Semantic search

On November 25, 2017 Comanche Peak, Unit 2 received alarms indicating a trip of both main feedwater pumps. After confirming a decreasing water level in all four steam generators, the control room initiated a manual reactor trip. All safety systems responded as designed including the automatic start of the auxiliary feedwater system. The cause of the trip of both main feedwater pumps could not be positively identified. Causal analysis indicates that a prior plant modification maintained power to abandoned relays in the Solid State Protection System that may have caused both main feedwater pumps to trip. Subsequent actions were taken to remove the fuses that provided power to the abandoned relays on both Unit 1 and Unit 2 to eliminate recurrence from this possible source. Additional corrective actions have been entered into the Comanche Peak Corrective Action Program.

All times below are in Central Standard Time (CST).

On November 7, 2017 at 05:04 EST Beaver Valley Power Station (BVPS) Unit 1 experienced an automatic Reactor Trip from 100 percent power due to an automatic Turbine Trip. The Turbine Trip was initiated by a Main Unit Generator Overcurrent Protection Trip.

The Reactor Trip was without complications. All control rods fully inserted into the core. The Auxiliary Feedwater System automatically actuated as expected and performed as designed. The plant was stabilized in Mode 3 with the normal Main Feedwater System in service and the Auxiliary Feedwater System properly secured.

The Main Unit Generator trip was caused by foreign material in the isophase bus duct. The isophase bus ducts have been properly inspected and cleared of all foreign material.

This event was reported (EN 53056) as an actuation of the Reactor Protection system 10 CFR 50.72(b)(2)(iv)(B) and a Specified System Actuation (Auxiliary Feedwater System) 10 CFR 50.72(b)(3)(iv)(A).

This event is being reported pursuant to 10 CFR 50.73(a)(2)(iv)(A) as a condition that resulted in the automatic actuation of the Reactor Protection System (RPS) and the expected automatic actuation of the Auxiliary Feedwater System.

On November 3, 2017, at 2022 hours, with reactor power at 100 percent, Indian Point Unit 3 experienced an automatic reactor trip on a turbine trip, which was in response to a main generator trip. The main generator trip was initiated by actuation of the Generator Protection System due to a main generator loss of field.

All control rods fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The Auxiliary Feedwater System (AFWS) automatically started as expected on steam generator low level to provide feedwater flow to the steam generators. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The direct cause of the loss of main generator field was a failed Thyristor Firing Module drawer which affected proper operation of the redundant Thyristor Firing Module drawer. The root cause was determined to be that the Automatic Voltage Regulator (AVR) Firing Module power supplies have a latent design vulnerability where shared common output nodes are not isolated after a failure. A plant modification is proposed that will eliminate the condition by electrically isolating the AVR Firing Module power supplies upon failure.

This event had no effect on the public health and safety. The event was reported to the Nuclear Regulatory Commission (NRC) on November 3, 2017 under 10 CFR 50.72(b)(2)(iv)(B) and 50.72(b)(3)(iv)(A) as an event that resulted in the automatic actuation of the Reactor Protection System when the reactor is critical and a valid actuation of the AFWS.

On September 13, 2017, with the Davis-Besse Nuclear Power Station operating at approximately 100 percent power, Auxiliary Feed Water (AFW) Pump Turbine 1 experienced high inboard bearing temperature during performance of quarterly Surveillance Testing. The turbine was tripped, and disassembly revealed damage to the journal bearing. The bearirig was replaced, and following successful post maintenance testing, AFW Train 1 was declared Operable on September 16. The cause of the bearing damage was an improperly marked oil sight glass, which allowed operation with improper bearing lubrication. The improper markings were due to the maintenance work instruction for replacing the sight glass not including dimensions or guidance for setting required operational bands.

On September 26, 2017, it was identified that low inboard bearing oil level had likely existed since completion of the previous quarterly surveillance test on June 21, when an oil sample was taken following testing but the bearing was not refilled due to the improperly marked sight glass. This issue is being reported in accordance with 10 CFR 50.73(a)(2)(v)(B) as a condition that could have prevented the fulfillment of the safety function, and in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by Technical Specifications.

At 1000 EDT on September 9, 2017, the Division 2 Mechanical Draft Cooling Tower (MDCT) fans were declared inoperable due to loss of output from the over speed fan brake inverter. The MDCT fans are required to support operability of the Ultimate Heat Sink (UHS) and the Emergency Equipment Cooling Water (EECW) system. The Division 2 EECW system cools the High Pressure Coolant Injection (HPCI) system room cooler. As a result, the non-functionality of the fan brakes lead to an unplanned HPCI inoperability.

Since HPCI is a single train system designed to mitigate the consequences of a loss of coolant accident (LOCA), this event could have prevented the fulfillment of a safety function. The cause of the event was the failure of the Division 2 fan brake inverter.

Corrective Actions were taken to replace the inverter and returning the MDCT fans, the UHS, EECW and HPCI to service on September 9, 2017 at 2351 EDT. A failure modes evaluation was performed by the vendor with no direct cause of the failed output determined. The fan brake system is only required for a design basis tornado and there was no credible tornado threat during this event.

The HPCI system is not required to mitigate a design basis tornado. The safety significance of this event is very low and there were no radiological releases associated with this event.

On October 26, 2017, at 0212 hours with St. Lucie Unit 2 in Mode 1 at 100% power, the reactor automatically tripped due to a loss of load following a failure within the turbine control system. The reactor trip was uncomplicated and all control rod assemblies fully inserted. Following the trip, one of the low power feedwater valves LCV-9005, did not properly maintain steam generator level which resulted in an actuation of the A-train auxiliary feedwater system. During the auxiliary feedwater actuation, one main feedwater isolation valve did not reposition closed as expected, but this did not impact heat removal. The main feedwater system remained available.

The failure within the turbine control system was caused by design deficiencies. Planned corrective actions include modifications to improve protective circuits, the addition of coolers and use of conformal coatings on printed circuit boards in the modules.

The problem with LCV-9005 was due to a latent design error that resulted in the setting of an incorrect stroke length for the control valve. This was corrected by adjusting the stroke length of the valve.

This report is being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A) for system actuations of the reactor protection system and the auxiliary feedwater system.

During this event offsite power remained operable and energized. All other equipment responded to the event as expected per the existing plant conditions; therefore, this event had no impact on the health and safety of the public.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Description On October 26, 2017, at 0212 hours with St. Lucie Unit 2 in Mode 1 at 100% power, the reactor automatically tripped due to a loss of load following a failure within the non-safety related turbine control system (TCS) (EIIS:TG:DCC). Based on initial investigation, it was determined that a TCS malfunction affected multiple testable dump manifold (TDM) solenoids (EIIS:TG:PSV). Ultimately, electro-hydraulic (EH) (EIIS:TG) system pressure was lost (i.e., turbine tripped) after two TDM 1 solenoids spuriously operated concurrently. All high pressure turbine governor and throttle valves (EIIS:TA:XCV) and all low pressure turbine intercept and reheat stop valves (EIIS:TA:SHV) repositioned closed as expected upon loss of EH pressure. The reactor trip was uncomplicated and all control rod assemblies fully inserted.

Following the reactor trip, the 15% bypass feedwater regulating valve, LCV-9005 (EIIS:JB:LCV), did not provide the expected feedwater flow to the 2A Steam Generator (EIIS:JB:SG). This resulted in lowering steam generator level and an actuation of the A train auxiliary feedwater actuation system (AFAS) (EIIS:JC). During the auxiliary feedwater actuation, one main feedwater isolation valve (MFIV) (EIIS:JB:ISV), HCV-09-1A, did not reposition closed as expected, but this did not impact heat removal as the redundant MFIV in series isolated main feedwater. The main feedwater system remained available.

Cause of the Event

The failure within the turbine control system was caused by design deficiencies. The TCS incorporates various features for fault tolerance, including the use of three separate trip circuits for each TDM, the 2 out of 3 hydraulic logic of the TDM design, and redundant datalinks provided for Remote I/O communications. The design is intended to ensure a single failure or malfunction will not result in turbine trip. Replaced modules were retained for analysis. Two sets were sent to the original equipment manufacturer. The third set was sent to an independent lab for forensic analysis. Based on the results of the forensic analyses, this report may be supplemented with additional causal factors as appropriate.

The problem with LCV-9005 was due to a latent design error that resulted in the setting of an incorrect stroke length for the control valve. The stroke length of LCV-9005 has been properly adjusted.

The problem with HCV-09-1A was caused by a failed solenoid, and the solenoid was replaced.

Analysis of the Event

This licensee event report is being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A) as “Any event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph (a)(2)(iv)(B).” This event included automatic actuations of the reactor protection system and the auxiliary feedwater system.

Testable Dump Manifolds The TCS has automatic control and trip devices necessary for operation and protection of the turbine-generator.

An automatic trip is provided to prevent any damage to the turbine-generator. The unit trips upon occurrence of conditions which are potentially hazardous to the turbine-generator or to other associated plant equipment. The TCS uses two headers to provide emergency turbine trip and overspeed protection. The emergency trip header has two testable dump manifolds (TDM 1 and TDM 2) and the overspeed protection header has one testable dump manifold (TDM 3). Each triple redundant electronic emergency trip system uses a TDM to interface with the control oil system. The 2-out-of-3 solenoid logic used to provide a protective trip also provides a means to test the system while on-line.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Reviews of EH pressure data at each TDM showed that TDM 1 solenoid B was momentarily spuriously opening during the night prior to the event, and also that TDM 1 solenoid A and TDM 2 solenoid C had momentarily opened over the same time period. Approximately 30 minutes prior to the trip, TDM1 solenoid B opened and stayed open, putting TDM 1 into a continuous half trip state. The trip occurred after a second solenoid on TDM 1 spuriously opened.

Auxiliary Feedwater Actuation LCV-9005 and LCV-9006 are a pair of non-safety related 15% bypass feedwater regulating valves supplying main feedwater flow to the 2A and 2B SGs respectively with a predetermined set point and flow rate post trip. In 1997, LCV-9005 was replaced with what was intended to be a like for like valve replacement. However, the replacement LCV-9005 had different flow characteristics and a different stroke length that was not properly documented; therefore, not properly setup.

Prior to its replacement in 1997, LCV-9005 had a stroke length of 1.5 inches. The replacement valve had a stroke length of 2 inches. Stroke length is used to set up the control of the valve flow rate characteristics.

Therefore, the new model valve was only opening a percentage of a 1.5 inch stroke length instead of 2 inches.

This resulted in less flow than needed to automatically maintain flow to the steam generator without manual operation. A change in the plant conditions following implementation of a low power feedwater digital controller in 2013 compounded the effect of shortened valve stroke length that became apparent during this plant trip.

The opposite train valve LCV-9006 was determined to be operating with the proper stroke length, and main feedwater was used to feed the 2B Steam Generator post trip.

Safety Significance

The digital signals sent by the TCS to the TDMs during this event were reviewed and determined to be invalid and spurious. The turbine was not damaged or exposed to hazardous conditions during this event.

The auxiliary feedwater system is provided with complete sensor and control instrumentation to enable the system to automatically respond to a loss of steam generator inventory. Due to the incorrect setting of LCV- 9005 and the lowering water level in the 2A steam generator, the AFAS-1 actuation was valid. Once the mismatched 15% bypass feedwater regulating valve was isolated by AFAS-1, water level in the 2A steam generator was restored using auxiliary feedwater. 2B steam generator level was maintained post trip via LCV- 9006 and main feedwater.

During the auxiliary feedwater actuation, one of two MFIVs did not reposition closed as expected. There are two MFIVs in series on each feedwater train (A and B). The 2A train of main feedwater was automatically isolated by at least one MFIV. The Unit 2 UFSAR Table 7.3-12 describes failure modes and effects for the auxiliary feedwater actuation system. This analysis bounds the observation of the event described in this LER.

During this event offsite power remained operable and energized. Loss of turbine load events are bounded in the UFSAR as anticipated operational conditions. All other equipment responded to the event as expected per the existing plant conditions; therefore, this event had no impact on the health and safety of the public.

Corrective Actions

The corrective actions listed below are either completed or are being managed under the Corrective Action Program:

1. The three digital output modules controlling solenoids for TDM 1 were replaced, each consisting of an Electronics Module (EMOD), Personality Module (PMOD) and base assembly.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

2. The digital output module EMOD and PMOD for TDM 2 solenoid C was also replaced, as there was evidence that this solenoid had spuriously opened prior to the event.

3. The removed digital output modules were retained for analysis. Two sets (EMOD/PMOD/Base) from TDM 1 were sent to Emerson. The third set from TDM 1 was sent to an independent lab for forensic analysis.

4. Additional countermeasures measures were taken to further protect the TCS remote I/O cabinets from the environment. This included improving the remote TCS cabinets' environmental protection.

5. Actions are planned to install coolers for TCS cabinets.

6. Actions are planned to replace circuit card components in Remote I/O Cabinets.

7. Actions are planned to implement redundancy and diagnostics modifications to the TCS.

8. The stroke length of LCV-9005 was properly adjusted for a 2-inch stroke.

9. The failed solenoid on HCV-09-1A was replaced.

Failed Components Identified Turbine Control System Digital Output Module - Electronics Module (EMOD) Description: Digital Output 5-60VDC EMOD Manufacturer: Emerson Emerson Style Number: 1C31122G01 EMOD Serial Number: 3611019514 Emerson EMOD Module Revision 10 Turbine Control System Digital Output Module - Personality Module (PMOD) Description: Digital Output PMOD Manufacturer Emerson Emerson Style Number: 1C31125G02 PMOD Serial Number: T104316024 Emerson PMOD Module Revision 06 15% Bypass Feedwater Regulating Valve Manufacturer: Fisher Controls Co Inc. (Emerson) Valve Serial Number: 4” - 52A7148 Main Feedwater Isolation Valve Solenoid Description: valve:solenoid,3-way, 1/8" FNPT conn, carbon steel, 120 VDC,90 psi, normally closed Manufacturer: Parker Hannifin Part Number V5H71970 Cat ID322057-1

Additional Information

None

On August 20, 2017 at 1605 PDT, Columbia Generating Station was manually scrammed due to a rise in Main Condenser back pressure. The rise in back pressure was due to the spurious closure of the Main Condenser Air Removal Suction Valve (AR-V-1) as a result of the failure of it's associated solenoid pilot valve. Following the reactor scram and depressurization of the reactor a Level 3 actuation occurred. In addition a startup flow control valve failed which necessitated throttling of the Feedwater start-up level control isolation valve to control Reactor Pressure Vessel level. All other safety systems functioned as expected and all control rods were fully inserted. Reactor decay heat was removed via bypass valves to the main condenser.

The apparent cause was the plant modification to address the single point vulnerability of the closure of AR-V-1 was not implemented in time to prevent a plant shutdown. A temporary modification has been installed to maintain AR-V-1 open for the remainder of the operating cycle.

These events are reportable in accordance with 10 CFR 50.73(a)(2)(iv)(A).

On June 8, 2017 at 1527 hours, the reactor automatically scrammed due to a loss of Main Turbine- Electro-Hydraulic Control (EHC) logic power causing a high neutron flux, Reactor Protection System (RPS) trip. The safety systems operated as expected. Secondary Containment differential pressure lowered to 0" WG due to a trip of the normal operation of the Reactor Building Ventilation system. The differential pressure was restored by the initiation of Standby Gas Treatment System.

The scram was caused directly by a DC+ (direct current, positive) test lead (Maxi Grabber) that inadvertently contacted with the grounding screw, causing a short and momentary loss of EHC logic power.

Immediate action was taken to validate that there was no damage to the +30 VDC (volts DC) EHC logic.

The root cause for this event is an insufficient focus on the High Risk Activity of adjusting the EHC power supply, and inadequate risk mitigating actions for that activity.

The condition is being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A) as an event that resulted in an automatic actuation of the RPS, including reactor scram. Although no safety system functional failure occurred, this event is also reportable pursuant to 10CFR 50.73(a)(2)(v)(C) as a condition that could have prevented fulfillment of a safety function. There were no actual, or potential consequences to the health and safety of the public as a result of this event.

I

On July 17, 2017, at 1606 CDT, Waterford 3 experienced an automatic reactor scram due to a loss of forced circulation, which was the result of a loss of off-site power to the safety and non-safety electrical busses. Prior to the scram, plant operators manually tripped the main turbine and generator due to overheating of the isophase bus duct due to the failure of a shunt assembly connection in the duct to Main Transformer 'B'. The automatic electrical bus transfer did not occur due to relay failures in the fast dead bus transfer system. Both 'A' and 'B' Emergency Diesel Generators started and loaded as designed to re-energize the 'A' and 'B' safety busses. The loss of off-site power caused a loss of both Main Feedwater pumps, resulting in an automatic actuation of the Emergency Feedwater system.

The Root Cause of this event was the design change procedure used for modifications to the fast dead bus transfer circuitry did not include guidance to detect the susceptibility of the relays to DC coil inductive kick. The faulty relays in the fast bus transfer circuit were replaced prior to plant startup.

An Unusual Event was declared at 1617 CDT due to loss of off-site power to safety buses for >15 minutes.

All required safety-related equipment responded as expected during this event.

Technical Specification 3.7.6. A pinhole sized through wall leak was discovered on the downstream side of CD-123, the 32 Auxiliary Boiler Feed Pump Bearing Cooling Relief Valve, which was unisolable to the Condensate Storage Tank.

The pinhole leak was identified following the performance of 3PT-Q120B, 32 Auxiliary Boiler Feed Pump Functional Test. All Operability and Acceptance Criteria of 3PT-Q120B were sat. The relief valve was removed from the system and sent to a vendor for evaluation. After the vendor evaluation, it was determined that the valve pinhole area leak was due to a casting defect.

This event was determined to be reportable as a Loss of Safety Function pursuant to10 CFR 50.72(b)(3)(v)(B) - Any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to remove residual heat.

RC FORM 366 (04-2017)

On June 26, 2017, Operations commenced a downpower from 100 percent to 93 percent reactor power to support performance of the Main Turbine Stop and Control Valve Test. With reactor power at 94 percent, the 22 Main Boiler Feed Pump Turbine (MBFPT) speed control trouble alarm annunciated coincident with pump speed swings of 800 revolutions per minute (rpm). The operators ceased the downpower and placed the 22 Main Boiler Feedwater Pump (MBFP) in Manual speed control to control the rpm swings. This was unsuccessful, and the rpm swings continued. The 22 MBFPT low pressure (LP) governor valves were observed to be cycling from full-closed to full-open. The decision was made to take local pneumatic control of the 22 MBFP to stabilize pump speed. Two minutes after establishing local pneumatic control, the LP governor valves went to full closed. With the rapid reduction in 22 MBFP speed, the pump was no longer delivering feedwater flow to the SGs. An automatic main turbine runback signal should have been generated on a low speed signal; however, there was no turbine runback actuation. In response, the operators commenced a manual runback to reduce main turbine load, but the decreasing SG levels reached 15 percent, and at 1531 hours a manual reactor trip was initiated.

All control rods fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The direct cause of the reactor trip was that the shoulder screws used on the 22 MBFPT LP governor valve servomotor linkage had backed out and detached. This caused the LP governor valves to fail closed, shutting off the turbine steam supply. This event had no effect on the public health and safety. The event was reported to the Nuclear Regulatory Commission (NRC) on June 26, 2017 under 10 CFR 50.72(b)(2)(iv)(B), 50.72(b)(2)(xi), and 50.72(b)(3)(iv)(A).

On August 21, 2016, during Unit 1 restart following a maintenance outage, an unexpected actuation of the Main Generator Inadvertent Energization Lockout Relay caused the main generator to trip, resulting in an automatic reactor trip. The generator lockout prevented the automatic transfer of station auxiliaries to the available startup transformer power, requiring the emergency diesel generators to start and power the safety related buses.

Reactor coolant pumps normally powered through the non-safety buses were deenergized, and decay heat removal was via natural circulation and Auxiliary Feedwater. The lockout relay actuation was caused by a latent error introduced during a 2013 design modification where a wire was inadvertently removed from the circuit.

Corrective actions included restoration of the affected circuit and implementation of procedure guidance to verify the inadvertent energization relay state and to reset as required following Main Generator manual synchronization.

This licensee event report is being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A) for system actuations of the reactor protection system, the emergency diesel generators and the auxiliary feedwater system.

This event had no effect on the health and safety of the public.

On May 15, 2017, at 19:18 hours, station Operations personnel were performing a High Pressure Coolant Injection (HPCI) Pump Operability Test which ensures the HPCI Minimum Flow Valve opens as pump flow decreases. When the HPCI Turbine was tripped, the Minimum Flow Valve did not open as expected when system flow was reduced to the low flow setpoint. Operators took steps to open the valve manually, but upon release of the control switch, the valve returned to the closed position.

The valve was then left in the closed position.

The HPCI system was declared inoperable and Technical Specification 3.5.1 Condition G was entered.

The cause of the Minimum Flow Valve failing to open was attributed to the HPCI Pump Discharge Flow Indicating Switch, specifically, intermittent failure of the high side micro switch caused by residual material from the manufacturing process.

The Flow Indicating Switch, which had been installed for three months, was replaced and the HPCI Pump Operability Test was successfully re-performed. The failed switch was then sent to Exelon's Power Labs for failure analysis.

The safety significance of this event was minimal. Given the impact on the HPCI system, this report is submitted for Unit 2 in accordance with the requirements of 10 CFR 50.73(a)(2)(v)(D), which requires the reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. The HPCI system is a single train system and the loss of HPCI could impact the plant's ability to mitigate the consequences of an accident.

On April 26, 2017, Arkansas Nuclear One, Unit 1 (ANO-1), was operating normally at 100% rated thermal power.

The 500kV transmission line to the substation at Pleasant Hill, Arkansas was out of service for planned maintenance.

The area around the plant was experiencing severe weather from thunderstorms and tornado warnings had been issued from the National Weather Service for the four county area.

At approximately 1002 CST switchyard breakers for 500kV lines opened on fault current. High winds had damaged the transmission towers approximately 16 miles away from ANO and caused phase to ground faults. This resulted in a loss of all offsite power lines to the 500kV bus. The autotransformer also locked out as designed when the 500kV transmission lines faulted.

The Reactor Operator initiated a manual reactor trip about 8 seconds after the 500kV lines tripped and prior to the reactor protection system initiating an automatic trip. During this time both emergency diesel generators (EDGs) (EK) started as expected. EDG #2 re-energized one Engineered Safeguards bus. EDG #1 ran unloaded until shutdown.

The plant was stabilized in Mode 3 with Emergency Feedwater (EFW) pumps supplying the steam generators, maintaining the water level at the natural circulation setpoint.

On August 24, September 11, and September 15, 2016, during performance of an extent of condition evaluation related to the protection of Technical Specification (TS) equipment from external flood hazards, Arkansas Nuclear One, Unit 1 (ANO-1), identified non-conforming plant design conditions such that specific ANO-1 TS equipment was considered to not be adequately protected from tornado missiles. These are legacy design issues.

On August 24, 2016, at 0945, September 11, 2016, at 1504, and September 15, 2016, at 0958, Operations declared the affected components inoperable, implemented Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance", along with necessary compensatory measures, and subsequently declared the affected equipment operable but non-conforming.

The cause of this issue was unclear and changing regulatory requirements during original plant licensing that led to an inadequate understanding of the regulatory guidance with respect to tornado missile protection design requirements.

Interim corrective actions include implementation of compensatory strategies. Plant modifications and license basis changes are being evaluated to resolve outstanding issues.