05000334/LER-2017-001
| Beaver Valley Power Station Unit Number 1 | |
| Event date: | 2-3-2017 |
|---|---|
| Report date: | 4-18-2017 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(vii)(A), Common Cause Inoperability 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 52571 | 10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor, 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 3342017001R00 - NRC Website | |
| ML17110A191 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley  |
| Issue date: | 04/18/2017 |
| From: | Richey M L FirstEnergy Nuclear Operating Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-17-127 LER 17-001-00 | |
| Download: ML17110A191 (7) | |
comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
2017 Beaver Valley Power Station Unit Number 1 334
3. LER NUMBER
00 05000- Energy Industry Identification System (EIIS) codes identified in the in the text as [XX].
CONDITIONS PRIOR TO OCCURENCE
Beaver Valley Power Station Unit 1 (BV-1) and Unit 2 (BV-2) were in Mode 1 at 100% Power There were no Structures, Systems, or Components (SSCs) that were inoperable at the start of the event that contributed to the event.
DESCRIPTION OF EVENT
In order to address the concerns outlined in NRC Regulatory Information Summary (RIS) 2015-06 "TORNADO MISSILE PROTECTION", an evaluation of tornado missile vulnerabilities and their potential impact on Technical Specification (TS) plant equipment was conducted. This evaluation concluded that the following Structures, Systems, and Components (SSCs) are potentially vulnerable to tornado generated missiles:
The steam discharge flow paths to atmosphere for the Beaver Valley Power Station Unit 1 (BV-1) and Unit 2 (BV-2) Main Steam [SB] Safety Valves [SV] (MSSVs) (reference TS 3.7.1) are potentially vulnerable to tornado generated missiles. A tornado could generate missiles capable of striking the steam exhaust piping of the MSSVs potentially crimping the piping resulting in reduced steam flow exhaust capacity. In the worst case, (based on multiple missile strikes), all fifteen MSSVs at each Unit (five per steam line) [SB] could be rendered inoperable. On February 23, 2017, the BV-1 and BV-2 TS required MSSVs were declared inoperable and Enforcement Guidance Memorandum (EGM) 15-002 Rev 1 "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition(s) for Operation and the MSSVs were then declared Operable but nonconforming.
The BV-2 MSSVs exhaust piping is less vulnerable to horizontal missile strikes than the BV-1 MSSVs exhaust piping due to the four sided concrete structure around the steam exhaust piping. The steam discharge flow paths to atmosphere of the BV-1 and BV-2 Atmospheric Dump Valves (ADVs) [RV] (Reference TS 3.7.4) are potentially vulnerable to tornado generated missiles. A tornado could generate missiles capable of striking the steam exhaust piping of the ADVs potentially crimping the piping resulting in reduced steam flow capacity. In the worst case, (based on multiple missile strikes), all TS required ADVs at each Unit could be rendered inoperable. On February 23, 2017, the BV-1 and BV-2 TS required ADVs were declared inoperable and EGM 15-002 Rev 1 was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition for Operation and the associated ADVs were then declared Operable but nonconforming.
The BV-2 ADVs exhaust piping is less vulnerable to horizontal tornado missiles strikes than the BV-1 ADVs exhaust piping due to the four sided concrete structure around the steam exhaust piping.
001 comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to NE0E3-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
Unrelated to RIS 2015-06, on March 31, 2017, the BV-1 Residual Heat Release Valve [RV] (RHRV) was included in BV TS 3.7.4 under administrative control per NRC Administrative Letter 98-10 titled "DISPOSITIONING OF TECHNIICAL SPECIFICATIONS THAT ARE INSUFFICIENT TO ASSURE PLANT SAFETY". On March 31, 2017, the required RHRV was declared inoperable and EGM 15-002 Rev 1 was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition for Operation and the BV-1 RHRV was declared Operable but nonconforming.
A follow-up NRC 10 CFR 50.72 notification was not required for the addition of the BV-1 RHRV to the TS 3.7.4 under administrative control based on the guidance contained in EGM 15-002, Rev 1. The initial tornado missile non- conformances were previously reported in a 10 CFR 50.72 notification to the NRC on February 23, 2017 in EN 52571.
As part of plant walk downs conducted to support the evaluation of tornado missile vulnerabilities, two BV-2 tornado missile barrier doors [DR] were initially found to be open. Specifically, Auxiliary Building door (A-35-5A) was found open, and Fuel Building door (F-66-3), was found partially open. These two doors were then closed and latched. These two doors are now maintained closed and latched except when opened under administrative controls.
Auxiliary Building door (A-35-5A) is fabricated from heavy steel plate and is intended to protect portions of the Primary Component Cooling water (CCP) [CC] trains from tornado missiles striking and consequentially disabling, in the worst case, both trains of CCP. As a result, both trains of CCP are postulated to be unable to perform their core decay heat removal function. This non-conformance has been corrected by closing and latching the Auxiliary Building door (A-35-5A).
Note that a normally closed rolling corrugated steel door, which is not a missile barrier door, is in series with Auxiliary Building door (A-35-5A).
Fuel Building door (F-66-3) is fabricated from heavy steel plate and is intended to prevent irradiated fuel damage as a result of tornado generated missiles passing through a normally closed non- missile Decontamination Building [NE] corrugated rolling steel door. Tornado missiles could then enter into the Fuel Building [ND] thru the door (F-66-3), opening.
In the worst case, tornado generated missiles could then strike irradiated spent fuel assemblies in process of being moved in the fuel pool or to transfer casks. This non-conformance has been corrected by closing and latching the fuel building door.
An Operations standing order for Auxiliary Building door (A-35-5A) was issued in the interim to maintain the correct door configuration as closed and latched following usage.
The Severe Weather Abnormal Operating Procedure (AOP) [AOP 1/2OM-53C.4A.75.1, Acts of Nature — Severe Weather] was revised to verify Auxiliary Building door (A-35-5A) and Fuel Building door (F-66-3) door are closed and latched. This AOP was also revised to include additional controls for the (F-66-3) Fuel Building door. The additional controls include suspending irradiated fuel assembly movement in the spent fuel pool and/or suspending fuel transfer cask activities in the fuel building upon notification of a tornado watch if the door is unlatched or open.
The potential tornado missile vulnerabilities for the steam discharge flow paths of the MSSVs and ADVs (discussed above) are being addressed in accordance with EGM 15-002 Rev 1 and DSS-ISG-2016-01 (NRC enforcement discretion and interim guidance documents). Immediate compensatory measures were taken to reduce the likelihood and mitigate the potential consequences of tornado generated missiles.
comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
Beaver Valley Power Station Unit Number 1 2017 00
CAUSE OF EVENT
Cause of exhaust piping non-conformance These conditions were part of the original plant design and have existed since the initial construction and licensing of the plants. BV-1 and BV-2 received their operating licenses in 1976 and 1987, respectively.
The design of the BV-1 and BV-2 MSSVs and the ADVs (including the RHRV), as described in the Updated Final Safety Analysis Reports (UFSAR), does not address the fact that these exhaust stacks are not protected against tornado missiles. However, the UFSARs do address that missile protection is provided for the MSSVs and ADVs themselves. As stated in BV-2 UFSAR Table 3.2-1, in addition to the ADVs and MSSVs being missile protected, the auxiliary feed water pump [BA] steam exhaust piping is missile protected. It could not be determined if the existing configuration of the vent stacks was evaluated during the original design and licensing process, or if this condition was considered acceptable due to the low likelihood of damage to the exhaust stacks from tornado generated missiles.
Based on the above, the apparent cause of steam flow discharge flow paths of the BV-1 and BV-2 MSSVs and ADVs not being tornado missile protected was a lack of clarity during the plant's original design and licensing. This led to an inadequate understanding of the tornado missile protection regulatory requirements.
Cause of Open Missile Doors The importance of the function of tornado missile barriers was not identified in plant processes such that site personnel could implement the requirements for missile barrier protection. The importance of protecting against tornado generated missiles was not adequately translated throughout Beaver Valley programs, processes, and training to site personnel.
There was no standard for labeling of doors in regards to hazard barrier requirements.
The conditions where the doors were open and unlatched was pre-existing but previously un-recognized. A previous opportunity to label the doors in response to RIS 2001-09 "Control of Hazard Barriers" was not capitalized on at the time.
Labeling of hazard barriers was instituted following RIS 2001-09. However, tornadoes were not considered. Therefore, the barriers remained unlabeled, and site personnel were not alerted to their function. After the function of the doors for tornado missile protection was recognized, administrative controls were established to normally maintain both doors in the closed and latched position.
Therefore, the apparent cause for the two doors being not closed and latched is the importance of the function of tornado missile barriers was not identified in plant processes such that site personnel could implement the requirements for missile barrier protection.
001 05000- 334 comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
Beaver Valley Power Station Unit Number 1 2017 00
ANALYSIS OF EVENT
There were no actual consequences resulting from these non-conforming conditions. A tornado that could produce the design basis missiles is highly unlikely. There are no actual safety consequences impacting plant safety since neither BV-1 nor BV-2 has experienced any onsite tornado missile event in at least the past three years. The probability of tornado missiles causing multiple MSSVs or ADVs or CCP trains to become inoperable is also very low. In addition, the probability of tornado missiles causing fuel assembly damage greater than currently assumed in accident analysis is also very low.
The plant risk associated with the tornado missile exposure of the steam flow discharge paths of the BV-1 MSSVs and ADVs, the steam flow discharge paths of the BV-2 MSSVs and ASDVs, and the two BV-2 tornado missile barrier doors being found open is considered to be very low. This is based on the probability of tornado-generated missiles hitting the maximum (bounding) unprotected target area being significantly smaller than the baseline Core Damage Frequencies of the effective BVPS Probabilistic Risk Assessment (PRA) models.
These conditions are being reported in accordance with the following 10 CFR 50.73 criteria:
- 10CFR 50.73(a)(2)(i)(B) for any condition which was prohibited by the plant's Technical Specifications. [Both BV-1 and BV-2 for MSSVs/ ADVs and CCP system potentially being inoperable for longer than TS completion times.]
- 10CFR 50.73(a)(2)(ii)(B) for any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety. [All BV-1 and BV-2, MSSVs, ADVs, and the BV-2 CCP system potentially having both trains inoperable, and due to the potential for the irradiated fuel assembly damage to be greater than analyzed due to tornado missile strike(s).]
- 10CFR 50.73(a)(2)(v)(A) for any condition that could have prevented the fulfillment of the safety function of systems that are needed to shut down the reactor and maintain it in a safe shut down condition. [All BV-1 and BV-2 MSSVs, ADVs and both trains of BV-2 CCP potentially being inoperable.]
- 10CFR 50.73(a)(2)(vii)(A) for any event where a single cause or condition caused at least two independent trains to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shut down condition. [All BV-1 and BV-2 for MSSVs, / ADVs, and both trains of BV-2 CCP potentially being inoperable due to same causes (i.e.
- 10CFR 50.73(a)(2)(ix)(A)(1) for any event or condition that as a result of a single cause could have prevented the fulfillment of a safety function for two or more trains or channels in different systems that are needed to shutdown the reactor and maintain it in a safe shutdown condition. [All BV-1 and BV-2, MSSVs, ADVs, and both trains of BV-2 CCP potentially being inoperable due to same causes (i.e. tornado missiles).] Based on the above, the safety significance of the defined license basis non-conforming conditions identified is very low.
These conditions were also reported to the NRC in EN 52571 under 10 CFR 50.72(b)(3)(ii)(B), and 10 CFR 50.72(b)(3)(v)(A).
001 comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
05000- Beaver Valley Power Station Unit Number 1 334
CORRECTIVE ACTIONS:
1. Revise BV-1/BV-2 operating manual procedure 1/2OM-53C.4A.75.1 to specifically mention the MSSV/ADV exhaust piping as being vulnerable to tornado generated missiles, and provide guidance for plant operators to check these first for damage following a tornado or when identifying potential missiles around the site before a possible tornado.
2. The non-conformances which include the BV-1 and BV-2 MSSVs/ADVs exhaust piping may be addressed through physical plant modifications, industry approved risk evaluation, or another method in compliance with the plants licensing basis.
3. BV-2 Doors A-35-5A and F-66-3 have been labeled as tornado missile doors that will remain normally closed and latched.
4. AOP 1/2OM-53C.4A.75.1, Acts of Nature — Severe Weather, has been revised to confirm doors (A-35-5A) and (F-66-3) are closed and latched upon receipt of a Tornado Watch.
5. BV-1 / BV-2 Procedure 1/2-ADM-2021 "Control of Penetrations (Including HELB Doors)" has been requested to be revised to include a list of tornado missile barrier doors.
6. Preventive Maintenance (PM) tasks for BV-2 doors (A-35-5A) and (F-66-3) have been requested to be created.
The Corrective actions listed above will be tracked by applicable condition reports and/ or Notifications associated with these events.
PREVIOUS SIMILAR EVENTS
A review of previous BVPS LERs in the past three years was conducted for issues related to removing/maintaining tornado missile barriers during plant operation. The following LER was determined to be similar to these events:
BV-1 and BV-2 LER 2014-005-00 "Containment equipment hatch missile shield removal inadvertently results in exceeding Technical Specification 3.6.1 required completion times".
CR 2017-01959, CR 2017-01963, AND CR 2017-03608