IR 05000259/2009002

IR 05000259-09-002, 05000260-09-002 and 05000296-09-002, on 01/01/2009 - 03/31/2009, Browns Ferry Nuclear Plant, Units 1, 2 and 3; Surveillance Testing, Identification and Resolution of Problems, and Event Follow-up

ML091210243
Person / Time
Site:	Browns Ferry
Issue date:	04/30/2009
From:	Eugene Guthrie Reactor Projects Region 2 Branch 6
To:	Swafford P Tennessee Valley Authority
References
IR-09-002
Download: ML091210243 (55)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION II

SAM NUNN ATLANTA FEDERAL CENTER 61 FORSYTH STREET, SW, SUITE 23T85 ATLANTA, GEORGIA 30303-8931 April 30, 2009 Mr. Preston D. Swafford Chief Nuclear Officer and Executive Vice President Tennessee Valley Authority 3R Lookout Place 1101 Market Street Chattanooga, TN 37402-2801 SUBJECT: BROWNS FERRY NUCLEAR PLANT - NRC INTEGRATED INSPECTION REPORT 05000259/2009002, 05000260/2009002 AND 05000296/2009002, AND ANNUAL ASSESSMENT MEETING

SUMMARY

Dear Mr. Swafford:

On March 31, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Browns Ferry Nuclear Plant, Units 1, 2, and 3. The enclosed inspection report documents the inspection results which were discussed, on April 3, 2009, with Mr. Jim Randich and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

In addition to the routine Reactor Oversight Process baseline inspections for all three units, the inspectors continued to conduct augmented inspections on Unit 1 as delineated in NRC letters dated May 16, 2007, December 6, 2007, and May 21, 2008. These Unit 1 augmented inspections were conducted to compensate for the lack of valid data for certain Performance Indicators (PIs). These additional inspections are only considered to be an interim substitute for the invalid Unit 1 PIs until complete and accurate PI data is developed and declared valid. In accordance with letters dated January 7, 2008, and July 11, 2008, the only PIs that remain invalid, and thereby subject to the augmented baseline inspection, are the Mitigating Systems Performance Index PIs.

Based on the results of this inspection, three self-revealing findings of very low safety significance (Green) were identified. Two of these were determined to involve violations of NRC requirements. In addition, two licensee-identified violations which were determined to be of very low safety significance are listed in this report. However, because of their very low safety significance and because they were entered into your corrective action program, the NRC is treating these violations as non-cited violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you wish to contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement,

United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Senior Resident Inspector at the Browns Ferry Nuclear Plant.

TVA 2 In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Senior Resident Inspector at the Browns Ferry Nuclear Plant. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response, if any, will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Eugene F. Guthrie, Chief Reactor Projects Branch 6 Division of Reactor Projects Docket Nos.: 50-259, 50-260, 50-296 License Nos.: DPR-33, DPR-52, DPR-68 Enclosure: Inspection Report 05000259/2009002, 05000260/2009002 and 05000296/2009002 w/Attachments cc w/encl. (See page 3)

_________________________ X SUNSI REVIEW COMPLETE OFFICE RII:DRP RII:DRP RII:DRP RII:DRP RII:DRP RII:DRP SIGNATURE TR CS KK JBB PCH EFG NAME TRoss CStancil KKorth JBaptist PHiggins EGuthrie DATE 4/30/2009 4/30/2009 4/30/2009 4/30/2009 4/30/2009 4/30/2009 E-MAIL COPY? YES NO YES NO YES NO YES NO YES NO YES NO

TVA 3 cc w/encl:

Ashok S. Bhatnagar, Senior VP General Counsel Nuclear Generation Development and Tennessee Valley Authority Construction Electronic Mail Distribution Tennessee Valley Authority Electronic Mail Distribution Larry E. Nicholson, General Manager Performance Improvement Preston D. Swafford Tennessee Valley Authority Chief Nuclear Officer and Executive VP Electronic Mail Distribution Tennessee Valley Authority Electronic Mail Distribution Michael A. Purcell Senior Licensing Manager William R. Campbell, Senior VP Nuclear Power Group Fleet Engineering Tennessee Valley Authority Tennessee Valley Authority Electronic Mail Distribution 6A Lookout Place 1101 Market Place Michael J. Lorek, Vice President Chattanooga, TN 37402-2801 Nuclear Engineering & Projects Tennessee Valley Authority Thomas Coutu, Vice President Electronic Mail Distribution Nuclear Support Tennessee Valley Authority Fredrick C. Mashburn, Acting Manager Electronic Mail Distribution Corporate Nuclear Licensing and Industry Affairs R. G. (Rusty) West, Site Vice President Tennessee Valley Authority Browns Ferry Nuclear Plant Electronic Mail Distribution Tennessee Valley Authority Electronic Mail Distribution Senior Resident Inspector Browns Ferry Nuclear Plant Frederick Russell Godwin U.S. Nuclear Regulatory Commission Manager, Licensing and Industry Affairs 10833 Shaw Road Browns Ferry Nuclear Plant Athens, AL 35611-6970 Tennessee Valley Authority P.O. Box 2000 Kirksey E. Whatley, Director Decatur, AL 35609 Office of Radiation Control Alabama Dept. of Public Health James J. Randich, Plant Manager Electronic Mail Distribution Browns Ferry Nuclear Plant Tennessee Valley Authority Chairman P.O. Box 2000 Limestone County Commission Decatur, AL 35609 310 West Washington Street Athens, AL 35611 Ludwig E. Thibault, General Manager Nuclear Oversight & Assistance Dr. D. E. Williamson Tennessee Valley Authority State Health Officer 3R Lookout Place Alabama Dept. of Public Health 1101 Market Steet Electronic Mail Distribution Chattanooga , TN 37402-2801

TVA 4 Letter to Preston D. Swafford from Eugene F. Guthrie dated April 30, 2009 SUBJECT: BROWNS FERRY NUCLEAR PLANT - NRC INTEGRATED INSPECTION REPORT 05000259/2009002, 05000260/2009002 AND 05000296/2009002,

AND ANNUAL ASSESSMENT MEETING SUMMARY Distribution w/encl:

C. Evans, RII EICS (Part 72 Only)

L. Slack, RII EICS (Linda Slack)

OE Mail (email address if applicable)

RIDSNRRDIRS PUBLIC RidsNrrPMBrownsFerry Resource

U.S. NUCLEAR REGULATORY COMMISSION REGION II Docket Nos.: 50-259, 50-260, 50-296 License Nos.: DPR-33, DPR-52, DPR-68 Report No.: 05000259/2009002, 05000260/2009002 and 05000296/2009002 Licensee: Tennessee Valley Authority (TVA)

Facility: Browns Ferry Nuclear Plant, Units 1, 2, and 3 Location: Corner of Shaw and Nuclear Plant Roads Athens, AL 35611 Dates: January 1, 2009 through March 31, 2009 Inspectors: T. Ross, Senior Resident Inspector C. Stancil, Resident Inspector K. Korth, Resident Inspector J. Baptist, Senior Project Engineer (Section 4OA2.2)

P. Higgins, Project Engineer (Section 4OA2.2)

Approved by: Eugene F. Guthrie, Chief Reactor Projects Branch 6 Division of Reactor Projects

SUMMARY OF FINDINGS IR 05000259/2009002, 05000260/2009002 and 05000296/2009002; 01/01/2009 - 03/31/2009;

Browns Ferry Nuclear Plant, Units 1, 2 and 3; Surveillance Testing, Identification and Resolution of Problems, and Event Follow-up.

The report covered a three month period of inspection by resident inspectors, a senior project engineer and a project engineer from Region II. Two Green non-cited violations and one Green Finding were identified. The significance of most findings is identified by their color (Green,

White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process Revision 4, dated December 2006.

Cornerstone: Initiating Events

Green.

A Green self-revealing non-cited violation of 10 CFR 50, Appendix B, Criterion XVI was identified for not promptly identifying and correcting a condition adverse to quality associated with steam cuts and/or defects in the Unit 1 reactor pressure vessel (RPV) flange that resulted in increased unidentified reactor coolant system (RCS)leakage during Cycle 7 operation. The Unit 1 RPV head and flange surfaces were repaired during the following refueling outage. This finding was entered into the licensee's corrective action program (CAP) as Problem Evaluation Report 155705.

This finding was greater than minor because it was associated with the Initiating Event Cornerstone attribute of Equipment Performance, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability during at-power operations. The finding was determined to be of very low safety significance (Green) because the maximum unidentified RCS leakage from the Unit 1 RPV flange leak was much less than the Technical Specification limit for unidentified RCS leakage of 5 gpm and would not have affected other mitigation systems resulting in a total loss of their safety function. No cross-cutting aspect was assigned to this issue because the direct cause was not considered as indicative of current performance due to improvements in the CAP since this issue occurred. (Section 4OA2.3)

Green.

A Green self-revealing finding was identified for inadequate design control and replacement of the 43A relay in the Unit 2 main generator voltage regulator control circuit that resulted in a reactor scram due to a main turbine generator trip from a loss of main generator excitation. The failed 43A relay was subsequently replaced with another model relay better suited to low energy control circuit applications. This finding was entered into the licensee's corrective action program as Problem Evaluation Report 153987.

This finding was greater than minor because it was associated with the Initiating Event Cornerstone attribute of Design Control, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during at-power operations. The finding was determined to be of very low safety significance (Green) because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigating equipment or functions were not available.

The cause of this finding was directly related to the cross-cutting area of Human Performance and the aspect of conservative assumptions and safe actions, because the licensees design change process was expedited such that important technical considerations regarding equipment reliability and operating experience were not adequately evaluated to ensure optimum relay selection for use in low voltage control circuit applications (H.1.b). (Section 4OA3.3)

Cornerstone: Mitigating Systems

Green.

A self-revealing non-cited violation of Technical Specification 5.4.1,

"Procedures", was identified for an incorrect Unit 1 surveillance procedure that instructed technicians to install a jumper in the wrong location which resulted in the inadvertent lockout of the Loop II residual heat removal (RHR) pumps automatic start feature while the Loop I RHR pumps were removed from service for testing. The improperly installed jumper resulted in the RHR system being unable to perform its safety function. The immediate corrective actions for this event included removal of the jumper to restore the automatic start feature of the RHR Loop II pumps, revision to the surveillance procedure to reflect the correct location for the jumper, and completion of the surveillance. This finding was entered into the licensees corrective action program as Problem Evaluation Report 166487.

The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of Procedure Quality and adversely affected the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. A Phase 2 analysis was performed because the event represented a loss of the RHR system safety function. The Phase 2 analysis using Appendix A, Technical Basis for At-Power Significance Determination Process, of IMC 0609 determined that the finding was of very low safety significance (Green). The cause of this finding was directly related to the cross cutting area of Problem Identification and Resolution and the aspect of thorough evaluation of identified problems because a prior licensee-identified procedural discrepancy regarding the location of this jumper was not adequately evaluated and resolved to ensure the jumper would be installed in the correct circuit (P.1(c)). (Section 1R22)

Two violations of very low safety significance, which were identified by the licensee, have been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program (CAP). These violations and the problem evaluation report (PER) tracking numbers are listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

Unit 1 began this report period at full Rated Thermal Power (RTP). On February 4, 2009, an unplanned downpower to 85 percent RTP was conducted in response to the automatic bypassing of a power cell and resultant output current instability of the 1B Variable Frequency Drive (VFD). On February 8, 2009, power was further reduced to 55 percent RTP to remove the 1B Recirculation pump from service to repair the VFD cell. Following these repairs, the unit was returned to full RTP on February 10, 2009. On February 18, 2009, an automatic reactor scram from full RTP occurred on Unit 1 due to a main turbine trip initiated by a neutral voltage overload trip of the main generator. The cause of the trip was condensation accumulating in the 1B bus duct cooling fan ductwork that was blown into the main generator output bus bars when the fan was started. The unit was restarted on February 24, 2009, but was removed from service the next day when the 1B Recirculation pump suffered an oil leak which damaged the lower radial bearing. The unit was restarted on March 13, 2009, returned to full RTP on March 16, 2009, and remained at full RTP for the remainder of the report period.

Unit 2 operated at essentially full RTP the entire report period except for an automatic scram and three planned downpowers. On February 16, 2009, a manual reactor scram from full RTP was inserted on Unit 2 due to elevated stator cooling water temperature. The cause of the temperature increase was failure of the stator cooling water system temperature control valve. After repairs were made, the unit was restarted on February 17, 2009, and returned to full RTP on February 23, 2009. On January 23, February 13 and March 27, 2009, planned downpowers to approximately 75 percent RTP were conducted to perform control rod pattern adjustments as well as other maintenance. In each case the unit was restored to full RTP on the following day.

Unit 3 operated at essentially full RTP the entire report period except for two planned downpowers. On January 9, 2009, a planned downpower to approximately 75 percent RTP was conducted to perform a control rod sequence exchange, turbine valve testing and main condenser waterbox cleaning. The unit was returned to full RTP on January 10, 2009. On January 25, 2009, a planned downpower to approximately 70 percent RTP was conducted to repair a packing leak on the 3A Reactor Feed Pump and to perform control rod exercise testing. The unit was returned to full RTP on January 26,

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R04 Equipment Alignment

.1 Partial Walkdown

a. Inspection Scope

The inspectors conducted three equipment alignment partial walkdowns to evaluate the operability of selected redundant trains or backup systems, listed below, with the other train or system inoperable or out of service. The inspectors reviewed the functional systems descriptions, Updated Final Safety Analysis Report (UFSAR), system operating procedures, and Technical Specifications (TS) to determine correct system lineups for the current plant conditions. The inspectors performed walkdowns of the systems to verify that critical components were properly aligned and to identify any discrepancies which could affect operability of the redundant train or backup system. Documents reviewed are listed in the Attachment to this report.

• Unit 2 Reactor Core Isolation Cooling System

• Unit 1/2 Emergency Diesel Generators (EDG) A and B

• Unit 1 and Unit 3 250V DC Main Batteries 1 and 3 respectively

b. Findings

No findings of significance were identified.

.2 Complete Walkdown

a. Inspection Scope

The inspectors completed a detailed alignment verification of the Unit 1 Standby Liquid Control (SLC) System, using the applicable P&ID flow diagram, 1-47E854-1, along with the relevant operating instruction, 1-OI-63, to verify equipment availability and operability. The inspectors reviewed relevant portions of the UFSAR and TS. This detailed walkdown also verified electrical power alignment, the condition of applicable system instrumentation and controls, component labeling, pipe hangers and support installation, and associated support systems status. Furthermore, the inspectors examined the applicable System Health Reports, Work Orders (WO), and any PERs that could affect system alignment and operability.

b. Findings

No findings of significance were identified.

1R05 Fire Protection

.1 Routine Walkdowns

a. Inspection Scope

The inspectors reviewed licensee procedures, Standard Programs and Processes (SPP)-10.10, Control of Transient Combustibles, and SPP-10.9, Control of Fire Protection Impairments, and conducted a walkdown of the six fire areas (FA) and fire zones (FZ) listed below. Selected FAs/FZs were examined in order to verify licensee control of transient combustibles and ignition sources; the material condition of fire protection equipment and fire barriers; and operational lineup and operational condition of fire protection features or measures. Also, the inspectors verified that selected fire protection impairments were identified and controlled in accordance with procedure SPP-10.9. Furthermore, the inspectors reviewed applicable portions of the Site Fire Hazards Analysis Volumes 1 and 2 and Pre-Fire Plan drawings to verify that the necessary fire fighting equipment, such as fire extinguishers, hose stations, ladders, and communications equipment, was in place.

• Unit 2 Reactor Building Elev. 621, Electrical Board Room 2A (FA-9)

• Unit 2 Reactor Building Elev. 621, Shutdown Board Room 2A (FA-10)

• Unit 2 Reactor Building Elev. 621, Shutdown Board Room 2B (FA-11)

• Unit 1 Reactor Building Elev. 639 South of Column Line R (FZ 1-6)

• Unit 1 Reactor Building Elev. 621 and North Elev. 639 (FZ 1-5)

• Unit 2 Reactor Building, Elev. 519, 541, and 565 - East side (FZ 2-2)

b. Findings

No findings of significance were identified.

1R11 Licensed Operator Requalification

.1 Resident Inspector Quarterly Review

a. Inspection Scope

On March 23, 2009, the inspectors observed licensed operator requalification simulator examination for two crews. Each crew received the same examination scenario: Group 6 Isolation and Main Steam Line Break in Containment.

The inspectors specifically evaluated the following attributes related to each operating crews performance:

• Clarity and formality of communication

• Ability to take timely action to safely control the unit

• Prioritization, interpretation, and verification of alarms

• Correct use and implementation of Abnormal Operating Instructions (AOIs), and Emergency Operating Instructions (EOIs)

• Timely and appropriate Emergency Action Level declarations per Emergency Plan Implementing Procedures (EPIP)

• Control board operation and manipulation, including high-risk operator actions

• Command and Control provided by the Unit Supervisor and Shift Manager The inspectors attended a post-examination critique to assess the effectiveness of the licensees program. The inspectors also reviewed simulator physical fidelity (i.e., the degree of similarity between the simulator and the reference plant control room, such as physical location of panels, equipment, instruments, controls, labels, and related form and function).

b. Findings

No findings of significance were identified.

1R12 Maintenance Effectiveness

a. Inspection Scope

The inspectors reviewed two specific equipment issues listed below for structures, systems and components (SSC) within the scope of the Maintenance Rule (MR)

(10CFR50.65) with regard to some or all of the following attributes:

(1) Work practices;

(2) Identifying and addressing common cause failures;

(3) Scoping in accordance with 10 CFR 50.65(b) of the MR;

(4) Characterizing reliability issues for performance;

(5) Trending key parameters for condition monitoring;

(6) Charging unavailability for performance;

(7) Appropriateness of performance criteria in accordance with 10 CFR 50.65(a)(2);

(8) System classification in accordance with 10 CFR 50.65(a)(1); and

(9) Appropriateness and adequacy of (a)(1) goals and corrective actions (i.e., Ten Point Plan). The inspectors also compared the licensees performance against site procedure SPP-6.6, Maintenance Rule, PI Monitoring, Trending and Reporting; Technical Instruction 0-TI-346, Maintenance Rule PI Monitoring, Trending and Reporting; and SPP 3.1, Corrective Action Program. The inspectors also reviewed, as applicable, WOs, surveillance records, PERs, system health reports, engineering evaluations, and MR expert panel minutes; and attended MR expert panel meetings to verify that regulatory and procedural requirements were met.

• Emergency Equipment Cooling Water (EECW) Strainer Failures

• Secondary Containment Isolation Damper Failures

b. Findings

No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Evaluation

a. Inspection Scope

For planned online work and/or emergent work that affected the combinations of risk significant systems listed below, the inspectors reviewed five licensee maintenance risk assessments and actions taken to plan and control work activities to effectively manage and minimize risk. The inspectors verified that risk assessments and applicable risk management actions (RMA) were conducted as required by 10 CFR 50.65(a)(4) and applicable plant procedures such as SPP-7.0, Work Management; SPP-7.1, On-Line Work Management; 0-TI-367, BFN Equipment to Plant Risk Matrix; and BP-336, Risk Determination And Risk Management. The inspectors also evaluated the adequacy of the licensees risk assessments and implementation of RMAs.

• Unit 1/2 A EDG and Unit 2 High Pressure Coolant Injection (HPCI) Pump Out of Service (OOS).

• 1C RHR pump, Division I Core Spray, A3 EECW pump, EECW North Header Sectionalizing valve (67-13) OOS

• Unit 1/2 C EDG and B3 EECW Pump OOS

• Unit 1/2 B EDG, 2A Control Rod Drive (CRD) Pump and 2A Residual Heat Removal (RHR) Pump OOS

• 1D RHR pump, A3 EECW pump, and B3 EECW pump OOS, and 1B CRD pump (aligned to Unit 2), and A1 RHRSW pump (aligned to EECW)

b. Findings

No findings of significance were identified.

1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the seven operability/functional evaluations (FE) listed below to verify technical adequacy and ensure that the licensee had adequately assessed TS operability. The inspectors also reviewed applicable sections of the UFSAR to verify that the system or component remained available to perform its intended function. In addition, where appropriate, the inspectors reviewed licensee procedures NEDP-22, FE and PIDP-3, Operability and Reportability Reviews of PERs, to ensure that the licensees evaluation met procedure requirements. Furthermore, where applicable, inspectors examined the implementation of compensatory measures to verify that they achieved the intended purpose and that the measures were adequately controlled. The inspectors also reviewed PERs on a daily basis to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.

• Unit 1/2 EDG C Redundant Start Test Failure (PER 162369)

• Unit 1 CS Pump A Failure to Trip (PER 161766)

• Common Unit 161KV Capacitor Bank Battery Multiple Failures of PM for Average and Pilot Cell Temperatures (PER 162770)

• C Diesel Generator Failure to Load During Appendix R Run (PER 162127)

• Inadequate Operating Pressure Test of Unit 1 RV Nozzle N-11B Weld Repair (PERs 158384 and 158571)

• Unit 1/2 EDG A Turbo Charger Degradation and Common Cause Evaluation (PERs 153878 and 159837)

• Revised Safe Shutdown Instruction (SSI) Entry Conditions (PERs 162431 and 162779)

b. Findings

Introduction:

The inspectors identified an issue with the adequacy of the Entry Conditions to 0-SSI-001, Safe Shutdown Instructions (SSIs), for ensuring designated safe shutdown equipment are capable of performing their intended functions during an 10CFR50, Appendix R, fire event. This issue is being characterized as an unresolved item (URI).

Description:

On December 23, 2008, the licensee issued Revision 2 of 0-SSI-001, which instituted a significant change to the SSI Entry Conditions. In essence this revision, added an entry condition based on the operators ability to restore and maintain reactor water level above +2 inches on the narrow range scale with available equipment. With this change in effect, operators would not enter the SSIs during an Appendix R fire event unless they were unable to restore and maintain reactor water level above +2 inches.

As long as operators could maintain reactor water level during a fire event, they would continue to use the Emergency Operating Instructions (EOI) in lieu of the SSIs. In January 2009, the inspectors reviewed the affect of 0-SSI-001, Revision 2, upon the operators ability to align and operate designated safe shutdown equipment in a manner that would ensure their capability to perform their intended functions during a 10CFR50, Appendix R, fire event. Based on this review, the inspectors questioned the adequacy of the revised SSI entry conditions to ensure critical parameters (e.g., Suppression Pool temperature) would be maintained consistent with assumptions in the safe shutdown analyses (SSA). Failure of the operators to enter the SSIs at the right time could invalidate the critical SSI timelines for operator actions to ensure reactor core and containment cooling functions are met. To address the inspectors concerns regarding the potential adverse impact on critical assumptions in the SSAs as a consequence of delayed entry into the SSIs by the operators, the licensee initiated PER 162431. After further review of the inspectors concerns, the licensee subsequently determined that the Entry Conditions of 0-SSI-1 did not ensure timely entry into the safe shutdown procedures in the event that decay heat removal capability was lost due to fire damage.

The Revision 2 procedure change evaluation of 0-SSI-001 did not consider the potential impact on decay heat removal and containment cooling functions during a fire event.

The licensee initiated PER 162779 to promptly address this specific issue.

On February 9, 2009, the licensee issued Revision 3 of 0-SSI-001 which changed the Entry Conditions to include additional provisions for ensuring timely entry into the SSIs that would assure critical SSA assumptions were met to allow decay heat removal and containment cooling functions to be fulfilled. This SSI revision, and a revision to the licensees Fire Protection Report, were the primary corrective actions to resolve PER 162779. In order to address the inspectors original, overall concern, as part of the corrective actions for PER 162431, the licensee committed to conduct a comprehensive re-evaluation of the SSI entry conditions to assure they were consistent with all SSA assumptions and SSI timelines for any Appendix R fire event. [Note: following further dialogue with the NRC staff regarding acceptability of SSI entry conditions, the licensee also initiated PER 164685 and subsequently issued Revision 4 of 0-SSI-001, on February 27, 2009, which changed the Entry Conditions back to the way they were in Revision 1. The Entry Conditions prescribed by Revision 1 and 4 of 0-SSI-001 were essentially based only on the magnitude of the fire, and did not include qualifiers related to plant parameters (e.g., reactor water level, suppression pool temperature).]

In order to fully assess the safety and enforcement implications regarding the adequacy of the revised SSI entry conditions, additional information from the licensee will be needed. Consequently, pending completion of the licensees comprehensive re-evaluation, and further review by the NRC, this issue will be identified as URI 05000259, 260, 296/2009002-01, Inappropriate Change to SSI Entry Conditions For Appendix R Fire Events.

1R19 Post Maintenance Testing

a. Inspection Scope

The inspectors reviewed the six post-maintenance tests (PMT) listed below to verify that procedures and test activities confirmed SSC operability and functional capability following maintenance. The inspectors reviewed the licensees completed test procedures to ensure any of the SSC safety function(s) that may have been affected were adequately tested, that the acceptance criteria were consistent with information in the applicable licensing basis and/or design basis documents, and that the procedure had been properly reviewed and approved. The inspectors also witnessed the test and/or reviewed the test data, to verify that test results adequately demonstrated restoration of the affected safety function(s). The inspectors verified that PMT activities were conducted in accordance with applicable WO instructions, or procedural requirements, including SPP-6.3, Pre-/Post-Maintenance Testing, and MMDP-1, Maintenance Management System. Furthermore, the inspectors reviewed problems associated with PMTs that were identified and entered into the CAP.

• Unit 2: PMT for Placement of 2-FCV-073-0002, HPCI Steam Line Inboard Isolation Valve, on the Electrical Soft Back Seat, in accordance with 2-SR-3.6.1.3.5(HPCI),

HPCI System Motor Operated Valve Operability and WO 09-710035-001

• Unit 1: PMT for Replacement of 1-FSV-090-0255, Drywell Leak Detection Intake Outboard Isolation Valve, in accordance with 1-SR-3.6.1.3.5, Primary Containment Isolation Valve Operability Test, and WOs 08-725524-000 and WO 08-725524-001

• Unit 1: PMT for Replacement of 1-XS-75-61, Core Spray System I Auto-Init Reset Pushbutton, in accordance with WO 09-710858-000

• Common: PMT for Repairs to C Emergency Diesel Air-Start System in accordance with EPI-0-082-DGZ005, Diesel Generator C Redundant Start Test and WO 09-711187-000

• Unit 1: PMT for Disassembly, Refurbishment and Reassembly of the 1B Inboard and 1D Inboard and Outboard Main Steam Isolation Valves

• Unit 2: PMT for Repair of 2-FCV-073-0016, HPCI Steam Admission Valve in accordance with 2-SR-3.5.1.7, HPCI Main and Booster Pump Set Developed Head and Flowrate Test at Rated Reactor Pressure, and WO 08-712154-000

b. Findings

No findings of significance were identified.

1R20 Refueling and Other Outage Activities

.1 Unit 2 Forced Outage Due To Elevated Stator Cooling Water Temperature

a. Inspection Scope

On February 16, 2009, Unit 2 was manually tripped from full RTP due to elevated main generator stator cooling water temperature. The loss of stator cooling water was due to the temperature control valve, 2-TCV-035-0054, failing open and bypassing more than the required cooling flow. The unit subsequently entered Mode 4 to correct the problem, conduct maintenance on the HPCI System, and perform reactor vessel water level instrumentation surveillances. The unit was restarted on February 20 and reached full RTP on February 23, 2009. During this short forced outage the inspectors examined the conduct of critical outage activities pursuant to TS, applicable procedures, and the licensees outage risk assessment and outage management plans. Some of the more significant outage activities monitored, examined and/or reviewed by the inspectors were as follows:

• Reactor Shutdown and cooldown activities per 2-GOI-100-12A, Unit Shutdown from Power Operations to Cold Shutdown and Reduction in Power During Power Operations

• Control of Cold Shutdown (Mode 4) conditions, and critical plant parameters

• Licensees conduct of 2-GOI-200-2, Drywell Closeout; and an independent detailed closeout inspection of the Unit 2 drywell by the inspectors

• PORC event review and restart meeting in accordance with SPP-10.5, Plant Operations Review Committee

• Reactor startup and power ascension activities per 2-GOI-100-1A, Unit Startup

• Outage risk assessment and management per SPP-7.2, Outage Management

• Control and management of forced outage and emergent work activities per SPP-7.2 The inspectors reviewed PERs generated during the Unit 2 forced outage, and attended Corrective Action Review Board (CARB) meetings to verify that initiation thresholds, priorities, mode holds, and significance levels were assigned as required.

b. Findings

No findings of significance were identified.

.2 Unit 1 Forced Outage Due To Main Generator Trip

a. Inspection Scope

On February 18, 2009, Unit 1 automatically scrammed from full RTP due to a main turbine generator (MTG) trip that was caused by a neutral voltage overload. The cause of the MTG trip was apparently due to the accumulation of a considerable amount of condensed water in the 1B bus duct cooling fan ductwork, such that when operators switched from the 1A to the 1B bus duct cooling fan, water was blown into the main generator output bus bars resulting in an electrical fault. While shutdown, the licensee also decided to cool down to Mode 4 on February 19 to repair an HPCI Steam Line Isolation Valve. The unit was restarted on February 24, 2009, but had to shutdown and cool down again due to a loss of oil from the 1B Recirculation Pump lower motor bearing. During this cooldown, three of the Main Steam Isolation Valves failed to fast-close and repairs to these valves caused a further delay in restoring the unit to power.

The unit was restarted on March 13 and reached full RTP on March 16, 2009. During this forced outage the inspectors examined the conduct of critical outage activities pursuant to TS, applicable procedures, and the licensees outage risk assessment and outage management plans. Some of the more significant outage activities monitored, examined and/or reviewed by the inspectors were as follows:

• Reactor Shutdown and cooldown activities per 1-GOI-100-12A, Unit Shutdown from Power Operations to Cold Shutdown and Reduction in Power During Power Operations

• Control of Cold Shutdown (Mode 4) conditions, and critical plant parameters

• Licensees conduct of 1-GOI-200-2, Drywell Closeout; and two independent detailed closeout inspections of the Unit 1 drywell by the inspectors

• PORC event reviews and restart meetings in accordance with SPP-10.5

• Reactor startups, heatups and power ascension activities per 1-GOI-100-1A, Unit Startup, and 1-SR-3.4.9.1(1), Reactor Heatup and Cooldown Rate Monitoring

• Outage risk assessment and management per SPP-7.2

• Control and management of forced outage and emergent work activities per SPP-7.2 The inspectors reviewed PERs generated during the Unit 1 forced outage and attended PER Screening Committee (PSC) and CARB meetings to verify that initiation thresholds, priorities, mode holds, and significance levels were assigned as required.

b. Findings

No findings of significance were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors witnessed portions and/or reviewed completed test data for the following eight surveillance tests of risk significant and/or safety-related systems to verify that the tests met TS surveillance requirements, UFSAR commitments, and in-service testing and licensee procedure requirements. The inspectors review confirmed whether the testing effectively demonstrated that the SSCs were operationally capable of performing their intended safety functions and fulfilled the intent of the associated surveillance requirement.

Reactor Coolant System (RCS) Leak Detection Tests:

• 1-SR-3.4.5.3, Unit 1 Drywell Floor Drains Sump Flow Monitoring System Calibration In-Service Tests:

• 3-SR-3.5.1.6(RHR I), Quarterly Unit 3 RHR System Rated Flow Test Loop I Routine Surveillance Tests:

• 1-SR-3.4.6.1, Dose Equivalent Iodine 131 Concentration

• 1-SR-3.3.5.1.6(CS I), Unit 1 Core Spray System Logic Functional Test Loop

• 0-SR-3.8.1.8(I & II), 480V Load Shedding Logic System Functional Tests (Divisions I

& II)

• EPI-0-082-DGZ005, Diesel Generator C Redundant Start Test

• 0-SR-3.8.1.6, Common Accident Signal Logic Division I

• 1-SR-3.3.5.1.6(B I), Unit 1 RHR Logic Functional Test

b. Findings

Introduction:

A Green self-revealing noncited violation (NCV) of TS 5.4.1, "Procedures,"

was identified for an inadequate surveillance procedure for installing a jumper in the wrong location, which resulted in the Unit 1 RHR system being unable to perform its safety function.

Description:

On March 21, 2009, plant operators and electrical maintenance personnel were performing a functional test of the Unit 1 RHR Loop I pump and valve logic in accordance with 1-SR-3.3.5.1.6 (B I), Functional Testing of RHR Loop I Pump and Minimum Flow Valve Logic. The initial alignment for this surveillance required the Loop I pump breakers (RHR Pumps 1A and 1C) to be racked out to the test position. A step in the procedure then required a jumper to be installed to simulate a Unit 2 accident signal which would trip the 1A and 1C RHR Pump breakers, if a Unit 1 accident signal was not present. The surveillance procedure directed the jumper to be installed between terminals KK-75 and KK-76 in Panel 1-9-33. The Loop I pump load shed relays that were intended to be tested were actually in Panel 1-9-32. When the jumper was installed in the wrong cabinet it resulted in the lockout of the automatic start feature for the 1B and 1D RHR Pumps. The operators immediately recognized that the Loop II RHR pumps were locked out and directed maintenance personnel to remove the jumper to restore the automatic start feature to the pumps. This finding was entered into the licensees CAP as PER 166487.

Subsequent investigation revealed that a walk-down by maintenance personnel prior to performing the surveillance had identified a discrepancy in the surveillance procedure.

The procedure had directed the jumper to be installed in panel 1-9-33 which was incorrect, but a later step directed the jumper to be removed from panel 1-9-32 which was the appropriate location for the jumper. This was communicated to the Operations Procedure Group, but they inappropriately left the installation of the jumper in the wrong panel and changed the location for the jumper removal step to the same panel. This was a missed opportunity for the licensee to correct the surveillance procedure prior to running the surveillance.

Analysis:

The installation of a jumper in the wrong location due to an inadequate procedure was a performance deficiency which resulted in the loss of safety function of the RHR system. This finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of Procedure Quality and adversely affected the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The Phase 1 worksheet in NRC Manual Chapter 0609, "Significance Determination Process," was used to conclude that a Phase 2 analysis was required because the finding represented an actual loss of safety function for the RHR system. The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis for at Power Significance Determination Process," of NRC Manual Chapter 0609, "Significance Determination Process," and the Phase 2 Risk Notebook for Browns Ferry Unit 2. The inspectors assumed that RHR was unavailable for Low Pressure Injection safety function, but that Loop II RHR would be available for Containment Heat Removal safety function. Additionally, a credit of one was used for operator recovery to manually start the Loop II RHR pumps during the injection phase if an accident occurred. These assumptions resulted in a finding of very low safety significance with the dominant sequences being a transient without power conversion system and stuck open relief valve. These results were validated by a senior reactor analyst who concluded that the SDP results were very conservative since the Phase 2 worksheet calculates the increased risk based on an assumed exposure time of three days, whereas this condition only existed for approximately one minute.

The cause of this finding was directly related to the cross cutting area of Problem Identification and Resolution, in the component of corrective action program, and the aspect of thorough evaluation of identified problems, because a prior licensee-identified procedural discrepancy regarding the jumper location was not adequately evaluated and resolved to ensure the jumper would be installed in the correct circuit (P.1(c)).

Enforcement:

Unit 1 Technical Specification 5.4.1 required, in part, that written procedures be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide (RG) 1.33, Revision 2, Appendix A, February 1978. RG 1.33, Appendix A, Section 8 included surveillance test procedures for Emergency Core Cooling Systems. Contrary to the above, 1-SR-3.3.5.1.6 (B I),

Functional Testing of RHR Loop I Pump and Minimum Flow Valve Logic, was not adequately established and maintained such that during the performance of the test, both the Loop I and Loop II RHR pumps were rendered inoperable, resulting in the system being unable to fulfill its safety function.

Because the finding is of very low safety significance and has been entered into the licensees as PER 166487, this violation is being treated as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000259/2009-002-02, Inadequate Surveillance Procedure Causes Loss of Unit 1 RHR System Safety Function."

Cornerstone: Emergency Preparedness

1EP6 Drill Evaluation

a. Inspection Scope

On March 25, 2009, the inspectors observed an Emergency Preparedness (EP) drill that contributed to the licensees Drill/Exercise Performance (DEP) and Emergency Response Organization (ERO) PI measures, to identify any weaknesses and deficiencies in classification, notification, dose assessment and protective action recommendation (PAR) development activities. The inspectors observed emergency response operations in the simulated control room and the Technical Support Center to verify that event classification and notifications were done in accordance with EPIP-1, Emergency Classification Procedure and other applicable Emergency Plan Implementing Procedures. The inspectors also attended the licensee critique of the drill to compare any inspector-observed weakness with those identified by the licensee in order to verify whether the licensee was properly identifying weaknesses.

b. Findings

No findings of significance were identified.

4OA1 Performance Indicator (PI) Verification

.1 Cornerstone: Barrier Integrity

RCS Activity and RCS Leakage

a. Inspection Scope

The inspectors reviewed the licensees procedures and methods for compiling and reporting the following PIs, including procedure SPP-3.4, PI for NRC Reactor Oversight Process for Compiling and Reporting PIs to the NRC. The inspectors examined the licensees PI data for the specific PIs listed below for the first through fourth quarters of 2008. The inspectors reviewed the licensees data and graphical representations as reported to the NRC to verify that the data was correctly reported. The inspectors also validated this data against relevant licensee records (e.g., PERs, Daily Operator Logs, Plan of the Day, Licensee Event Reports, etc.), and assessed any reported problems regarding implementation of the PI program. Furthermore, the inspectors met with responsible plant personnel to discuss and review licensee records to verify that the PI data was appropriately captured, calculated correctly, and discrepancies resolved. The inspectors also used the Nuclear Energy Institute (NEI) 99-02, Regulatory Assessment PI Guideline, Revision 5, to ensure that industry reporting guidelines were appropriately applied.

• Unit 1 RCS Activity

• Unit 1 RCS Leakage

• Unit 2 RCS Activity

• Unit 2 RCS Leakage

• Unit 3 RCS Activity

• Unit 3 RCS Leakage

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

.1 Review of items Entered into the Corrective Action Program

As required by Inspection Procedure 71152, Identification and Resolution of Problems, and in order to help identify repetitive equipment failures or specific human performance issues for follow-up, the inspectors performed a daily screening of items entered into the licensees CAP. This review was accomplished by reviewing daily PER report summaries, and periodically attending daily PSC and CARB meetings.

.2 Focused Annual Sample Review - Unit 1 HPCI System Issues

a. Inspection Scope

In accordance with the Unit 1 Augmented Inspection Plan (AIP), the inspectors examined the licensee's causal determination and corrective actions to address equipment problems that caused the Unit 1 MSPI PI for the HPCI System to exceed the green/white threshold during the second and third quarters of 2007. The inspectors 1)

Assessed the adequacy of the licensee's evaluation of the degraded performance of the Unit 1 HPCI system by reviewing appropriate apparent evaluations, root cause analyses, common cause analyses for the White HPCI System MSPI status, and the supporting PERs for the individual failures; 2) Evaluated the appropriateness of corrective actions associated with each root, apparent, or contributing cause; 3) Determined whether corrective actions were prioritized with consideration of risk significance and regulatory compliance; 4) Performed an in-depth review of each of the equipment problems to determine whether any of the equipment problems would have caused inoperability of the HPCI system; 5) Evaluated other historical or current Unit 1 HPCI system issues to determine if they contain any common cause or extent of cause aspects; 6) Evaluated the effectiveness of corrective actions utilizing criterion established in IP 71152 (Section 3.02.a); and 7) Evaluated the causal evaluations utilizing criterion established in IP 95001 (Section 02.01-03). Documents reviewed during the inspection are listed in the

.

b. Findings and Observations

No findings of significance were identified. The inspectors concluded that none of the reviewed equipment problems would have caused the HPCI system to become inoperable. However, the inspectors did identify that for three of these equipment problems, no PERs were entered into the CAP, but instead were corrected using only the plant WO system. In addition, the inspectors identified that for two other equipment problems for which PERs had been entered into the CAP, not all aspects of these equipment problems were addressed by the PERs. The inspectors conducted several discussions with plant Licensing, Engineering, and CAP management personnel. Plant personnel agreed that these equipment problems should have been entered into, or more thoroughly resolved in, the plant CAP. Subsequently the licensee initiated PERs to correct these administrative issues as necessary. The inspectors concluded that the licensee's failure to enter these equipment problems into the plant CAP was a performance deficiency. However, since none of these equipment problems caused inoperability of the HPCI system, the inspectors concluded that the performance deficiency was minor in accordance with the criteria in Manual Chapter 0612, Appendix B.

.3 Focused Annual Sample Review - Unit 1 Reactor Pressure Vessel Flange Leak

a. Inspection Scope

On October 28, 2008, during the Unit 1 Cycle 7 refueling outage, the licensee identified steam cuts in the Unit 1 RPV head flange surfaces. These steam cuts were indicative of the increasing unidentified reactor coolant system leakage that the licensee had been closely monitoring since restart of Unit 1 and throughout Cycle 7 operation. The inspectors reviewed PER 155705, Unit 1 RPV Head Steam Cut Indications, including the associated apparent cause evaluation and corrective action plans. This PER was initiated to resolve the Unit 1 RPV flange leakage and subsequent damage to the flange mating surfaces. The inspectors also reviewed PER 99148, Unit 1 Reactor Vessel Head Steam Tracing, that was initiated on March 14, 2006, prior to Unit 1 restart; and other relevant documents listed in the attached Supplemental Information. Furthermore, the inspectors interviewed responsible engineering personnel.

b. Findings and Observations

One finding of significance was identified.

Introduction:

A Green self-revealing NCV of 10 CFR 50, Appendix B, Criterion XVI was identified for not promptly identifying and correcting a condition adverse to quality associated with steam cuts and/or defects on the Unit 1 reactor RPV flange that resulted in a significant increase in the unidentified RCS leakage during Cycle 7 operation.

Description:

On March 14, 2006, during Unit 1 recovery, the licensee initiated PER 99148 due to the existence of known damage (i.e., steam cutting) to the RPV flange head-side surface in the vicinity of the O-ring grooves. This type of damage was indicative of RCS leakage that had breached the inner and outer O-ring seals during prior operating cycle(s). In a meeting on March 21, 2006, and after examining additional inspections of the RPV head-side flange on March 22, 2006, the licensee documented in Meeting Minutes dated March 28, 2006, that issues were also raised concerning the uncertainty of the condition of the RPV vessel-side flange surface given the obvious damage to the head-side flange. But no WO, PER action item, or new PER was written to inspect and repair the RPV vessel-side flange which at that time was covered and submerged (i.e., reactor cavity flooded) in preparation for Unit 1 fuel load.

The Unit 1 RPV head-side flange was subsequently repaired in accordance with ASME code requirements prior to restart. However, no evidence could be located regarding any detailed inspections or repairs of the Unit 1 RPV vessel-side flange. Furthermore, on February 14, 2007, the licensee had another opportunity to identify any defects or steam cutting of the RPV vessel-side flange during the Unit 1 reactor vessel reassembly when the vessel flange sealing surfaces were inspected for cleanliness and damage.

But this inspection was not a detailed examination and no specific record of inspection results or indications of damage was documented.

After a five-year recovery effort, Unit 1 was restarted on May 21, 2007. Almost immediately after reactor startup, and RCS heatup and pressurization, Unit 1 experienced elevated drywell temperatures and indications that the RPV head flange inner O-ring seal was breached. After a brief investigation, the licensee decided to raise the drywell temperature alarm setpoints, and disable the RPV head seal leakoff alarm.

From June 2007 until the Unit 1 refueling outage in October 2008, the drywell floor drain leakage (i.e., RCS unidentified leakrate) slowly, but steadily increased from 0.1 gallons per minute (gpm) to 1.2 gpm. Despite multiple shutdowns and Unit 1 drywell entries searching for the source of the floor drain leakage, the licensee was unsuccessful. But on October 28, 2008, during disassembly of the Unit 1 reactor vessel, the licensee discovered steam cuts in both mating surfaces of the RPV head flange. These steam cuts were clearly indicative of a failure of the inner and outer RPV flange O-ring seals that had resulted in elevated RCS leakage in the drywell. PER 155705 was initiated to resolve the identified steam cuts. The subsequent apparent cause determination of PER 155705 concluded that the steam cuts were due to existing damage on the RPV flange at the time of U1 restart that were not repaired. Both the RPV head flange and RPV flange were repaired according to ASME code requirements prior to Unit 1 startup following the U1C7 refueling outage.

Analysis:

The licensees failure to promptly identify and resolve suspected steam cuts in the Unit 1 RPV flange prior to restart that resulted in elevated RCS unidentified leakage was determined to be a performance deficiency. This finding is greater than minor because it is associated with the Initiating Event Cornerstone attribute of Equipment Performance, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability during at-power operations. Also, this finding represented a degradation of the barrier integrity function of the RPV flange that if left uncorrected would have become a more significant safety concern (i.e., initiator of a small LOCA). The finding was evaluated using Phase 1 of the At-Power SDP, and was determined to be of very low safety significance (Green) because the maximum unidentified RCS leakage from the Unit 1 RPV flange leak was much less than the five gpm TS limit for unidentified RCS leakage and would not have affected other mitigation systems resulting in a total loss of their safety function.

No cross-cutting aspect was assigned to this issue because the direct cause was not considered as indicative of current performance due to improvements in the CAP since this issue occurred.

Enforcement:

Criterion XVI, Corrective Action, of 10 CFR 50, Appendix B, required that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. Contrary to Criterion XVI, the licensee failed to promptly identify into their CAP and correct in a timely manner evidence of steam cutting on the surface of the Unit 1 RPV flange. Because this violation was considered to be of very low safety significance, and has been entered into the licensees CAP as PER 155705, it is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000259/2009002-03, Unit 1 RPV Flange Leak Due To Lack of Prompt Identification and Resolution of Defects.

.4 Focused Annual Sample Review - Trend in Inadequate Verification of Work Activities

a. Inspection Scope

The inspectors reviewed the cause evaluation and specific corrective actions associated with PER 159472, Trend in Inadequate Verification of Work Activities. This PER was initiated to evaluate a trend in licensee personnel signing procedure or WO steps when the action had not been completed. The problem description for the PER contained eight examples of when a step was signed and the action described in the step had not been fully completed. The inspectors reviewed the cause determination, corrective actions taken or planned, and the extent of condition evaluation for this PER. In addition, the inspectors conducted an independent review of the PER database to assess if interim corrective actions had been effective in addressing this trend.

b. Findings and Observations

No findings of significance were identified.

The licensee conducted a common-cause evaluation. The causes for this trend were determined to be inconsistent techniques used to ensure verifications were performed correctly; administrative type errors; and not using human performance tools to the extent necessary to prevent self-checking type errors.

The licensees corrective actions included: evaluating the need for training on the use of verification techniques; issuing site-wide bulletins on documentation errors, and responsibility and integrity associated with an employees signature; assigning personnel to conduct observations of work packages, both while in-progress and after completion; conducting a self-assessment on work-order closure reviews; and conducting periodic meetings with the maintenance shops to reinforce expectations for the use of human error prevention tools. However, other than the site bulletins, these actions were limited to the Maintenance Department only, even though three of the eight examples listed in the problem description for this PER were caused by Operations Department personnel.

Furthermore, the inspectors noticed that several additional examples of this behavior have occurred since the adverse trend was identified. These additional examples (e.g.,

PERs 163782, 166455, 161157, and 167641) also involved a lack of rigor in performing signoffs by Engineering, Operations, and Maintenance personnel. No interim corrective actions were taken when PER 159472 was initiated. In response to the inspectors observations, the licensee initiated PER 167540 to address the inadequate extent of condition.

4OA3 Event Follow-up

.1 Unit 2 Manual Reactor Scram

a. Inspection Scope

On February 16, 2009, Unit 2 was manually tripped from full RTP due to elevated stator cooling water temperature. The loss of stator cooling water was due to the temperature control valve (TCV), 2-TCV-035-0054, failing open and bypassing more than the required cooling flow. The resident inspectors responded to the control room and verified that the unit was in a stable Mode 3 (Hot Shutdown) condition. The inspectors also confirmed that all safety-related mitigating systems and automatic functions operated properly. Furthermore, the inspectors evaluated safety equipment and operator performance before and after the event by examining existing plant parameters, strip charts, plant computer historical data displays, operator logs, and the critical parameter trend charts in the post-trip report. The inspectors also interviewed responsible on-shift Operations personnel and examined the implementation of applicable alarm response procedures (ARPs), AOIs, and EOIs, particularly 2-AOI-100-1, Reactor Scram. Furthermore, the inspectors reviewed and verified that the NRC required notifications were made in accordance with 10 CFR 50.72.

b. Findings

No significant findings were identified.

.2 Unit 1 Automatic Reactor Scram

a. Inspection Scope

On February 18, 2009, Unit 1 automatically scrammed from full RTP due to a MTG trip that was caused by a neutral voltage overload. The cause of the MTG trip was accumulation of water in the 1B bus duct cooling fan ductwork, such that when operators switched from the 1A to the 1B bus duct cooling fan, water was blown into the main generator output bus bars resulting in an electrical fault. The resident inspectors responded to the control room and verified that the unit was in a stable Mode 3 (Hot Shutdown) condition. The inspectors also confirmed that all safety-related mitigating systems and automatic functions operated properly. Furthermore, the inspectors evaluated safety equipment and operator performance before and after the event by examining existing plant parameters, strip charts, plant computer historical data displays, operator logs, and the critical parameter trend charts in the post-trip report. The inspectors also interviewed responsible on-shift Operations personnel and examined the implementation of applicable ARPs, AOIs, and EOIs, particularly 1-AOI-100-1, Reactor Scram. Furthermore, the inspectors reviewed and verified that the NRC required notifications were made in accordance with 10 CFR 50.72.

b. Findings

No significant findings were identified.

.3 (Closed) LER 05000260/2008-001, Automatic Turbine and Reactor Trip Resulting From

a Failure of the Design Change Process

a. Inspection Scope

On October 4, 2008, the Unit 2 reactor automatically scrammed from full RTP due to a MTG trip from a loss of main generator excitation. During and following the scram, all safety-related mitigating systems operated as designed, and all operator actions in response to the scram were deemed to be appropriate (see IR 05000260/2008-005, Section 4OA3.1). This LER and its associated PER 153987, including the root cause analysis (RCA), were reviewed by the inspectors.

b. Findings

This LER is considered closed with one finding identified.

Introduction:

A Green self-revealing finding was identified for inadequate design control and replacement of the 43A relay in the main generator voltage regulator control circuit that resulted in a Unit 2 reactor scram due to a MTG trip from a loss of main generator excitation. This event was very similar to a Unit 2 reactor scram on January 11, 2007.

Description:

On October 4, 2008, just prior to the scram, Unit 2 operators observed that the 500 KV Unit Station Service Transformer (USST) 2B automatic tap changer was operating excessively, and the Unit 2 MTG was experiencing unstable field voltage, transfer voltage, and phase amperage swings. In response to these unstable conditions, the operators placed the main generator voltage regulator in manual control. However, immediately after the main generator voltage regulator was transferred from auto to manual, the Unit 2 MTG tripped which initiated an automatic reactor scram. Subsequent investigation by the licensee determined that certain contacts in the auto/manual transfer relay (i.e., 43A relay) of the main generator voltage control circuit had failed to make-up which resulted in a loss of main generator excitation which tripped the MTG. The cause(s) of the voltage instabilities which initially prompted the operators to transfer the main generator voltage regulator to manual were under investigation by the licensee.

A post-scram RCA was conducted by the licensee, including a failure analysis by an independent laboratory of the 43A relay (i.e., HFA model). This relay was tested and verified to exhibit intermittent high resistance across contacts #7 and 8 which would explain why these contacts failed to make-up and resulted in loss of main generator excitation. The licensees RCA concluded that the General Electric (GE) model HFA relay being used to perform the function of the auto/manual transfer relay (43A relay) in the main generator voltage control circuit was poorly suited for this application. In addition, based on the independent lab analysis, it was determined that another possible contributing cause was mechanical misadjustment of the relay. The HFA model used for this relay function wasnt specifically designed for very low current and/or voltage control signal switching, and as such was considered to be susceptible to insufficient contact makeup, particularly if not adjusted properly.

The HFA model relay that failed was installed as the 43A relay following a similar Unit 2 reactor scram event on January 11, 2007. The root cause of the Unit 2 reactor scram in January 2007 was attributed to the original 43A relay reaching its end of life. The original relay had been determined to be obsolete with no equivalent replacement identified in March 2005. But no schedule was developed to initiate the replacement of the obsolete relay until January 2007 when it failed. In March 2007, the failed, obsolete 43A relay was then replaced with a GE model HFA relay as part of a design change.

However, the design change process that replaced the original 43A relay with an HFA relay was accomplished in less than a month. This process typically takes a year or two, especially for a component considered to be a Single Point Failure for Power Generation Reliability. Consequently, a key aspect of the Technical Evaluation Considerations of SPP-9.3, Plant Modifications and Engineering Change Control, regarding equipment reliability was not adequately evaluated to ascertain any potential adverse impacts. Furthermore, applicable operating experience (e.g., Information Notice 88-98) regarding relays used in low current applications was not considered. As such, because of the ready availability of HFA relays on the site, the level of urgency to install a replacement relay, and the lack of a thorough evaluation of the critical technical considerations and operating experience, the licensee selected a relay that was poorly suited for its application.

The Units 1 and 3 main generator voltage regulator 43A relays were also replaced with HFA relays in 2007. Since the Unit 2 scram in October 2008, the Units 1 and 2 HFA model 43A relays were replaced with another model relay specifically designed for very low voltage applications. The Unit 3 HFA model 43A relay was scheduled to be replaced at the next earliest opportunity.

Analysis:

The use of a relay in the Unit 2 MTG voltage regulator control circuit which was not well suited for that application due to a non-thorough evaluation of equipment reliability and operating experience conducted as part of the design control process was a performance deficiency which directly resulted in an automatic reactor scram. This finding is greater than minor because it is associated with the Initiating Event Cornerstone attribute of Design Control, and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during at-power operations. The finding was evaluated using Phase 1 of the At-Power SDP, and was determined to be of very low safety significance (Green) because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigating equipment or functions were not available.

The cause of this finding was directly related to the cross-cutting area of Human Performance, in the component of decision-making, and the aspect of conservative assumptions and safe actions, because the licensees design change process was expedited such that important technical considerations regarding equipment reliability and operating experience were not adequately evaluated to ensure optimum relay selection for use in low voltage control circuit applications (H.1.b). The licensee's RCA associated with PER 153987 had also identified the expedited modification process as a contributing factor.

Enforcement:

No violation of regulatory requirements occurred because the replacement of an MTG exciter control relay was a non-regulated activity. This finding was entered in the licensees CAP as PER 153987, and will be identified as FIN 05000259/2009002-04, Main Generator Voltage Regulator Relay Failure Results in Unit 2 Reactor Scram, in this inspection report.

.4 (Closed) LER 50-259/2008-002 and LER 50-259/2008-002-01, ASME Code Class 1

Pressure Boundary Leak on an Instrument Line Connected to the Reactor Vessel

a. Inspection Scope

The inspectors reviewed the LER, and revised LER, dated January 22 and March 16, 2009, respectively, and the applicable PERs 157918 and 163176, including associated root cause analysis and corrective action plans.

On November 23, 2008, during an ASME Section XI System Leakage Test of the Unit 1 RPV, a very small reactor coolant pressure boundary (RCPB) leak was identified from an unisolatable instrument line connected to the RPV. This instrument line was an ASME Code Class 1 component connected to RPV Nozzle N11B. Subsequent nondestructive examination (NDE) by the licensee determined the leak was from a tiny through-wall crack (i.e., 0.19 linear) in the N11B safe end. The root cause was determined to be excessive residual stress introduced in the safe end inner diameter surface due to severe cold work (i.e., boring) of the forged safe end that was welded to the nozzle during initial fabrication. This stress, along with conductive water chemistry and sensitized metal in the weld heat affected zone, led to intergranular stress corrosion cracking (IGSCC) which caused the formation of a crack and subsequent leak. The susceptibility of RPV instrument nozzles to IGSCC cracking was a recognized industry issue that was also identified by General Electric (GE) SIL 571; Instrument Nozzle Safe End Crack dated September 15, 1993. The N11B nozzle safe end leak was repaired using a full structural weld overlay. All other similar Unit 1 RPV nozzle safe ends were nondestructively examined, including ultrasonic testing, prior to Unit 1 startup.

Corrective action plans to ultrasonically examine similar RPV nozzle safe ends on Units 2 and 3 have been established for their upcoming refueling outages.

b. Findings

One finding of significance was identified (see Section 4OA7 below). This LER and its revision are considered closed.

.5 (Closed) LER 50-259/2008-003, Main Steam Relief Valve As-Found Setpoint Exceeded

Technical Specification Lift Pressure

a. Inspection Scope

The inspectors reviewed the LER dated February 11, 2009, and the applicable PER 159200, including associated apparent cause determination and corrective action plans.

The inspectors also reviewed the fuel vendor's evaluation, Browns Ferry Nuclear Plant Unit 1 Cycle 7 - Evaluation of As-Found SRV Opening Setpoints on Vessel Overpressure, dated January 26, 2009.

Following the Unit 1 Cycle 7 (U1C7) refueling outage, the licensee removed and lift tested the 13 MSRVs that had been in service during the U1C7 operating cycle. During this surveillance testing, the as-found U1C7 lift setpoints for 10 of the 13 MSRVs exceeded the TS 3.4.3 allowed limit of plus 3% of the TS required setpoint. The cause of the MSRV as-found setpoints being outside their TS limits was determined to be corrosion bonding between the pilot valve seat and disc, which continues to be a recognized industry problem. The failure of these MSRVs to lift within the allowed setpoint limits constituted a condition prohibited by TS 3.4.3. To address the potential safety consequences, the licensee conducted a Reactor Vessel Overpressure Evaluation by re-running the U1C7 Reload ASME Overpressure and Plant Transient analysis using the as-found MSRV lift setpoint data. From the results of this evaluation, the licensee concluded that the as-found condition of the MSRVs from U1C7 would have been sufficient to fulfill the pressure relief safety function during design basis over-pressure transient events.

The licensee also conducted an anticipated transient without scram (ATWS)overpressure analysis for the most limiting event assuming the same as-found MSRV lift setpoint data. This analysis demonstrated compliance with the ASME Section III Service Level C Limit for emergency events.

b. Findings

One finding of significance was identified (see Section 4OA7 below). This LER is considered closed.

.6 (Closed) LER 05000259/2007-002-01, Unit 1 Manual Scram Due to an Unisolable EHC

Leak

a. Inspection Scope

On May 24, 2007, Unit 1 operators initiated a manual reactor scram from Mode 2 reactor startup conditions. The scram was the result of an EHC system leak that could not be isolated. The immediate cause of the leak was failure of a stainless steel tubing connection when the fitting was being torqued to stop a minor leak while the system was under pressure. Nut disengagement and unflaring of the tubing resulted in system pressure pushing the tubing out of the connection. During and following the scram, all safety-related mitigating systems operated as designed, and all operator actions were deemed to be appropriate. The original LER, including the associated PER 125288, root cause analysis, and TVA Central Laboratories Services Technical Report No. 27-0712, were reviewed by the inspectors and documented in Inspection Report 05000259/2007004. As a result of this review, FIN 05000259/2007004-01, Unisolable Electro-hydraulic Control System Leak Due To Improperly Installed Compression Fitting Causes Unit 1 Reactor Scram, was issued. However, the licensee subsequently re-performed the root cause analysis and revision 1 of the LER was issued to provide additional details. The root cause for the scram was attributed to weakness in the work control process that allowed work to be completed using a generic WO that did not provide adequate checks and balances to ensure that specific work items were properly evaluated, planned and documented, commensurate with the sensitivity of the equipment and the risk of the activity. The inspectors reviewed the revised LER and PER, including associated root cause analysis.

b. Findings

No new significant findings or violations of NRC requirements were identified. This revision to the LER is closed.

.7 (Closed) LER 05000259/2007-007-01, Automatic Reactor Scram from a Neutron

Monitoring Trip Signal

a. Inspection Scope

On August 11, 2007, Unit 1 reactor automatically scrammed from full RTP due to exceeding the Average Power Range Monitor (APRM) Thermal Power Flow Biased trip setpoint. The immediate cause of this trip signal was due to the failure of recirculation flow transmitter (1-FT-68-81B) when a fitting on its sensing line failed. The original LER, including its associated PER 128756 and root cause analysis, were reviewed by the inspectors and documented in Inspection Report 05000259/2007005. As a result of this review, NCV 05000259/2007005-01, Untimely Corrective Actions to Resolve Leaking Recirculation Flow Transmitter Fitting Resulted in Unit 1 Reactor Scram, was issued.

The licensee subsequently decided to re-perform the root cause analysis and revision 1 of the LER was issued to provide additional details. The root cause for the scram was attributed to a lack of rigorous worker practices in the use of place-keeping and flagging to keep up with the work steps during the Unit 1 recovery activities. The inspectors reviewed the revised LER, and the revised PER and associated root cause analysis.

b. Findings

No new significant findings or violations of NRC requirements were identified. This revision to the LER is closed.

4OA5 Other Activities

.1 Quarterly Resident Inspector Observations of Security Personnel and Activities

a. Inspection Scope

During the inspection period the inspectors conducted observations of security force personnel and activities to ensure that the activities were consistent with licensee security procedures and regulatory requirements relating to nuclear plant security.

These observations took place during both normal and off-normal plant working hours.

These quarterly resident inspector observations of security force personnel and activities did not constitute any additional inspection samples. Rather, they were considered an integral part of the inspectors' normal plant status reviews and inspection activities.

b. Findings

No significant findings were identified.

.2 (Closed) Temporary Instruction (TI) 2515/176, EDG TS Surveillance Requirements

Regarding Endurance and Margin Testing Inspection activities for TI 2515/176 were previously completed and documented in inspection report 05000259,260,296/2008004, and this TI is considered closed at Browns Ferry; however, TI 2515/176 will not expire until August 31, 2009. The information gathered while completing this temporary instruction was forwarded to the Office of Nuclear Reactor Regulation for review and evaluation.

4OA6 Meetings, Including Exit

.1 Exit Meeting Summary

On April 3, 2009, the senior resident inspector presented the inspection results to Mr. James Randich and other members of the staff, who acknowledged the findings.

Although the inspection included review of proprietary documents, no proprietary material is included in this report.

.2 Annual Assessment Meeting Summary

On April 16, 2009, the NRCs Director of Reactor Projects, the Acting Chief of Reactor Projects Branch 6, and the Senior Resident Inspector assigned to the Browns Ferry Nuclear Plant met with TVA and the public to discuss the NRCs Reactor Oversight Process and the Browns Ferry annual assessment of safety performance for the period of January 1 through December 31, 2008. The major topics addressed were: the NRCs assessment program, the results of the Browns Ferry assessment, and NRC inspection activities. Attendees included Browns Ferry site management, members of the site staff, local officials, and members of the public and local media.

This meeting was a Category 1 meeting open to the public. The members of the public or media expressed no concerns about the operation of the Browns Ferry facility. The presentation material used for the discussion and a list of attendees are attached to this report.

4OA7 Licensee-Identified Violations

The following findings of very low safety significance (Green) were identified by the licensee and were violations of NRC requirements which met the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600, for being dispositioned as NCVs.

• The licensee identified a violation of Unit 1 TS 3.4.4.a which required that no RCPB leakage could exist during unit operation. Contrary to this, during an operating pressure test at the end of the Unit 1 Cycle 7 refueling outage, the licensee identified a through wall leak in the RPV Nozzle N11B safe end that would have existed during unit operation. This finding was determined to be of very low safety significance because any potential increase in the LOCA initiating event frequency would have been extremely small considering the size of the crack, the propagation mechanism, and the fact it was identified at the end of the operating cycle with no prior evidence of leakage. Furthermore, even total failure of the RPV instrument line nozzle would have been well within the capacity of existing LOCA mitigating systems.

• The licensee identified a violation of Unit 1 TS 3.4.3 which required that twelve of thirteen MSRVs lift at a setpoint within plus or minus three percent of a specified value. Contrary to this, during surveillance testing following the Unit 1 Cycle 7 refueling outage, the licensee discovered that ten MSRVs did not meet the TS allowed pressure band as described in the licensees PER 159200. This finding was determined to be of very low safety significance because the as-found lift setpoint conditions of the Unit 1 MSRVs were analyzed and determined to meet the design basis criteria for an over-pressurization event.

ATTACHMENTS:

1. Supplemental Information 2. Attendance List 3. Meeting Presentation

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

S. Berry, Systems Engineering Manager

J. Black, Chemistry Supervisor

S. Bono, Director of Engineering

T. Brumfield, Training Manager

M. Button, Maintenance Manager

M. Cantrell, Operations Training Manager

S. Cephus, Component Engineer Supervisor

P. Chadwell, Operations Manager

A. Elms, General Manager of Work Management and Outages

J. Emens, Site Licensing Supervisor

D. Feldman, Operations Support Superintendent

A. Feltman, Emergency Preparedness Manager

M. Floyd, Maintenance Supervisor

E. Frevold, Design Engineering Manager

R. Givens, Operations Unit Supervisor

F. Godwin, Licensing Manager

L. Hughes, Operations Superintendent

J. McCarthy, Director of Safety and Licensing

J. Mitchell, Site Security Manager

R. Nacoste, Operations Unit Supervisor

M. Palmer, Assistant Plant Manager

B. Pierce, Chemistry Manager

E. Quinn, Performance Improvement Manager

J. Randich, General Manager of Operations

D. Robinson, Chemistry Supervisor

R. Rogers, Modifications and Projects Manager

P. Sawyer, Radiation Protection Manager

J. Underwood, Nuclear Assurance Manager

R. West, Site Vice President

LIST OF ITEMS

Opened

05000259, 260, 296/2009002-01 URI Inappropriate Change to SSI Entry Conditions For Appendix R Fire Events (Section 1R15)

Opened and Closed

05000259/2009002-02 NCV Inadequate Surveillance Procedure Causes Loss of Unit 1 RHR System Safety Function (Section 1R22)

05000259/2009002-03 NCV Unit 1 RPV Flange Leak Due To Lack of Prompt Identification and Resolution (Section 4OA2.3)

05000260/2009002-04 FIN Main Generator Voltage Regulator Relay Failure Results in Unit 2 Reactor Scram (Section 4OA3.3)

Closed

05000260/2008-001 LER Automatic Turbine and Reactor Trip Resulting from a Failure of the Design Change Process (Section 4OA3.3)

05000259/2008-002 LER ASME Code Class 1 Pressure Boundary Leak on an Instrument Line Connected to the Reactor Vessel (Section 4OA3.4)

05000259/2008-002-01 LER ASME Code Class 1 Pressure Boundary Leak on an Instrument Line Connected to the Reactor Vessel (Section 4OA3.4)

05000259/2008-003 LER Main Steam Relief Valve As-Found Setpoint Exceeded Technical Specification Lift Pressure (Section 4OA3.5)

05000259/2007-002-01 LER Unit 1 Manual Scram Due to an Unisolable EHC Leak (Section 4OA3.6)

05000259/2007-007-01 LER Automatic Reactor Scram from a Neutron Monitoring Trip Signal (Section 4OA3.7)

2515/176 TI EDG TS Surveillance Requirements Regarding Endurance and Margin Testing (Section 4OA5.2)

Discussed

None