Semantic search

In order to address the concerns outlined in NRC Regulatory Issue Summary (RIS) 2015-06 "TORNADO MISSILE PROTECTION", evaluations of tornado missile vulnerabilities and their potential impact on Technical Specification (TS) plant equipment were conducted. This particular evaluation concluded that the following Structures, Systems, and Components (SSCs) are potentially vulnerable to tornado generated missiles:

The Beaver Valley Power Station Unit 1 (BV-1) Emergency Diesel Generators (EDGs) engine exhaust piping is potentially vulnerable as a result of tornado generated missiles striking and subsequently crimping or crushing this piping rendering the EDGs inoperable.

On July 19, 2017, both of the BV-1 TS required EDGs were declared inoperable and Enforcement Guidance Memorandum (EGM) 15-002 Rev 1 "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition(s) for Operation and both EDGs were then declared operable but nonconforming.

The apparent cause of this issue was a lack of clarity during the original design and licensing of the plant that led to inadequate understanding of the tornado missile protection regulatory requirements.

Actions will be taken to establish compliance for BV-1 EDGs either by a plant modification or employing a methodology for addressing tornado missile non- conformances for the EDG exhaust piping.

This issue is reportable under 10 CFR 50.72 for a loss of safety function. However, enforcement discretion is being applied. As stated in EGM 15-002, Rev. 1, the NRC will exercise enforcement discretion for subsequent tornado missile 10 CFR 50.72 notifications. On February 23, 2017, FENOC provided the NRC the initial 10 CFR 50.72 notification in Event Notification (EN) number 52571 concerning tornado missile protection issues known at that time.

In order to address the concerns outlined in NRC Regulatory Issue Summary (RIS) 2015-06 "TORNADO MISSILE PROTECTION", an evaluation of tornado missile vulnerabilities and their potential impact on Technical Specification (TS) plant equipment was conducted. This evaluation concluded that the following Structures, Systems, and Components (SSCs) are potentially vulnerable to tornado generated missiles:

The steam discharge flow paths to atmosphere of the Beaver Valley Power Station Unit 1 (BV-1) and Unit 2 (BV-2) Main Steam Safety Valves (MSSVs) (reference TS 3.7.1) are potentially vulnerable to tornado generated missiles.

The steam discharge flow paths to atmosphere of the BV-1 and BV-2 Atmospheric Dump Valves (ADVs) (reference TS 3.7.4) are potentially vulnerable to tornado generated missiles.

On February 23, 2017, the BV-1 and BV-2 TS required MSSVs and ADVs were declared inoperable and Enforcement Guidance Memorandum (EGM) 15-002 Rev 1 "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition(s) for Operation and the associated systems were then declared Operable but nonconforming.

The apparent cause of this issue was a lack of clarity during the original design and licensing of the plants that led to inadequate understanding of the tornado missile protection regulatory requirements.

In addition, as part of the evaluation of tornado missile vulnerabilities, two BV-2 tornado missile barrier doors were found to be open. Specifically, Auxiliary Building door (A-35-5A) was found open and Fuel Building door (F-66-3), was found to be partially open. These doors were then closed and latched.

Actions will be taken to establish compliance for the MSSVs and ADVs either by plant modification or by employing a methodology for addressing tornado missile noncompliance for the MSSVs and the ADVs.

These conditions (as applicable) were reported to the NRC on February 23, 2017 in Event Notification (EN) number 52571 under 10 CFR 50.72(b)(3)(ii)(B) and 10 CFR 50.72(b)(3)(v)(A).

On May 20, 2014, at 0835 hours during a plant startup following the seventeenth refueling outage, Beaver Valley Power Station (BVPS) Unit 2 operations personnel manually tripped the reactor when it was recognized that the pre-determined trip criteria of 85 percent narrow range water level in the 'A' Steam Generator would be met. This manual trip criterion was reached after the steam generator water level began to oscillate following the start of the second condensate pump. Due to low decay heat input the main steam line isolation valves were shut in order to limit reactor coolant system cool down. Plant trip response was as expected without complications, and all control rods fully inserted in the core.

This event is being reported pursuant to 10 CFR 50.73(a)(2)(iv)(A) as a condition that resulted in the valid manual or automatic actuation of any of the systems listed in (a)(2)(iv)(B) - (1) Reactor Protection System (RPS) and (2) Multiple Main Steam Isolation Valves (MSIVs). A 10 CFR 50.72 notification was made at 1052 hours on May 20, 2014, to report the manual reactor trip and main steam line isolation (EN# 50124).

The cause of this event has been determined to be the lack of an integrated secondary startup procedure.

Station operating procedures will be revised to prevent recurrence.

During the Beaver Valley Power Station (BVPS) Unit 1 1R22 Refueling Outage, a through wall defect was discovered during a planned visual examination of the Reactor Containment Building (RCB) steel liner. The BVPS Unit 1 containment design consists of an internal steel liner that is surrounded by reinforced concrete.

Investigation and laboratory analysis determined that there were indications of two through wall penetrations with a possible third penetration slightly off-set from the second. The total combined area of the three penetrations was calculated to be 0.395 square inches. A visual inspection of 100 percent of the accessible liner area was completed. No additional significant indications of corrosion were identified. Prior to startup from 1R22, the RCB steel liner was repaired and tested satisfactory.

The direct cause of this event was determined to be pitting type corrosion, originating from foreign material introduced during the original construction of the containment wall.

An evaluation determined that there is reasonable assurance that the containment was operable during the period of time that the plant was operated with the small areas of through wall corrosion on the steel liner.

Therefore, there was no loss of safety function and the safety significance is considered to be very low. This event is being reported under 10 CFR 50.73(a)(3)(ii)(A) as a condition resulting in a principal safety barrier being degraded.

At approximately 0228 hours on September 30, 2013, during a planned shutdown of Beaver Valley Power Station (BVPS) Unit 1 for a refueling outage, the "B" motor driven Auxiliary Feedwater (AFW) pump was manually started, while in Mode 3, due to lowering levels in the steam generators.

The condensate pump recirculation flow control valve opened to approximately 40 percent, which resulted in a reduction of the condensate flow to the steam generators and a decrease in the steam generator levels.

The operators recognized that adequate feedwater flow was not available using the normal flow path of the condensate pump through the bypass feedwater regulating valves to the steam generators. In response to the lowering steam generator levels, the operators manually started the "B" motor driven AFW pump to restore the steam generator water levels. Following the start of the AFW pump, the steam generator levels were returned to their normal operating control band. The apparent cause of this event was that the condensate flow control valve opened when it was not intended due to the associated flow controller being out of calibration. The controller was repaired and functionally checked during the refueling outage.

This event is being reported under 10 CFR 50.73(a)(2)(iv) as a condition that resulted in the valid manual start of a system listed in (a)(2)(iv)(B)(6) - Auxiliary Feedwater. The safety significance associated with the manual start of the AFW pump is considered to be very low.

On November 4, 2011, plant personnel identified that a maintenance activity performed on December 13, 2010, may have resulted in non-compliance with the Required Actions of Technical Specification (TS) 3.7.5. Specifically, on December 13, 2010, the Beaver Valley Power Station Unit Number 1 (BVPS-1) "A" Train Motor Driven Auxiliary Feedwater (AFW) system pump (1FW-P-3A) was removed from service and declared inoperable at 0339 hours to perform maintenance. TS 3.7.5 Condition B for one AFW Train being inoperable was entered due to removal of 1FW-P-3A pump from service. The turbine driven AFW pump (1FW-P-2) remained aligned to the "A" train supply header as required by TS 3.7.5 Required Action B.1. This Required Action applies when both AFW supply headers are Operable. With the 1FW-P-3A pump inoperable and the 1FW-P-2 pump aligned to the "A" supply header, the automatic open signal timing circuit for the Train "A" AFW flow throttle valves was de-energized as part of a clearance to perform a calibration on relay 62-AFPA at 0950 hours on December 13, 2010, and was not re-energized until 1642 hours on December 13, 2010. Although the Train "A" AFW flow throttle valves were in the open position, this action resulted in the inability to meet TS Surveillance Requirement 3.7.5.3 and, therefore, resulted in Train "A" AFW flow throttle valves being inoperable. TS 3.7.5 Condition D for two AFW trains being inoperable was not applied when the automatic open signal timing circuit for the Train "A" flow throttle valves was de-energized. As a result, the required action of TS 3.7.5 Condition D to place the plant in Mode 3 within the following six hours was not met. This event is reportable per 10 CFR 50.73(a)(2)(i)(B) (Operations or Condition prohibited by TS) due to two trains of AFW being inoperable for greater than six hours while the BVPS-1 was operating in Mode 1.

The Apparent Cause of this event was the lack of knowledge/correct interpretation of the auto-open feature and its impact on operability by the on-shift crew tasked with approving and issuing the clearance for posting. The safety significance of the event was very low.

This supplement is being issued due to four additional events that have been identified as violations of TS 3.7.5 as a result of the extent of condition investigation from the original event. The safety significance of each of these four events was very low.

At 1135 hours on November 13, 2003, the Beaver Valley Power Station Unit 1 reactor received an unexpected automatic reactor trip signal while operating at 100 percent power. The reactor trip signal was inadvertently generated during the performance of a maintenance surveillance procedure on the Solid State Protection System. Instrument and Control Technicians connected a digital volt meter (DVM) across the incorrect terminals in the Reactor Trip Breaker Switchgear cabinet when verifying breaker position contact state. This incorrect action created a current path across an open contact and energized the turbine trip relay. The turbine trip initiated an automatic reactor trip. The operating crew entered Emergency Procedure E-0, and transitioned to ES-0.1 in response to the trip. During the event, all required plant safety systems responded as required. This event is reportable pursuant to 10 CFR 50.73(a)(2)(iv)(A) as an event that resulted in automatic actuation of systems listed in 10 CFR 50.73(a)(2)(iv)(B)(1).

The cause was self-checking and peer checking that did not meet expectations. The 'B' train of Solid State Protection System (SSPS) had just been returned to service, exiting the applicable Action of the technical specifications (a two hour allowed outage time). Because the crew had exited the time critical portion of the technical specification, they did not complete the remaining portion of the surveillance procedure with the same sense of rigor as was used in the prior steps. The safety significance of this event was low.

NRC FORM 360 (7-2001) �

On July 18, 2003, during a routine post-refueling outage review of the Reactor Coolant System (RCS) precision flow calorimetric data from a test procedure on RCS Total Flow Measurement, it was determined that one of the nine channels of RCS flow (3 channels per loop) was set non- conservatively with respect to Technical Specifications. Specifically, it was Identified that channel F-1RC-424 on the 8-RCS loop was set to 89.2 percent of full power RCS flow when the Technical Specification allowable value for loop flow is greater than or equal to 89.8 percent. The root cause of the non-conservative RCS flow setpoint is an inadequate process to verify RCS flow setpoints are within Technical Specification limits prior to reaching ten-percent power. Since, this condition existed longer than the allowed outage time of 6 hours permitted by Technical Specifications, it was a condition prohibited by plant Technical Specification 3.3.1.1; therefore this event is reportable pursuant to 10 CFR 50.73(a)(2)(i)(B). Additionally, there were two occasions where maintenance removed an operable instrument from service placing the plant in a condition outside of the action statement. Therefore, Technical Specification 3.0.3 was unknowingly in effect and actions to commence plant shutdown were not initiated within one hour. Thus, these events were also conditions that are prohibited by plant Technical Specification and are reportable pursuant to 10 CFR 50.73(a)(2)(1)(8). Review of this event for effect on core damage frequency (CDF) for BVPS Unit 1 was performed and the cumulative safety significance of these events was _ determined to be small.

NRC FORM 3E4 (74(101)

On November 11, 2002, Beaver Valley Power Station (BVPS) Unit 1 was performing a planned power reduction from full power at a rate of approximately 12 percent per hour for a scheduled maintenance outage. At approximately 1946 hours, the plant was at 53 percent power and the Turbine Motoring Condition alarm was received. An automatic turbine trip will occur if this alarm is received for more than 30 seconds. An automatic reactor trip will also occur following a turbine trip signal, if the plant power level is above 49 percent power. After approximately 20 seconds from the time of the alarm, the Control Room Unit Supervisor directed a manual reactor trip. Control room personnel implemented Emergency Operating Procedure E-0 for a reactor trip. The Auxiliary Feed Water System actuated as expected and all other systems functioned as required.

An investigation into the event determined that the turbine motoring condition alarm was caused by a failure of the turbine differential pressure instrument that measures the differential pressure between the turbine impulse pressure and the turbine exhaust. The failure was due to a misapplication of the instrument to the service conditions. The failed instrument was replaced with a new instrument more suited for the application.

The manual initiation of a reactor trip via the Reactor Protection System by the BVPS Unit 1 control room operator on November 11, 2002, was a valid manual reactor trip signal and was not part of a pre-planned sequence during testing or reactor operation. Therefore this event is reportable pursuant to 10 CFR 50.73(a)(2)(iv)(A). The safety significance of the manual reactor trip on November 11, 2002 was small.

A

At 1353 hours on December 7, 2001, the operating station air compressor 1SA-C-1A tripped while station air compressor 1SA-C-1B was de-energized for preventive maintenance. The running compressor tripped due to a blown fuse in its control circuitry. The blown fuse was caused by a short circuit that was the result of uninsulated screwdriver contact in an energized circuit between compressors 1SA-C-1A and 1SA-C-1B. The on-shift operations crew responded per the appropriate alarm response procedure, and entered Abnormal Operating Procedure (AOP) 1.34.1, 'Loss of Station Instrument Air". Operators were dispatched locally to compressor 1SA-C-1A, the compressor's supply breaker and to the backup diesel air compressor 1SA-C-2. A local start of 1SA-C-1A was unsuccessful due to the blown control power fuse. The backup diesel air compressor was started and placed in service; however, system pressure had already reached an abnormally low level and the backup diesel compressor was unable to restore system pressure due to insufficient capacity. The low system air pressure caused Loop 1C main steam trip valve, TV-1MS-101C, to begin to close as indicated by alarm "Steamline Stop Valve Not Fully Open".

At 1401 hours, Beaver Valley Power Station (BVPS) Unit 1 reactor was manually tripped due to the loss of station air in accordance with AOP-1.34.1. All control rods fully inserted into the reactor core and all required safety systems operated as designed. Emergency Operating Procedure E-0 for Reactor Trip was performed and the plant was stabilized in Mode 3. The direct cause for the manual trip was a loss of station air due to the unavailability of both station air compressors. The root cause of the event was determined to be the failure of the station work process to adequately plan, review, control, assign risk significance, and provide adequate oversight for work activities. This event is reportable pursuant to 10 CFR 50.72 (b)(2)(iv)(B) and 10 CFR 50.73(a)(2)(iv)(A) as a valid reactor trip and was not part of a pre-planned sequence during testing or reactor operation. The safety significance of this event was low.

On October 6, 2001, Beaver Valley Power Station Unit No. 1 testing personnel and the Control Room operators were performing a Control Rod Drop Testing surveillance in preparation for reactor startup following Unit l's fourteenth refueling outage. The plant was in a sub-critical condition in Mode 3 with Shutdown Bank B control rods withdrawn. At 1959 hours, the Control Room operators observed indications of two dropped control rods (via rod position indication reading zero steps and rod bottom lights on), and entered Unit 1 Abnormal Operating Procedure (AOP) 1.1.8 for Rod Inoperability. The Reactor Operator opened the reactor trip breakers in accordance with the AOP and the Reactivity Management Plan. Emergency Operating Procedure E-0 for Reactor Trip was performed and the plant remained in Mode 3. The manual initiation of a reactor trip via the Reactor Protection System by the BVPS Unit 1 control room operator on October 6, 2001, was a valid manual reactor trip signal and was not part of a pre-planned sequence during testing or reactor operation. Therefore this event is reportable pursuant to 10 CFR 50.73(a)(2)(iv)(A).

It was subsequently discovered that the two dropped control rod indications were caused by the testing personnel repositioning knife switches to place the rod drop computer in service. There were no dropped control rods. This action by the testing personnel and resulting expected indications were not communicated to the Control Room operators prior to their occurrence. The opening of the reactor trip breakers was caused by a lack of good communication practices and a lack of procedure adherence by an inexperienced test engineer. This engineer failed to read a step in the test procedure which required the engineer to inform the Reactor Operator that the control room would be losing indication on control rod Shutdown Bank B. The safety significance of the manual reactor trip on October 6, 2001 was small.