IR 05000259/2011004

IR 05000259-11-004, 05000260-11-004, 05000296-11-004; on 07/01/2011 - 09/30/2011, Browns Ferry, Units 1, 2, and 3; Integrated Inspection Report

ML113180503
Person / Time
Site:	Browns Ferry
Issue date:	11/14/2011
From:	Eugene Guthrie Division Reactor Projects II
To:	James Shea Tennessee Valley Authority
References
IR-11-004
Download: ML113180503 (58)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION ber 14, 2011

SUBJECT:

BROWNS FERRY NUCLEAR PLANT - NRC INTEGRATED INSPECTION REPORT 05000259/2011004, 05000260/2011004, AND 05000296/2011004

Dear Mr. Shea:

On September 30, 2011, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Browns Ferry Nuclear Plant, Units 1, 2, and 3. The enclosed inspection report documents the inspection results which were discussed on October 13, 2011, with Mr. C.

J. Gannon and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations, orders, and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents one self-revealing apparent violation (AV) concerning an improperly installed outboard bearing on the Unit 1 High Pressure Coolant Injection (HPCI) system booster pump. This violation has potential safety significance greater than very low safety significance (Green). However, the violation does not represent an immediate safety concern because the booster pump bearing was replaced, and the Unit 1 HPCI system was returned to service after successful post-maintenance testing. This violation with the supporting circumstances and details is documented in the inspection report.

This report also documents three findings of very low safety significance (Green). These findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and they were entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with the NRCs Enforcement Policy. Furthermore, one licensee-identified violation, which was determined to be of very low safety significance, is listed in this report. If you contest any violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001, with copies to: (1) the Regional Administrator, Region II; (2) the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and

TVA 2 (3) the Senior Resident Inspector at the Browns Ferry Nuclear Plant. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the Senior Resident Inspector at the Browns Ferry Nuclear Plant.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.

Sincerely,

/RA/

Eugene F. Guthrie, Chief Special Project, Browns Ferry Division of Reactor Projects Docket Nos.: 50-259, 50-260, 50-296 License Nos.: DPR-33, DPR-52, DPR-68

Enclosure:

NRC Integrated Inspection Report 05000259/2011004, 05000260/2011004, and 05000296/2011004

REGION II==

Docket Nos.: 50-259, 50-260, 50-296 License Nos.: DPR-33, DPR-52, DPR-68 Report No.: 05000259/2011004, 05000260/2011004, 05000296/2011004 Licensee: Tennessee Valley Authority (TVA)

Facility: Browns Ferry Nuclear Plant, Units 1, 2, and 3 Location: Corner of Shaw and Nuclear Plant Roads Athens, AL 35611 Dates: July 1, 2011, through September 30, 2011 Inspectors: T. Ross, Senior Resident Inspector C. Stancil, Resident Inspector P. Niebaum, Resident Inspector L. Pressley, Resident Inspector Approved by: Eugene F. Guthrie, Chief Reactor Projects Special Branch Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000259/2011004, 05000260/2011004, 05000296/2011004; 07/01/2011 - 09/30/2011;

Browns Ferry Nuclear Plant, Units 1, 2 and 3; Fire Protection, Surveillance Testing and Event Followup.

The report covered a three month period of inspection by the resident inspectors. One apparent violation (AV) and three non-cited violations (NCV) were identified. The significance of most findings is identified by their color (Green, White, Yellow, and Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP); and, the cross-cutting aspects were determined using IMC 0310, Components Within the Cross-Cutting Areas.

Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process Revision 4, dated December 2006.

Cornerstone: Initiating Events

Green.

A NRC-identified non-cited violation of the Technical Specifications 5.4.1.d,

Fire Protection Program Implementation, was identified for the licensees failure to control transient combustible materials in a designated exclusion area between Fire Zones 1-1 and 1-2 in the Unit 1 reactor building. Specifically, on August 12, 2011, the inspectors identified transient combustible materials left unattended in the designated exclusion area between Loops I and II of the low pressure coolant injection (LPCI) system following LPCI injection valve maintenance activities. Upon notification by the inspectors, the licensee promptly removed the materials. This issue was entered into the licensees corrective action program as problem evaluation report (PER) 418101.

The finding was determined to be greater than minor because it was similar to example 4.k. of Inspection Manual Chapter (IMC) 0612, Appendix E, for an issue of concern involving transient combustibles in a designated combustible free area required for separation of redundant safe shutdown trains. The safety significance of the finding was characterized using IMC 0609, Significance Determination Process (SDP), Appendix F, Attachment 1, Fire Protection SDP Phase 1 Worksheet, and determined to be of very low safety significance because of a low degradation rating since a roving fire watch was already established in this same area for an another fire impairment while the transient combustibles were left unattended. The cause of this finding was directly related to the cross cutting aspect of effectively communicating expectations regarding procedural compliance in the Work Practices component of the Human Performance area, because the expectations for the removal of combustible materials from this area were not effectively communicated to the night shift personnel H.4(b). (Section 1RO5.1)

Green.

A self-revealing non-cited violation of Technical Specifications 5.4.1.a was identified for the licensees failure to establish an adequate maintenance procedure to ensure appropriate calibration and alignment of the Emergency Diesel Generator (EDG) overspeed trip limit switch (OTLS) arm. The lack of procedure guidance resulted in an improperly adjusted OTLS that caused a premature trip of the A EDG output breaker and loss of Unit 1 shutdown cooling (SDC) on May 2, 2011. The licensee replaced and properly set the OTLS on the A EDG, verified the OTLS setpoint on all other seven EDGs, and initiated revisions to applicable maintenance procedures. This issue was entered into the licensees corrective action program as problem evaluation report (PER) 362340.

The finding was determined to be greater than minor because it was associated with the Initiating Events Cornerstone attribute of Equipment Performance, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown. Specifically, the misadjusted A EDG OTLS resulted in a premature trip of the A EDG output breaker and a loss of Unit 1 SDC. According to Inspection Manual Chapter (IMC)0609, Significance Determination Process (SDP), Appendix G, Shutdown Operations, Table 1, Losses of Control, the safety significance of the finding was initially characterized to be potentially greater than very low safety significance because the inadvertent loss of SDC represented a loss of control due to a loss of thermal margin to boiling greater than 20 percent. However, a Phase 3 analysis was performed by a Senior Reactor Analyst, it was determined the loss of SDC event was of very low risk significance (i.e., Green), due in part to a low change in risk because of a high chance of recovery of offsite power before the duration of time required to cause the EDG to trip, and the likelihood of recovery of the tripped EDG. The cause of this finding was directly related to the cross-cutting aspect of appropriate self assessments in the Self and Independent Assessments component of the Problem Identification and Resolution area, because inadequate technical rigor applied by the licensee to recognize single point system vulnerabilities resulted in inadequate procedural guidance for maintenance personnel to appropriately calibrate and align the OTLS switch arm and overspeed trip lever [P.3.(a)]. (Section 4OA3.2)

Green.

A self-revealing non-cited violation of Technical Specifications 5.4.1.a was identified for the licensees failure to establish adequate work order instructions for maintenance activities on CR120A relays associated with the Unit 3 Primary Containment Isolation System (PCIS). Consequently, on May 12, 2011, while performing maintenance on a CR120A relay, electricians inadvertently initiated a PCIS Group 2 actuation which resulted in a loss of Unit 3 shutdown cooling (SDC).

The licensee immediately restored the affected relay wiring and reestablished Unit 3 SDC. Additional, corrective actions to revise CR120A relay maintenance procedures were in progress. This issue was entered into the licensees corrective action program as problem evaluation report (PER) 368764.

The finding was determined to be greater than minor because it was associated with the Initiating Events Cornerstone attribute of Procedure Quality, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown. Specifically, the work package to replace the Unit 3 PCIS relays did not include specific work precautions or instructions to require that jumpers be installed to prevent an inadvertent Group 2 PCIS actuation. According to Inspection Manual Chapter (IMC)0609, Significance Determination Process (SDP), Appendix G, Shutdown Operations, Table 1, Losses of Control, the finding was determined to be of very low safety significance because the change in temperature during the inadvertent loss of SDC did not exceed 20 percent of the temperature margin to boil. In addition,

Checklist 8 of Appendix G, Attachment 1, Shutdown Operations, confirmed adequate mitigation capability remained available for all of the shutdown safety functions to be considered of very low safety significance. The cause of this finding was directly related to the cross-cutting aspect of complete documentation in the Resources component of the Human Performance area, because the licensee failed to provide adequate work package details concerning the replacement of PCIS relays which resulted in the loss of SDC [H.2.(c)]. (Section 4OA3.6)

Cornerstone: Mitigating Systems

• (TBD). A licensee-identified apparent violation of Technical Specifications 5.4.1.a was identified for the licensee failing to establish an adequate maintenance instruction for properly installing the Unit 1 High Pressure Coolant Injection (HPCI)booster pump outboard bearing. On July 20, 2011, visual inspections confirmed the booster pump outboard bearing was installed incorrectly and exhibited severe damage. The licensee replaced the HPCI booster pump outboard bearing and the issue was entered into the licensees corrective action program as problem evaluation reports (PER) 405165 and 408067.

The finding was determined to be greater than minor because it was associated with the Mitigating Systems Cornerstone attributes of Equipment Performance and Procedure Quality, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the work package to replace the HPCI booster pump outboard bearing did not include sufficiently detailed instructions to ensure that the bearings were installed in the correct back to back arrangement. Failure to correctly install the HPCI booster pump bearing resulted in severe bearing damage that would have eventually led to a failure of the Unit 1 HPCI pump. The significance of this finding was characterized using Inspector Manual Chapter (IMC) 609, Significance Determination Process (SDP),

Attachment 04, Phase 1 - Initial Screening and Characterization of Findings, which did not screen as Green for the Mitigating Systems Cornerstone because it involved a loss of system safety function. A further characterization of the safety significance was then performed using IMC 609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations. The Phase 2 SDP of Appendix A determined the finding to be potentially greater than very low safety significance (Green) based on the Browns Ferry Phase 2 pre-solved table. Since this finding was potentially greater than Green it will necessitate a Phase 3 SDP to characterize the safety significance. Because the safety significance of this finding has not been finalized, it will be designated as To Be Determined (TBD). No crosscutting aspect was assigned because the incorrect bearing installation did not occur within the past three years, and therefore, was not reflective of current licensee performance.

(Section 1R22)

Licensee Identified Violations

One violation of very low safety significance, which was identified by the licensee, has been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. The violation and the corrective action program tracking number are listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

Unit 1 operated at essentially full Rated Thermal Power (RTP) for most of the report period except for two planned downpowers and six unplanned downpowers. On July 27, 2011, an unplanned downpower to 70 percent RTP was conducted due to a 1A3 reactor feedwater (RFW) heater manway leak of 10 gpm which exceeded the radwaste system capacity in volume and temperature. Additionally, on July 27, another unplanned downpower from 70 to 60 percent RTP was conducted due to high downstream river temperatures. Reactor power was further reduced to 50 percent RTP on August 2, again for elevated river temperatures. Unit power was incrementally raised until the unit returned to full RTP on August 6. On August 6, 2011, an unplanned downpower to 96 percent RTP was conducted due to a Technical Specifications (TS)3.0.3 entry due to a loss of all reactor coolant leakage detection capability required by TS 3.4.5.

The unit returned to full RTP that same day. On September 7, 2011, an unplanned downpower to 93 percent RTP was conducted due to a large steam leak from 1C1 RFW heater. The unit returned to full RTP on September 8. On September 8, 2011, an unplanned downpower to 71 percent RTP was conducted to isolate the RFW side of the 1C1 and 1C2 RFW heaters. The unit returned to full RTP on September 14. On September 15, 2011, a planned downpower to 85 percent RTP was conducted for a routine control rod pattern adjustment and returned to full RTP that same day.

Unit 2 operated at essentially full RTP for most of the report period except for two planned downpowers and three unplanned downpowers. On August 2, 2011, an unplanned downpower to 50 percent RTP was conducted due to high downstream river temperatures. Unit power was incrementally raised until the unit returned to full RTP on August 6. On August 18, 2011, an unplanned downpower to 65 percent RTP was conducted due to the manual closure of 2A outboard main steam isolation valve (MSIV) to minimize the risk of an inadvertent trip from an electrical fault. Following repairs, the unit returned to full RTP on August 19. On September 16, 2011, an unplanned downpower to 95 percent RTP was conducted due to 2B4 RFW heater normal level control valve failed closed, and following repair, returned to full RTP that same day.

On September 30, 2011, a planned downpower to 80 percent RTP was conducted for a routine control rod pattern adjustment and returned to full RTP that same day.

Unit 3 operated at essentially full RTP for most of the report period except for one planned downpower, one unplanned downpower, and an automatic reactor scram. On August 2, 2011, an unplanned downpower to 50 percent RTP was conducted due to high downstream river temperatures. Unit power was incrementally raised until the unit returned to full RTP on August

6. On September 28, 2011, an automatic scram occurred from full RTP due to an unexpected

main turbine generator trip. The main generator trip initiated a power-to-load unbalance which tripped the main turbine and subsequently initiated a reactor scram. The main generator tripped due to actuation of the generator neutral overvoltage relay when a piece of metal screening in the isophase bus duct broke off and grounded the C phase isophase bus. Following repairs, the unit restarted (i.e., entered Mode 2) on September 29, raised power to approximately 20% and synchronized the main generator to the grid on September 30. But the main turbine generator (MTG) was manually tripped shortly thereafter due to high vibrations. The MTG was re-synchronized to the grid on October 1 and returned to full RTP on October

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R04 Equipment Alignment

.1 Partial Walkdown

a. Inspection Scope

The inspectors conducted three partial equipment alignment walkdowns to evaluate the operability of selected redundant trains or backup systems, listed below, while the other train or subsystem was inoperable or out of service. The inspectors reviewed the functional systems descriptions, Updated Final Safety Analysis Report (UFSAR), system operating procedures, and Technical Specifications (TS) to determine correct system lineups for the current plant conditions. The inspectors performed walkdowns of the systems to verify that critical components were properly aligned and to identify any discrepancies which could affect operability of the redundant train or backup system.

• Unit 1/2 D Emergency Diesel Generator (EDG)

• Unit 1 Residual Heat Removal (RHR) Division II

• Unit 3 Standby Liquid Control (SLC) System

b. Findings

No findings were identified.

.2 Complete Walkdown

a. Inspection Scope

The inspectors completed a detailed alignment verification of the Unit 2 RHR System, Division I, using the applicable piping and flow diagram (0-47E811-1), along with the relevant operating instructions (2-OI-74) and attachments, to verify equipment availability and operability. The inspectors reviewed relevant portions of the UFSAR and TS. This detailed walkdown also verified electrical power alignment, the condition of applicable system instrumentation and controls, component labeling, pipe hangers and support installation, and associated support systems status. Furthermore, the inspectors examined applicable System Health Reports, open Work Orders, and any previous Problem Evaluation Reports (PERs) that could affect system alignment and operability.

b. Findings

No findings were identified.

1R05 Fire Protection

.1 Fire Protection Tours

a. Inspection Scope

The inspectors reviewed licensee procedures, Nuclear Power Group Standard Programs and Processes (NPG-SPP)-18.4.7, Control of Transient Combustibles, and NPG-SPP-18.4.6, Control of Fire Protection Impairments, and conducted a walkdown of six fire areas (FA) and fire zones (FZ) listed below. Selected FAs/FZs were examined in order to verify licensee control of transient combustibles and ignition sources; the material condition of fire protection equipment and fire barriers; and operational lineup and operational condition of fire protection features or measures. Also, the inspectors verified that selected fire protection impairments were identified and controlled in accordance with procedure NPG-SPP-18.4.6. Furthermore, the inspectors reviewed applicable portions of the Fire Protection Report, Volumes 1 and 2, including the applicable Fire Hazards Analysis, and Pre-Fire Plan drawings, to verify that the necessary firefighting equipment, such as fire extinguishers, hose stations, ladders, and communications equipment, was in place. This activity constituted six inspection samples.

• Unit 3 Reactor Building, Elevation (EL) 621 and EL 639 (FZ 3-4)

• Unit 2 Reactor Building EL 621 Electric Board Room and 250V Battery Room (FA-9)

• Unit 2 Reactor Building EL 639 South of Column Line R (FZ 2-6)

• Unit 2 Reactor Building, EL 621 480V Shutdown Board Room 2A (FA 10)

• Unit 2 Reactor Building, EL 621 480V Shutdown Board Room 2B (FA 11)

• Unit 1 Reactor Building EL 519 and 565 Designated Exclusion Area Between FZs 1-1 and 1-2)

b. Findings

Introduction:

A Green NRC-identified non-cited violation (NCV) of the T.S. 5.4.1.d, Fire Protection Program Implementation, was identified for the licensees failure to control transient combustible materials in the designated exclusion area in the Unit 1 reactor building.

Description:

On August 12, the inspectors identified combustible materials left unattended in the designated exclusion area on top of the drywell primary containment personnel access room (i.e., the clean room) of the Unit 1 reactor building. This exclusion area was painted red and established the required 20 foot separation between Fire Zones 1-1 and 1-2, which included separation of both trains of the Low Pressure Coolant Injection (LPCI) valves located on top of the clean room. Section 7.2.2, Combustible Material Control Procedures of the Fire Protection Plan stated the following The Fire Protection Program restricts the storage or staging of transient combustibles during modes 1, 2, or 3 within the twenty foot zone of separation, visibly marked as red floors. Also, NPG-SPP-18.4.7, Control of Transient Combustibles, Section 3.2.2 stated Transient combustibles are not allowed to be staged or stored in areas visibly marked as red floor areas while the applicable Unit is in Mode 1,2, or 3. The materials discovered in the red floor area on the clean room were related to maintenance activities on the Unit 1 LPCI outboard injection valve (1-FCV-74-66). The inspectors had verified the materials were not inside the red floor area at the conclusion of day shift on August 11. However, during night shift of August 11, the materials were restaged to support continued maintenance on the 1-FCV-74-66 valve. This time, the transient combustibles were discovered unattended in the red floor area by the inspectors on dayshift of August 12. The materials consisted of a large plastic bag of clean rags, a small pile of oily rags, two canvas tool bags with tools, two empty plastic bags, several nylon FME covers, and a roll of red duct tape. These materials were left in close proximity to a stencil on the floor that stated Do not store combustible material in this area. The inspectors immediately notified the work control center, who promptly contacted the maintenance shop which removed the materials from the red floor area. This issue was captured in the licensees corrective action program (CAP) as PER 418101.

The inspectors recognized that the required compensatory measure for a lack of spatial separation between redundant trains of Appendix R safe shutdown equipment was to station a one hour roving fire watch. An hourly fire watch had already been established in this area as a compensatory measure for a previous unrelated fire impairment.

Analysis:

Storing or staging transient combustibles in a red floor area while the unit was in Mode 1, 2, or 3 was a performance deficiency. The performance deficiency was determined to be more than minor because it was considered sufficiently similar to example 4.k of Inspection Manual Chapter (IMC) 0612, Appendix E, for identified transient combustibles in a combustible free zone required for separation of redundant trains. The finding was associated with the Initiating Events Cornerstone and characterized according to IMC 0609, Significance Determination Process (SDP),

Appendix F, Attachment 1, Fire Protection SDP Phase 1 Worksheet. A low degradation rating was assigned to the finding because a roving fire watch was already established during the time the transient combustibles were left in the red floor area and could have promptly detected any fire in the area. Therefore the finding screened as having a very low safety significance (Green). The cause this finding was directly related to the cross cutting aspect of Procedural Compliance in the Work Practices component of the Human Performance area, because maintenance workers failed to comply with written procedures and posted instructions regarding storage of combustible materials in the red floor area H.4(b).

Enforcement:

Technical Specification 5.4.1.d required that written procedures for the Fire Protection Program shall be established and implemented. Section 7.2.2.c, Combustible Material Control Procedures of the Fire Protection Plan established that the storage or staging of transient combustibles during modes 1, 2, or 3 would be restricted from within the twenty foot zone of separation, visibly marked as red floors. Contrary to the above, on August 12, 2011, the licensee failed to adequately control transient combustibles in a red floor area in the Unit 1 reactor building as required by the Fire Protection Plan. The licensee promptly removed the transient combustibles from the restricted area. Because this violation was of very low safety significance and it was entered into the licensees CAP as PER 418101, this violation is being treated as an NCV, consistent with the NRC Enforcement Policy. This NCV is identified as NCV 05000259/2011004-01, Failure to Control Transient Combustible Materials in the Unit 1 Reactor Building.

1R06 Internal Flood Protection Measures

.1 Areas Susceptible to Internal Flooding

a. Inspection Scope

The inspectors performed a review of the common Unit 1, 2 and 3 RHR Service Water (RHRSW) and Emergency Equipment Cooling Water (EECW) pump rooms located within the Intake Pumping Station for internal flood protection measures. The inspectors reviewed plant design features and measures intended to protect the plant and its safety-related equipment from internal flooding events, as described in the following documents: UFSAR; Moderate Energy Line Break Flood Evaluation Report for Unit 1-Extended Power Uprate; and Browns Ferry Nuclear Plant Probabilistic Safety Assessment, Internal Flooding Notebook, Rev. 1.

The inspectors also performed walkdowns of risk-significant areas, susceptible systems and equipment, including the RHRSW and EECW pump rooms to review flood-significant features such as area level switches, room sumps and sump pumps, flood protection door seals, conduit seals and instrument racks that might be subjected to flood conditions. Plant procedures for mitigating flooding events were also reviewed to verify that licensee actions were consistent with the plants design basis assumptions.

The inspectors also reviewed a sampling of the licensees corrective action documents with respect to flood-related items to verify that problems were being identified and corrected. Furthermore, the inspectors reviewed selected completed preventive maintenance procedures, work orders, and surveillance procedures to verify that actions were completed within the specified frequency and in accordance with design basis documents. This activity constituted one inspection sample.

b. Findings

No findings were identified.

.2 Cables Located in Underground Bunkers/Manholes

a. Inspection Scope

The inspectors conducted an inspection of underground bunkers/manholes subject to flooding that contain cables whose failure could disable risk-significant equipment. The inspectors performed walkdowns of the following underground areas containing safety-related and/or risk significant cables: 1) Hand-Hole (HH) 15 and HH-26 located on the east-side of the reactor building; 2) Intake Cable Tunnel connecting the Unit 3 turbine building with the Intake Building; and 3) Switchyard Cable Tunnel between the Turbine Building and 500 KV switchyard. These walkdowns were conducted to verify that safety-related and/or risk-significant cables were not submerged in water, or water damaged; all cables and/or splices appeared intact; and the proper condition of associated cable tray support structures. As applicable, the inspectors verified proper operation of installed dewatering devices (i.e., sump pumps) and level switches to ensure that affected cables would not become submerged. Where dewatering devices were not installed, the inspectors ensured that drainage was provided and was functioning properly.

Furthermore, the inspectors reviewed past preventative maintenance activities performed by the licensee to visually inspect all plant manholes, valve pits, and cable tunnels; and check operability of applicable sump pumps. This activity constituted one inspection sample.

b. Findings

No findings were identified.

1R11 Licensed Operator Requalification

a. Inspection Scope

On August 15, 2011, the inspectors observed an as-found licensed operator requalification simulator examination for an operating crew according to Unit 2 Simulator Exercise Guide OPL177.101, Failure of RPS A with a Failure of C SBGT to Start, Recirc. Pump Trip, Power Oscillations, ATWS, Stuck Open SRV and SRV Tailpipe Break in Containment.

The inspectors specifically evaluated the following attributes related to the operating crews performance:

• Clarity and formality of communication

• Ability to take timely action to safely control the unit

• Prioritization, interpretation, and verification of alarms

• Correct use and implementation of Abnormal Operating Instructions (AOIs), and Emergency Operating Instructions (EOIs)

• Timely and appropriate Emergency Action Level declarations per Emergency Plan Implementing Procedures (EPIP)

• Control board operation and manipulation, including high-risk operator actions

• Command and Control provided by the Unit Supervisor and Shift Manager The inspectors attended the post-examination critique to assess the effectiveness of the licensee evaluators, and to verify that licensee-identified issues were comparable to issues identified by the inspector. The inspectors also reviewed simulator physical fidelity (i.e., the degree of similarity between the simulator and the reference plant control room, such as physical location of panels, equipment, instruments, controls, labels, and related form and function). This activity constituted one inspection sample.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

.1 Routine

a. Inspection Scope

The inspectors examined two specific equipment issues listed below for structures, systems and components (SSC) within the scope of the Maintenance Rule (MR)

(10CFR50.65) with regard to some or all of the following attributes, as applicable:

(1) Appropriate work practices;

(2) Identifying and addressing common cause failures;

(3) Scoping in accordance with 10 CFR 50.65(b) of the MR;

(4) Characterizing reliability issues for performance monitoring;

(5) Charging unavailability for performance monitoring;

(6) Balancing reliability and unavailability;

(7) Trending key parameters for condition monitoring;

(8) System classification and reclassification in accordance with 10 CFR 50.65(a)(1) or (a)(2);

(9) Appropriateness of performance criteria in accordance with 10 CFR 50.65(a)(2); and

(10) Appropriateness and adequacy of 10 CFR 50.65 (a)(1) goals, monitoring and corrective actions (i.e. Ten Point Plan). The inspectors also compared the licensees performance against site procedure NPG-SPP-3.4, Maintenance Rule Performance Indicator Monitoring, Trending and Reporting; Technical Instruction 0-TI-346, Maintenance Rule Performance Indicator Monitoring, Trending and Reporting; and NPG-SPP 3.1, Corrective Action Program. The inspectors also reviewed, as applicable, work orders, surveillance records, PERs, system health reports, engineering evaluations, and MR expert panel minutes; and attended MR expert panel meetings to verify that regulatory and procedural requirements were met.

• Control Room Emergency Ventilation System (CREVS) Control Circuit and Fuse Long Term Issues

• 250 VDC System, Battery Boards 4, 5, and 6 Development of Performance Criteria and return to 10CFR50.65(a)(2) classification

b. Findings

No findings were identified.

1R13 Maintenance Risk Assessments and Emergent Work Evaluation

a. Inspection Scope

For planned online work and/or emergent work that affected the combinations of risk significant systems listed below, the inspectors reviewed five maintenance risk assessments, and actions taken to plan and/or control work activities to effectively manage and minimize risk. The inspectors verified that risk assessments and applicable risk management actions (RMA) were conducted as required by 10 CFR 50.65(a)(4) and applicable plant procedures such as NPG-SPP-7.0, Work Management; NPG-SPP-7.1, On-Line Work Management; 0-TI-367, BFN Equipment to Plant Risk Matrix; NPG-SPP-7.3, Work Activity Risk Management Process; and NPG-SPP-7.2, Outage Management.

Furthermore, as applicable, the inspectors verified the actual in-plant configurations to ensure accuracy of the licensees risk assessments and adequacy of RMA implementation.

• D 4KV Shutdown Board, D EDG, Unit 2 Division II LPCI Valve 74-66, 2A Outboard Main Steam Isolation Valve (MSIV), and G Control Air Compressor (CAC) out of service (OOS)

• F Service Air Compressor, G CAC, B CAC, 1B Control Bay Chiller, 3C EDG, 1B Control Rod Drive (CRD) Pump OOS

• 3D EDG, Unit 3 RHR Division II, and Unit 3 High Pressure Coolant Injection (HPCI)

OOS during Work Week (WW) 1132

• Unit 1 North EECW Header, Reactor Zone Ventilation Fans/Dampers, Reactor Building to Suppression Chamber Vacuum Breakers, and 1C Raw Cooling Water Pump OOS

• 3ED 4KV Shutdown Board degraded voltage relays and A2 RHRSW pump OOS with 3A RPS power supply on alternate

b. Findings

No findings were identified.

1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the six operability/functional evaluations listed below to verify technical adequacy and ensure that the licensee had adequately assessed TS operability. The inspectors also reviewed applicable sections of the UFSAR to verify that the system or component remained available to perform its intended function. In addition, where appropriate, the inspectors reviewed licensee procedure NEDP-22, Functional Evaluations, to ensure that the licensees evaluation met procedure requirements. Furthermore, where applicable, inspectors examined the implementation of compensatory measures to verify that they achieved the intended purpose and that the measures were adequately controlled. The inspectors also reviewed PERs on a daily basis to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.

• Unit Common: Water and Debris in SBGT Suction Piping (PER 384210)

• Units 1 and 2: C EDG Governor Oil Leak (PER 361305)

• Units 1 and 2: A EDG Overspeed Trip Limit Switch Marginal Setting (PER 362340)

• Unit 3: Missile Protection of EDG Fuel Oil Storage Tank Vents/Flame Arrestors

• Unit 2: Failure of Core Spray Relay 2-RLY-075-14A-K30B Extent of Condition

• Unit 3 Control Rod Blade to Fuel Channel Interference (PER 236036)

b. Findings

No findings were identified.

1R19 Post Maintenance Testing

a. Inspection Scope

The inspectors reviewed the six post-maintenance tests (PMT) listed below to verify that procedures and test activities confirmed SSC operability and functional capability following maintenance. The inspectors reviewed the licensees completed test procedures to ensure any of the SSC safety function(s) that may have been affected were adequately tested, that the acceptance criteria were consistent with information in the applicable licensing basis and/or design basis documents, and that the procedure had been properly reviewed and approved. The inspectors also witnessed the test and/or reviewed the test data, to verify that test results adequately demonstrated restoration of the affected safety function(s). The inspectors verified that PMT activities were conducted in accordance with applicable WO instructions, or procedural requirements, including NPG-SPP-06.3, Pre-/Post-Maintenance Testing, and MMDP-1, Maintenance Management System. Furthermore, the inspectors verified that problems associated with PMTs were identified and entered into the CAP.

• Shutdown Board C Battery Replacement PMT per WO 112202248.

• 3A EDG Six Year Inspections and PMT per WO 11845795

• Unit 1 LPCI Division I Outboard Injection Valve 74-52 Repair PMT per WO 112519700

• 2A Outboard MSIV DC Coil Replacement and Circuit Repair PMT per WOs 112586072 and 112579402

• CREVS Train A PMT per 0-SR-3.7.3, Control Room Emergency Ventilation System Post Maintenance Operability Test

• Unit 1 HPCI Booster Pump Outboard Bearing Replacement PMT per 1-SR-3.5.1.7(COMP), HPCI Comprehensive Pump Test

b. Findings

No findings were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors witnessed portions of, and/or reviewed completed test data for the following seven surveillance tests of risk-significant and/or safety-related systems to verify that the tests met TS surveillance requirements, UFSAR commitments, and in-service testing and licensee procedure requirements. The inspectors review confirmed whether the testing effectively demonstrated that the SSCs were operationally capable of performing their intended safety functions and fulfilled the intent of the associated surveillance requirement.

In-Service Tests:

• 3-SR-3.5.1.6 (RHR II), Quarterly RHR System Rated Flow Test Loop II Routine Surveillance Tests:

• 1-SR-3.5.1.6 (RHR I), Quarterly RHR System Rated Flow Test Loop I

• 1-SR-3.5.1.7, HPCI Main and Booster Pump Set Developed Head and Flow Rate Test at Rated Reactor Pressure

• 2-SR-3.3.5.1.6(CS II), Core Spray System Logic Functional Test Loop II

• 3-SR-3.5.1.6(CS II), Core Spray Flow Rate Loop II

• 3-SR-3.5.1.7, HPCI Main and Booster Pump Set Developed Head and Flow Rate Test at Rated Reactor Pressure

• 3-SR-3.5.3.3, Reactor Core Isolation Cooling (RCIC) Rated Flow at Normal Operating Pressure

b. Findings

One finding was identified as described below. Another finding was also identified as described in Section 4OA7 of this report.

Introduction:

A licensee-identified Apparent Violation (AV) of TS 5.4.1.a was identified for the licensees failure to establish adequate work instructions to ensure proper installation of the Unit 1 HPCI booster pump outboard bearing assembly that resulted in severe damage to the bearings which would have eventually led to a failure of the Unit 1 HPCI pump.

Description:

On July 20, 2011, during the performance of quarterly surveillance test 1-SR-3.5.1.7, HPCI Main and Booster Pump Set Developed Head and Flow Rate Test at Rated Reactor Pressure, several vibration data points were identified as elevated or higher than expected. The total run time of HPCI during this surveillance test was approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The licensee initiated PER 405165 to enter the issue into their CAP. Further investigation by the licensee indicated an increasing trend in vibration levels was evident, as well as the presence of excessive wear metal particulates in a subsequent lube oil sample. On July 23, 2011, Unit 1 HPCI was removed from service for a physical inspection of the HPCI pump bearings which determined the booster pump outboard bearings were installed incorrectly and severely damaged. The licensee initiated PER 408067 and performed maintenance to replace the HPCI booster pump outboard bearings. The booster pump outboard bearing assembly consisted of two separate bearing assemblies configured in a back to back arrangement to control thrust in both axial directions. During disassembly and inspection the licensee discovered the bearings in a tandem arrangement which would only withstand thrust in one direction (i.e., in the direction away from the gearbox). The as-found condition of the bearings and inner races exhibited severe wear, with light wear to the outer race, and cage damage from contact with the retainer ring and adjacent bearing inner race. Unit 1 HPCI was returned to service (RTS) and declared operable on July 27, 2011, after the bearing replacement and related repairs were completed. In addition, as part of the extent of condition review, bearing lube oil samples were taken and analyzed for HPCI on Units 2 and 3. These samples did not indicate any anomalous results. Vibration levels were also verified to be normal. Furthermore, additional work orders (WOs) were initiated to verify correct bearing installation on Units 2 and 3.

The Unit 1 HPCI booster pump bearings were initially installed on March 16, 2005 per WO 2002-013120-030 and Mechanical Corrective Instruction MCI-0-073-PMP002, HPCI Booster Pump - Inspection, Rework and Reassembly, as part of the Unit 1 recovery project. Bearing vibration had been monitored and trended since that time with no unusual indications until May 2011 during post-maintenance testing following a HPCI system over pressurization event and subsequent repairs (see below).

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and a loss of offsite power (LOOP) event that resulted in a reactor scram on all three Browns Ferry units (see also Section 4OA 3.8 of this report). For the first two days of the LOOP event, Unit 1 HPCI was placed into service about five different times, accumulating approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> of total runtime. No vibration data was taken during this accumulated runtime. Unit 1 achieved Mode 4 cold shutdown conditions on April 28. On May 19, 2011, Unit 1 was restarted and synchronized back onto the grid the next day.

On May 20, 2011, operators opened HPCI System Inboard Discharge Valve, to fill and vent portions of the system while performing 1-SR-3.5.1.1(HPCI), Maintenance of Filled HPCI Discharge Piping. However, during this fill and vent evolution significant damage to the HPCI system water-side occurred from an inadvertent system over-pressurization event due to unexpected leakage past the HPCI system testable check valve (see also Section 4OA3.4 of this report). The licensee initiated PER 372659, repaired the damage to the HPCI system, and returned Unit 1 HPCI to service on May 31, 2011.During this HPCI system equipment outage , the licensee also attempted to improve overall HPCI turbine and pump alignment in order to reduce overall system vibrations. But, just prior to returning Unit 1 HPCI system to service, the licensee did identify some increased vibration levels from the main and booster pumps during system PMTs, and promptly initiated PER 378921. The magnitude of these in-service vibrations did not require immediate corrective actions. Approximately two hours of run time was accumulated during the HPCI system PMTs.

Although the licensees root cause determination was still in progress, the licensee did determine the as-found degraded condition of the Unit 1 HPCI booster pump bearings was a maintenance preventable functional failure of the Unit 1 HPCI system. The inspectors verified that the last time the Unit 1 HPCI system demonstrated it was capable of fulfilling its safety function, for the full eight hour mission time, was during the LOOP event of April 2011. Based on this, the inspectors concluded the capability of the Unit 1 HPCI pump to fulfill its safety function for the required mission time was indeterminate for approximately 68 days from May 19 (Unit 1 entered Mode 2) to July 27, 2011 (HPCI RTS), while it was required to be operable by TS.

Analysis:

The licensees failure to provide adequate work instructions to ensure the HPCI booster pump outboard bearings were correctly installed was a performance deficiency which resulted in severe damage to the bearings. This performance deficiency was considered more than minor because it was associated with the Equipment Performance and Procedure Quality attributes of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the work instructions to replace the HPCI booster pump outboard bearings under WO 2002-013120-030 and procedure MCI-0-073-PMP002 did not include sufficiently detailed instructions to ensure that the bearings were installed in the correct arrangement. Failure to correctly install the booster pump bearings resulted in severe bearing damage that would have eventually led to the loss of the HPCI safety function. The significance of this finding was characterized using Inspector Manual Chapter (IMC) 609, Significance Determination Process (SDP), Attachment 04, Phase 1 - Initial Screening and Characterization of Findings, which did not screen as Green for the Mitigating Systems Cornerstone because it involved a loss of system safety function. A further characterization of the safety significance was then performed using IMC 609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations.

The Phase 2 SDP of Appendix A determined the finding to be potentially greater than very low safety significance (Green) based on the Browns Ferry Phase 2 pre-solved table. Since this finding was potentially greater than Green it will necessitate a Phase 3 SDP to characterize the safety significance. However, because the safety significance of this finding has not been finalized, it will be designated as To Be Determined (TBD).

This finding was determined to not have a cross-cutting aspect because the bearing was incorrectly installed in March of 2005 during activities related to Unit 1 recovery.

Therefore since the maintenance activities related to the incorrect bearing replacement did not occur within the past three years, and the licensee identified the degraded bearings as soon as reasonably expected, this finding was not considered to be reflective of current licensee performance so no cross-cutting aspect was assigned.

Enforcement:

Unit 1 TS 5.4.1.a. required that written procedures recommended in Regulatory Guide (RG) 1.33, Revision 2, Appendix A, shall be established, implemented, and maintained. Item 9.a of RG 1.33, Appendix A, stated, in part, that maintenance affecting the performance of safety-related equipment be properly preplanned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to the above, on March 16, 2005, the licensee failed to establish an adequate procedure for the performance of maintenance that affected the performance of a piece of safety related equipment. Specifically, the level of detail in work order package WO 2002-013120-030 and procedure MCI-0-073-PMP002 was inadequate to ensure the proper installation of the Unit 1 HPCI booster pump outboard thrust bearings which directly led to severe bearing damage and would have eventually resulted in failure of the HPCI pump. The licensee initiated PER 408067 to enter this issue into their CAP and performed maintenance to replace the bearings.

Pending final determination of the safety significance, this AV is identified as AV 05000259/2011004-02, Failure to Properly Install Unit 1 High Pressure Coolant Injection Booster Pump Outboard Bearings.

Cornerstone: Emergency Preparedness

1EP6 Drill Evaluation

a. Inspection Scope

During the report period, the inspectors observed an Emergency Preparedness (EP)training drill that contributed to the licensees Drill/Exercise Performance (DEP) and Emergency Response Organization (ERO) performance indicator (PI) measures on August 3, 2011. This drill was intended to identify any licensee weaknesses and deficiencies in classification, notification, dose assessment and protective action recommendation (PAR) development activities. The inspectors observed emergency response operations in the simulated control room, Technical Support Center, and Operations Support Center to verify that event classification and notifications were done in accordance with EPIP-1, Emergency Classification Procedure, and licensee conformance with other applicable Emergency Plan Implementing Procedures. The inspectors also attended the post-drill critique to compare any inspector-observed weakness with those identified by the licensee in order to verify whether the licensee was properly identifying EP related issues and entering them in to the CAP, as appropriate.

b. Findings

No findings were identified.

4OA1 Performance Indicator (PI) Verification

Cornerstone: Mitigating Systems

The inspectors reviewed the licensees procedures and methods for compiling and reporting the following Performance Indicators (PIs), including procedure NPG-SPP-02.2, Performance Indicator Program. The inspectors examined the licensees PI data for the specific PIs listed below for the third quarter of 2010 through the second quarter of 2011. The inspectors reviewed the licensees data and graphical representations as reported to the NRC to verify that the data was correctly reported. The inspectors also validated this data against relevant licensee records (e.g., PERs, Daily Operator Logs, Plan of the Day, Licensee Event Reports, Maintenance Rule Cause Determination and Evaluation Reports, etc.), and assessed any reported problems regarding implementation of the PI program. Furthermore, the inspectors met with responsible plant personnel to discuss and go over licensee records to verify that the PI data was appropriately captured, calculated correctly, and discrepancies resolved. The inspectors also used the Nuclear Energy Institute (NEI) 99-02, Regulatory Assessment Performance Indicator Guideline, to ensure that industry reporting guidelines were appropriately applied.

• Unit 1 Mitigating Systems Performance Index - Residual Heat Removal System

• Unit 2 Mitigating Systems Performance Index - Residual Heat Removal System

• Unit 3 Mitigating Systems Performance Index - Residual Heat Removal System

• Unit 1 Mitigating Systems Performance Index - Emergency AC Power

• Unit 2 Mitigating Systems Performance Index - Emergency AC Power

• Unit 3 Mitigating Systems Performance Index - Emergency AC Power

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

.1 Review of items entered into the Corrective Action Program:

As required by Inspection Procedure 71152, Identification and Resolution of Problems, and in order to help identify repetitive equipment failures or specific human performance issues for follow-up, the inspectors performed a daily screening of items entered into the licensees CAP. This review was accomplished by reviewing daily PER and Service Request (SR) reports, and periodically attending Corrective Action Review Board (CARB) and PER Screening Committee (PSC) meetings.

.2 Focused Annual Sample Review - Operator Workarounds

a. Inspection Scope

The inspectors conducted a review of existing Operator Workarounds (OWA) to verify that the licensee was identifying OWAs at an appropriate threshold, entering them into the corrective action program, establishing adequate compensatory measures, prioritizing resolution of the problem, and implementing appropriate corrective actions in a timely manner commensurate with its safety significance. The inspectors examined all active OWAs listed in the Limiting Condition of Operation Tracking (LCOTR) Log, and reviewed them against the guidance in BFN-ODM-4.16, Operator Workarounds/

Burdens/Challenges. The inspectors also discussed these OWAs in detail with on shift operators to assess their familiarity with the degraded conditions and knowledge of required compensatory actions. Furthermore, the inspector walked down selected OWAs, and verified the ongoing performance, and/or feasibility of, the required actions.

Lastly, for selected OWAs, the inspector reviewed the applicable PER, including the associated functional evaluation and corrective action plans (both interim and long term).

b. Findings and Observations

No findings were identified. However, the inspectors had the following observations which were discussed with the licensee:

• The inspectors determined that the most recent quarterly OWA self assessment/aggregate impact review was not performed as scheduled by the Operations department in accordance with BFN-ODM-4.16. This issue was entered into the licensees CAP as PER 438523, and the aggregate review was rescheduled.

• As required by BFN-ODM-4.16, each OWA in the tracking tool was required to include the OWA number, the description of the OWA, the compensatory actions and frequency of the required actions, whether the issue is a workaround, burden or a challenge, the time required to implement the compensatory actions, the watchstation(s) affected, supporting documentation, the PER number, the work order (WO) number and the current WO status. The inspectors determined that the information for many of the OWAs listed in the tracking tool was not complete.

Specifically, the impacted watchstations, the time required to implement the compensatory actions and the PER numbers were not consistently included in the OWA tracking tool. This information would be a very useful part of the aggregate review that is supposed to evaluate the impacts of all OWAs, burdens and challenges on an individual watchstation. The licensee entered this into the CAP as PER 443247.

• The inspectors also determined that Operations should have included the quarterly aggregate impact review into the quarterly self assessments on all workarounds, burdens and challenges as required by BFN-ODM-4.16. The current practice has been to perform self assessments annually. The licensee entered this into the CAP as PER 443247.

• The inspectors determined that the time required for the reactor building Auxillary Unit Operator (AUO) to respond to the Hydraulic Control Units (HCU) accumulator alarms were not listed on the OWA tracking tool. SR 440835 documents HCU 46-23 on Unit 1 was recharged 4 times in the last 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. SR 440948 documents HCU 34-31 accumulator alarm had been received 13 times in the last month. Each time a HCU accumulator alarms, both the MCR operators and the reactor building AUO are required to respond. A review of the MCR logs indicated the reactor building AUO response time ranges from approximately 11 to 41 minutes each occurrence. The licensee entered this issue into their CAP as PER 446939.

• The inspectors reviewed Operator Workaround 3-071-OWA-2011-0176 and discussed it with the Unit 3 Unit Supervisor and Reactor Operators on shift. During this review, it was determined that the procedure referred to an incorrect step. The inspectors concluded that this had the potential to delay the response, but because the correct procedure step was easily identifiable, it would not significantly impact the operators ability to implement the OWA. The licensee entered this issue into their CAP as PER 443722.

4OA3 Follow-up of Events

.1 (Closed) Licensee Event Report (LER) 05000259/2011-002-00, Loss of Safety Function

(SDC) Resulting from Loss of Power from C EDG Due to Oil Leak

a. Inspection Scope

The inspectors reviewed LER 05000259/2011-002-00 dated June 27, 2011. The inspectors also reviewed the applicable PER 362395, including associated root cause determination and corrective action plans.

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and loss of all 500 KV offsite power sources that resulted in a LOOP and reactor scram on all three Browns Ferry units. On April 28, 2011, with all three units in cold shutdown (Mode 4) and power supplied by onsite emergency diesel generators (EDGs) and a 161 KV offsite source, control room personnel performed an emergency shutdown of the Unit 1/2 C EDG. The C EDG was shut down due to a hydraulic oil leak from metal tubing on a part of the EDG governor that was causing voltage and frequency fluctuations. The 4 KV Shutdown Board C, previously powered by the C EDG, was de-energized. This resulted in a loss of power to the 1B Reactor Protection System (RPS)which caused a Primary Containment Isolation System (PCIS) actuation. The Group 2 PCIS isolation caused the shutdown cooling (SDC) suction valve to go closed as designed and resulted in the loss of SDC flow to Unit 1 reactor for 47 minutes. In addition, the loss of power to the 4 KV shutdown board C also caused the loss of the 2B RHR pump which resulted in a momentary suspension of SDC flow to Unit 2. Plant operators promptly restored power to the 4 KV Shutdown Board C and the 1B RPS, reset the PCIS, and realigned and restarted SDC on Unit 1. Shutdown cooling for Unit 2 was immediately restored by starting the 2D RHR pump which was powered separately.

The licensee determined the immediate cause of the fluctuating C EDG voltage and frequency was a leaking 1/8 inch threaded brass fitting on the governor-to-governor booster pump hydraulic oil tubing. The root cause was determined to be less than adequate design of the Unit 1/2 C EDG governor hydraulic oil tubing to compensate for vibrational stress.

The EDG governor hydraulic oil lines were hard tubing that was part of the original skid-installation of all four Unit 1/2 EDGs in 1968. The licensee redesigned the governor-to-governor booster pump hydraulic oil lines and replaced the lines on all four Unit 1/2 EDGs with flexible hoses. The four Unit 3 EDG governor-to-governor booster pump hydraulic oil lines were originally supplied with flexible hose in 1973 under the same model number. The vendor stated that the change to flexible hose was conducted for ease of installation. The licensee also completed a 10 CFR 21 evaluation. No licensee performance deficiency was identified by the inspectors.

b. Findings

No findings were identified. This LER is considered closed.

.2 (Closed) LER 05000259/2011-003-00, Loss of Safety Function (SDC) Resulting from

Emergency Diesel Generator Output Breaker Trip

a. Inspection Scope

The inspectors reviewed LER 05000259/2011-003-00 dated July 1, 2011. The inspectors also reviewed the applicable PER 362340, including associated root cause determination and corrective action plans.

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and loss of all 500 KV offsite power sources that resulted in a LOOP and reactor scram on all three Browns Ferry units. On May 2, with all three units in cold shutdown (Mode 4) and power supplied by onsite EDGs, and a 161 KV offsite source, the output breaker of the Unit 1/2 A EDG tripped. The tripped A EDG output breaker resulted in an immediate loss of electrical power to the 4KV Shutdown Board A that caused a loss of SDC to Unit 1. Operators promptly restored SDC to Unit 1.

The licensee determined the A EDG output breaker trip was directly caused by a misadjusted overspeed trip limit switch (OTLS) arm. The licensee determined the root cause to be inadequate technical rigor applied by site engineering personnel to recognize single point system vulnerabilities which resulted in inadequate engineering guidance for maintenance personnel to properly configure the OTLS. The licensee replaced and properly set the OTLS on all eight EDGs. The licensee also initiated revisions to maintenance procedures to correct inadequacies in the overspeed trip lever arm inspections and to incorporate steps for adjustment and verification of the OTLS arm within a specified margin. Additional licensee investigation and evaluation for this event, including single point vulnerability reviews for select safety related systems, were still in progress.

b. Findings

One finding was identified. This LER is considered closed.

Introduction:

A self-revealing NCV of TS 5.4.1.a, was identified for the licensees failure to establish an adequate maintenance procedure to ensure proper calibration and alignment of the EDG OTLS switch arm which resulted in a premature trip of the A EDG output breaker and loss of Unit 1 shutdown cooling (SDC).

Description:

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and loss of all 500 KV offsite power sources that resulted in a reactor scram on all three Browns Ferry units. On May 2, with all three units in cold shutdown (Mode 4) and power supplied by onsite EDGs and a 161 KV offsite source, the output breaker of the Unit 1/2 A EDG tripped. The tripped A EDG output breaker interrupted power to 4 KV Shutdown Board A which caused a loss of power to a portion of the Unit 1 RPS resulting in PCIS Group 2, 3, 6, and 8 isolations. The Group 2 PCIS actuation caused the SDC suction valve to isolate as designed, the running RHR pump to trip, and resulted a the loss of SDC flow to Unit 1 for approximately 57 minutes.

Although the A EDG was common to both Units 1 and 2, Unit 2 was not adversely affected by this event. Control room annunciation (Overspeed Trip and Not Auto)indicated an overspeed trip condition with the A EDG. Operators aligned alternate power to the 4 KV shutdown board A and the RPS, reset the PCIS, and realigned and restarted SDC on Unit 1. During the loss of SDC, Reactor coolant system temperature increased from 114.5 to 138.5 degrees F.

The licensee determined the underlying cause of the A EDG output breaker trip was an inadvertent, spurious actuation of the A EDG OTLS resulting from a marginal setting on the OTLS arm. Troubleshooting revealed that the as-found state of the OTLS was actuated (overspeed condition) even though the mechanical overspeed lever arm (normally in contact with the OTLS arm) had not actuated (i.e. the A EDG had not actually oversped, and in fact, remained running). Therefore, the A EDG output breaker trip was directly caused by a misadjusted OTLS arm.

The licensee initiated PER 362340 to determine the root cause of the A EDG output breaker trip. The licensee determined the root cause to be inadequate technical rigor applied by site engineering personnel to recognize single point system vulnerabilities which resulted in inadequate engineering guidance for maintenance personnel to properly configure the OTLS. Inadequate engineering guidance resulted in insufficient detail in maintenance procedures to ensure appropriate calibration and alignment of the OTLS switch arm and overspeed trip lever. As part of their immediate corrective actions, the licensee replaced and properly set the OTLS on all eight EDGs. A licensee evaluation of existing maintenance guidance for the EDG overspeed trip devices identified a lack of aging aspects, inspection, adjustment, and replacement frequency for the OTLS on each of the EDGs. Therefore, the licensee initiated revisions to maintenance procedures MCI-0-082-ENG004, Standby Diesel Engine Mechanical Overspeed Trip Assembly Inspection, Rework, Reassembly, to correct inadequacies in the overspeed trip lever arm inspections and ECI-0-000-SWZ002, Replacement of Switches, to incorporate steps for adjustment and verification of the OTLS arm within a specified margin. Furthermore, the licensee was in the process of developing a preventive maintenance task to inspect, test, and establish a replacement frequency for EDG overspeed trip devices based on fleet and owners group recommendations.

Additional investigation and evaluation for this event, including single point vulnerability reviews for select safety related systems, were still in progress and as such the licensee stated their plans to submit a revised LER by November 15, 2011.

Analysis:

The inspectors determined that the licensees failure to provide sufficient detail in maintenance procedures to allow for appropriate calibration and alignment of the EDG OTLS arm and overspeed trip lever was a performance deficiency which resulted in a loss of Unit 1 SDC. This performance deficiency was considered more than minor because it was associated with the Initiating Events Cornerstone attribute of Equipment Performance, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown. Specifically, the misadjusted A EDG OTLS resulted in a spurious actuation of the OTLS, a premature trip of the A EDG output breaker trip, and unexpected loss of SDC. According to IMC 0609, Appendix G, Shutdown Operations, Table 1, Losses of Control, the safety significance of the finding was initially characterized to be potentially greater than very low safety significance because the inadvertent loss of SDC represented a loss of control due to a loss of thermal margin to boiling of greater than 20 percent. The SRA performed a Phase 3 analysis. The Unit 1 full power SPAR model was used to model the late Loss of Offsite Power sequences that had not been recovered by the time of the EDG trip at four and one half days. This assumption was based on information that indicated the long time vibration on the EDG contributed to the actuation of the EDGs trip. The full power model was used to screen the finding, since its assumptions are based on a higher decay heat load. The Initiating Event frequency was determined by multiplying the offsite power non recovery probability at 109 hours0.00126 days <br />0.0303 hours <br />1.802249e-4 weeks <br />4.14745e-5 months <br /> times the updated annual LOOP frequencies for 2009. The models offsite power recovery values up to ten hours were set to fail. Screening values of

.1 were used for

the probability that the A EDG could be recovered after its trip. The result was a change in risk below the CDF, and LERF thresholds of 1E-6. The dominant reason for the low change in risk was the high chance of recovery of offsite power before the duration of time required to cause the EDG to trip, and the likelihood of recovery of the tripped EDG. The performance deficiency is GREEN The cause of this finding was directly related to the cross-cutting aspect of appropriate self assessments in the Self and Independent Assessments component of the Problem Identification and Resolution area, because inadequate technical rigor applied by the licensee to recognize single point system vulnerabilities resulted in inadequate procedural guidance for maintenance personnel to appropriately calibrate and align the OTLS switch arm and overspeed trip lever [P.3.(a)].

Enforcement:

Unit 1 TS 5.4.1.a. required that written procedures recommended in RG 1.33, Revision 2, Appendix A, shall be established, implemented, and maintained. Items 9.a of RG 1.33, Appendix A, stated, in part, that maintenance affecting the performance of safety-related equipment be properly preplanned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to the above, since original installation, the licensee failed to establish an adequate procedure for maintenance that affected the performance of a piece of safety related equipment. Specifically, the level of detail in maintenance procedures MCI-0-082-ENG004 and ECI-0-000-SWZ002 were inadequate to ensure appropriate calibration and alignment of the OTLS switch arm and overspeed trip lever.

Inadequate alignment and calibration of the A EDG OTLS caused an inadvertent trip of the A EDG output breaker which resulted in an uncontrolled loss of Unit 1 shutdown cooling on May 2, 2011. As part of their immediate corrective actions, the licensee verified the OTLS on all eight EDGs were properly set. However, because the finding was of very low safety significance and has been entered into the licensees CAP as PER 362340, this violation is being treated as an NCV consistent with the NRC Enforcement Policy. This NCV is identified as NCV 05000259/2011004-03, Unit 1 Loss of Shutdown Cooling Caused by the Emergency Diesel Generator Output Breaker Trip.

.3 (Closed) LER 05000259/2011-005-00, Reactor Water Level Scram Due to Distracted

Operations Crew

a. Inspection Scope

The inspectors reviewed LER 05000259/2011-005-00 dated June 27, 2011. The inspectors also reviewed applicable PERs 363784 and 335574, including associated cause determination and corrective action plans.

On April 27, 2011, Unit 1, 2 and 3 were in Mode 3 (Hot Shutdown) while operators in the main control room were responding to a three Unit shutdown due to a LOOP event that occurred at about 4:36 p.m. Central Daylight Time (CDT). The Unit 1 reactor operators in particular, were injecting water in the reactor vessel using the control rod drive system and reactor core isolation cooling (RCIC) system as required per General Operating Instruction (GOI) 1-GOI-100-12A, Unit Shutdown from Power Operation to Cold Shutdown and Reductions in Power During Power Operations. The specified reactor water level band for Unit 1 was between +2 to +51 inches. However, at 9:20 p.m. CDT, on April 27, the operators became distracted and failed to maintain reactor vessel water level (RVWL) in the prescribed band. As a result, an RPS actuation (i.e., reactor scram signal) occurred due to RVWL lowering below +2 inches. All Unit 1 control rods were already fully inserted at the time due to the previous scram at 4:36 p.m. CDT. The low level scram signal also generated a valid PCIS signal for Groups 2, 3, 6 and 8 which isolated as designed. The initial follow-up of this event by the inspectors was documented in Section 4OA3.1 of IR 05000259/2011-03.

b. Findings

One minor violation was identified. This LER is considered closed.

Technical Specifications 5.4.1 a. required, in part, that written procedures shall be established, implemented and maintained covering the applicable procedures recommended in RG 1.33, Rev. 2, Appendix A. Specifically section 2.j. requires General Plant Operating Procedures for Hot Standby to Cold Shutdown conditions. Contrary to this requirement, Operations personnel did not control RVWL in the prescribed band of

+2 inches to +51 inches as required by 1-GOI-100-12A. As a result, a valid RPS scram signal was generated that was not part of a preplanned evolution. The licensee captured this issue in their corrective action program as PERs 363784 and 335574, and promptly restored water level to within the prescribed band of +2 to +51 inches.

Because the reactor was in Mode 3 (Hot Shutdown) and all Unit 1 control rods were already fully inserted, this is being treated as a minor violation. This failure to comply with TS 5.4.1 a. constitutes a violation of minor significance that is not subject to enforcement action in accordance with the NRCs Enforcement Policy.

.4 (Closed) LER 05000259/2011-006-00, Loss of Safety Function (HPCI) Due to Primary

Containment Isolation

a. Inspection Scope

The inspectors reviewed LER 05000259/2011-006-00 dated July 19, 2011, and the applicable PER 372659, including associated apparent cause determination and corrective action plans.

On May 20, 2011, while performing 1-SR-3.5.1.1(HPCI), Maintenance of Filled HPCI Discharge Piping, operators opened 1-FCV-073-0044, HPCI System Inboard Discharge Valve, to fill and vent portions of the HPCI system. During this evolution the HPCI discharge piping, suddenly and unexpectedly, pressurized to 1020 psig due to leakage past primary containment isolation valve (PCIV) 1-FCV-073-0045, the HPCI System Testable Check Valve. A flood level alarm for the HPCI room was received in the Unit 1 main control room. Water was observed to be leaking from some HPCI components on the HPCFI pump suction side due to its lower design pressure. Also some equipment in the HPCI room was sprayed from the high pressure water inleakage. Operators promptly shut 1-FCV-073-0044 to isolate the HPCI system from the RCS. To satisfy PCIV TS, primary containment was maintained for the HPCI system penetration flow path by also deactivating 1-FCV-073-0044 which rendered the HPCI system incapable of performing its accident mitigation safety function. The failure of 1-FCV-073-0045 to close was subsequently determined to be misalignment of the linkage between the actuator and valve which caused binding that prevented the check valve from fully reseating (i.e., partially stuck open). A main control room actuator open indication was indicative of the misaligned linkage. The inspectors determined that this open indication was misdiagnosed by the licensee as an actuator indication problem only.

The licensee implemented corrective actions to restore the damaged HPCI system and FCV-73-45 operability. The licensee implemented a temporary modification to remove the check valve actuator linkage from the valve disc seat to eliminate any possibility that the actuator would bind or prevent check valve motion. Smooth operation of the check valve was verified. Additionally, the licensee conducted extent of condition walkdowns and evaluations for the Units 2 and 3 HPCI testable check valves to verify similar problems did not exist on Units 2 and 3.

The issues associated with this LER were previously addressed by the inspectors as documented in Section 1R15.b of inspection report (IR) 05000259/2011003.

b. Findings

One finding of significance was previously identified in IR 05000259/2011003 (see NCV 05000259/2011003-02). This LER is considered closed.

.5 (Closed) LER 05000296/2009-003-03, Reactor Core Isolation Cooling System

Inoperable Longer Than Allowed By the Technical Specifications

a. Inspection Scope

The inspectors reviewed LER 05000296/2009-003-03 dated July 29, 2011. The inspectors also reviewed the applicable PERs 304722 and 329704, including associated root cause determination and corrective action plans, and all previous documentation resulting from the original violation NCV 05000296/2010003-03.

The original LER 50-296/2009-003-00 dated May 24, 2010, and applicable PERs 200183,119628 and 246527, including cause determination and corrective action plans, were reviewed by the inspectors and documented in Section 4OA3.2 of NRC IR 05000296/2010003. As a result of this prior review, two violations of NRC requirements were identified: NCV 05000296/2010003-02, Unit 3 RCIC System Inoperable beyond the Technical Specifications Allowed Outage Time; and NCV 05000296/2010003-03, Failure to Provide Complete and Accurate Information in LER 0500296/2009-003-00.

The NCV 05000296/2010003-03 was the result of the review of the original LER, when the inspectors determined that, contrary to 10 CFR 50.9, LER 0500296/2009-003-00 was not accurate or complete in all material aspects for which the licensee initiated PER 246527. Specifically, the LER inaccurately reported the duration of system inoperability, and the availability of HPCI while the RCIC was inoperable, and did not report a previous event that occurred on the same unit with the same cause as required by 10 CFR 50.73(b)(5).

As part of the PER 246527 corrective actions, the licensee issued a revised LER 0500296/2009-003-01 on July 15, 2010. The principal intent of this LER revision was to establish the date that began the period of RCIC inoperability as March 22, 2006, and to notify the NRC that additional time was needed to complete a determination of any concurrent HPCI system inoperability. The licensee revised their commitment to supplement the LER to September 30, 2010. Subsequently, the licensee issued their second revised LER 0500296/2009-003-02 on August 31, 2010. This LER was revised by the licensee to correct and update the LER narrative with an expanded timeline and results from their efforts to retrieve high speed computer data regarding actual Unit 3 RCIC pump performance. This second revision was also intended to address and correct any missing or inaccurate information identified by the inspectors in the original LER. This revised LER included changes to the Abstract, Description of Event, Cause of the Event, Analysis of the Event, and Corrective Actions.

The second revision of the LER did specifically report a more accurate duration of system inoperability, including when the nonconforming turbine electric governor-remote (EG-R) had been installed; a discussion of concurrent HPCI unavailability while RCIC was inoperable; and a discussion of the previous event on February 9, 2007 that occurred on the same unit with the same cause. The inspectors reviewed the revisions 1 and 2 of the LERs, and verified the root causes and previously identified corrective actions for the RCIC flow instabilities were not substantially different, except for the additional clarifying information provided. However, the inspectors identified incomplete and inaccurate information in LER 0500296/2009-003-02. Specifically, the LER incompletely and/or inaccurately reported the following: 1) An incorrect event date; 2) A non-specific time for when TVA determined RCIC inoperability; 3) Omission of previous corrective actions to address RCIC oscillations and why these repairs and subsequent post maintenance testing did not resolve the RCIC instabilities; 4) An incorrect reference to the first oscillation event; 5) Omission of TS shutdown implications to Unit 3; 6)

Omission of similar events; and 7) Omission of the PER for the previous 10CFR50.9 NCV.

The licensee initiated PERs 304722 and 329704 to determine the cause of the repeat inaccurate and incomplete information contained in revised LER 0500296/2009-003-02, and to evaluate if the LER should be further supplemented. The NRC documented in Section 4OA3.1 of NRC inspection report (IR) 05000296/2010005 a Severity Level IV, cited violation (VIO) of 10 CFR 50.9, VIO 05000296/2010005-03, Repeated Failure to Provide Complete and Accurate Information in LER 0500296/2009-003-02. A Notice of Violation EA-11-012 was attached.

Subsequently, by TVA letter dated March 11, 2011, the licensee contested the violation on the basis that they were meeting the completeness and accuracy requirements of 10 CFR 50.9. By NRC letter dated June 3, 2011, the staff concluded that the violation occurred as stated in the Notice dated February 9, 2011. By TVA letter dated July 5, 2011, the licensee provided a description of corrective actions taken (see Section 4OA5.2 of this report), the reason for the violation, and that full compliance with 10 CFR 50.9 would be achieved upon submittal of Revision 3 of LER 50-296/2009-003 on July 29, 2011. The inspectors reviewed the final revised LER 05000296/2009-003-03 and verified that the supplemental information provided in the LER was complete and accurate in all material aspects.

b. Findings

No findings were identified. This LER is considered closed.

6. (Open) LER 05000296/2011-001-00, Loss of Shutdown Cooling (RHR)

a. Inspection Scope

The inspectors reviewed the LER 05000296/2011-001-00 dated July 11, 2011.

Inspectors also reviewed the applicable PER 368764, including associated immediate and root cause determinations, analysis of the event and corrective actions.

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and loss of all 500 kV offsite power sources resulting in a reactor scram on all three Browns Ferry units. On May 12, 2011, with all three units in cold shutdown (Mode 4) and offsite power supplied by multiple 161 kV offsite sources, electricians were performing scheduled maintenance to replace a Unit 3 Group 1 PCIS relay. During the relay replacement activity, a lifted wire inadvertently caused downstream relays to de-energize, which resulted in a PCIS Group 2 actuation that isolated the SDC suction and tripped the in-service 3B RHR pump resulting in a loss of SDC for Unit 3. Operators immediately directed electricians to reconnect the lifted wire and promptly restored SDC to Unit 3.

As part of the immediate corrective actions, a work stoppage was issued by the outage Director until an initial investigation of the event was conducted. Corrective actions to prevent recurrence included temporarily stopping all logic system related work on key safety functions to verify relay maintenance procedures included instructions to place jumpers in order to maintain system logic during work involving wire lifts. Furthermore, the licensee ensured that work added to a forced outage was reviewed for adequate planning and that planned work was viable under given plant conditions.

The licensee determined the root cause to be inadequate work package details that did not include specific work precautions or instructions to require installation of jumpers in order to maintain system logic and to prevent the loss of SDC. Additionally, the work package required conditions that would normally be found during a refueling outage with the RHR system out of service.

b. Findings

One finding was identified. This LER is still considered open pending further review.

Introduction:

A self-revealing Green NCV of TS 5.4.1.a was identified for the licensees failure to provide, in sufficient level of detail, a complete and accurate work package to ensure appropriate system logic was maintained during maintenance activities on relays associated with the PCIS. This inadequate work package caused a loss of Unit 3 SDC due to closure of an SDC suction valve and subsequent trip of the 3B RHR pump.

Description:

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and a loss of all 500 kV offsite power sources resulting in a reactor scram on all three Browns Ferry units. On May 12, 2011, at 6:25 p.m. with all three units in cold shutdown (Mode 4) and offsite power supplied by multiple 161 kV offsite sources, electricians were performing preventive maintenance (PM) activities on Unit 3 GE CR120A relays under work order (WO) 09-715863-000 in accordance with procedure ECI-0-000-RLY005, The Replacement, Repair and Inspection of CR120A Relays and Associated Components. Electricians lifted a neutral wire on PCIS BFN-3-064-16AK56 relay coil which caused all normally energized relays downstream of the relay to become de-energized. One of the downstream relays to de-energize was BFN-3-064-16AK29 (RHR Isolation) which initiated a Channel A , PCIS Group 2 isolation which closed valve 3-FCV-074-0048 (RHR SDC Inboard Valve) and subsequently caused 3B RHR pump to trip resulting in a loss of SDC. Operators directed electricians to reconnect the lifted wire. Operators then reset the Group 2 isolation, restarted the 3B RHR pump, and restored the RHR Loop II SDC valve alignment. During the approximately forty minute loss of SDC, moderator temperature increased from 112.5 degrees Fahrenheit (F) to the highest recorded temperature of 122 degrees F. Time to boil at the time of the event was approximately four hours.

Prior to performing PMs on the relays, the electricians identified the wire was energized.

This was an unexpected condition and the electricians stopped work and reported the condition to supervision and the outage control center (OCC). The OCC in conjunction with the work control center evaluated the situation and failed to consult with Engineering concerning the task. Logic prints that were reviewed did not show the neutral wire for the relays. Conservative decision making was not properly utilized to evaluate the task or risk associated with the work. The electricians were then directed to lift the wire leads while energized, which caused the unexpected partial PCIS Group 2 actuation.

The licensee initiated PER 368764 to determine the root cause of the event and implement corrective actions. The licensee determined the direct cause of the event was due to electricians lifting an energized wire. The root cause of the event was determined to be insufficient details or precautions in the work package instructions as well as a lack of details concerning the desired plant conditions for performance of the work. Similar relay PM WOs for other units included a statement that a jumper should be installed to maintain PCIS continuity. Also there was no statement in the WO concerning the condition of the plant for which the work was planned. The licensee assumed that the Auxiliary Decay Heat Removal (ADHR) system would be in service and both RHR loops out of service during this maintenance activity.

Additional contributing factors to the event were determined to be a lack of consistency when using the risk management process for outage scope additions. The work package had been initially screened as low risk because it was planned to be worked during a normal refueling outage with RHR out of service and ADHR in service.

Therefore it was determined the work was not capable of causing an engineered safety feature (ESF) actuation. Also it was determined that a lack of training on electrical fundamentals was a contributor. Workers were not aware that lifting the energized wire could cause downstream relays to de-energize.

The licensees corrective actions were ongoing to revise maintenance procedures concerning relay replacements and to verify that instructions were included in any work plans to maintain system logic as necessary. The licensee also conducted a work stoppage, briefed plant personnel regarding this event, and investigated the need to perform additional training.

Analysis:

The licensees failure to provide, in sufficient level of detail, a complete and accurate work package to ensure appropriate PCIS logic was maintained during relay maintenance activities was a performance deficiency which resulted in a loss of SDC.

This performance deficiency was considered more than minor because it was associated with the Initiating Events Cornerstone attribute of Procedure Quality, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown. Specifically, the work package to replace the GE CR120A relays under work order (WO) 09-715863-000 did not include specific work precautions or instructions to require that jumpers be installed to prevent the loss of Unit 3 SDC. The inspectors characterized the finding using IMC 0609, Appendix G, Shutdown Operations. Based on Table 1, Losses of Control, of Appendix G, the inspectors determined the finding screened as very low safety significance (Green) because the change in temperature during the inadvertent loss of shutdown cooling did not equate to a loss of control since the change in RCS temperature did not exceed the 20 percent margin to boil. In addition, Checklist 8 of Appendix G, Attachment 1, Shutdown Operations, did not require further analysis because it confirmed adequate mitigation capability remained available for all of the shutdown safety functions to be considered of very low safety significance.

The cause of this finding was directly related to the cross-cutting aspect of complete documentation in the Resources component of the Human Performance area, because the licensee failed to provide adequate work package instructions concerning the replacement of PCIS relays which resulted in the loss of SDC [H.2.(c)].

Enforcement:

Unit 3 TS 5.4.1.a. required that written procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, shall be established, implemented, and maintained. Item 9.a of RG 1.33, Appendix A, stated in part that maintenance affecting the performance of safety-related equipment be properly preplanned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to the above, on May 12, 2011, the licensee failed to establish adequate work instructions for maintenance affecting the performance of safety-related equipment. Specifically, work order package WO 09-715863-000 and maintenance procedure ECI-0-000-RLY005 provided inadequate instructions to ensure the continuity of the PCIS logic was maintained while PCIS relays were being replaced.

This directly resulted in the inadvertent actuation of a Channel A, PCIS Group 2 isolation and subsequent loss of SDC for approximately 40 minutes. The licensee took immediate corrective actions to restore SDC and therefore no loss of control occurred.

However, because the finding was of very low safety significance and has been entered into the licensees CAP as PER 368764, this violation is being treated as an NCV, consistent with the Enforcement Policy. This NCV is identified as NCV 05000296/2011004-04, Unit 3 Loss of Shutdown Cooling During Primary Containment Isolation System Relay Replacement.

.7 (Closed) LER 05000296/2011-002-00, Reactor Scram Due to Scram Discharge Volume

High Water Level

a. Inspection Scope

The inspectors reviewed the LER 05000296/2011-002-00 dated July 21, 2011. The inspectors also reviewed the applicable PERs 373365 and 335574, including the associated cause determination and corrective action plans.

On May 22, 2011, while Unit 3 was in cold shutdown (Mode 4), Maintenance personnel were reconnecting the high voltage cable on the G Intermediate Range Monitor (IRM)when a spike occurred on the C and D IRM channels resulting in an invalid reactor scram signal. All Unit 3 control rods were already fully inserted. Operations personnel verified the cause of the invalid scram and attempted to reset the scram. However, the reactor operator failed to bypass the high level on the scram discharge volume and upon resetting the initial invalid scram signal, a valid RPS scram signal occurred. The initial follow-up of this event by the inspectors was documented in Section 1R20.2 of IR 05000296/2011-03. This LER is closed.

b. Findings

One minor violation was identified. This LER is considered closed.

Technical Specifications 5.4.1 a. required, in part, that written procedures shall be established, implemented and maintained covering the applicable procedures recommended in RG 1.33, Rev. 2, Appendix A. Specifically, Section 6.u requires procedures for a reactor trip (scram). Contrary to this requirement, on May 22. 2011, Operations personnel failed to place the scram discharge volume high water level switch in bypass as required by Abnormal Operating Instruction (AOI) 3-AOI-100-1, Reactor Scram, before resetting the invalid scram. As a result, a valid RPS scram signal occurred that was not part of a preplanned evolution. The licensee captured this issue into their CAP as PERs 373365 and 335574, and reset the scram in accordance with the AOI. Because the reactor was in cold shutdown (Mode 4) and all Unit 3 control rods were already fully inserted, this was considered a minor violation. This failure to comply with TS 5.4.1 a. constitutes a violation of minor significance that is not subject to enforcement action in accordance with the NRCs Enforcement Policy.

.8 (Closed) LER 50-259/2011-01, Three Unit Scram Caused By Loss of All 500-KV Offsite

Power Sources

a. Inspection Scope

On April 27, 2011, Units 1, 2, and 3 automatically scrammed from 75 percent, 75 percent, and 100 percent RTP, respectively, due to complete loss of the 500 KV offsite power system. The initial follow-up inspection of this event by the inspectors was documented in Section of IR 4OA3.1 of IR 05000259, 260, and 296/2011003. The inspectors subsequently reviewed the subject LER that was issued on June 27, 2011, and its associated PER 364318, including the root cause analysis and corrective actions. The licensee concluded that severe weather was the direct cause of the three unit scram and LOOP event at Browns Ferry due to the extensive damage and loss of the 500KV system resulting from numerous tornadoes in the north Alabama area. Also numerous longer term corrective actions were developed to improve Browns Ferry Nuclear Plant severe weather preparedness, readiness and response.

b. Findings

No findings were identified associated with this specific LER regarding the LOOP and three unit scram event. However, several other LERs related to this event, involving specific equipment problems and operator performance errors were also issued, and reviewed separately by the inspectors. This particular LER is considered closed.

.9 (Closed) LER 50-260/2009-003-01, Safety/Relief Valve As-Found Setpoint Exceeded

Technical Specification Lift Pressure

a. Inspection Scope

The inspectors reviewed the LER 05000260/2009-003-01 dated July 28, 2011. This revised LER was submitted to provide updated and corrected technical and editorial information. The original LER was reviewed by the inspectors and documented in Section 4OA3.4 of IR 50-260/2009-004. A licensee identified violation (LIV) was also documented in Section 4OA7 of IR 50-260/2009-004. The information provided in LER 05000260/2009-003-01 was not of a significant nature to warrant any change to the original LER findings.

b. Findings

No findings were identified. This LER is considered closed.

.10 Unit 3 Automatic Reactor Scram

a. Inspection Scope

On September 28, 2011, Unit 3 automatically scrammed from 100 percent RTP due to a power to load unbalance (i.e., main generator load reject) automatic trip of the main turbine generator (MTG). The cause of the MTG trip was attributed to an electrical short to neutral on the main generator phase C isophase bus. This isophase bus short was caused by a broken piece of heavy metal screening that had been installed as a foreign material exclusion barrier on the fan exhaust of the isophase bus cooling (IBC) system.

Preliminary investigation results indicated that flow induced vibration caused a portion of the FME screen to break off, which was then carried down the IBC ventilation ductwork by the air flow. This piece of metal screening simultaneously contacted the C phase bus and bus duct resulting in a momentary ground that tripped of the generator neutral overvoltage relay. An inspector promptly responded to the control room and verified that the unit was stable in Mode 3 (Hot Shutdown) conditions, and confirmed that all safety-related mitigating systems had operated properly. The inspector also evaluated safety equipment and operator performance before and after the event by examining existing plant parameters, strip charts, plant computer historical data displays, operator logs, and the critical parameter trend charts used for the post-trip report. The inspector also interviewed responsible on-shift Operations personnel, examined the implementation of the applicable annunciator response procedures and AOIs, including 3-AOI-100-1, Reactor Scram, and reviewed the written notification made in accordance with 10 CFR 50.72. The inspector discussed the preliminary cause of the IBC FME screen failure with responsible Operations and Engineering personnel. Furthermore, the inspector reviewed 3-AOI-100-1, Attachment 2, Scram Report - Post Trip Review, and Attachment 3, Collection of Recorded Data.

Operators commenced restart of Unit 3 (i.e., entered Mode 2) on September 29 and achieved essentially full RTP on October 2, 2011. During this short forced outage the inspectors examined the conduct of critical outage activities pursuant to TS, applicable procedures, and the licensees risk assessment and maintenance plans. Some of the more significant outage activities monitored, examined and/or reviewed by the inspectors were as follows:

• Plant Oversight Review Committee (PORC) event review and restart meetings on September 29, 2011.

• Reactor startup and power ascension activities per 3-GOI-100-1A, Unit Startup

• Reactor vessel and coolant heatup per 3-SR-3.4.9.1(1), Reactor Heatup and Cooldown Rate Monitoring

• Outage risk assessment and management

• Control and management of forced outage and emergent work activities Corrective Action Program The inspectors reviewed PERs generated during the Unit 3 forced outage and attended management review committee meetings to verify that initiation thresholds, priorities, mode holds, and significance levels were assigned as required.

b. Findings

No findings were identified during the initial event followup.

4OA5 Other Activities

.1 Quarterly Resident Inspector Observations of Security Personnel and Activities

a. Inspection Scope

During the inspection period, the inspectors conducted observations of security force personnel and activities to ensure that the activities were consistent with licensee security procedures and regulatory requirements relating to nuclear plant security.

These observations took place during both normal and off-normal plant working hours.

These quarterly resident inspector observations of security force personnel and activities did not constitute any additional inspection samples. Rather, they were considered an integral part of the inspectors' normal plant status reviews and inspection activities.

b. Findings

No findings were identified.

.2 (Closed) Notice of Violation (VIO) 05000296/2010-005-03 (EA-11-012), Repeated

Failure to Provide Complete and Accurate Information in LER 0500296/2009-003-02

a. Inspection Scope

Per Inspection Procedure 92702, Follow-up on Corrective Actions for Violations and Deviations, the inspectors reviewed the licensees responses to VIO 05000296/2010-005-03 (EA-11-012) dated March 11 and July 5, 2011. The licensees corrective actions included implementation of a licensing desktop instruction for the preparation and review of LERs and submittal of Revision 3 of LER 0500296/2009-003, which was reviewed by inspectors and closed in this report (Section 4OA3.5). The licensees desktop instruction included verification of objective evidence to substantiate LER information, a second peer review prior to submittal for the site vice-presidents signature, a quality review board to improve the quality and rigor of each LER review, and a timeline for LER development and completion milestones to prevent time compression of the LER review process.

The inspectors also reviewed the licensees upper tier apparent cause evaluation report, LER Inaccuracies and Inconsistencies (PER 315128), and verified implementation of licensee corrective actions. Furthermore, the inspectors reviewed selected PERs in the licensees CAP to verify that the licensee was identifying LER problems at an appropriate threshold and evaluating them for resolution.

b. Findings

No findings were identified. This VIO is considered closed.

.3 (Closed) VIO 07200052/2011-002-05, Repetitive Failure to Adequately Control Transient

Combustible Materials in Proximity of the Independent Spent Fuel Storage Facility

a. Inspection Scope

Per Inspection Procedure 92702, Follow-up on Corrective Actions for Violations and Deviations, the inspectors reviewed the licensees response to VIO 07200052/2011-002-05 dated June 13, 2011. The licensees immediate corrective actions included removal of the transient combustible materials followed by an evaluation of those materials which concluded the material was well within the allowed limits. Previous corrective actions included establishment of an ISFSI Pad Escort Zone (i.e., fenced in area immediately around the ISFSI pad) with appropriate posted signage and gate locks to preclude unattended vehicles from being parked on the pad and to require Operations escort for any access to the ISFSI pad. Additional corrective actions included establishment of an ISFSI Pad Exclusion Zone (i.e., an area 150 feet from any point on the ISFSI pad) and to prevent vehicle entrance into the zone without shift manager approval in order to minimize the possibility of any hazard being introduced into the zone. This exclusion zone consisted of concrete jersey barriers outlining the edge of the zone and chains with signs installed across roadways stating ISFSI Exclusion Zone, No Vehicle Entry Without Shift Manager Approval. The licensee also revised procedure 0-GOI-300-1, Operator Round Logs, Attachment 12, Outside Operator Round Log, to include specific requirements regarding the exclusion area. Furthermore, the Operations department performed multiple stand-down briefings concerning the event.

The inspectors reviewed corrective actions associated with PERs 245382, 318694, 419427 and 419450. The inspectors also conducted multiple tours of the ISFSI Pad Escort Zone and ISFSI Pad Exclusion Zone to verify the licensees controls were in place and were being effectively applied. Furthermore, the inspectors reviewed the latest revisions (Revs. 210 and 211) of 0-GOI-300-1, Attachment 12, Sections 6.0, Steps

(23) and (24), that define and verify the ISFSI Pad and Exclusion Zones are to be clear of uncontrolled transient combustibles.

b. Findings

No findings were identified. This VIO is considered closed.

.4 Operation of an Independent Spent Fuel Storage Installation

a. Inspection Scope

In accordance with the guidance of Inspection Procedure (IP) 60855.1, Operation of an Independent Spent Fuel Storage Installation at Operating Plants, the inspectors reviewed changes made to the licensees ISFSI related programs and procedures since the last inspection to verify that changes made in accordance with 10 CFR 72.48, 10 CFR 72.212(b), and 10 CFR 50.59, as applicable for general licensed ISFSIs, were consistent with the commitments and requirements specified in the Safety Analysis Report (SAR), Certificate of Compliance (CoC), 10 CFR Part 72, and the Technical Specifications (TS). The inspectors did not observe ISFSI operations involving spent fuel transfer and storage, nor interview personnel or review documentation associated with such operations, because the licensee did not conduct or plan to conduct any ISFSI campaigns during calendar year 2011.

b. Findings and Observations

No findings or observations were identified.

4OA6 Meetings, Including Exit

.1 Exit Meeting Summary

On October 13, 2011, the resident inspectors presented the inspection results to Mr. C.J.

Gannon, Plant General Manager, and other members of the licensees staff, who acknowledged the findings. The inspectors also contacted Mr. P. Summers, Director of Safety and Licensing, for a brief re-exit of the inspection results on November 14, 2011.

All proprietary information reviewed by the inspectors as part of routine inspection activities were properly controlled, and subsequently returned to the licensee or disposed of appropriately.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and was a violation of NRC requirements which met the criteria of the NRC Enforcement Policy for being dispositioned as a Non-Cited Violation.

• 10 CFR 50 Appendix B, Criterion XVI, Corrective Action required in part that measures shall be established to assure that conditions adverse to quality, such as failures are promptly identified and corrected. Contrary to this requirement the licensee failed to adequately identify and correct the failure of normally energized relay 2-RLY-075-14A-K30B during performance of 2-SR-3.3.5.1.6(CS II), Core Spray System Logic Functional Test Loop II on August 8, 2011 prior to returning it to an operable status. The licensee entered this issue into their CAP as PER 415242 and replaced the failed relay on August 13. The safety significance of this finding was characterized to be of very low safety significance in accordance with the Phase 1 SDP of IMC 0609, Attachment 4, because the finding did not represent an actual loss of a safety function of a single train of EDGs for greater than the TS allowed outage time.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

W. Baker, Operations Support Superintendent

S. Bono, Maintenance Manager

J. Boyer, Systems Engineering Manager

O. Brooks, Operations LOR Supervisor

B. Bruce, Nuclear Steam Supply Systems Engineering Manager

W. Byrne, Site Security Manager

J. Colvin, Engineering Programs Manager

P. Donahue, Assistant Engineering Director

M. Durr, Director of Engineering

M. Ellet, Maintenance Rule Coordinator

J. Emens, Licensing Manager

A. Feltman, Emergency Preparedness Manager

N. Gannon, Plant General Manager

K. Groom, Mechanical Design Engineering Supervisor

D. Hughes, Operations Manager

W. Hayes, Reactor Engineering Manager

S. Kelly, Assistant Work Control Manager

D. Kettering, I&C and Electrical Systems Engineering Manager

R. King, Design Engineering Manager

D. Malinowski, Operations Training Manager

P. Summers, Director of Safety and Licensing

B. Tidwell, Acting Director of Training

R. Norris, Radiation Protection Manager

W. Nurnberger, Work Control Manager

W. Pearce, Performance Improvement Manager

K. Polson, Site Vice President

M. Rasmussen, Operations Superintendent

H. Smith, Fire Protection Supervisor

S. Spears, Electrical Maintenance Supervisor

J. Underwood, Chemistry Manager

S. Walton, Electrical Maintenance Superintendent

A. Yarbrough, BOP Engineering Supervisor

LIST OF ITEMS

Opened

05000259/2011004-02 AV Failure to Properly Install Unit 1 High Pressure Coolant Injection Booster Pump Outboard Bearings (Section 1R22)

Opened and Closed

05000259/2011004-01 NCV Failure to Control Transient Combustible Materials in the Unit 1 Reactor Building (Section 1RO5.1)

05000259/2011004-03 NCV Unit 1 Loss of Shutdown Cooling Caused by Emergency Diesel Generator Output Breaker Trip (Section 4OA3.2)

05000296/2011004-04 NCV Unit 3 Loss of Shutdown Cooling During Primary Containment Isolation System Relay Replacement (Section 4OA3.6)

Closed

05000259/2011-002-00 LER Loss of Safety Function (SDC) Resulting from Loss of Power from C EDG Due to Oil Leak (Section 4OA3.1)

05000259/2011-003-00 LER Loss of Safety Function (SDC) Resulting from Emergency Diesel Generator Output Breaker Trip (Section 4OA3.2)

05000259/2011-005-00 LER Reactor Water Level Scram Due to Distracted Operations Crew (Section 4OA3.3)

05000259/2011-006-00, LER Loss of Safety Function (HPCI) Due to Primary Containment Isolation (Section 4OA3.4)

05000296/2009-003-03 LER Reactor Core Isolation Cooling System Inoperable Longer Than Allowed By the Technical Specifications (Section 4OA3.5)

05000296/2011-002-00 LER Reactor Scram Due to Scram Discharge Volume High Water Level (Section 4OA3.7)

05000259/2011-001-00 LER Three Unit Scram Caused By Loss of All 500-KV Offsite Power Sources (Section 4OA3.8)

05000260/2009-003-01 LER Safety/Relief Valve As-Found Setpoint Exceeded Technical Specification Lift Pressure (Section 4OA3.9)

05000296/2010-005-03 VIO Repeated Failure to Provide Complete and Accurate Information in LER 0500296/2009-003-02 (Section 4OA5.2)

200052/2011-002-05 VIO Repetitive Failure to Adequately Control Transient Combustible Materials Stored In Proximity of Loaded Dry Casks on the Independent Spent Fuel Storage Facility (ISFSI) Pad (Section 4OA5.3)

Discussed

05000296/2011-001-00 LER Loss of Shutdown Cooling (RHR) (Section 4OA3.6)