 1000-gallon day tanks. All outside tanks, piping, pumps, and valves are underground.

As documented in EGM 15-002, tornado missile scenarios that may lead to core damage are very low Reported lessons learned are incorporated into the licensing process and fed back to industry Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects,Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Edwin I. Hatch Nuclear Plant Unit 1 05000-321

NO

probability events because safety-related SSCs are typically designed to withstand effects of tornados. For a tornado missile-induced scenario to occur, a tornado would have to touch down at the site and result in the generation of missiles that would hit and fail vulnerable, unprotected safety-related equipment, and/or unprotected safety-related subcomponents in a manner that is non-repairable and non-recoverable. In addition, because plants are designed with redundancy and diversity, the tornado missiles would have to affect multiple trains of safety systems and/or means of achieving safe shutdown.

The NRC has completed a generic risk analysis of potential tornado missile protection non-compliances to examine the risk significance of these scenarios. This assessment documents a conservative, bounding-type analysis of the risk significance for plant facilities. The generic analysis assumed that core damage would occur if a tornado hit a plant located in the most active tornado region in the country and that it caused a tornado-generated missile to fail all emergency core cooling equipment at the plant with no ability to recover.

Given this conservative assumption, it has been determined that the core damage frequency (CDF) associated with tornado missile related non-compliances is well below CDF requiring immediate regulatory action.

Therefore, the generic bounding risk analysis performed by the NRC concluded that this issue is of low risk significance.

During a postulated design basis tornado, the unprotected diesel fuel oil storage tank ventilation piping could result in the degradation of the ventilation piping such that the fuel oil storage system is degraded. However, because Hatch has not experienced an actual tornado missile event, this event is considered to have very low safety significance.

Corrective Actions

Upon identification of the noncompliance, compensatory measures were taken to revise the abnormal procedure for natural occurring phenomena to include actions that must be taken for the diesel generator fuel oil storage tank vent lines following a tornado or high winds event. A design change is also being processed to prevent the vent lines from being impacted due to a tornado missile.

Previous Similar Events

None.