Semantic search

On November 7, 2017 at 05:04 EST Beaver Valley Power Station (BVPS) Unit 1 experienced an automatic Reactor Trip from 100 percent power due to an automatic Turbine Trip. The Turbine Trip was initiated by a Main Unit Generator Overcurrent Protection Trip.

The Reactor Trip was without complications. All control rods fully inserted into the core. The Auxiliary Feedwater System automatically actuated as expected and performed as designed. The plant was stabilized in Mode 3 with the normal Main Feedwater System in service and the Auxiliary Feedwater System properly secured.

The Main Unit Generator trip was caused by foreign material in the isophase bus duct. The isophase bus ducts have been properly inspected and cleared of all foreign material.

This event was reported (EN 53056) as an actuation of the Reactor Protection system 10 CFR 50.72(b)(2)(iv)(B) and a Specified System Actuation (Auxiliary Feedwater System) 10 CFR 50.72(b)(3)(iv)(A).

This event is being reported pursuant to 10 CFR 50.73(a)(2)(iv)(A) as a condition that resulted in the automatic actuation of the Reactor Protection System (RPS) and the expected automatic actuation of the Auxiliary Feedwater System.

On December 20. 2017, at 1040 Eastern Standard Time (EST), the Watts Bar Nuclear Plant (WBN) 1B-B 6.9kV Shutdown Board (SDBD) normal feeder breaker opened. The loss of voltage to the 1B-B SDBD resulted in the start of the 1 B-B Motor Driven Auxiliary Feedwater (MDAFW) pump. the Unit 1 Turbine Driven Auxiliary Feedwater (TDAFW) pump. and the start of all four Emergency Diesel Generators (EDGs). Power was restored to the 1B-B SDBD when it loaded on to its associated EDG. Following initial investigation, the 1B-B SDBD was transferred to its alternate offsite power source at 1217 EST. At 1230 EST. the 1 B-B SDBD alternate feeder breaker opened, with a plant response that was similar to the first loss of power.

Restoration of normal offsite power to the 1B-B SDBD was completed at 1654 EST. This event is being reported as a safety system actuation and as an event or condition that could have prevented fulfillment of a safety function related to containment temperature being outside Technical Specification limits.

Both loss of voltage events to the 1B-B SDBD were caused by poor contact of the B and C phases of the protective relay potential transformer drawer secondary connections which supplies the degraded and loss of voltage relays. The mounting block that houses the secondary pins was able to be trimmed, resulting in an improvement of the secondary connection. The mounting blocks for the secondary connections on SDBDs 1A-A, 2A-A, and 2B-B will be inspected and modified. if required, during future equipment outages. The procedure associated with inspection of the secondary connections will be revised.

NRC FORM He :2-2:- APPROVED BY OMB: NO. 3150-0104 EXPIRES: 03/31/2020 comments regarding burden estimate to the Information Services Branch (T-2 F43). U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov. and to the Desk Officer. Office of Information and Regulatory Affairs, used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

On October 29, 2017, Unit 1 entered MODE 3 from MODE 4 without satisfying all of Technical Specification 3.7.5, Auxiliary Feedwater (AFW) Limiting Conditions for Operation (LCO) as required by LCO Applicability 3.0.4 for the Turbine Driven Auxiliary Feedwater (TDAFW) pump system.

LCO Applicability 3.0.4 does not permit entry into a MODE of applicability when an LCO is not met, unless the associated actions to be entered permit continued operation in the MODE for an unlimited time or after performance of an acceptable risk assessment and the appropriate risk management actions have been established. After entering MODE 3, it was discovered that components were not operable, contrary to LCO 3.0.4.

This event is being reported pursuant to 10 CFR 50.73(a)(2)(i)(B), for an operation or condition prohibited by Technical Specifications.

On September 10, 2017 at approximately 1855 hours, the Turkey Point Unit 4 reactor was manually tripped from 88% power due to lowering level in Steam Generator (SG) C. The reactor was stabilized in Mode 3.

Auxiliary Feed Water actuated as expected on low level in SG C and was secured at approximately 1933 hours. At the time of the event, the Turkey Point site was experiencing high winds with rain associated with Hurricane Irma. The B and C Main Feedwater Regulating Valves (MFRV) had been in manual control when the C MFRV failed closed. The cause of the event was a degraded signal due to water intrusion into the C MFRV valve positioner hand selector switch enclosure resulting from a less than adequate design and installation. Corrective actions include modifications to the Unit 3 and 4 MFRV hand selector switch enclosures and enclosure penetrations, and repair of a failed component associated with the 4C MFRV. Additionally, the terminal/pull box specifications will be revised to improve direction for installation activities. Safety significance is very low because the unit responded as designed to the trip.

On October 25, 2017, St. Lucie Unit 2 was in Mode 1 operation at 100 percent reactor power when the station discovered that both of the required flow transmitters (indication only) for the 2C steam driven auxiliary feedwater (AFW) pumps had been isolated since October 17, 2017. The transmitters were returned to service and extent of condition walkdowns were completed on the AFW pump flow transmitters for both St. Lucie Units 1 and 2; no other anomalies were noted.

This event was caused by human error because the personnel involved in the AFW flow calibration activities on October 17, 2017 did not adequately perform the system restorative steps in accordance with the governing procedure.

Based on the availability of diverse methods to verify AFW flow delivery to the steam generators, this condition had no effect on the health and safety of the public.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Description On October 25, 2017, St. Lucie Unit 2 was in Mode 1 operation at 100 percent reactor power. Maintenance personnel were troubleshooting indication flow ‘spikes' from FT-09-2C1 (EIIS:BA:FT), the flow transmitter for the 2C steam driven auxiliary feedwater (AFW) pump (EIIS:BA:P) discharge. At 1910 hours, the operators declared the 2C AFW flow transmitter FT-09-2C1 inoperable as maintenance reported that the transmitter was isolated. FT-09-2C1 was promptly un-isolated, filled and vented, and restored to service at approximately 1915 hours. During the extent of condition walkdown, maintenance supervision discovered that flow transmitter FT-09-2C2 was also isolated; it was promptly unisolated, filled and vented, and restored to service at approximately 1925 hours.

By 2128 hours on October 25, 2017, the extent of condition walkdowns were completed for the remaining electric driven AFW pumps for Unit 2 and all AFW pumps for Unit 1; no anomalies were noted.

Cause of the Event

Investigation revealed that the individuals that performed an earlier calibration on October 17, 2017 did not properly perform the restoration lineup in accordance with the governing procedure.

Analysis of the Event

This event was reportable under 10 CR 50.73(a)(2)(i)(B) as any operation or condition that was prohibited by the Technical Specifications (TSs).

The AFW system consists of two electric driven pumps and one steam driven pump. Each electric AFW pump is normally aligned to its respective steam generator (SG) (EIIS:SB:SG), and the steam driven AFW pump can feed either SG.

The 2C steam driven AFW pump is provided with two redundant flow transmitters that are used to provide post- accident AFW flow indication. With both 2C AFW pump flow transmitters isolated, the minimum operable channel requirement of TS Table 3.3-10 was not met. Therefore Unit 2 was in the TS 48-hour completion and 6-hour shutdown action statement per TS 3.3.3.6 (Accident Monitoring Instrumentation) action (b). The 2C AFW pump flow transmitters were isolated on October 17, 2017, when maintenance personnel commenced loop calibrations of the Unit 2 AFW flow loops. When the condition was discovered on October 25, 2017, the 54-hour total completion and shutdown time had already been exceeded.

Safety Significance

The subject flow transmitters perform no automatic accident mitigation or control functions; they are used to monitor plant parameters during and following a design basis accident. From October 17 to October 25, 2017, the operators would not have the ability to directly monitor flow from the 2C AFW pump. However, the operators have sufficient diverse means to verify that AFW flow is getting to the SGs, such as SG level and condensate storage tank level trends as well as monitoring the effectiveness of decay heat removal via RCS temperature indication. Loss of the primary method to directly monitor the 2C AFW pump flow would not prevent successful mitigation of any design bases accident. Therefore, this condition had no effect on the health and safety of the public.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Corrective Actions

1. The flow transmitters were immediately returned to service.

2. An extent of condition walkdown identified no other isolated transmitters in the AFW system.

3. The maintenance personnel involved with the earlier calibration that resulted in isolation of the 2C AFW flow transmitters were disqualified pending remediation.

Failed Components

ID: Flow Transmitter for Auxiliary Feedwater Pump 2C Discharge Tag Nos.: FT-09-2C1, FT-09-2C2 Manufacturer: Rosemount Model: 1153DB5

Additional Information

None.

On August 17, 2017, at 1205 Eastern Daylight Time (EDT), the Watts Bar Nuclear Plant (WBN) lost power to the 1B-B 6.9kV Shutdown Board. The loss of power to this safety related bus resulted in an automatic start of the Unit 1 Turbine Driven Auxiliary Feedwater Pump (TDAFWP). Power to the 1B-B Shutdown Board (SDBD) was restored at 1505 EDT on August 17, 2017.

During the loss of power to the 1B-B SDBD, a reduction in containment and control rod drive mechanism cooling occurred. At 1233 EDT, lower containment average temperature exceeded Technical Specification (TS) limits, and TS 3.6.5 Condition A was entered for containment average air temperature not within limits. Lower containment average temperature was restored to within limits at 1525 EDT on August 17. 2017. This is reportable as a potential loss of safety function.

The cause of this event is mechanical vibration while closing a panel drawer resulting in actuation of protective relays that led to a loss of power.

Clearances will require the relays involved in this event to be isolated during drawer movement to prevent a similar occurrence.

On July 25, 2017, at 0428 Eastern Daylight Time (EDT) Watts Bar Nuclear Plant (WBN) Unit 2 was in Mode 3.

commencing a Reactor Startup. While in the initial phase of withdrawing the first of four Control Banks, the two associated group demand position indicators deviated greater than 2 steps from each other. In accordance with Technical Requirement 3.1.7, Position Indication System, Shutdown, with one or more group demand position indicators inoperable, the reactor trip breakers are to be opened immediately. Operations personnel opened the reactor trip breakers immediately by initiating a manual trip of the Reactor Protection System. The Auxiliary Feedwater system was in service and controlling Steam Generator water levels at the time of the event and did not receive any valid actuation signals. No other system actuations occurred as a result of this reactor trip and all systems operated as designed.

The rod demand indication deviation was determined to be caused by a failed logic card, which was replaced.

On 8/05/15, at 1539, Salem Unit 2 experienced an automatic reactor trip. The cause of the reactor trip was due to a trip of the 21 Reactor Coolant Pump (RCP) causing a 21 Reactor Coolant Loop low flow condition.

The 21 RCP breaker tripped as designed when the 2B Auxiliary Power Transformer (APT) infeed breaker to the 2H 4 kilovolt (kV) Non-Vital Bus opened. The root cause evaluation did not identify a definitive cause.

However the most probable cause of the 2H 4 kV Non-Vital Bus trip was due to a ground fault on the 21 Heater Drain Pump (HDP) motor that was not isolated by its associated neutral overcurrent relay. An automatic start of the Auxiliary Feedwater (AFW) system occurred as expected following the reactor trip due to low steam generator water levels.

Corrective actions include replacement of the 21 HDP motor and its neutral overcurrent relay.

This event is reportable under 10 CFR 50.73 (a)(2)(iv)(A) as an event that resulted in an automatic actuation of the reactor protection system and actuation of the AFW system.

On September 1, 2017 CPNPP Unit 2 was manually tripped by Control Room Operators due to two dropped rods. All safety systems responded as designed including the automatic start of the Auxiliary Feedwater System. The proximate cause of the dropped rods was a high resistance condition on a single phase of a three phase fusible knife switch in a Rod Control System Power cabinet. Subsequent third party cause analysis was unable to determine the root cause of the high resistance condition. The defective switch was replaced.

Additional corrective actions to avoid recurrence have been entered into the CPNPP Corrective Action Program.

All times below are in Central Standard Time (CDT).

At time 2140 (CDT) on September 1, 2017, CPNPP Unit 2 experienced two (2) dropped rods, one control, one shutdown. The reactor was then manually tripped. The Auxiliary Feedwater system automatically started as expected.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000- Comanche Peak Nuclear Power Plant Unit 2 446

A. REPORTABLE EVENT CLASSIFICATION

The event is reportable under 10 CR 50.73(a)(2)(iv)(A) "Any event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph (a)(2)(iv)(B) of this section." The system which was manually actuated was the Reactor Protection System (RPS). The Auxiliary Feedwater System (AFW) automatically started as designed due to low-low steam generator water level following the trip.

B. PLANT CONDITION PRIOR TO EVENT

At 2140 on September 1, 2017 CPNPP Unit 2 was operating in Mode 1 at approximately 100% rated thermal power.

C. STATUS OF STRUCTURES, SYSTEMS, OR COMPONNETS THAT WERE INOPERABLE AT THE START OF THE

EVENT AND CONTRIBUTED TO THE EVENT

There were no structures, systems, or components which were inoperable prior to the event which contributed to the event. Prior to the actual rod drops, the fusible disconnect switch discussed below was performing its design function.

D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES

At time 2140 (CDT) on September 1, 2017, CPNPP Unit 2 experienced two (2) dropped rods, one control, one shutdown.

The reactor was then manually tripped by the control room operators. The time difference between the two rod drops was approximately fifteen (15) to thirty (30) seconds. All safety systems responded as designed.

The initial troubleshooting determined the disconnect switch for the Stationary Coils of Rod Control Power Cabinet 2-2BD caused the rods to drop. Further investigation determined the cause of the rod drops was a high resistance connection on the "A" phase of the Rod Control Power Cabinet 2-2BD stationary coil three-phase fusible disconnect switch (EIIS:(AA) (CAB)(JS)). The switch was replaced and and the reactor started up on September 4.

E. THE METHOD OF DISCOVERY OF EACH COMPONENT OR SYSTEM FAILURE, OR PROCEDURAL PERSONNEL

ERROR

Initial indication of rod drop was provided to the Control room operator by an annunciated alarm. Operators confirmed rod drop through Tavg/Tref alarms and lowering of primary pressure. The reactor was manually tripped approximately one minute after the initial rod dropped (times as indicated by the plant computer).

II. COMPONENTS OR SYSTEM FAILURES

A. CAUSE OF EACH COMPONENT OR SYSTEM FAILURE

A third-party failure analysis identified damage to the "A" phase switch knife blade and its associated receiver clip. The "B" and "C" phase knife blades and clips were undamaged and provided no indication as to the cause of the failure of the "A" phase knife blade and clip. All that could be determined was that the "A" phase switch knife blade and clip experienced heat which resulted in a high resistance connection. That high resistance connection resulted in a voltage drop that was sufficient to cause the stationary coils of two control rods to release their control rods, dropping them into the core.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000- Comanche Peak Nuclear Power Plant Unit 2 446

B. FAILURE MODE, MECHANISM, AND EFFECTS OF EACH FAILED COMPONENT

The three-phase fusible disconnect switch is used primarily to provide isolation to equipment requiring three-phase electrical power. The disconnect switch is essentially three manual electrical knife switches mechanically linked to operate in parallel. The knife blades are independently fused and provide continuity to one of the three phases of electrical power to which they are connected. Other than the fuses, the disconnect switch has no automatic functions and is open and shut manually. The disconnect switch associated with Rod Control Power Cabinet 2-2BD is normally shut and is operated solely to provide electrical isolation to the cabinet. The disconnect switch was last operated by CPNPP personnel in support of maintenance on Rod Control Power Cabinet 2-2BD during the April 2017 2RF16 refueling outage.

No maintenance activities were performed on the switch at that time.

The stationary coils associated with Rod Control Power Cabinet are part of the Rod Control System and are normally energized, fail safe (de-energized) to result in rod insertion. In the event described herein, the high resistance condition experienced on the "A" phase of the disconnect switch resulted in a low voltage condition at the stationary coils which resulted in the dropped rods.

The cause of the high resistance and overheating of the disconnect switch could not be determined.

C. SYSTEMS OR SECONDARY FUNCTIONS THAT WERE AFFECTED BY FAILURE OF COMPONENTS WITH

MULTIPLE FUNCTIONS

This event did not involve systems or secondary functions which were affected by the high resistance condition identified with the disconnect switch.

D. FAILED COMPONENT INFORMATION

The failed disconnect switch was style no. 55E-5328 (catalogue no. 2528D 46 E01) provided by Westinghouse.

III. ANALYSIS OF THE EVENT

A. SAFETY SYSTEM RESPONSES THAT OCCURRED

The Reactor Protection System responded as designed to the manual trip input by the plant operators. All plant safety systems responded as designed. Automatic start of the AFW system was the expected response and the system responded as designed.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000- Comanche Peak Nuclear Power Plant Unit 2 446

B. DURATION OF SAFETY SYSTEM TRAIN INOPERABILITY

The event reported herein did not involve the inoperability of any safety system component or system.

C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT

The Rod Control Power Cabinet 2-2BD three-phase fusible disconnect switch has no nuclear safety function; its purpose is to isolate power during maintenance. The high resistance experienced by this disconnect switch resulted in two control rods being dropped and necessitated a manual reactor trip. The analysis contained in FSAR 15.4.3 bounds the condition experienced: one analysis considers one or more rod control cluster assemblies (RCCAs) dropped with a given group, and a second analysis considers a dropped RCCA bank. Both cases are considered ANS condition II events (transients not accidents).

No automatic safety functions were exercised other than the expected automatic start of the Auxiliary Feedwater System and all plant safety systems responded as designed during the resultant transient. This event had no impact on nuclear safety, reactor safety, radiological safety, environmental safety or the safety of the public.

IV. CAUSE OF THE EVENT

The cause of the event was a high resistance condition associated with the electrical connection on the "A" phase of the Rod Control Power Cabinet 2-2BD stationary coil three-phase fusible disconnect switch.

V. CORRECTIVE ACTIONS

The defective switch was replaced. In accordance with the CPNPP Corrective Action Program, phase-to-phase voltage readings will be taken for the Rod Control power supplies three-phase fusible disconnect switches of both Units. A periodic maintenance activity to measure phase-to-phase voltage readings will also be developed. All proposed activities will be tracked and managed under the CPNPP Corrective Action Program.

VI. PREVIOUS SIMILAR EVENTS

There have been no similar reportable events at CPNPP in the past three years.

Technical Specification 3.7.6. A pinhole sized through wall leak was discovered on the downstream side of CD-123, the 32 Auxiliary Boiler Feed Pump Bearing Cooling Relief Valve, which was unisolable to the Condensate Storage Tank.

The pinhole leak was identified following the performance of 3PT-Q120B, 32 Auxiliary Boiler Feed Pump Functional Test. All Operability and Acceptance Criteria of 3PT-Q120B were sat. The relief valve was removed from the system and sent to a vendor for evaluation. After the vendor evaluation, it was determined that the valve pinhole area leak was due to a casting defect.

This event was determined to be reportable as a Loss of Safety Function pursuant to10 CFR 50.72(b)(3)(v)(B) - Any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to remove residual heat.

RC FORM 366 (04-2017)

On March 6, 2017, Instrumentation and Control (I&C) maintenance had a scheduled activity to calibrate the 22 Steam Generator (SG) Auxiliary Feedwater (AFW) flow indicator (FI-1201). The tag-out was applied by Operations at 0748 hours on the two flow transmitter root stop valves. l&C personnel began to calibrate FI-1201 at approximately 1000 hours. The calibration Procedure requires isolation of the high and low isolation valves and opening of the equalizing valve to allow venting of any pressure going to the transmitter. The calibration was performed and all as-found readings were within acceptance range. The test equipment was removed. The transmitter restoration was completed with the exception of filling and venting the transmitter FI-1201 and placing it back in service. Due to the root valves being tagged out, the source of water was isolated preventing proper filling and venting of the transmitter. The l&C supervisor discussed the restoration 'of the transmitter with the Operations shift manager, and it was agreed that Operations would complete restoration of the transmitter when the tag-out was removed. The l&C supervisor noted this and marked NA for the steps to return the transmitter back in service. This is a common practice when performing transmitter calibrations as a part of larger work windows because the tag-out must first be removed for a source of water to be available for restoration. However, the l&C supervisor did not obtain the Shift Manager's initials, which is required by Procedure.

ConSequently, Operations did not restore the transmitter to service, resulting in FI-1201 remaining inoperable for greater than the Technical Specification 3.3.3 allowed completion time of 30 days. It should be noted that in spite of inoperability of FI-1201, since FI-1201 is indication only, there was no actual loss or degradation of water flow to the steam generators at any time and thus had no impact on SG heat removal capability.

On April 17. 2017, the staff identified a low refrigerant level in the Unit 1 train B essential chilled water (EC) system chiller during inspection. Operations personnel immediately declared EC chiller train B inoperable. On April 17, 2017, the leak was corrected and EC chiller train B was refilled with refrigerant to within the manufacturer's specifications. Operations personnel declared the system operable on April 18, 2017. The chiller had been inoperable since April 11. 2017, when the automatic purge system was placed into service. The direct cause of the low refrigerant level was leakage due to prior installation of a fitting on the automatic purge system filter without a plug.

During the 7-day period that EC chiller train B was inoperable, the supported low pressure safety injection (LPSI) system train B was inoperable. LPSI train A was also inoperable for approximately 17 minutes on April 13, 2017, during the performance of a routine surveillance test. This 17-minute period represented a condition that could have prevented the fulfillment of a safety function.

The cause of the leak was determined to be ineffective work instructions that did not identify the appropriate part number to be used during filter replacement. Corrective actions include revision of the work instructions. This change will ensure that the existing plug remains in place during filter element replacement. A leak test was also added to the work instructions to verify that no refrigerant leaks are present following maintenance.

On March 29, 2017, during an evaluation of protection of Technical Specification (TS) equipment from the damaging effects of tornados, nonconforming conditions were identified in the plant design. Specifically, TS equipment did not meet current design basis for protection against potential tornado missile impact. Identified components/systems were declared inoperable and NRC Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado Generated Missile Protection Noncompliance," was implemented. Initial compensatory measures were implemented, per the guidance of NRC Interim Staff Guidance DSS-ISG-2016-01 Appendix A, within the time allowed by the applicable Limiting Conditions for Operation (LCOs) and the associated systems were then declared operable but nonconforming.

The six systems, containing TS required equipment, did not meet current design basis for protection against potential tornado missile impact. Credible tornado missile impacts could affect the following systems; Service Water, Fuel Oil, Emergency Diesel Generators, Auxiliary Feedwater, Component Cooling Water and Control Room Ventilation Filtration.

Comprehensive compensatory measures will be implemented in approximately 60 days of discovery, per the guidance of NRC Interim Staff Guidance DSS-ISG-2016-01 Appendix A.

Due to the historical nature of the issue, a specific cause for the identified vulnerabilities was not determined.

In order to address the concerns outlined in NRC Regulatory Issue Summary (RIS) 2015-06 "TORNADO MISSILE PROTECTION", an evaluation of tornado missile vulnerabilities and their potential impact on Technical Specification (TS) plant equipment was conducted. This evaluation concluded that the following Structures, Systems, and Components (SSCs) are potentially vulnerable to tornado generated missiles:

The steam discharge flow paths to atmosphere of the Beaver Valley Power Station Unit 1 (BV-1) and Unit 2 (BV-2) Main Steam Safety Valves (MSSVs) (reference TS 3.7.1) are potentially vulnerable to tornado generated missiles.

The steam discharge flow paths to atmosphere of the BV-1 and BV-2 Atmospheric Dump Valves (ADVs) (reference TS 3.7.4) are potentially vulnerable to tornado generated missiles.

On February 23, 2017, the BV-1 and BV-2 TS required MSSVs and ADVs were declared inoperable and Enforcement Guidance Memorandum (EGM) 15-002 Rev 1 "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," was applied. Compensatory measures were implemented within the time allowed by the applicable Limiting Condition(s) for Operation and the associated systems were then declared Operable but nonconforming.

The apparent cause of this issue was a lack of clarity during the original design and licensing of the plants that led to inadequate understanding of the tornado missile protection regulatory requirements.

In addition, as part of the evaluation of tornado missile vulnerabilities, two BV-2 tornado missile barrier doors were found to be open. Specifically, Auxiliary Building door (A-35-5A) was found open and Fuel Building door (F-66-3), was found to be partially open. These doors were then closed and latched.

Actions will be taken to establish compliance for the MSSVs and ADVs either by plant modification or by employing a methodology for addressing tornado missile noncompliance for the MSSVs and the ADVs.

These conditions (as applicable) were reported to the NRC on February 23, 2017 in Event Notification (EN) number 52571 under 10 CFR 50.72(b)(3)(ii)(B) and 10 CFR 50.72(b)(3)(v)(A).

At 1302 hours Eastern Daylight Time (EDT) on 10 08 2016 with the plant in Mode 1 at 100 percent power, H. B. Robinson Steam Electric Plant, Unit No. 2 (HBRSEP2), experienced a grid perturbation. As a result, HBRSEP2 experienced a reactor trip due to low voltage on the 4kV buses. Plant safety systems responded with the emergency buses separating from offsite power due to emergency bus undervoltage. The emergency diesel generators (EDG) started and powered the 480V emergency buses. 'A' service water pump did not start on the blackout sequencer; however, sufficient service water flow was available from the three operating service water pumps.

This failure did not aggravate this event. The site declared an Unusual Event (UE) at 1317 EDT for loss of power to emergency buses.

At 0011 EDT on 10 09'16, the UE was terminated.

Once the power grid was stable, plant personnel commenced restoration of offsite power to allow shutdown of the the EDGs. During this evolution, at approximately 2323 EDT on 10 . 08 2016, an automatic actuation of the 'B' auxiliary feedwater (AFW) pump occurred due to improper breaker coordination that satisfied the autostart logic for the AFW system.

The apparent cause of the voltage transient in the HBRSEP2 switchyard is a failed fault detection relay, which prevented the grid fault from being immediately isolated. The failed relay has been replaced.