Event Notification Report for February 6, 2012

U.S. Nuclear Regulatory Commission
Operations Center

Event Reports For
02/03/2012 - 02/06/2012

** EVENT NUMBERS **

"Calvert Cliffs will be implementing scheduled maintenance to the plant data network to install a data diode to meet the new cyber security requirements listed in 10 CFR 5.71. This work will require the TSC, OSC and subsequently the EOF to lose normal data flow from the plant data network for a period of approximately 6 to 8 hours. ERDS will also be unavailable during this maintenance. Should an emergency be declared during this period, the Control Room will continue to have the capability to retrieve plant data inputs to assess plant conditions and perform core damage assessment. Control Room Emergency Response Organization personnel will use backup methods already captured in emergency response procedures to disseminate plant parameter data to the effected Emergency response Facilities and NRC during the plant data network outage. MIDAS (Meteorological Data) will continue to be operational at the site."

The licensee notified the NRC Resident Inspector.

"On February 3, 2012, at 1035 hours [CST], the Control Room Emergency Ventilation Air Conditioning (CREV AC) system was declared inoperable when the electrical feed breaker to the Refrigeration Compressor Unit (RCU) was found in a tripped condition. As a result, Technical Specification 3.7.5, Condition A, was entered. Troubleshooting is in progress at this time.

"The CREV AC system maintains a habitable control room environment and ensures the operability of components in the control room emergency zone during accident conditions.

"This notification is being made in accordance with 10 CFR 50.72(b)(3)(v)(D) because the CREV system is a single train system, and loss of the CREV AC could impact the plant's ability to mitigate the consequences of an accident."

The LCO places the plant in a 30-day action statement.

The licensee has notified the NRC Resident Inspector.

Cooper Nuclear Station (CNS) returned one high pressure fuel hose to Engine Systems, Inc. (ESI) because CNS had found foreign material within the hose during receipt inspection. This fuel hose was one of four fuel hoses that had been supplied to CNS by ESI in October 2011. ESI performed an evaluation and found very small pieces of the elastomer tube internal to the hose. Apparently these pieces were introduced during assembly of the end fittings onto the hose during fabrication of the hose assembly.

When installed, this fuel hose would be located after the engine fuel filter and before the fuel injection pumps. Foreign material within this hose could migrate to the fuel injection pumps. The entrance of foreign material could impact operability of one or more fuel injection pumps and therefore affect fuel delivery to one or more engine cylinders. This could impact the load carrying capability of the diesel engine or possibly cause complete engine shutdown. Either scenario has the potential to prevent the emergency diesel generator from performing its safety related function.

These hoses were supplied only to CNS.

"On January 30, 2012, a design vulnerability was discovered at Byron and Braidwood stations in the Engineered Safety Feature 4.16kV bus under-voltage protection scheme for Byron Station Units 1 and 2. Specifically a voltage unbalance created by an open circuit of either the A or C phase from the offsite grid to the System Auxiliary Transformers (SAT) is not designed to actuate the protective relays on the 4.16kV safety bus that provides isolation from the offsite grid and the automatic start and loading of the emergency onsite diesel generators.

"Two under-voltage relays are provided on each 4.16kV safety bus, which are combined in a two out of two logic to generate a loss of power signal. The relays are sensing voltage between two phases (i.e., A&B and B&C). An open circuit condition on the C phase or the A phase would not satisfy the two out of two logic. This condition results in both 4.16kV safety buses remaining energized with a bus undervoltage situation and results in equipment protective devices actuating from over-current conditions.

"This configuration is a non-conforming condition in that the design of the under-voltage relays and logic was intended to identify degraded grid conditions, not loss of a single phase. With an open circuit on the A or C phase from the grid to the SATs, during normal operations, operators have to diagnose the condition and manually isolate safety buses from offsite power which would automatically start and load the emergency diesel generators. During a design basis event concurrent with an open circuit on A or C phase from the grid to the SATs, analysis performed to date indicates that starting of the ECCS loads would have caused the bus voltage to decrease sufficiently to actuate the under-voltage protective relays and restore cooling with emergency onsite power without challenging fuel design limits.

"The 4.16kV safety bus under-voltage protection scheme at Byron and Braidwood is believed to be a typical industry design. This design issue is being evaluated at the other Exelon stations. The results of this evaluation will be shared with the NRC. Therefore, this condition is being reported as a voluntary notification due to its potential generic industry applicability."

The licensee notified the NRC Resident Inspector.

"On January 30, 2012, a design vulnerability was discovered at Byron and Braidwood stations in the Engineered Safety Feature 4.16kV bus under-voltage protection scheme for Braidwood Station Units 1 and 2. Specifically a voltage unbalance created by an open circuit of either the A or C phase from the offsite grid to the System Auxiliary Transformers (SAT) is not designed to actuate the protective relays on the 4.16kV safety bus that provides isolation from the offsite grid and the automatic start and loading of the emergency onsite diesel generators.

"Two under-voltage relays are provided on each 4.16kV safety bus, which are combined in a two out of two logic to generate a loss of power signal. The relays are sensing voltage between two phases (i.e., A&B and B&C). An open circuit condition on the C phase or the A phase would not satisfy the two out of two logic. This condition results in both 4.16kV safety buses remaining energized with a bus undervoltage situation and results in equipment protective devices actuating from over-current conditions.

"This configuration is a non-conforming condition in that the design of the under-voltage relays and logic was intended to identify degraded grid conditions, not loss of a single phase. With an open circuit on the A or C phase from the grid to the SATs, during normal operations, operators have to diagnose the condition and manually isolate safety buses from offsite power which would automatically start and load the emergency diesel generators. During a design basis event concurrent with an open circuit on A or C phase from the grid to the SATs, analysis performed to date indicates that starting of the ECCS loads would have caused the bus voltage to decrease sufficiently to actuate the under-voltage protective relays and restore cooling with emergency onsite power without challenging fuel design limits.

"The 4.16kV safety bus under-voltage protection scheme at Byron and Braidwood is believed to be a typical industry design. This design issue is being evaluated at the other Exelon stations. The results of this evaluation will be shared with the NRC. Therefore, this condition is being reported as a voluntary notification due to its potential generic industry applicability."

The licensee notified the NRC Resident Inspector.

During the licensee's NFPA 805 transition review process, several unanalyzed conditions were discovered but determined to be not reportable at that time. During subsequent review, the licensee determined these conditions did meet reporting requirements.

The following unanalyzed conditions affect all three Browns Ferry units:

"On 5/11/2010, it was determined that in the event of an Appendix-R fire, multiple hot shorts affecting reactor pressure instrument loops, Safety Relief Valves (SRV) overpressure logic or ADS [Automatic Depressurization System] logic could cause 2 to 13 SRVs to spuriously open, for certain fire areas. The current Appendix R safe shutdown analysis only assumes 2 SRVs spuriously open. The issue has significant safety impact due to the potential for one fire scenario to result in spurious opening of multiple SRVs, loss of low pressure inventory makeup, and loss of the condensate system for inventory makeup, which would challenge adequate core cooling during performance of Safe Shutdown Instructions.

"On 8/18/2010, it was determined that in the event of an Appendix-R fire, fire induced circuit damage can potentially result in the inability to manually close the following Motor Operated Valves: Residual Heat Removal Heat Exchanger outlet valves and Emergency Equipment Cooling Water pump cross-tie valves. The failure to be able to manually close these valves could result in the loss of decay heat removal function and loss of credited diesel generators to power required safe shutdown equipment. These issues have significant safety impact since the capability to manually close these valves is necessary to ensure adequate core cooling during performance of BFN Safe Shutdown Instructions.

"On 9/30/2010, it was determined that in the event of an Appendix-R fire, fire induced multiple hot shorts could cause both Inboard and Outboard RHR test return valves, and Drywell Spray and Suppression Pool Spray valves to spuriously open due to damage to the valve control circuit cables. This could result in draining of the Pressure Suppression Chamber Head Tank and the affected low pressure Emergency Core Cooling System loop piping (RHR or CS). Consequently, the discharge pipe in the credited Residual Heat Removal (RHR) loop may not be filled and vented when the Safe Shutdown Instructions (SSIs) call for the RHR pump to be started. The resulting water hammer could result in piping system damage resulting in loss of core cooling and decay heat removal functions and loss of suppression pool inventory. Additionally, single spurious actuation of Core Spray (CS) test return valves due to fire damage to their control circuits could have the same results. These issues have significant safety impact since they would challenge the ability to provide adequate core cooling during performance of Safe Shutdown Instructions.

On 8/22/2011, two unanalyzed conditions were discovered:

First, "it was determined that, in the event of an Appendix-R fire in certain areas, fault propagation due to loss of the breaker control circuit in conjunction with power cable damage could result in de-energization of the associated 4kV Shutdown Board. This potential exists since some 4kV Shutdown Board load breakers are not equipped with separate fuses for trip circuits extending beyond the board. This condition could result in a loss power to credited safe shutdown equipment that would challenge the ability to provide adequate core cooling during performance of BFN Safe Shut down Instructions.

Second, "it was determined that in the event of an Appendix-R fire in certain areas, Multiple Spurious Operations (MSO) could result in the Main Steam Isolation Valves failing to close, or to re-open. This potentially results in a challenge to control inventory loss during performance of Safe Shut down Instructions.

The following unanalyzed condition only affects Unit 2:

"On 8/18/2010, it was determined that in the event of an Appendix-R fire, fire induced circuit damage can potentially result in the inability to manually close certain Main Steam Drain Line Motor Operated Valves. The current Appendix R safe shutdown analysis credits manual closure of these valves. Failure to close these valves results in loss of suppression pool inventory which could challenge adequate core cooling during performance of BFN Safe Shutdown Instructions."

Compensatory actions in the form of fire watches to mitigate all these conditions are in place in accordance with the BFNP Fire Protection Report. The licensee will make the required 60-day written reports in accordance with 10CFR50.73(a)(2)(ii)(B). These events were entered into the licensee's Corrective Action Program.

The licensee has notified the NRC Resident Inspector.

"This report is being made pursuant to 10CFR50.72(b)(2)(xi). At 1715 [EST], a site security officer was discovered unresponsive on the north end of the Unit 2 turbine hall by a fellow officer. The cause of the individual's unresponsiveness is unknown but appears to be personal health related. The individual was unresponsive to revival attempts and transported by ambulance to the local Hudson Valley Hospital. The individual was pronounced dead at the hospital.

"The individual's security contingent equipment was immediately secured on discovery. This event had no impact on the status of IPEC plant operation and all applicable security procedures / requirements were followed upon discovery."

The licensee notified New York State Public Service Commission and the NRC Resident Inspector.