IR 05000313/2016008

NRC Component Design Bases Inspection and Confirmatory Action Letter Follow-Up Inspection Report 05000313/2016008 and 05000368/2016008

ML17059D000
Person / Time
Site:	Arkansas Nuclear
Issue date:	02/28/2017
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Richard Anderson Entergy Operations
Farmholtz T
References
EA-14-008, EA-14-088, EA-16-124, EA-17-017 IR 2016008
Download: ML17059D000 (71)

Text

ary 28, 2017

SUBJECT:

ARKANSAS NUCLEAR ONE - NRC COMPONENT DESIGN BASES INSPECTION AND CONFIRMATORY ACTION LETTER FOLLOW-UP INSPECTION REPORT 05000313/2016008 AND 05000368/2016008

Dear Mr. Anderson:

On December 2, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed the onsite portion of the subject inspection at the Arkansas Nuclear One (ANO), Units 1 and 2. On February 9, 2017, the NRC inspectors discussed the results of this inspection with Mr. Barry Davis, Director of Engineering, and other members of your staff. In conjunction with this inspection, the NRC inspection team also reviewed your progress in implementing the specific actions from the ANO Comprehensive Recovery Plan that were committed to in a Confirmatory Action Letter (CAL), dated June 17, 2016, (NRCs Agencywide Documents Access and Management System (ADAMS) Accession No. ML16169A193) (EA-16-124). The team discussed the results of this inspection with you and other members of your staff. The team documented the results of this inspection in the enclosed inspection report.

The team documented six findings of very low safety significance (Green) in this report. Five of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Arkansas Nuclear One.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Arkansas Nuclear One. The teams review of ANOs progress in implementing the portions of the ANO Comprehensive Recovery Plan that were committed to in the CAL described above focused on those actions intended to improve the engineering vendor oversight, flood protection, and preventive maintenance classification. The inspection included a review of selected corrective actions to address the finding of substantial safety significance (Yellow) involving the failure to adequately approve the design and to load test a temporary lift assembly (EA-14-008), and the finding substantial safety significance (Yellow) involving the failure to assure that safety-related equipment below the design flood level was protected (EA-14-088). The enclosed report documents the basis for closing 9 of the 13 CAL actions reviewed, as well as observations related to the stations progress in addressing those actions that were not sufficiently complete or effective to close at this time. The NRC will further review your development and implementation of corrective actions for these risk-significant findings during future inspections.

Attachment 3 of the enclosed report summarizes the NRCs inspection of the CAL actions to date.

In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice and Procedure," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from ADAMS. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6

Enclosure:

Inspection Report 05000313/2016008 and 05000368/2016008 w/Attachment 1: Supplemental Information Attachment 2: Initial Request for Information Attachment 3: List of Confirmatory Action Letter Items Closed and Discussed Attachment 4: Detailed Risk Analysis for NCV 05000313/2016008-04

REGION IV==

Dockets: 05000313; 05000368 Licenses: DPR-51; NPF-6 Report Nos.: 05000313/2016008; 05000368/2016008 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Units 1 and 2 Location: Junction of Highway 64 West and Highway 333 South Russellville, Arkansas Dates: October 31, 2016, to February 9, 2017 Team Leader: G. George, Senior Reactor Inspector Inspectors: H. Freeman, Senior Reactor Inspector I. Anchondo, Reactor Inspector N. Okonkwo, Reactor Inspector J. Kirkland, Senior Operations Engineer Accompanying R. Deese, Senior Reactor Analyst Personnel: G. Nicely, Contractor, Beckman and Associates M. Yeminy, Contractor, Beckman and Associates Approved By: Thomas R. Farnholtz Chief, Engineering Branch 1 Division of Reactor Safety 1 Enclosure

SUMMARY

IR 05000313/2016008; 05000368/2016008; 10/31/2016 - 02/09/2017; Arkansas Nuclear One;

IP 71111.21, Component Design Bases Inspection; IP 92702, Follow-up on Traditional Enforcement Actions including Violations, Deviations, Confirmatory Action Letters, Confirmatory Orders, and Alternative Dispute Resolution Confirmatory Orders The inspection activities described in this report were performed between October 31, 2016, and February 2, 2017, by five inspectors from the NRCs Region IV office and two NRC engineering contractors. Five findings of very low safety significance (Green) are documented in this report. Four of these findings involved a violation of NRC requirements. Additionally, one violation was identified, and determined to be a violation related to and bounded by a previously issued Yellow finding regarding the ability to combat an external flooding event (Inspection Reports 05000313/2014009 and 05000368/2014009), and therefore was not characterized by color significance. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance Determination Process. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas.

Violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, prior to December 2, 2016, the licensee failed to use appropriate assumptions in thermal overload device calculations and failed to establish a suitable periodic test program for safety-related Unit 1 motor operated valve thermal overload device trip setpoints, as discussed in Regulatory Guide 1.106, Regulatory Position C.2. In response to this issue, the licensee demonstrated reasonable assurance of operability by using the results of the 18-month high pressure injection system valve testing which required multiple stroking of block valves to obtain various flows without tripping the thermal overload devices. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-5017 and CR-ANO-1-2016-5130.

The team determined that the failure to meet the intent of Regulatory Guide 1.106,

Regulatory Position C.2 was a performance deficiency. The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify the adequacy of the design and perform suitable testing for thermal overload device setpoint drift did not ensure that the safety-related motor operated valves would be available to throttle the associated system flows during a design basis accident. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluations because the licensee failed to thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee failed to thoroughly evaluate Condition Report CR-ANO-1-2016-0778 which documented NRC inspector concerns associated with design and testing of motor operated valve thermal overload devices [P.2]. (Section 1R21.2.1.b.1)

Green.

The team identified Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, which states, A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Additionally, Test results shall be documented and evaluated to assure that test requirements have been satisfied. Specifically, as of December 2, 2016, Units 1 and 2 emergency diesel generator surveillance procedures failed to incorporate the applicable voltage and frequency limits of NRC Safety Guide 9, and did not consistently document or evaluate results to assure test requirements have been satisfied. In response to this issue, the licensee provided the team test results which demonstrated that an immediate safety concern was not present. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-1-2016-4785 and CR-ANO-2-2016-4257.

The team determined that the failure to incorporate the acceptance limits of NRC Safety Guide 9 into surveillance test procedures for emergency diesel generators and assure that test requirements have been satisfied in accordance with 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences, and would have the potential to lead to a more significant safety concern. Specifically, the failure to incorporate appropriate acceptance criteria in test procedures and assure that the criteria have been satisfied had the potential to lead to a worse condition, if left uncorrected. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green)because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance. (Section 1R21.2.1.b.2)

Green.

The team identified a Green finding for the failure to meet the surveillance standards of IEEE 308-1971, Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations, Section 5.2.3, Preferred Power Supply. Specifically, from 2001 to December 2, 2016, the licensee failed to monitor the operation of the voltage regulator/load tap changer functions on startup transformers 1, 2, and 3. In response to this issue, the licensee provided reasonable assurance that the voltage regulator/load tap changer was operating properly based on review of plant computer voltage plot data following an Arkansas Nuclear One, Unit 1 trip that occurred on December 14, 2015. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-4777,

CR-ANO-C-2016-4879, and CR-ANO-C-2016-5015.

The team determined that the failure to monitor startup transformers 1, 2, and 3 voltage regulator/load tap changers to the extent that they are shown to be ready to perform their intended function, in accordance with IEEE Standard 308-1971, was a performance deficiency. The finding was determined to be more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences.

Specifically, the failure to monitor the adequacy of the voltage supplied from startup transformers 1, 2, and 3 voltage regulator/load tap changer did not ensure that offsite power would be available to perform its necessary functions to provide power to the safety-related mitigation equipment. In accordance with Inspection Manual Chapter 0609, Appendix A,

The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

(Section 1R21.2.2.b.1)

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which states, in part that, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, prior to December 22, 2016, the licensee failed to verify the adequacy of the emergency feedwater suction transfer procedure by determining if the qualified condensate storage tank will be completely empty of water, possibly causing an air ingestion failure of the Unit 1 emergency feedwater pumps, prior to transferring to the credited safety-related alternate suction source. In response to this issue, the licensee resolved the immediate safety concern by revising the emergency feedwater pump operating procedure, removing the steps that were the cause of the concern. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-1-2016-5166, CR-ANO-1-2016-5725, and CR-ANO-1-2017-0040.

The team determined that the failure to verify the adequacy of the design of the Unit 1 emergency feedwater suction from the qualified condensate storage tank to alternate sources of water by performance of design review, by use of calculational methods, or by performance of a suitable testing program in accordance with 10 CFR Part 50, Appendix B,

Criterion III, Design Control, was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the reliability, availability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to have adequate measures in place to ensure an acceptable design analysis or a suitable test program would verify that the process of transferring emergency feedwater suction from the qualified storage tank to the alternate sources ensures the capability of the Unit 1 emergency feedwater system to perform its safety function. In accordance with Inspection Manual Chapter 0609,

Attachment 4, Initial Characterization of Findings, dated June 19, 2012, the team determined this finding affected the secondary short term heat removal function of the Mitigating Systems Cornerstone. In accordance with Inspection Manual Chapter 0609,

Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding represented a loss of the emergency feedwater system and function. Therefore, a detailed risk evaluation was necessary. The senior reactor analyst determined that the change in core damage frequency of this finding was 7 x 10-7 per year, therefore the significance was of very low safety significance (Green). This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

(Section 1R21.2.7.b.1)

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, from December 17, 1979, to December 2, 2016, the licensee did not verify that the design of the protective devices for the loads required at the beginning of a loss-of-coolant accident were adequate to prevent tripping these devices under degraded voltage conditions, which would render the affected loads non-functional.

In response to this issue, the licensee performed a preliminary analysis to determine that the protective overload devices would not cause safety equipment to fail at degraded voltages allowed by technical specifications. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-5027 and CR-ANO-C-2016-5191.

The team determined that the failure to ensure that safety-related electrical components would not fail during the allowable time duration of a degraded voltage condition (in accordance with NRC Multi-Plant Action B-23, Position 1.C) was a performance deficiency.

The finding was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to ensure that the protective devices for the loads required at the beginning of a Loss of Control Accident would not fail under degraded voltage conditions did not ensure that these loads would be available to perform their mitigating functions. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green)because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.3.1.b.1)

Green.

The team identified three examples of a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, which states, in part that, activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances. Specifically, prior to December 2, 2016, Unit 1 Operating Procedure OP 1203.025, Natural Emergencies,

Revision 60 and Unit 2 Operating Procedure OP 2203.008 Natural Emergencies,

Revision 42 failed to ensure all actions required to establish external flood protection, as specified by flood protection design basis engineering report CALC-ANOC-CS-00003,

Revision 00 were implemented. This issue was entered into the licensees corrective action program as Condition Report CR-ANO-2-2016-4265.

The licensees failure to prescribe procedures appropriate to the circumstances for combating emergencies or other significant acts of nature such as flooding was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences, and would have the potential to lead to a more significant safety concern. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2,

Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it does not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with identification because the licensee failed to identify issues, completely, accurately, and in a timely manner in accordance with the corrective action program. Specifically, the licensee failed to identify these deficiencies during a review of these same procedures as part of actions to close significant performance deficiencies as documented in Arkansas Nuclear One Area Action Plan FP-6 [P.1]. (Section 1R21.3.3.b.1)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity This inspection of component design bases verifies that plant components are maintained within their design basis. Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design basis functions. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity Cornerstones for which there are no indicators to measure performance.

1R21 Component Design Basis Inspection

.1 Overall Scope

To assess the ability of the Arkansas Nuclear One, Units 1 and 2, equipment and operators to perform their required safety functions, the team inspected risk-significant components and the licensees responses to industry operating experience. The team selected risk-significant components for review using information contained in the Arkansas Nuclear One, Units 1 and 2 probabilistic risk assessments and the U. S. Nuclear Regulatory Commissions (NRCs) standardized plant analysis risk model.

In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and nonsafety-related systems including pumps, circuit breakers, heat exchangers, transformers, and valves.

The team selected the risk-significant operating experience to be inspected based on its collective past experience.

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design basis and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For selected components, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design basis have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results, significant corrective actions, repeated maintenance, 10 CFR 50.65(a)1 status, operable, but degraded conditions; NRC resident inspector input of problem equipment, system health reports, industry operating experience, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15 to 25 total samples that include risk-significant and low design margin components, components that affect the large-early-release-frequency (LERF), and operating experience issues. The sample selection for this inspection was 11 components, 1 of which affects LERF, and 4 operating experience items. The selected inspection and associated operating experience items supported risk-significant functions including the following:

a. Electrical power to mitigation systems: The team selected several components in the electrical power distribution systems to verify operability to supply alternating current (ac)and direct current

(dc) power to risk-significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and a loss-of-coolant accident with offsite power available. As such the team selected:

• Unit 1 480 V Class 1E Load Control Center B-5

• Startup Transformer 1 and Open Phase Detection Modification

• Unit 1 125 VDC Battery Buses D-01 & D-02

• Unit 2 480 V Class 1E Load Control Center 2B-5

• Alternate AC Emergency Diesel Generator 2K-9 b. Components that affect large-early-release-frequency (LERF): The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components:

• Unit 1 Electromatic Relief Valve PSV-1000 c. Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected:

• Unit 1 Motor Driven Emergency Feedwater Pump P-7B

• Units 1 and 2 Service Water System Pumps and Motors

• Unit 1 Reactor Building Coolers

• Unit 2 Component Cooling Water Heat Exchanger 2E-28C

• Units 1 and 2 Emergency Diesel Generator Fuel Oil Storage Tanks

.2.1 Unit 1 480 V Class 1E Load Control Center B-5

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Unit 1 480 V Class 1E load control center B-5. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• Protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

• Degraded and loss of voltage relays selection and associated time delays to verify settings were in accordance with calibration procedures, time delay calculations, and accuracy calculations.

• Licensee responses to NRC Generic Letter (GL) 2006-02, Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power, dated February 1, 2006.

• Interface and coordination with the transmission system operator for plant voltage requirements and notification set points were reviewed.

• Emergency diesel generator loading calculations to determine whether the capacity of the emergency diesel generator is adequate to supply worst case accident loads.

• Emergency diesel generator surveillance test results to ensure that the voltage and frequency transients were within the NRC Safety Guide 9 acceptable limits.

1. Failure to Verify the Adequacy of Motor Operated Valve Thermal Overload Devices

Introduction.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to use appropriate assumptions in thermal overload device calculations and failed to establish a suitable periodic test program for safety-related Unit 1 motor operated valve thermal overload device trip setpoints.

Description.

The licensee initiated Condition Report CR CR-ANO-1-2016-0778 as a result of the February 2016 NRC Inspection Procedure 95003 inspection. The NRC inspection team had the following concern and questions associated with motor operated valve thermal overload devices for eight Unit 1 motor operated valves CV-1219, CV-1220, CV-1278, CV-1279, CV-1227, CV-1228, CV-1284, and CV-1285:

1. The team was concerned that the thermal overloads may trip during accident conditions and prevent the valves from performing their safety function because the operators were expected to throttle flow to 20 gallons per minute.

2. The team asked if the thermal overloads were periodically tested to ensure the thermal overloads were working properly.

3. The team asked if the operators are trained to limit the number of throttling attempts, or if Unit 1 procedures limited the number of throttling attempts. The team gave an example that the motor manufacture, Flowserve, has guidance that a motor should have no more than 5 starts (throttle attempts) in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with a required cool down of 1.5 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> depending on motor frame size.

As part of the corrective report, the licensee reviewed results from Calculation 94-E-0018-02, GL 89-10 MOV Cable, Breaker and TOL Evaluation, that evaluated thermal overload relay and heater size combinations for the various sizes and types of safety-related motor operated valves to determine if the thermal overloads would trip for the throttling/jogging function. The licensee determined that the thermal overloads would be able to complete approximately 25 throttling attempts before tripping. The licensee stated that the thermal overload devices on the 8 motor operated valves were not in a periodic test program.

The licensees thermal overload device sizing criteria was based Arkansas Nuclear One Design Standard EES-12, Motor Operated Valve Electrical Evaluation, Revision 4.

Section 6.1.1, Regulatory Position - Regulatory Guide 1.106 discusses that Arkansas Nuclear One intends that Unit 1 meets position C.2 of Regulatory Guide 1.106, Thermal Overload Protection for Electric Motors on Motor-Operated Valves. Regulatory Guide 1.106, Position C.2 states, for thermal overload protection devices that are not bypassed:

The trip setpoint of the thermal overload protection devices should be established with all uncertainties resolved in favor of completing the safety-related action. With respect to those uncertainties, consideration should be given to

(1) variations in the ambient temperature at the installed location of the overload protection devices and the valve motors,

(2) inaccuracies in motor heating data and the overload protection device trip characteristics and the matching of these two items, and

(3) setpoint drift.

In order to ensure continued functional reliability and the accuracy of the trip point, the thermal overload protection device should be periodically tested.

The team determined that the licensee did not meet the intent of Regulatory Guide 1.106, Position C.2. Calculation 94-E-0018-02, GL 89-10 MOV Cable, Breaker and TOL Evaluation, did not establish a trip setpoint with all uncertainties resolved in favor of completing the safety-related function. Because the motor operated valves are used in throttling applications, the calculation requires additional considerations due to wide variations in the motor operated valve duty cycle and multiple occurrences of motor operated valve motor inrush that the licensee had not considered in their sizing criteria.

The calculation non-conservatively evaluated motor operated valve motors as starting unloaded with starting currents lasting only milliseconds. Since the motor operated valve will be mid-stroke, the motor operated valve will be started under load therefore the starting current may last up to 1 second which rapidly heats up the thermal overload bi-metallic element. The calculation non-conservatively divided the full stroke time into the thermal overload trip time at running current to determine how many throttles the motor could have without tripping the thermal overload. Additionally, the licensee did not establish a periodic test program to ensure continued functional reliability and accuracy of the trip point.

Analysis.

The team determined that the failure to meet the intent of Regulatory Guide 1.106, Regulatory Position C.2 was a performance deficiency. The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify the adequacy of the design and perform suitable testing for thermal overload device setpoint drift did not ensure that the safety-related motor operated valves would be available to throttle the associated system flows during a design basis accident. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluations because the licensee failed to thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee failed to thoroughly evaluate Condition Report CR-ANO-1-2016-0778 which documented NRC inspector concerns associated with design and testing of motor operated valve thermal overload devices [P.2].

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, prior to December 2, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program of motor operated valves thermal overload devices. Specifically, the licensee failed to use appropriate assumptions in thermal overload device calculations and failed to establish a suitable periodic test program for safety-related Unit 1 motor operated valve thermal overload device trip setpoints. In response to this issue, the licensee demonstrated reasonable assurance of operability by using the results of the 18-month high pressure injection system valve testing which required multiple stroking of block valves to obtain various flows without tripping the thermal overload devices. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-5017 and CR-ANO-1-2016-5130. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016008-01, Failure to Verify the Adequacy of Motor Operated Valve Thermal Overload Devices.

2. Failure to Incorporate NRC Safety Guide 9 Criteria into Surveillance Procedures

Introduction.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to incorporate the acceptance criteria into test procedures to ensure that Unit 1 and Unit 2 emergency diesel generator loads were energized within the applicable voltage and frequency limits of NRC Safety Guide 9. In addition, the licensee did not evaluate the results to assure that test requirements have been satisfied in a timely manner.

Description.

Arkansas Nuclear One, Unit 1, Updated Safety Analysis Report, Section 8.3.1.1.7, Emergency Power Supply System, states, The diesel generators are of such a size that, during the incremental adding of loads, the recommendations of NRC Safety Guide 9 will not be exceeded.

Arkansas Nuclear One, Unit 2, Updated Safety Analysis Report, Section 8.3.1.2, Analysis, states, The [Class 1E electric] system was designed to meet the requirements of IEEE 279-1971, IEEE 308-1971, IEEE 387-1972, 10CFR50 General Design Criteria 17 and 18, and Regulatory Guides 1.6 and 1.9.

NRC Safety Guide 9 (also known as Regulatory Guide 1.9, dated August 10, 1971),

Selection of Diesel Generator Set Capacity for Standby Power Supplies, establishes voltage and frequency limits during diesel generator sequencing. Position C.4 of NRC Safety Guide 9 states, in part, that:

At no time during the loading sequence should the frequency and voltage decrease to less than 95 percent of nominal and 75 percent of nominal, respectively.

Additionally, it states, Voltage should be restored to within 10 percent of nominal and frequency should be restored to within 2 percent of nominal in less than 40 percent of each load sequence time interval.

Although the Unit 1 and Unit 2 technical specifications do not specifically list the NRC Safety Guide 9 voltage and frequency criteria, the technical specification bases implies that the auto-sequenced loads were energized, both started and accelerated within the required criteria of NRC Safety Guide 9.

The team noted the following deficiencies related to the emergency diesel generator periodic 18-month technical specification surveillance testing in Unit 1 Procedure 1305.006, Integrated ES System Test, and Unit 2 Procedure 2305.001, Integrated Engineering Safeguards Test:

1. No acceptance criteria was incorporated into the test procedures to ensure compliance with NRC Safety Guide 9 starting and acceleration limits.

2. Prior to returning the emergency diesel generators to operable, the licensee did not consistently compare the test data with the applicable NRC Safety Guide 9 limits and consistently document those results to ensure operability of the emergency diesel generators.

3. The surveillance procedures only required the system engineer to receive the test data to develop system response trends and compare to NRC Safety Guide 9 criteria; however, the system engineers review was not integral to determining a successful test.

4. The surveillance procedures did not include any criteria as to when the system engineers review would be completed, specifically prior to returning to operable status. In some instances, the review was completed after the emergency diesel generator was restored to operable status.

Analysis.

The team determined that the failure to incorporate the acceptance limits of NRC Safety Guide 9 into surveillance test procedures for emergency diesel generators and assure that test requirements have been satisfied in accordance with 10 CFR Part 50, Appendix B, Criterion XI, Test Control, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences and would have the potential to lead to a more significant safety concern.

Specifically, the failure to incorporate appropriate acceptance criteria in test procedures and assure that the criteria have been satisfied had the potential to lead to worse condition, if left uncorrected. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, which states, A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Additionally, Test results shall be documented and evaluated to assure that test requirements have been satisfied. Contrary to the above, as of December 2, 2016, the licensee failed to assure that testing required to demonstrate that emergency diesel generators would perform satisfactorily in service was identified and performed in accordance with written test procedures which incorporated the requirements and acceptance limits contained in applicable design documents and failed to document and evaluate the test results to assure that the test requirements have been satisfied. Specifically, Units 1 and 2 emergency diesel generator surveillance procedures failed to incorporate the applicable voltage and frequency limits of NRC Safety Guide 9 and did not consistently document or evaluate results to assure test requirements have been satisfied. In response to this issue, the licensee provided the team test results which demonstrated that an immediate safety concern was not present. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-1-2016-4785 and CR-ANO-2-2016-4257.

Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000313/2016008-02 and NCV 05000368/2016008-02, Failure to Incorporate NRC Safety Guide 9 Criteria into Surveillance Procedures.

.2.2 Startup Transformer 1 and Open Phase Detection Modification

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the startup transformer 1 and open phase detection modification. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Transformer maintenance history to verify the monitoring of potential degradation.

• Transformer voltage regulator, controller, and automatic load tap changers periodic testing and maintenance procedures, and results to ensure adequate voltage was supplied to the control circuits and tap changer motor.

• Transformer loading calculations to determine whether the capacity of the transformer is adequate to supply worst-case loading.

• Voltage calculations to determine whether transformer taps for switchyard voltage were adequate to assure the availability of offsite power during accident conditions.

• Open phase detection circuit modifications being performed under Engineering Change 48771.

b. Findings

Failure to Monitor Startup Transformers 1, 2, and 3 Voltage Regulator/Tap Changer Functions

Introduction.

The team identified a Green finding for the failure to meet the surveillance standards of IEEE 308-1971, Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations, Section 5.2.3, Preferred Power Supply. Specifically, the licensee failed to monitor the operation of the voltage regulator/load tap changer functions on startup transformers 1, 2, and 3.

Description.

The Arkansas Nuclear One Units 1 and 2 Class 1E power system is designed to meet the requirements of IEEE Standard 308-1971, as discussed in Chapter 8 of both Unit 1 and 2 updated safety analysis reports. Additionally, as required by IEEE 308-1971 and 10 CFR 50, Appendix A, General Design Criterion 17, each redundant emergency safety features load can be powered by both onsite and offsite power supplies. Paragraphs

(3) and

(5) of Section 5.2.3, Preferred Power Supply, of IEEE 308-1971 states the following in part:

(3) Capability - The preferred power supply shall be capable of starting and operating all the required loads.

(5) Surveillance - The distribution system shall be monitored to the extent that it is shown to be ready to perform its intended function.

The team noted the licensee did not monitor the operation of the Beckwith automatic voltage regulator/load tap changer functions of startup transformers 1, 2, and 3, that are credited in safety-related calculations to ensure that adequate voltage is provided to the required safety-related emergency safety features electrical loads.

Calculation 09-E-0016-01, SUT [start up transformer] #1 and Unit Aux Millstone Studies, Revision 1 takes credit for a 1-second timing of the tap changes, and for the bypassing of a 20-second initial time delay to ensure adequate voltages are provided to safety-related loads and degraded voltage relays which are required to mitigate an event where offsite power was not lost.

Additionally, the team determined tasks do not currently exist to check the calibration of the Beckwith load tap changer controller associated with startup transformers 1, 2, and 3. There are currently no preventive maintenance tasks that functionally test the 20-second timer bypass function for the voltage regulators or functionally tests the timing between load tap changes are 1 second or less.

Further review by the licensee discovered that Entergys transmission organization did have procedures in place to verify that the voltage regulators maintained their proper set points, the various control and alarm functions are properly operating, and verified the timing of the load tap changes; however, those requirements were deleted when Entergy transferred control of those transformers from the transmission organization to Arkansas Nuclear One in 2001. The licensee provided the team reasonable assurance that the voltage regulator/load tap changer was operating properly based on a review of plant display computer points following a Unit 1 trip that occurred on December 14, 2015.

Analysis.

The team determined that the failure to monitor startup transformers 1, 2, and 3 voltage regulator/load tap changers to the extent that they are shown to be ready to perform their intended function, in accordance with IEEE Standard 308-1971, was a performance deficiency. The finding was determined to be more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, from 2001 to December 2, 2016, the failure to monitor the adequacy of the voltage supplied from startup transformers 1, 2, and 3 voltage regulator/load tap changer did not ensure that offsite power would be available to perform its necessary functions to provide power to the safety-related mitigation equipment. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding does not have a cross-cutting aspect because the performance deficiency does not reflect current licensee performance.

Enforcement.

This finding does not involve enforcement actions because no violation of a regulatory requirement was identified. In response to this issue, the licensee provided reasonable assurance that the voltage regulator/load tap changer was operating properly based on a review of plant computer voltage plots data following an Arkansas Nuclear One, Unit 1 trip that occurred on December 14, 2015. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-4777, CR-ANO-C-2016-4879, and CR-ANO-C-2016-5015.

Because this finding does not involve a violation and was of very low safety significance, it is identified as FIN 05000313/2016008-03 and FIN 05000368/2016008-03, Failure to Monitor Startup Transformers 1, 2, and 3 Voltage Regulator/Tap Changer Functions.

.2.3 Unit 1 125 VDC Battery Buses D-01 & D-02

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Unit 1 125 VDC Battery Buses D01 and D02. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Calculations for electrical distribution, system load flow/voltage drop to verify that bus capacity and voltages remained within minimum acceptable limits.

• Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and battery load contributions to ensure adequate design based bus loading.

• Bus procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.4 Unit 2 480 V Class 1E Load Control Center 2B-5

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Unit 2 480 V Class 1E load control center 2B-5. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance; including the cable aging management program.

• Results of completed preventative maintenance on switchgear and breakers, including breaker tracking.

b. Findings

No findings were identified.

.2.5 Alternate AC Emergency Diesel Generator 2K-9

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with alternate ac emergency diesel generator 2K-9. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component system health report, schematic and control diagrams to review system power distribution and coordination.

• Calculations for electrical system loading, load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

b. Findings

No findings were identified.

.2.6 Unit 1 Electromatic Relief Valve PSV-1000

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the Unit 1 electromatic relief valve PSV-1000. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history to verify the monitoring of potential degradation.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Component pipe sizing and load analysis to verify that the system can sustain normal and accident operation loads.

b. Findings

No findings were identified.

2.7 Unit 1 Motor Driven Emergency Feedwater Pump and Motor P-7B

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Unit 1 motor driven emergency feedwater pump and motor P-7B. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history to verify the monitoring of potential degradation.

• Condition Reports issued in the past 5 years to verify that repeat failures, and potential chronic issues, will not prevent the emergency feedwater pumps and associated components from performing their safety function.

• Component testing methodology and acceptance criteria to verify that the values supported design assumptions.

• Analysis of emergency feedwater suction transfer from safety-related sources to alternate sources to determine if air intrusion would occur.

• Calculations for voltage drop, ampacity, protection and coordination, motor brake horsepower requirements, and short circuit for the pump motor power supply and feeder cable.

b. Findings

Failure to Perform an Adequate Emergency Feedwater Pump Suction Transfer Design Calculation or Testing (EA 2017-017)

Introduction.

The NRC identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of the suction source transfer of the Unit 1 emergency feedwater system.

Specifically, the licensee failed to ensure that the safety-related qualified condensate storage tank will not empty to a level that will introduce air into the Unit 1 emergency feedwater pumps.

Description.

Unit 1 Operating Procedure 1106.006, Emergency Feedwater Pump Operation, Revision 098, directed the operators to transfer suction of the emergency feedwater system from the safety-related qualified condensate storage tank (T-41B) to the nonsafety-related condensate storage tank (T-41). This was completed by opening condensate storage suction valve CS-275 from tank T-41 to the emergency feedwater system. Operating Procedure 1106.006 did not direct the operators to close the suction valves from tank T-41B upon completion of suction source transfer to tank T-41.

Operating Procedure 1106.006 stated:

EFW suction should be transferred from T-41B to an alternate source prior to the QCST level dropping to < 2 feet. Transfer should be started whenever the T-41B level is < 3 feet.

Additionally, the procedure stated that the two tank levels will equalize as CST is pumped down to the QCST level.

The team was concerned that tank T-41B would continue to empty while tank T-41 was aligned as the alternate suction source for the emergency feedwater system. This concern was based on the differences in flow resistances between the different pipe diameters and arrangement of pipe coming from T-41 and T-41B, respectively. Once the tank T-41B becomes empty, there would be a potential common cause failure mechanism for Unit 1 emergency feedwater pumps caused by the introduction of air into pumps. Based on this concern, the team requested the formal analysis or test record that verified emergency feedwater system operation through the alternate suction transfer process from tank T-41B to tank T-41. The licensee could not produce an analysis or test record because this was not the alternate suction source credited in the accident analysis.

To address the teams concern, the licensee commissioned a preliminary analysis MPR-0062-0170-LTR-001, ANO EFW Pumps Suction Analysis, Revision 1. The analysis demonstrated that when suction source transfer begins at water level of 7 feet in tank T-41, the flow rate from tank T-41B exceeds the flow rate from tank T-41, even though the water level in tank T-41 was significantly higher. The analysis also shows that, through the design bases event, the water level in the tank T-41B would always be approximately 18 inches lower than the water level in tank T-41. The preliminary analysis also demonstrated that the water levels in the two tanks will not equalize, rather, that tank T-41B would empty first. Additionally, the licensee relied on monitoring of emergency feedwater pump suction pressure to transfer suction to the credited source when the suction pressure falls to 5 psig; however, the preliminary analysis demonstrated that suction pressure would remain above 5 psig throughout the event.

Furthermore, the team identified the following issues affecting the licensees preliminary analysis:

1. The licensees analysis assumed that suction from tank T-41 begins when the water level in tank T-41B was at 3 feet, while Operating Procedure 1106.006 states that suction should be transferred to an alternate source prior to the T-41B level dropping to < 2 feet. Adding that, in order to accomplish this, transfer should be transferred whenever the T-41B level is < 3 feet. Therefore, the analysis included 1 foot of additional margin that does not accurately reflect operation procedure requirements.

2. The preliminary analysis used a combined emergency feedwater system flow rate of 851 gallons per minute. This value may not be bounding as the actual flow rate may be significantly higher. A two pump flow rate of 1000 gallons per minute would also eliminate more margin as the pipe losses in tank T-41 suction piping are significantly higher.

3. The preliminary analysis began the transfer when the water level in tank T-41B was at 3 feet, assuming that the transfer will take 2 minutes to complete. The operation to operate condensate storage suction valve CS-275 is completed locally at the emergency feedwater system header. Since the procedure does not include evidence that an operator will be stationed at the valve, the team determined that the assumption of 2 minute completion did not conservatively reflect plant operation.

4. The preliminary analysis evaluated two separate runs of the suction transfer.

The analysis was completed with tank T-41 starting water level at 7 feet and at 10 feet. The team determined that neither level was conservative. Starting at 10 feet was not conservative because the water level in tank T-41B would rise until the water level in tank T-41 was approximately 7.8 feet because of minimum flow return. Then, tank T-41B level would decrease after the outflow from the tank T-41B would exceed the minimum flow return. Starting tank T-41 water level at 7 feet was not conservative because not enough time was given to deplete the water from tank T-41B, as this low water level will result in a transfer to service water too early. Additionally, the licensee did not have any procedural requirement to maintain the water level in tank T-41 at any specific height.

Starting the transient at the limiting water level in tank T-41 would result in additional loss of margin.

5. The preliminary analysis evaluated water level in tank T-41B, but did not confirm whether T-41B level zero is at the bottom of the tank or at about 6 inches, because the suction pipe protrudes 6 inches into the tank such that the final 6 inches of water is not available for emergency feedwater suction.

6. The preliminary analysis assumed that only the Unit 1s emergency feedwater system was operating, while there could be an event where Unit 2s emergency feedwater system may be drawing water from tank T-41B simultaneously. This would empty tank T-41B earlier than assumed in the analysis.

In response to these issues, the licensee resolved the immediate safety concern by revising the emergency feedwater pump operating procedure, removing the steps that were the cause of the finding.

The team determined that the licensee failed to verify the adequacy of the design of the transfer of Unit 1 emergency feedwater system suction from the qualified condensate storage tank T-41B to alternate sources of water by performance of design review, by use of calculational methods, or by performance of a suitable testing program.

Specifically, the licensee failed to verify the adequacy of the suction transfer by determining if tank T-41B would be completely empty of water, possibly causing an air ingestion failure of the Unit 1 emergency feedwater pumps, prior to transferring to service water, which is the credited safety-related alternate source.

Analysis.

The team determined that the failure to verify the adequacy of the design of the Unit 1 emergency feedwater suction from the qualified condensate storage tank to alternate sources of water by performance of design review, by use of calculational methods, or by performance of a suitable testing program in accordance with 10 CFR Part 50, Appendix B, Criterion III, Design Control, was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the reliability, availability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to have adequate measures in place to ensure an acceptable design analysis or a suitable test program would verify that the process of transferring emergency feedwater suction from the qualified storage tank to the alternate sources ensures the capability of the Unit 1 emergency feedwater system to perform its safety function. In accordance with Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, dated June 19, 2012, the team determined this finding affected the secondary short term heat removal function of the Mitigating Systems Cornerstone. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding represented a loss of the emergency feedwater system and function. Therefore, a detailed risk evaluation was necessary. The senior reactor analyst determined that the change in core damage frequency of this finding was 7 x 10-7 per year, therefore the significance was of very low safety significance (Green).

Details of the evaluation are documented in Attachment 4 of this report. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, prior to December 22, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Specifically, the licensee failed to verify the adequacy of the emergency feedwater suction transfer procedure by determining if the qualified condensate storage tank will be completely empty of water, possibly causing an air ingestion failure of the Unit 1 emergency feedwater pumps, prior to transferring to the credited safety-related alternate suction source. In response to this issue, the licensee resolved the immediate safety concern by revising the emergency feedwater pump operating procedure, removing the steps that were the cause of the finding. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-1-2016-5166, CR-ANO-1-2016-5725, and CR-ANO-1-2017-0040. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016008-04 (EA 2017-017), Failure to Perform an Adequate Emergency Feedwater Pump Suction Transfer Design Calculation or Testing.

.2.8 Units 1 and 2 Service Water System Pumps and Motors

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Units 1 and 2 service water system pumps and motors.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history to verify the monitoring of potential degradation.

• Service water suction from the emergency cooling pond to assure that system operation can be satisfied following loss of suction from the lake.

• Analysis of emergency cooling pond design temperature to assure that the system can provide 30 days of inventory following a design bases accident.

• Component testing methodology and acceptance criteria to verify that the values supported design assumptions.

• Corrective actions associated with previous NRC violations regarding service water, to verify that the licensee follows up on all open items.

• Engineering calculations of service water supply and balancing of flow rates to safety-related components.

• Seismic design of the service water intake structure, including the sluice gates and their motor operators, to verify that the system would fulfill its safety function after a seismic event.

• Motor sizing calculations to verify input assumptions, design loading to ensure adequate design for pumping capacity.

b. Findings

No findings were identified.

.2.9 Unit 1 Reactor Building Coolers

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Unit 1 reactor building coolers. The team also performed walkdowns of associated equipment located outside of the Reactor Building, and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• The water hammer analysis performed for the service water discharge piping.

• Engineering calculations of service water supply and balancing of flow rates to safety-related components.

• Heat exchanger heat transfer analysis to ascertain the coolers capability to remove the assigned rate of heat removal.

• The licensees response and commitments regarding Generic Letter 96-06 to verify that all actions were adequately implemented.

b. Findings

No findings were identified.

.2.10 Component Cooling Water Heat Exchanger 2E-28C

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the component cooling water heat exchanger 2E-28C.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Component and associated pipe sizing calculations to verify heat exchanger capabilities are consistent with those described in the updated safety analysis report.

b. Findings

No findings were identified.

.2.11 Units 1 and 2, Emergency Diesel Generator Fuel Oil Storage Tanks:

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the emergency diesel generator fuel oil storage tanks.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Fuel storage capacity and consumption calculations to verify the emergency diesel generators can operate during flooding conditions.

• Component operating and testing procedures to verify system capabilities to transfer suction from one storage tank to another.

b. Findings

No findings were identified.

.3.1 Inspection of NRC Regulatory Issues Summary 2011-12, Revision 1, Adequacy of

Station Electric Distribution System Voltages

a. Inspection Scope

The team reviewed the licensees evaluation of Regulatory Issue Summary 2011-12, Revision 1, Adequacy of Station Electric Distribution System Voltages, to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the regulatory issue summary. This regulatory issue summary was issued to clarify the NRC staffs technical position on existing regulatory requirements. Specifically, this regulatory issue summary clarified voltage studies necessary for degraded voltage relay (second level undervoltage protection) setting bases and transmission network/offsite/station electric power system design bases for meeting the regulatory requirements specified in General Design Criteria 17 to 10 CFR Part 50, Appendix A.

b. Findings

Failure to Ensure Safety Systems Would Survive Sustained Degraded Voltage Conditions

Introduction.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for failure to verify that the design of the protective devices for the loads required at the beginning of a loss-of-coolant accident were adequate to prevent tripping these devices under degraded voltage conditions, which would render the affected loads non-functional.

Description.

Section 8.3.1.5.1 of the Arkansas Nuclear One, Unit 1, Updated Safety Analysis Report, discusses the NRC positions and licensee responses to a 1977 NRC Generic Action Multi-Plant Action B-23, Statement of Staff Positions Relative to Emergency Power Systems for Operating Reactors, dated June 2, 1977.

Section 8.3.1.6.1 of the Arkansas Nuclear One, Unit 2, Updated Safety Analysis Report, provides the same discussion for Unit 2. Position 1 of the Multi-Plant Action B-23 required that a second level of voltage protection (or degraded voltage relay) for the onsite power system be provided and that the second level voltage protection had to satisfy criteria concerning the selection, time, design, and surveillance controls of voltage protection. Specific criteria in Position 1.C states:

The time delay selected should be based on the following conditions:

1. The allowable time delay, including margin, should not exceed the maximum time delay that is assumed in the FSAR accident analyses;

2. The time delay should minimize the effect of short duration disturbances from

reducing the availability of the offsite power source(s); and, 3. The allowable time duration of a degraded voltage condition at all distribution system levels should not result in failure of safety systems or components.

To determine that Multi-Plant Action B-23 position 1.C was satisfied, the team performed a detailed review of the licensees 1978 and 1979 responses regarding the design, selection, and installation of the degraded voltage relays in Unit 1 and Unit 2 onsite alternating current distribution systems. The team performed a detail review of the October 27, 1978, NRC Order modifying the Unit 1 operating license to implement voltage protection as corrective actions for the 1978 Arkansas Nuclear One degraded voltage condition event. Additionally, the team reviewed approved technical specification changes and engineering change documentation of changes to the Unit 1 and Unit 2 loss of voltage setpoints from 78 percent to 61.25 percent minimum expected grid voltage.

The team reviewed Calculation 95-E-0001-01, ANO Unit 1 Millstone Study - Main Calculation, Calculation 95-E-0001-02, Millstone Study Connected LD, MCC Circuit VD, LC LD, Calculation 95-E-0001-06, Unit 1 Control Circuit Voltage Drop, and other related calculations which verify that acceptable voltages are available during the selected second level voltage protection time delay for safety-related components in a degraded grid voltage condition.

The team determined that the licensee failed to demonstrate that, for the time delay selected, that safety-related electrical components would not fail for the allowable time duration of a degraded voltage condition. The team determined the following examples illustrate the licensees failure to verify the degraded voltage relay design satisfied Multi-Plant Action B-23, Position 1.C:

1. Since 1999, the licensee failed to provide a calculation of record or design information that established that Units 1 and 2 safety-related 4160 V motors, 480 V motors, and control circuits would not fail, for the full 9-second degraded voltage relay time delay, when starting and running the equipment at sustained degraded voltages between the technical specification loss of voltage setpoint, 61.25 percent, and the previous acceptable technical specification setpoint of 78 percent grid voltage.

2. Since 1979, the licensee failed to consider the starting in-rush current (lock-rotor current) of Unit 1 480 V motors in a sustained degraded voltage condition to determine if thermal overload devices would trip the motors prior to the degraded voltage time delay. Calculation 95-E-0001-01, Section 5.2.3 evaluated the degraded voltage relay timer tolerance band during degraded grid voltage dips down to a 75 percent voltage for the 480 V motors to ensure that the thermal overload would not operate prior to 9 seconds. This calculation concluded that full load amperes of a motor would increase to less than 133 percent of full load amperes. At this full load amperes, the thermal overload would not operate for 1000 seconds. Therefore, the thermal overload devices would not trip the motors during the degraded voltage time delay of 8 seconds. The team determined this evaluation failed to consider the starting current (lock-rotor current) of 480 V motors in a sustained degraded voltage condition. The team determined the use of starting current could produce an estimated 600 percent of full load amperes, which would reduce the time in which the thermal overload device operates.

Analysis.

The team determined that the failure to ensure that for the allowable time duration of a degraded voltage condition at all distribution levels would not result in failure of safety systems or components, in accordance with NRC Multi-Plant Action B-23, Position 1.C was a performance deficiency. The finding was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to ensure that the protective devices for the loads required at the beginning of a Loss-of-Coolant Accident would not fail under degraded voltage conditions did not ensure that these loads would be available to perform their mitigating functions. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green)because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, from December 17, 1979, to December 2, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, the licensee did not verify that the design of the protective devices for the loads required at the beginning of a loss-of-coolant accident were adequate to prevent tripping these devices under degraded voltage conditions, which would render the affected loads non-functional. In response to this issue, the licensee performed a preliminary analysis to determine that the protective overload devices would not cause safety equipment to fail at degraded voltages allowed by technical specifications. This finding was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-5027 and CR-ANO-C-2016-5191. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000313/2016008-05 and NCV 05000368/2016008-05: Failure to Ensure Safety Systems Would Survive Sustained Degraded Voltage Conditions.

.3.2 Inspection of NRC Information Notice 2012-06, Ineffective Use of Vendor Technical

Recommendations

a. Inspection Scope

The team reviewed the licensees evaluation of Information Notice 2012-06, Ineffective Use of Vendor Technical Recommendations, to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice. This information notice describes the NRCs review of recent operating experience involving ineffective use of vendor technical recommendations indicates that many of these events potentially allow latent failures to exist undetected and become an underlying cause of risk-significant initiating events.

The team verified that the licensees review adequately addressed the issues in the event notification.

b. Findings

No findings were identified.

.3.3 Inspection of NRC Information Notice 2015-01, Degraded Ability to Mitigate Flooding

Events

a. Inspection Scope

The team reviewed the licensees evaluation of Information Notice 2015-01, Degraded Ability to Mitigate Flooding Events, to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the examples described in the information notice. This information notice discusses operating experiences related to external flood protection where deficiencies with equipment, procedures, and analyses relied on to either prevent or mitigate the effects of external flooding at licensed facilities have resulted in degraded ability to mitigate flooding events. The team concluded that the licensees evaluation addressed the specific Fukushima Daiichi and Arkansas Nuclear One flood protection issues; however, the licensees evaluation did not address or document how other examples discussed in the information notice were either already addressed by a previously established process or were not applicable to the facility. The team did not identify any specific instances where the licensees design or facility was vulnerable in a way similar to the other examples provided in the information notice.

b. Findings

Readiness to Cope with External Flooding

Introduction.

The team identified three examples of a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for failure to prescribe procedures appropriate to the circumstance for combating significant acts of nature such as flooding. Specifically, the licensees procedures failed to ensure all components required to establish flood protection were installed in preparation for a flooding event.

Description.

During a follow-up inspection of Confirmatory Action Letter Area Action Plan FP-6 (Section 4OA5.1) on November 18, 2016, the inspectors reviewed licensees procedures Operating Procedures OP-1203.025, Natural Emergencies [Unit 1] and OP-2203.008 Natural Emergencies [Unit 2] and compared them to the flood protection design basis requirements as documented in engineering report CALC-ANOC-CS-00003 to ensure the adequacy of these procedures.

Area Action Plan FP-6 required the licensee to validate that all external flood gaps had been identified and included an associated corrective action (CA-34 of Condition Report CR-ANO-C-2014-0259) which directed the licensee to validate and update the natural emergencies procedures to ensure that all required operator actions were included in the procedures. The licensee closed this corrective action on April 26, 2014, indicating that the procedures had been validated to include all required operator actions and that no additional actions were required.

The inspectors found that while all of the components that were listed in engineering report CALC-ANOC-CS-00003 as being necessary to establish flood protection were included within Procedures OP 1203.025 and OP 2203.008, in some cases the procedures failed to ensure that the components were in their required positions prior to actual flooding occurring. Specifically:

1. Step 4 of Attachment B Local Flooding Actions of OP 1203.025 directed that the individual performing the step to ensure that appropriate personnel are informed to install the void area backflow preventer, but did not require verification that the backflow preventers were installed.

2. Step 5 of Attachment B Local Flood Actions of OP 2203.008 directed the individual performing the step to contact the Shift Manager if specified vault plugs were not installed, but required no further action.

3. Step 6 of Attachment B of OP 2203.008 directed the individual to verify that the technical support center was informed to install the void area backflow preventers if the flood was expected to exceed 354 feet. In addition to not ensuring these components were in the required condition, it would not satisfy the Unit 2 Technical Specification 3.7.5.1 requirement to close openings and penetrations within 4-hours of exceeding 350 feet if the flood was not expected to exceed 354 feet.

The licensee documented these issues in Condition Report CR-ANO-2-2016-4265.

Analysis.

The licensees failure to prescribe procedures appropriate to the circumstances for combating emergencies or other significant acts of nature such as flooding was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences, and would have the potential to lead to a more significant safety concern. Specifically, the procedures failure to ensure all components required to establish flood protection were installed in preparation for a flooding event had the potential to lead to a worse condition if left uncorrected. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green)because it does not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with identification because the licensee failed to identify issues, completely, accurately, and in a timely manner in accordance with the corrective action program. Specifically, the licensee failed to identify these deficiencies during a review of these procedures as part of actions to close significant performance deficiencies as documented in Arkansas Nuclear One Area Action Plan FP-6 [P.1].

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, which states, in part that, activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances. Contrary to the above, prior to December 2, 2016, the licensees procedures prescribed to mitigate the consequences of external flooding were not appropriate to the circumstances.

Specifically, Unit 1 Operating Procedure OP 1203.025, Natural Emergencies, Revision 60, and Unit 2 Operating Procedure OP 2203.008, Natural Emergencies, Revision 42 failed to ensure all actions required to establish external flood protection, as specified by flood protection design basis engineering report CALC-ANOC-CS-00003, Revision 00, were implemented. This issue was entered into the licensees corrective action program as Condition Report CR-ANO-2-2016-4265. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016008-06 and NCV 0500368/2016008-06, Readiness to Cope with External Flooding.

.3.4 Inspection of NRC Information Notice 2016-07, Operating Experience Regarding

Impacts On-Site Electrical Power Distribution from Inadequate Oversight of Contractor Activities

a. Inspection Scope

The team reviewed the licensees evaluation of Information Notice 2016-07, Operating Experience Regarding Impacts On-Site Electrical Power Distribution from Inadequate Oversight of Contractor Activities to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice. This information notice discusses the adverse effects to off-site power availability that have resulted from inadequate oversight of contractor activities.

The team verified that the licensees review adequately addressed the issues in the event notification.

b. Findings

No findings were identified.

.4 Results of Reviews for Operator Actions

a. Inspection Scope

The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than 2 or Birnbaum value greater than 1E-6.

For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant.

The selected operator actions were:

• Scenario 1: The scenario was designed to place the Unit 2 crew in a loss of all alternating current power (station blackout) event. In the security event procedure, the crew directs cross-tying one of the Unit 2 safety-related buses with an operating Unit 1 Emergency Diesel Generator.

• Scenario 2: The scenario was designed to place the Unit 1 crew in a tornado situation. This results in a loss of all Condensate Storage Tanks, and the crew is expected to align the Emergency Feedwater Pump suction to the Essential Service Water System. The supporting analysis assumes that operators will complete this alignment within 30 minutes of a Low-Low level alarm on the qualified condensate storage tank.

• Job Performance Measure 1: This job performance measure was to evaluate the time it takes an operator to do a self-contained breathing apparatus, in the Unit 1 simulator.

b. Findings

No findings were identified.

4OA2 Problem Identification and Resolution

(Discussed) VIO 05000313/2013012-04 (EA-14-008), Unit 1 - Failure to Follow the Materials Handling Program during the Unit 1 Generator Stator Move, and VIO 05000368/2013012-05, Unit 2 - Failure to Follow the Materials Handling Program during the Unit 1 Generator Stator Move The team reviewed the licensees root cause evaluations, and some completed and planned corrective actions. The licensee implemented a site-specific Procedure EN-OM-126-ANO-RC, Management and Oversight of Supplemental Personnel, to address specific observations identified by the Vendor Oversight Team, Nuclear Independent Oversight, and the NRC. Several observations are documented in Section 4OA5.1 involving actions VO-15, VO-23, and VO-24 below.

The NRC will further review the licensees evaluation of these issues and response to these risk-significant findings during future supplemental inspections.

Violations VIO 05000313/2013012-04 and VIO 05000368/2013012-05 remain open.

(Discussed) VIO 05000313/20140009-01 (EA-14-088), Unit 1 - Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings, and VIO 05000368/2014009-01, Unit 2 - Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings The team reviewed the licensees root cause evaluations, and some completed and planned corrective actions. The licensee implemented external events procedure changes, training of personnel, performed walkdowns of internal and external flood barrier validation, and labeling of flood protection features. Several observations are documented in Section 4OA5.1 involving actions DB-3, FP-1, FP-2, FP-3, FP-6, FP-7, and FP-13 below.

The NRC will further review the licensees evaluation of these issues and response to these risk-significant findings during future supplemental inspections.

Violations VIO 05000313/2014009-01 and VIO 05000368/2014009-01 remain open.

4OA5 Other Activities

Confirmatory Action Letter Item Follow-up (IP 92702) (EA 16-124)

.1 Actions to Address Significant Performance Deficiency

DB-3 Provide training to Engineering, Operations, and Planners to increase the knowledge and skills of those groups regarding passive barriers and other Design Basis Features.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including personnel not sufficiently verifying whether plant configuration met licensing basis requirements for mitigation of flooding events when questions arose. Area action plan DB-3 was developed to address knowledge aspects of this root cause.

To evaluate the licensees corrective action effectiveness the team reviewed corrective actions CR-ANO-C-2014-0259 CA-213, 214, 215, 219, 220, and 221; CR-ANO-C-2015-2833 CA-49, 50, 51, 52, 53, and 54.

The team reviewed corrective actions associated with developing and providing training to Engineering, Operations, and Planners to increase their knowledge and skills regarding passive barriers and other Design Basis Features, and found that the licensee had adequately documented that the training had been developed and provided to these groups (CR-ANO-C-2014-0259 CA-213, 214, and 215). The licensee also developed similar training for non-licensed operators (CA-219 and 220) and general employee training (CA-221).

The NRC team reviewed the training materials (ASLP-ESPC-DEBARRIER and ASLP-OPS-BARRIERS) developed in response to the corrective action and found that they included sufficient information to support understanding flooding features and design basis requirements among the target audience.

The team determined that the corrective actions associated with tracking and verification of completion of the training corrective actions mentioned above were completed and documented and that the actions fulfilled the intent of the actions.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address DB-3 were effective. Therefore, DB-3 is closed.

FP-1 Develop external flooding design basis documentation so configuration control is defined and maintained.

• Develop an engineering report and flood protection drawings similar to Fire Protection drawings to clearly document the flooding design basis and credited flood protection features (credited external flood protection features and credited operator actions)

• Assign unique equipment identification to each flood protection feature and boundary During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including not having detailed design requirements of flooding features. Area action plan FP-1 was developed to address the external flooding aspects of this root cause.

To evaluate the licensees corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-10 and supporting actions CA-52, 122, 131, 143, and 227; and CR-ANO-C-2013-0904 CA-114. The team reviewed the status of Engineering Change EC-57218 which implemented the actions specified by the corrective actions.

The team found that the licensee had clearly documented specific barriers required to provide external flood protection in their flood protection features database (CALC-ANOC-CS-15-00003) calculation and had developed a comprehensive set of external flood related drawings (A-7001 series). The license had also confirmed that similar vulnerabilities did not exist within the passive security barrier program as part of their extent of condition review.

During the teams review of CA-122, the team identified a minor violation of 10 CFR 50.36(c)(2), Technical Specifications, which requires inclusion of limiting conditions for operation which are the lowest functional capability or performance levels of equipment required for safe operation of the facility.

Corrective action CA-122 directed the licensee to verify the openings and the type of flooding protection required [as] described in Table 3.7-6 are in compliance with the Unit 2 Technical Specifications, specifically LCO 3/4.7.5.

Unit-2 Technical Specification 3.7.5.1 required flood protection be provided when the water level exceeds 350 feet above mean sea level, and initiation and completion [within 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />s] of the closure of the openings and penetrations in Table 3.7-6 using the equipment listed. Engineering Report No. CALC-ANOC-CS-15-00003, dated January 26, 2016, Section 7, Procedures, describes those minimum actions necessary to establish external flood protection. The team found that the openings, penetrations, and equipment listed in Table 3.7-6 did not encompass all of the equipment listed in CALC-ANOC-CS-15-00003 required to establish external flood protection, and therefore, did not describe the lowest functional capability or performance level required for safe operation of the facility.

The team found that the issue of concern was the result of the licensees failure to meet 10 CFR 50.36 which was within the licensees ability to foresee and correct based upon corrective action CA-122 and was therefore a performance deficiency. The team concluded that the answers to all of the more-than-minor screening questions were No and, therefore, this issue was not more-than-minor. While minor performance violations are not routinely documented in inspection reports, Inspection Manual Chapter 0612 Power Reactor Inspection Reports, Section 0612-14 allows for documentation when required to capture an inspection activity or conclusion. The licensee entered this issue into their corrective action program as CR-ANO-2-2016-4267. This failure to comply with 10 CFR 50.36(c)(2) constitutes a minor violation that is not subject to enforcement action in accordance with the NRCs Enforcement Policy.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-1 were effective. Therefore, FP-1 is closed.

FP-2 Develop internal flooding design basis documentation so configuration control is defined and maintained.

• Develop an engineering report and flood protection drawings similar to the Fire Protection drawings to clearly document the flooding design basis and credited flood protection features (credited internal flood protection features and credited operator actions).

• Update the Flooding ULD.

• Assign unique equipment identification to each flood protection feature and boundary.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including not having detailed design requirements of flooding features. Area action plan FP-2 was developed to address internal flooding aspect of this root cause.

To evaluate the licensees corrective action effectiveness the team reviewed corrective actions CR-ANO-C-2014-0259 CA-248, reviewed the internal flood protection features listed in CALC-ANOC-CS-15-0003, and performed a walkdown of selected areas. The team found that the licensee has developed an effective process for clearly identifying and documenting internal flood protection features similar to the actions taken for external flood protection (FP-1).

The team found that related corrective actions CA-230, 231, 232, 233, 234, 235, 236, 237, and 238 were scheduled to be completed on or after January 26, 2017.

These actions were associated with standards performance deficiencies identified during a focused self-assessment of ANO HELB/MELB [high energy line break/medium energy line break] as documented in CR-ANO-C-2015-2309.

The team concluded that corrective actions to address these deficiencies could potentially impact the internal flood protections features. The team concluded that action FP-2 should remain open. Corrective actions CA-230, 231, 232, 233, 234, 235, 236, 237, and 238 will be reviewed in a future inspection after the licensee completion determining whether they have any impact on the internal flooding design protection features.

FP-3 Label external flood barriers in the plant to provide in-field awareness of flood protection features.

As part of the licensees efforts to improve equipment reliability, the licensee committed to labeling external flood barriers in the plant to aid in configuration control. Area action plan FP-3 was developed as a corrective action to prevent recurrence.

To evaluate the licensees corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-11 and CR-ANO-C-2013-1304 CA-85. The team also performed a walkdown of selected areas of the plant to confirm actions taken and reviewed work process documents to verify completion status.

The team determined that the licensee had painted stripes on the floors, walls of the auxiliary building, and other structures (both internal and external) to provide visual reminders to personnel that they form a portion of the physical flood barrier. The licensee had stenciled penetration numbers and clearly denoted them as flood barriers where penetrations crossed a flood boundary and where a seal was located. Similarly, the licensee labeled floor drains that crossed the external flood boundary and have open drain paths on both sides (floor and ceiling) as appropriate.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-3 were effective. Therefore, FP-3 is closed.

FP-6 Validate that all external flood gaps identified from the review of documentation for credible flood paths and the follow-up walkdowns have been resolved.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including licensee personnel not sufficiently challenging and verifying whether plant conditions met license basis requirements for flood mitigation and not having detailed design requirements of flooding features. Area action plan FP-6 was developed as one of the corrective actions to prevent recurrence to address external flooding aspect of this root cause.

To evaluate the licensees corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-17 and supplemental actions CA-14, 20, 31, 32, 33, 34, 37, 39, 40, 59, 68, 69, 77, 142, 146, 202, 205, 206, 208, and 209.

During review of CA-34, the team identified additional examples of the Yellow flood finding associated with the adequacy of the licensees natural emergency procedures for both Units 1 & 2. Corrective action CA-34 directed the licensee to validate and update natural emergencies procedures to ensure that all required operator actions are included. This action was closed on April 26, 2014, as complete. This finding was documented in Section 1R21.3.3.b of this report.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-6 were effective. Therefore, FP-6 is closed.

FP-7 Perform walkdowns of all credited internal flood protection features and document the results in an engineering report.

During the 95003 supplemental inspection, the NRC team acknowledged that one of the contributing cause to the flooding issue was Entergy personnel provided inadequate oversight of outside design agency activities related to Fukushima walkdowns. The licensee initiated area action plan FP-7 to walkdown the credited internal flood protection features to ensure adequate protection from internally generated flood events.

To evaluate the licensees corrective action effectiveness the team reviewed corrective actions CR-ANO-C-2014-0259 CA-82, 18, and 112.

The team determined that the licensee had contracted supplemental personnel and completed walkdowns of all accessible areas in the plant that contained internal flood protection features and had initiated a corrective action to track the one inaccessible area while at power to schedule the walkdown during an outage. The licensees documents show the licensee provided adequate oversight of the contractors follow-up walkdowns to ensure that the Fukushima Near Term Task Force Recommendation 2.3 was properly implemented and all identified comments were addressed.

However, corrective action CA-112 directs that after the internal flood analysis, verify silicone foam seals have been upgraded or modified to watertight seals in all locations requiring internal flood seals. This action was originally scheduled for completion by June 23, 2016, but was extended until December 31, 2017.

The justification for this extension states that all identified concerns relative to internal flood boundaries have been addressed through the CR process and related Operability Determination process, and in general, silicone foam seals are currently deemed acceptable in internal flood boundary applications.

However, it also states that the full scope of the seals/locations that require upgrade or modification are not yet known.

The team concluded that the justification for the due date extension to CA-112 left it unclear whether the walkdowns of all credited internal flood protection features had been performed and whether all deficiencies had been identified, documented, and evaluated in the corrective action process. The team concluded that action FP-7 should remain open and that this action will be reviewed in a future inspection.

FP-13 Develop and conduct initial and continuing training essential to understanding and maintaining the license basis for flood barrier features. Address Operations, Engineering, and Work Planning groups.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including personnel not sufficiently verifying whether plant configuration met licensing basis requirements for mitigation of flooding events when questions arose. Similar to area action plan DB-3, this action FP-13 was developed to address knowledge aspects of this root cause.

The team found that the licensee had adequately documented that the training had been developed and provided to these groups. In addition to the documents reviewed for area action plan FP-1, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-216, 217, and 218; and CR-ANO-C-2013-1304 CA-27. The additional corrective actions were initiated to determine whether the training provided for Engineering, Operations, and Work Planning would be conducted in initial and continuing training, or initial training only.

The licensee concluded that Operations and Engineering training would be provided on a recurring basis but that training provided to Work Planning groups would be one-time training. In response to the NRC teams questions, the licensee stated that the qualification of work planners was not an accredited training program and, therefore, did not have recurring training requirements. In addition, the licensee stated that the training was included in the program for becoming a work planner and that the macro for developing work planning documents included a question to remind the planner to consider the potential impact on design basis flood barriers. The team concluded that this appeared to be a reasonable conclusion.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-13 were effective. Therefore, FP-13 is closed.

VO-15 Review current processes in Engineering related to the Vendor Oversight Fundamental Problem. Determine if additional actions are required to address less formal interfaces with suppliers of contract services. Assign additional actions as warranted to address any gaps identified.

During the 95003 supplemental inspection, the NRC team concluded that actions to improve contractor oversight were not fully effective; further action was needed because oversight plans for contract outage workers were inadequate, qualification requirements for contractors to act as supervisors did not have a consistent standard, and designated ANO oversight personnel lacked adequate guidance and training to perform their oversight role.

To evaluate the licensees corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2015-2838 CA-11, CR-ANO-C-2015-4620, CR-ANO-C-2016-0985, and Procedure EN-OM-126-ANO-RC, Management and Oversight of Supplemental Personnel, Revision 1. Specifically, the team reviewed the gap analysis CR-ANO-C-2015-2838 of 14 engineering program procedures that control the use and acceptance of supplemental personnel or vendor services. Additionally, the team reviewed the apparent cause evaluation of CR-ANO-C-2016-0985 to determine if actions associated with the identified gaps in vendor oversight were corrected.

In their gap analysis, the licensee concluded that no action was required to document any less than formal interface between engineering staff and supplemental support. The review identified that the engineering procedures contained the appropriate language to ensure oversight of vendor activities were maintained. The review concluded that more focus was needed on the use of the current procedures. The team verified this conclusion by independently interviewing engineering and vendor staff on activities that were conducted in the recent ANO Unit 2 refueling outage. The team concluded that the engineering procedures and supplemental personnel procedures include appropriate language to complete effective oversight of vendors and supplemental personnel.

To determine the effectiveness of the corrective actions, the team reviewed oversight plans, oversight plan scorecards, and field verification/rapid trending forms for ten activities using supplemental workers completed under the vendor oversight program from the previous year. The team verified the licensee ensured vendor contract wording was appropriate, included appropriate oversight procedures and frequency in oversight plans, and completed periodic observation and trending of supplemental work activities. The team concluded that, through these activities, the licensee appropriately implemented the vendor oversight guidance of EN-OM-126-ANO-RC.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address VO-15 were effective. Therefore, VO-15 is closed.

VO-23 Revise Procedure EN-DC-114, Project Management, to provide guidance in specifying contract language which will ensure detailed engineering calculations, quality requirements and standards are provided for internal and third party review, in accordance with revised Procedure EN-MA-119, Material Handling Program, when specially designed temporary lift assembles are to be used.

As part of the ANOs efforts to improve vendor oversight, the licensee committed to revising Procedure EN-DC-114, Project Management, to provide guidance on specifying contract language to provide documentation, requirements, and standards for internal, third-party reviews when temporary lift assemblies are used. Area action plan VO-23 was developed as a corrective action to prevent recurrence of the stator lifting rig failure.

To evaluate the licensees corrective action effectiveness, the team reviewed CR-ANO-C-2013-0888 CA-19, Procedure EN-DC-114, and Procedures EN-FAP-PM-003, Project Implementation - Segment 1 & 2, and EN-FAP-PM-004, Project Implementation - Segment 3 & 4. In addition, the team reviewed engineering change package EC 47488, which installed a temporary support structures to the Unit 2 containment building for ASME Code required tendon surveillance testing.

The team verified that the corrective actions to include guidance in the project management and implementation procedures were complete. The team verified through independent review of the engineering change package EC 47488, that the licensee implemented the guidance of Procedures EN-FAP-PM-003 and EN-FAP-PM-004 effectively.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address area action plan VO-23 were effective. Therefore, VO-23 is closed.

VO-24 Revise Procedure EN-MA-119 to require a documented engineering response to evaluation critical lifts if using any specially designed temporary lifting device, any lifting device that cannot be load tested per EN-MA-119 criteria, or any lifting device without a certified load rating name plate rating affixed to it.

As part of the ANOs efforts to correct conditions that led to the stator lifting rig failure, the licensee committed to revise Procedure EN-MA-119, Material Handling Program, to require an engineering response to evaluate critical lifts if using a special design temporary lifting device. Additionally, the licensee removed a Note from EN-MA-119 which led to the use of the stator lifting rig without appropriate qualification. Area action plan VO-23 was developed as a corrective action to prevent recurrence of the stator lifting rig failure.

To evaluate the licensees corrective action effectiveness the team reviewed CR-ANO-C-2013-0888 CA-20 and revisions to Procedure EN-MA-119. In addition, the team reviewed engineering change packages EC 66908 and EC 66817, which documented formal evaluations of rigging components of the temporary lifting rig used to lift parts of the emergency diesel generator 2K-4.

The team verified that the corrective actions to revise Procedure EN-MA-119 to include an engineering response to evaluate critical lifts evaluations for temporary lift rigs and to remove the Note were complete. The team verified through independent review of the engineering change packages previously mentioned, that the licensee implemented the revisions of Procedure EN-MA-119 effectively.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address VO-24 were effective. Therefore, VO-24 is closed.

.2 Actions to Address Equipment Reliability and Engineering Programs

PM-1 Create a site specific procedure for component classification that will ensure appropriate classification of equipment for Preventive Maintenance based upon risk and safety.

During the 95003 supplemental inspection, the NRC team agreed with licensees assessment that the preventive maintenance program was deficient in preventing risk-significant equipment failures. While no single event or action appears to have triggered the preventive maintenance program deficiencies, a gradual decline of licensee performance appears to have started at least 8 years ago and was accelerated by changes to Procedure EN-DC-324, Preventive Maintenance Program.

To evaluate the licensees preventive maintenance program effectiveness, the team reviewed CR-ANO-C-2015-2834 CA-0111, Procedure EN-DC-153-ANO-RC, Revision 0 Preventive Maintenance Component Classification, Revision 0, Procedure EN-DC-324-ANO-RC, Preventive Maintenance Program, Revision 0, and corrective action effectiveness review LO-ALO-2015-00001.

The team determined that the licensee had implemented the actions identified in CR-ANO-C-2015-2834 CA-0111, and ensured appropriate classification of equipment for preventive maintenance tasks based upon risk and safety. The licensee also created site specific Procedure EN-DC-153-ANO-RC, Revision 0, using the revised fleet procedure as a base and issued on April 6, 2016. Using the revised procedures, the licensee has since, through their corrective action program, identified and revised the preventive maintenance classification of several components based upon risk and safety are assigned.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address PM-01 were effective. Therefore, PM-01 is closed.

.3 Service Water System Self-Assessment

To ensure conditions adverse to quality are identified and resolved, the licensee will conduct a focused self-assessment of the Units 1 and 2 service water systems in accordance with station procedures and NRC Inspection Procedure 93810, Service Water System Operational Performance Inspection, by December 2016.

The service water system self-assessment began in late September 2016 and was scheduled to be completed by December 31, 2016, with the issuance of the self-assessment report. The report was not issued at the time of the onsite portion of the inspection.

The team reviewed the licensees focused self-assessment plan for the service water system operational performance inspection. The team compared the self-assessment activities to the guidelines in NRC Inspection Procedure 93810, Service Water System Operation Performance Inspection. The team reviewed the self-assessment objectives, task descriptions, and self-assessment staffing. The team reviewed the contract, scope of work, and qualifications of the self-assessment supplemental staff. The team verified that the licensees service water self-assessment plan addressed every guideline and aspect of NRC Inspection Procedure 93810.

As of November 1, 2016, the team reviewed the 17 condition reports generated by the licensees self-assessment. The team determined that these 17 issues identified were appropriately entered and classified in the corrective action program. Additionally, the team concluded that the licensee appropriately classified the associated operability determinations. The team did not review the resolution of the 17 issues identified because planned corrective actions were not complete at the time of the onsite inspection.

As the licensee was simultaneously performing the self-assessment, the component design bases inspection team inspected service water system components. The results of this inspection were compared with the licensees self-assessment activities. The results of the component design basis inspection are documented in Section 1R21 of this report. There were some service water system conditions identified by the NRC that were previously identified by the licensees self-assessment. Few of the service water system issues identified by the NRC had not been previously identified by the licensees self-assessment; however, those aspects of the self-assessment under which they could be identified were not complete by the end of the onsite inspection. Therefore, based on this comparison, conclusions of effectiveness of the self-assessment would not be appropriate.

The team concluded that this action will remain open. This action will be reviewed during a future inspection after the licensee has issued the self-assessment report and developed a plan to address the findings and recommendations documented in the report. Additionally, the NRC will need to review a sample of corrective actions associated with the identified conditions to ensure resolution.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On February 9, 2017, the inspectors presented the inspection results to Mr. B. Davis, Director of Engineering, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Anderson, Site Vice President

T. Evans, General Manager

G. Sullins, Acting Director, Regulatory Assurance and Performance Improvement

B. Davis, Director, Engineering

D. James, Director, Recovery

R. Penfield, Director, Regulatory Assurance

P. Butler, Manager, Design Engineering

M. Skartvedt, Manager, Systems and Components

D. Perkins, Senior Manager, Operations

S. Pyle, Manager, Regulatory Assurance

D. Marvel, Acting Manager, Maintenance

N. Mosher, Regulatory Assurance

M. Hall, Regulatory Assurance

L. Cloninger, Design Engineering

B. Miller, Design Engineering

L. McConnell, Design Engineering

M. Estep, Design Engineering

B. Buser, Design Engineering

B. Pace, Senior Manager, Production

B. Daiber, Manager, Engineering

J. Toben, Senior Manager, Project Management

D. Edgell, Manager, Recovery

NRC Personnel

R. Deese, Senior Reactor Analyst

C. OKeefe, Chief, Projects Branch E

B. Tindell, Senior Resident Inspector

M. Tobin, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

Failure to Verify the Adequacy of Motor Operated Valve Thermal

05000313/2016008-01 NCV Overload Devices (Section 1R21.2.1.b.1)

05000313/2016008-02 Failure to Incorporate NRC Safety Guide 9 Criteria into NCV

05000368/2016008-02 Surveillance Procedures (Section 1R21.2.1.b.2)

05000313/2016008-03 Failure to Monitor Startup Transformers 1, 2, and 3 Voltage FIN

05000368/2016008-03 Regulator/Tap Changer Function (Section 1R21.2.2.b.1)

Failure to Perform an Adequate Emergency Feedwater Pump

05000313/2016008-04 NCV Suction Transfer Design Calculation or Testing (EA 2017-017)

(Section 1R21.2.7.b.1)

Attachment 1

Opened and Closed

05000313/2016008-05 Failure to Ensure Safety Systems Would Survive Sustained NCV

05000368/2016008-05 Degraded Voltage Conditions (Section 1R21.3.1.b.1)

05000313/2016008-06 NCV Readiness to Cope with External Flooding (Section 1R21.3.3.b.1)

05000368/2016008-06

Discussed

05000313/2013012-04 Failure to Follow the Materials Handling Program during the VIO

05000368/2013012-05 Unit 1 Generator Stator Move (Section 4OA2)

05000313/2014009-01 Inadequate Flood Protection for Auxiliary and Emergency Diesel VIO

05000368/2014009-01 Fuel Storage Buildings (Section 4OA2)