Text

NRC Evaluations of Changes, Tests, and Experiments and Permanent Plant Modifications Baseline Inspection Report 05000416/2016007
	ML16348A222
Person / Time
Site:	Grand Gulf
Issue date:	12/09/2016
From:	Thomas Farnholtz; Region 4 Engineering Branch 1
To:	Fallacara V; Entergy Operations
References
	IR 2016007
	Download: ML16348A222 (38)
	v • d • e

cember 9, 2016

SUBJECT:

GRAND GULF NUCLEAR STATION - NRC EVALUATIONS OF CHANGES, TESTS, AND EXPERIMENTS AND PERMANENT PLANT MODIFICATIONS BASELINE INSPECTION REPORT 05000416/2016007

Dear Mr. Fallacara:

On November 3, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Grand Gulf Nuclear Station. The NRC inspectors discussed the results of this inspection with Mr. T. Coutu, Director of Performance Improvement and Regulatory Assurance, and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented five findings of very low safety significance (Green) in this report.

Five of these findings involved violations of NRC requirements; three of these violations were determined to be Severity Level IV under the traditional enforcement process. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

From November 2015 to November 2016, the NRC issued nine Severity Level IV traditional enforcement violations associated with impeding the regulatory process. Inspection Procedure 92723, Follow up Inspection for Three or More Severity Level IV Traditional Enforcement Violations in the Same Area in a 12-Month Period, was performed in response to six of these Severity level IV traditional enforcement violations as documented in NRC Inspection Report 05000416/2016003 (ML16315A372). As a result of the three additional Severity Level IV traditional enforcement violations documented in this report, the NRC plans to conduct Inspection Procedure 92723 to assess your evaluation of these additional violations and review the adequacy of associated corrective actions.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Grand Gulf Nuclear Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Grand Gulf Nuclear Station.

In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety Docket No. 50-416 License No. NPF-29

Enclosure:

Inspection Report 05000416/2016007 w/Attachment: Supplemental Information

REGION IV==

Docket(s): 05-416 License(s): NPF-29 Report(s): 05000416/2016007 Licensee: Entergy Operations, Inc.

Facility: Grand Gulf Nuclear Station, Unit 1 Location: 7003 Baldhill Road Port Gibson, MS 39150 Dates: October 17 to November 3, 2016 Inspectors: C. Smith, Reactor Inspector, Lead C. Stott, Reactor Inspector J. Watkins, Reactor Inspector Approved By: T. Farnholtz, Chief, Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000416/2016007; 10/17/2016 - 11/03/2016; Grand Gulf Nuclear Station; Evaluations of

Changes, Tests, and Experiments and Permanent Plant Modifications.

This report covers a two-week announced baseline inspection on evaluations of changes, tests, and experiments and permanent plant modifications. The inspection was conducted by Region IV based engineering inspectors. Five findings were identified by the inspectors. The findings were considered non-cited violations (NCVs) of NRC regulations. The significance of most findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process (SDP). Cross-cutting aspects were determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated July 9, 2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5, dated February 2014.

NRC-Identified Findings

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Severity Level IV. The team identified a Severity Level IV non-cited violation of 10 CFR 50.59(c)(2), Changes, Tests, and Experiments, for the licensees failure to obtain a license amendment prior to implementing a proposed change, test, or experiment that would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the final safety analysis report. Specifically, from June 24, 2014, until November 3, 2016, the licensee modified its reactor protection system to remove turbine first stage pressure instrumentation to measure reactor power, which resulted in a more than minimal increase of the likelihood of a malfunction. The failure to obtain a license amendment prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety was a performance deficiency. In response to this issue, the licensee implemented compensatory actions to ensure the reactor protection system trips would be enabled when required, will either prepare a new evaluation under current regulatory guidelines, or submit a license amendment request to the NRC, and documented the condition in its corrective action program as Condition Report CR-GGN-2016-08298.

This performance deficiency was more-than-minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the elimination of the turbine first stage pressure instruments increased the likelihood of a malfunction of the reactor protection system. Additionally, the violation was similar to the more-than-minor examples in the NRC Enforcement Manual Appendix E, Minor

Violations - Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP)for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects. (Section 1R17.2.b)

Severity Level IV. The team identified two examples of a Severity Level IV non-cited violation of 10 CFR 50.59(c)(2), Changes, Tests, and Experiments, for the licensees failure to conclude that modifications to the Division 3 diesel generator trip logic circuits and flood mitigation strategy would have required a license amendment.

Specifically, from October 7 to November 3, 2016, the licensee removed the automatic high crankcase diesel generator trip and from March 5, 2013, to November 3, 2016, used an unapproved method for mitigating design basis flooding.

The licensees failure to obtain a license amendment prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety was a performance deficiency. In response to these issues, the licensee entered the issues into the corrective action program as Condition Reports CR-GGN-2016-08328 and CR-GGN-2016-08329 and will either prepare new evaluations under current regulatory guidelines, or submit a license amendment request to the NRC.

The first example of a performance deficiency for the change to the Division 3 diesel generator trip logic was more-than-minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the elimination of the diesel generator automatic trips increased the likelihood of a malfunction of systems important to safety. The second example of a performance deficiency for a change to the flood mitigation strategy to rely on the construction of temporary sandbag barriers was more-than-minor because it was associated with the protection against external hazards attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Additionally, the violation was similar to the more-than-minor example of a change in requirements in the NRC Enforcement Manual Appendix E, Minor Violations - Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012,

Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather.

Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects. (Section 1R17.2.b)

Severity Level IV. The team identified a Severity Level IV non-cited violation of 10 CFR 50.59(d)(1), Changes, Tests, and Experiments, for the licensees failure to provide a written evaluation describing the basis for determining that a change to how often the Division 3 diesel fuel oil storage tank is cleaned and inspected did not require a license amendment. The failure to perform an evaluation prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety as required by 10 CFR 50.59 was a performance deficiency. In response to this issue, the licensee declared the Division 3 diesel generator inoperable until it performed the cleaning and inspections required by Regulatory Guide 1.137. After the inspection was successfully completed without issues, the licensee declared the Division 3 diesel generator to operable. This issue was entered the issue into the corrective action program as Condition Report CR-GGN-2016-08327.

This performance deficiency was more-than-minor because if left uncorrected, the issue would the performance deficiency have the potential to lead to a more significant safety concern. Specifically, the failure to clean and inspect the Division 3 fuel oil storage tank could result in the failure of the Division 3 diesel system.

Additionally, the violation was similar to the more-than-minor example of changes to requirements in the NRC Enforcement Manual Appendix E, Minor Violations -

Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green)because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects. (Section 1R17.2.b)

Green.

The team identified a Green, non-cited violation of Technical Specification 5.4.1(a), Procedures, for failure to establish adequate procedures for severe weather operations. Specifically, the licensee failed to establish adequate severe weather procedures to ensure the control building, diesel building, and standby service water pump houses would be adequately protected from flooding.

The failure to establish adequate procedures for severe weather operations to ensure compliance with Technical Specification 5.4.1(a), Procedures, and with the Regulatory Guide 1.33, Appendix A, Section 6.w, Acts of Nature, was a performance deficiency. In response to this issue, the licensee calculated the maximum allowable leakage of the sandbag barriers that would adequately protect any structure, system, or components important to safety from flooding. Additionally, the licensee performed a mock-up of the sandbag barriers and determined that the expected leakage through the sandbag barriers during a probable maximum precipitation event would be less than the maximum leakage allowed by the calculation. This finding was entered into the licensees corrective action program as Condition Reports CR-GGN-2016-08294 and CR-GGN-1-2016-08912.

This performance deficiency was more-than-minor because it was associated with the protection against external factors attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to establish adequate procedures to ensure the sandbag barriers offer adequate flood protection during a probable maximum precipitation event that no structures, systems, or components important to safety are affected. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green)because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of nontechnical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The team determined the finding had a cross-cutting aspect of Avoiding Complacency within the area of Human Performance because the licensee failed to recognize and plan for the possibility of mistakes, latent issues, and inherent risk in building the sandbag barriers, even while expecting successful outcomes [H.12]. (Section 1R17.2.b)

Cornerstone: Barrier Integrity

Green.

The team identified a Green non-cited violation of 10 CFR 50.36, Technical Specifications, which requires that surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. Contrary to this requirement, from June 24, 2014, until November 3, 2016, the licensee failed to include in its technical specification a surveillance requirement to assure that the facility operation will be within safety limits. Specifically, after modifying its reactor protection system to remove turbine first stage pressure instrumentation, the licensee failed to adjust the interval at which it calibrates the average power range monitor channels during surveillance tests to ensure the signals were accurately indicating the true core average power and that reactor protection system trips were enabled when required to assure the facility will be within safety limits. The licensees failure to ensure surveillance requirements relating to calibration to assure that facility operation will be within safety limits, and that the limiting conditions for operation will be met was a performance deficiency. In response to this issue, the licensee implemented compensatory actions to ensure the reactor protection system trips would be enabled when required, and documented the condition in its corrective action program as Condition Report CR-GGN-2016-08297.

This performance deficiency was more-than-minor because it was associated with the thermal limit design control attribute of the Barrier Integrity Cornerstone objective to provide reasonable assurance that physical design barriers (fuel cladding, reactor coolant system, and containment) protect the public from radionuclide releases caused by accidents or events. Specifically, the surveillance requirements did not assure calibration of the average power range monitors to ensure an accurate measurement of reactor power such that the reactor protection system trips were enabled at 35.4 percent power. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of human performance associated with change management because the licensee failed to use a systematic process for evaluating and implementing changes to the reactor protection system so that nuclear safety remains the overriding priority [H.3].

(Section 1R17.2.b)

Licensee-Identified Violations

No findings of more-than-minor significance were identified.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness

1R17 Evaluations of Changes, Tests, and Experiments and Permanent Plant

Modifications (71111.17T)

.1 Evaluations of Changes, Tests, and Experiments

a. Inspection Scope

The inspectors reviewed seven evaluations performed pursuant to Title 10, Code of Federal Regulations (CFR), Part 50, Section 59, to determine whether the evaluations were adequate and that prior NRC approval was obtained as appropriate. The inspectors also reviewed 12 screenings, where licensee personnel had determined that a 10 CFR 50.59 evaluation was not necessary. The inspectors reviewed these documents to determine if:

the changes, tests, and experiments performed were evaluated in accordance with 10 CFR 50.59 and that sufficient documentation existed to confirm that a license amendment was not required;

the safety issue requiring the change, tests and experiment was resolved;

the licensee conclusions for evaluations of changes, tests, and experiments were correct and consistent with 10 CFR 50.59; and

the design and licensing basis documentation was updated to reflect the change.

The inspectors used, in part, Nuclear Energy Institute (NEI) 96-07, Guidelines for 10 CFR 50.59 Implementation, Revision 1, to determine acceptability of the completed evaluations and screenings. The NEI document was endorsed by the NRC in Regulatory Guide 1.187, Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments, dated November 2000. The list of evaluations, screenings, and/or applicability determinations reviewed by the inspectors is included as an to this report.

This inspection constituted seven samples of evaluations and 12 samples of screenings and/or applicability determinations as defined in Inspection Procedure 71111.17-04.

b. Findings

No findings were identified.

.2 Permanent Plant Modifications

a. Inspection Scope

The inspectors reviewed nine permanent plant modifications that had been installed in the plant during the last three years. This review included in-plant walkdowns for portions of the accessible systems. The modifications were selected based upon risk significance, safety significance, and complexity. The inspectors reviewed the modifications selected to determine if:

the supporting design and licensing basis documentation was updated;

the changes were in accordance with the specified design requirements;

the procedures and training plans affected by the modification have been adequately updated;

the test documentation as required by the applicable test programs has been updated; and

post-modification testing adequately verified system operability and/or functionality.

The inspectors also used applicable industry standards to evaluate acceptability of the modifications. The list of modifications and other documents reviewed by the inspectors is included as an Attachment to this report.

This inspection constituted nine permanent plant modification samples as defined in Inspection Procedure 71111.17-04.

.2.1 Engineering Change 47077: Disable Main Transformer A/B/C Cooler Oil Flow Switches

The inspectors reviewed Modification Engineering Change 47077, implemented to temporarily remove the oil flow switches from the alarm circuits and prevent inadvertent trips of the cooler groups due to electrical faults by de-terminating and disconnecting the switch wires for each switch at the transformer. Alternate means of determining inadequate oil flow are provided via four separate temperature monitoring circuits for each transformer. There have been multiple instances of electrical faults in the main transformer cooler oil flow sensing circuits. These faults have resulted in plant down powers due to loss of main transformer cooling. It will be necessary to rework the manufacturers switch wiring to permanently correct this problem. The inspectors reviewed a sample of the affected circuits wiring diagrams and schematics, and the special post modification testing to verify the installation met the requirements of the modification, maintained the ability to still annunciate troubles and was in accordance with the design. The inspectors did not identify any concerns with the design change package.

.2.2 Engineering Change 15848: Control Room and Lower Cable Spreading Room

Instrumentation and Controls Upgrade The inspectors reviewed Modification Engineering Change 15848, implemented to alleviate the controls and communication problems, associated with operating the radial wells which provide cooling and makeup water for various heat exchangers. The plant service water system provides cooling water to various plant heat exchangers. This cooling water is supplied by radial wells 1, 3, 4, and 5 located west of the plant on the flood plain of the Mississippi River. Four radial wells and the switchgear house make up the plant service water radial well system. Each well contains two pumps that pump water to a common supply header for distribution to the various components in the plant service water system that require either cooling or makeup water. The plant service water radial well system required that operators be present at the radial wells to perform system balancing so that they could use the local hardwired pump and valve controls in each well. This process required four operators to occupy the wells simultaneously and communicate among themselves and to the control room operator through radio communications. The radial wells are located over a mile from the control room.

Because of the distance the operators must travel when dispatched from the plant to the radial wells, Grand Gulf Nuclear Station had limited capability to respond to system transients in a timely manner. Engineering Change 15846 and its associated child engineering changes provide a distributed, two-tiered communication and hybrid control system that utilizes a combination of hardware controls and wireless data transmission to upgrade the plant service water radial well system. Engineering Change 15846 did not make any changes to the plant service water radial well system, its logic or functional operation of the existing hard-wired controls. The hybrid control system was installed in parallel with the hard-wired controls, and the new controls enable only remote, manual control from the control room. No automatic operations were included in the scope of this Engineering Change.

The inspectors reviewed the removal and installation instructions, and walked down the installation of the new hybrid control system in the control room and at the well houses to verify the installation met the requirements of the modification and was in accordance with the design. The inspectors did not identify any concerns with the design change package.

.2.3 Engineering Change 52475: Flex Electrical Online Modifications

The inspectors reviewed modification Engineering Change 50283, implemented to perform the design basis evaluations, overall background, programmatic impacts, license impacts, and general engineering requirements for implementation of the child engineering changes. The installation is performed by four child Engineering Changes 50284, 50285, 51120, and 52475 that include the installation instructions, affected documents list/affected equipment list, and test plan that are specific to the implementation of each change. Engineering Change 50283 and the associated child engineering changes provide the nuclear change evaluation and interfaces with the safety related systems and equipment for the proposed modifications. The equipment installed per this engineering change is not required for safe shutdown at Grand Gulf Nuclear Station and does not impact any equipment necessary for safe shutdown. The work associated with Engineering Change 50283 is for the installation of the interfaces of the design basis structures, systems, and components. The child engineering changes installed fused disconnects, routed cable through secondary containment, installed cable tray, installed several a storage cabinets containing debris cleaning equipment, hoses, wye and adapters, tools, tool bags, etc., and installed conduit and cable for temporary connections.

The inspectors reviewed the cable and conduit routing diagrams, architectural drawings, and schematics for the new equipment, walked down the installation of the new equipment and did not identify any concerns and verified the installation met the requirements of the modification and was in accordance with the design. The inspectors did not identify any concerns with the design change package.

.2.4 Engineering Change 59387: Replacement of Division I Diesel Diodes VISHAYS

VS-400U1600D Type Diodes The inspectors reviewed Modification Engineering Change 59387, implemented to upgrade CR1 - 6 diodes in the Portec voltage regulator circuit on the Division I diesel generator. The current diodes in the voltage regulator circuit are International Rectifier 1N3740(R) type diodes. The recommended new diodes are Vishay 400U(R)series diodes. The previous diodes have a history of failure, dating back to 1996, and were in need of an upgrade. The Portec static exciter voltage regulator transformers are overcompensated, meaning they supply more power than required to operate. Excess power from the bridge is bypassed or shunted away through the use of shunting thyristors (SCRs) to maintain the proper level of excitation and therefore the proper generator output voltage. Excess current is routed through diodes CR2, CR4, and CR6.

For this reason, CR2, CR4, and CR6 are in a conducting state for longer intervals than CR1, CR3, and CR5 which do not carry the shunted current. As in any other semiconductor device, the more a diode is in a conducting state, the more heat it will generate. For this reason, when the diesel generator is loaded it is expected the temperature of diodes CR2, CR4 and CR6 in the center bank would be elevated when compared to diodes CR1, CR3 and CR5. This was validated with field measurements using thermography. The preferred diode replacement is a VS-400U(R)160D, which has a peak reverse voltage rating of 1600 Volts and average forward current rating of 400 amps at 120°C as opposed to 600 VDC and 250 amps at 130°C for the International Rectifier 1N3740(R) type diodes.

The inspectors reviewed the preventative testing methods on the diodes, wiring diagrams, schematics, operating experience, and the component equivalency evaluations for the new diodes, and did not identify any concerns and verified the installation met the requirements of the modification and was in accordance with the design. The inspectors did not identify any concerns with the design change package.

.2.5 Engineering Change 43890: Replacement of Condensate Demineralizer Drain Valves

The inspectors reviewed Engineering Change 43890, implemented to replace the condensate demineralizer drain valves 1N22F201A, 1N22F201B, and 1N22F201C.

These condensate demineralizer filters clean particulate matter from the condensate system and also for suppression pool cleanup. These condensate demineralizer drain valves discharge to the radwaste system where the water is reprocessed and routed back into the condensate system. The original drain valves were butterfly valves with soft seats that routinely leaked after initial use. This engineering design change involved changing the A and C butterfly valves for new butterfly valves with hard seats made of stellite that are leak tight. The B butterfly drain valve was replaced with a blind flange because the associated B condensate filter is in need of repair. The licensee administratively controls the system using only the A and C condensate drain valves.

The inspectors did not identify any concerns with the design change package.

.2.6 Engineering Change 62542: Installation of Universal Dry Tubes for Source Range

Monitor/Intermediate-Range Monitor The inspectors reviewed Engineering Change 62542, implemented to replace the source range monitor and intermediate-range monitor dry tubes that house the source range monitor and intermediate-range monitor detectors. The source range monitor detectors are used to provide neutron flux information to reactor operators during low power operations. Intermediate-range monitor detectors do a similar function except they provide neutron flux information during operations of higher neutron flux than the source range monitors. The existing dry tubes were manufactured of stainless steel and would not accommodate a wide-range nuclear monitor which the licensee sought to incorporate. Also, the existing dry tubes are no longer being manufactured. This engineering change involved installing new wider dry tubes made from titanium that can accommodate a wide-range nuclear monitor. These titanium dry tubes are sold from the same manufacturer as the original, stainless steel dry tubes and were designed to be a direct fit replacement. The inspectors did not identify any concerns with the design change package.

.2.7 Engineering Change 61256: Permanent Bypass of Primary Water Pump Vibration

Generator Trip Signals The inspectors reviewed Engineering Change 61256, implemented to remove the automatic trip signals from the turbine generator. Specifically, the primary water pump high vibration signals (which fed a trip signal to the electrical generation protection panel) would cause a turbine trip when activated. These signals were removed to prevent spurious turbine trips. Operators monitor the vibrations and will take actions in the case of unacceptable vibrations. The inspectors did not identify any concerns with the design change package.

.2.8 Engineering Change 64460: Third extension of 10-year inspection of Division III Fuel Oil

Storage Tank The inspectors reviewed Engineering Change 64460, implemented to extend the 10-year inspection of the fuel oil storage tank for the Division 3 high pressure core spray diesel generator. The Division 3 fuel oil storage tank inspection was last performed in March 25, 2003, but was not performed on its due date because of a scheduling error.

A second extension was made to perform the inspection so that the inspection date would align with the planned diesel outage; however, it was never performed. Finally, a third extension was approved which delayed the inspection date to December 31, 2016.

.2.9 Engineering Change 49880: Replacement of Turbine First Stage Pressure Signals With

Average Power Range Monitor Signals For The Reactor Protection System The inspectors reviewed Engineering Change 49880, implemented to replace the turbine first stage pressure signals with average power range monitor signals. The turbine first stage pressure instruments provided signals for various turbine and reactor control functions, the most safety significant of which was the reactor protection system.

Because of repeated mechanical failures of the turbine first stage pressure sensor instrument lines, the Engineering Change was implemented to replace the signals with average power range monitor signals that measured neutron flux.

b. Findings

.1 Inadequate Technical Specification Surveillance Requirements for Reactor Protection

System

Introduction.

The team identified a Green non-cited violation of 10 CFR 50.36, Technical Specifications, for the licensees failure to establish an appropriate surveillance test to demonstrate operability of its reactor protection system instrumentation. After modifying its reactor protection system to remove turbine first stage pressure instrumentation, the licensee failed to adjust the interval at which it calibrates the average power range monitor channels during surveillance tests to ensure the signals were accurately indicating the true core average power.

Description.

The turbine first stage pressure sensors are used as an indirect measurement of reactor power, and provide a near-linear signal over the full range of turbine operation. In 2012, the plant was modified to generate more reactor power with an extended power uprate. Subsequent to the extended power uprate, the turbine first stage pressure instrument piping mechanically failed on multiple occasions. As a corrective action, the licensee performed Engineering Change 49880, dated June 24, 2014, which removed the turbine first stage pressure instrument piping and the replaced turbine first stage pressure instrument signals with signals from the average power range monitor to control various functions. Some of these functions are the safety related reactor protection system functions of low power and hi power setpoints, turbine stop valve closure and control valve fast closure reactor protection system trip enable/bypass, and the end-of-cycle recirculation pump trip enable/bypass.

Unlike the turbine first stage pressure instruments, the signal output from the average power range monitor is a direct measurement of neutron flux and is not a linear signal.

The average power range monitor requires calibration to accurately measure reactor power. Grand Gulfs technical specifications require that the licensee perform a calibration of its average power range monitor system to demonstrate reactor protection system instrument operability. Technical Specification Surveillance Requirement 3.3.1.1.2 requires that the licensee verify the absolute difference between the average power range monitor channels and the calculated power

< 2 percent RTP (rated thermal power) while operating at 21.8 percent RTP.

Additionally, the Surveillance Requirement is Not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER 21.8 percent RTP. The reactor protection system trip (scram) functions are required to be enabled when thermal power 35.4 percent to maintain MCPR safety limits. Surveillance Procedure 06-RE-1C51-W-0001, APRM

[average power range monitor] Gain Adjustment, Revision 106, is the procedure that accomplishes Surveillance Requirement 3.3.1.1.2. The team reviewed data from the last plant startup and found that procedure 06-RE-1C51-W-0001 was not performed until the plant reached 42.14 percent power. The team also found that operators raised power from approximately 20 percent to approximately 70 percent within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Currently, the technical specification surveillance requirements do not require the average power range monitor system to be calibrated at 35.4 percent power when the reactor protection system trips need to be enabled.

Prior to the modification to remove the turbine first stage pressure instruments, the surveillance requirements were acceptable because the turbine first stage pressure instruments provided a measurement of reactor power without the need for a calibration.

However, after the removal of the turbine first stage pressure instruments, the average power range monitors needed more frequent calibration to ensure an accurate measurement of reactor power and so that the reactor protection system trips were enabled at 35.4 percent power.

Because the surveillance requirements for reactor protection system instrumentation are inadequate, this resulted in noncompliance with 10 CFR 50.36(c)(3), such that technical specification surveillance requirements relating to calibration did not assure that facility operation will be within safety limits and that the limiting conditions for operation will be met.

Analysis.

The licensees failure to ensure surveillance requirements relating to calibration assure that facility operation will be within safety limits, and that the limiting conditions for operation will be met as required by 10 CFR 50.36 was a performance deficiency. This performance deficiency was more-than-minor because it was associated with the thermal limit design control attribute of the Barrier Integrity Cornerstone objective to provide reasonable assurance that physical design barriers (fuel cladding, reactor coolant system, and containment) protect the public from radionuclide releases caused by accidents or events. Specifically, the surveillance requirements did not assure calibration of the average power range monitors to ensure an accurate measurement of reactor power such that the reactor protection system trips were enabled at 35.4 percent power. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of human performance associated with change management because the licensee failed to use a systematic process for evaluating and implementing changes to reactor protection system so that nuclear safety remains the overriding priority [H.3].

Enforcement.

Title 10 CFR 50.36(c)(3), Technical Specifications, requires, in part, that technical specifications include surveillance requirements to assure that the facility operation will be within safety limits and limiting conditions for operation will be met.

Contrary to this requirement, from June 24, 2014, until November 3, 2016, the licensee failed to include in its technical specification a surveillance requirement to assure that the facility operation will be within safety limits. Specifically, after modifying the reactor protection system, the licensee failed to ensure that the surveillance requirements for enabling the reactor protection system trips would ensure safety limits and limiting conditions for operations would be met because the surveillance requirements did not assure calibration of the average power range monitors to ensure an accurate measurement of reactor power such that the reactor protection system trips were enabled at 35.4 percent power.

In response to this issue, the licensee implemented compensatory actions to ensure the reactor protection system trips would be enabled when required, and documented the condition in its corrective action program as Condition Report CR-GGN-2016-08297.

Because the associated finding was of very low safety significance (Green) and because the licensee entered it into its corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000461/2016007-01, Inadequate Technical Specification Surveillance Requirement for Reactor Protection System.

.2 Failure to Obtain NRC Approval for Changes to the Reactor Protection System

Introduction.

The team identified a Severity Level IV non-cited violation of 10 CFR 50.59(c)(2), Changes, Tests, and Experiments, for the licensees failure to obtain a license amendment prior to implementing a proposed change, test, or experiment that would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the final safety analysis report. Specifically, the licensee modified its reactor protection system to remove turbine first stage pressure instrumentation to measure reactor power, which resulted in a more than minimal increase of the likelihood of a malfunction.

Description.

On July 18, 2012, the licensee sought and received NRC approval (Amendment 191 to the operating license) for an extended power uprate - a modification that increased reactor power by approximately 15 percent. The NRC approved the extended power uprate in a safety evaluation report, titled GNRI-2012-153. Following the extended power uprate, the turbine first stage pressure instrument lines mechanically failed on several occasions. After a re-design of the turbine first stage pressure instrument lines failed to resolve the issues, the licensee implemented modification Engineering Change 49880 to eliminate the turbine first stage pressure instruments, and instead use the average power range monitors to measure reactor power. The 10 CFR 50.59 evaluation for Engineering Change 49880 states that the likelihood of a spurious trip is slightly higher for the average power range monitor configuration than for the turbine first stage pressure configuration. However, the evaluation did not quantify how much more likely a spurious trip was, nor was the failure modes and effects analysis of adding a signal converter to the average power range monitor described at the level of detail described in the final safety analysis report.

Additionally, the calculational methodology NEDC-31336 General Electric Instrument Setpoint Methodology was approved by the NRC in a safety evaluation, dated November 6, 1995. When Grand Gulf received NRC approval of the extended power uprate, the licensee stated it would follow NEDC-31336. NEDC-31336, Section 3.25, states that the "Reactor Protection System design purposely chooses turbine first stage pressure, as opposed to the more direct measurement of power such as neutron flux, to assure diversity between the turbine stop valve closure and turbine control valve fast closure scram functions and the neutron flux scram function. However, the 10 CFR 50.59 evaluation for Engineering Change 49880 did not address how the licensee planned to remove the turbine first stage pressure instruments and still comply with the requirements of NEDC-31336.

The licensee is permitted to make changes to the facility as described in the Updated Final Safety Analysis Report without prior NRC approval, provided that these changes do not result in a more than minimal increase in the frequency of occurrence of an accident previously evaluated in the final safety analysis report. Regulatory Guide 1.187, Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments, states that the methods described in Nuclear Energy Institute NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations, Revision 1, are acceptable to the NRC staff for complying with the provisions of 10 CFR 50.59. Nuclear Energy Institute NEI 96-07, Section 4.3.2, states that licensees can make changes to the facility if the change does not more than minimally increase the likelihood of a malfunction of a system important to safety. However, it also states that Although this criterion allows minimal increases, licensees must still meet applicable regulatory requirements and other acceptance criteria to which they are committed (such as contained in regulatory guides and nationally recognized industry consensus standards, e.g., the ASME [American Society of Mechanical Engineers] B&PV [boiler and pressure vessel] Code and IEEE [Institute of Electrical and Electronics Engineers] Standards).

Nuclear Energy Institute NEI 96-07 also states that changes that would reduce system/equipment redundancy, diversity, separation, or independence would require NRC approval because they would result in a more than increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety.

Modification Engineering Change 49880 to eliminate the turbine first stage pressure instruments and replace the signals with average power range monitor signals reduced the diversity, separation, and independence by 50 percent, and resulted in a more than increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety.

Analysis.

The Reactor Oversight Significance Determination Process does not specifically consider the regulatory process impact in its assessment of licensee performance. Therefore, it is necessary to address this violation which impedes the NRCs ability to regulate using traditional enforcement to adequately deter non-compliance. The licensees failure to obtain a license amendment prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety as required by 10 CFR 50.59 was a performance deficiency. This performance deficiency was more-than-minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the elimination of the turbine first stage pressure instruments increased the likelihood of a malfunction of the reactor protection system.

Additionally, the violation was similar to the more-than-minor example of a change in requirements in the NRC Enforcement Manual Appendix E, Minor Violations -

Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather.

Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects.

Enforcement.

Title 10 CFR 50.59(c)(2) states, in part, that a licensee may make changes in the facility as described in the final safety analysis report, make changes in the procedures as described in the final safety analysis report, and conduct tests or experiments not described in the final safety analysis report without obtaining a license amendment only ifthe change, test, or experiment does not meet any of the criteria in paragraph (c)(2) of this section. Paragraph (c)(2), states, in part, a licensee shall obtain a license amendment prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component, important to safety previously evaluated in the final safety analysis report.

Contrary to this requirement, from June 24, 2014, until November 3, 2016, the licensee made a change to the facility as described in the final safety analysis report that resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety. Specifically, modification Engineering Change 49880 eliminated the turbine first stage pressure instruments signals to the reactor protection system and replaced the signals with average power range monitor signals which reduced the diversity, separation, and independence, and resulted in a more than increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety.

In response to this issue, the licensee entered the issue into the corrective action program as Condition Report CR-GGN-2016-08298 and will either prepare a new evaluation under current regulatory guidelines, or submit a license amendment request to the NRC. Because the associated finding was of very low safety significance (Green)and because the licensee entered it into its corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000461/2016007-02, Failure to obtain NRC approval for changes to the Reactor Protection System.

.3 Failure to Obtain NRC Approval for Changes to Diesel Generator Trips and Flood

Mitigation Strategy

Introduction.

The team identified two examples of a Severity Level IV non-cited violation of 10 CFR 50.59(c)(2), Changes, Tests, and Experiments, for the licensees failure to conclude that modifications to the Division 3 diesel generator trip logic circuits and flood mitigation strategy would have required a license amendment. Specifically, the licensee removed the automatic high crankcase diesel generator trip and used an unapproved method for mitigating design basis flooding.

Description.

In the first example, the licensee modified the Division 3 diesel generator trip circuitry to remove the automatic diesel trip for a high crankcase pressure trip and substitute operator manual actions. Regulatory Guide 1.9, Selection, Design, and Qualification of Diesel Generator Units specified methods acceptable to the NRC for the design of diesel generator systems. The licensee stated in Section 8.1-8 its Updated Final Safety Analysis Report that the design of the diesel generator complies with Regulatory Guide 1.9. Regulatory Guide 1.9 requires the design of the diesel generator to retain all protective devices during monthly emergency diesel generator testing, except for periodic tests that demonstrate diesel generator system response under simulated accident conditions per Regulatory Positions 2.2.5, 2.2.6, and 2.2.12.

Additionally, Section 8.3.1.1.4.2.10 of the Updated Final Safety Analysis Report states, When the [Division 3] diesel generator is called upon to operate under LOCA [loss of coolant accident] conditions, only the emergency protective devices are used. The emergency protective devices are:

1. Generator differential current 2. Engine overspeed All other trip signals are blocked from tripping the diesel generator during the loss-of-coolant accident. Normal protective devices are used to protect the machine when it is operating in parallel with the normal power system during periodic tests. The normal protective devices are:

1. Loss of excitation 2. Reverse power 3. Overcurrent with voltage restraint 4. Low lube oil pressure 5. High jacket water temperature 6. Generator differential current

7. Engine overspeed

8. High crankcase pressure The Division 3 diesel generator had a design vulnerability, in that a tornado or large differential pressure between the diesel generator crankcase and the room will activate the high crankcase pressure sensor and either trip or lockout the diesel. In response to industry operating experience for this vulnerability, Grand Gulf implemented modification Engineering Change 66685 for the Division 3 diesel generator trip logic circuitry to remove the automatic diesel trip for a high crankcase pressure trip. In lieu of the automatic trip on high crankcase pressure, the licensee would rely on manual operator action to recognize, diagnose, and take action for a high crankcase pressure event.

Although the modification and 10 CFR 50.59 evaluation was acceptable for loss of coolant accident or loss of voltage scenarios, the removal of the high crankcase trip during normal monthly surveillance runs was contrary to the requirements of Regulatory Guide 1.9. Additionally, the substitution of manual operator actions for automatic actions would result in a more than minimal increase of the likelihood of a malfunction of a system important to safety.

In the second example, the licensee implemented modification Engineering Change 41518 to abandon the permanently-installed probable maximum precipitation (flooding) seals on the lower portion of the exterior doors on the control building, diesel building, and the 1 and 2 standby service water pump houses. In lieu flooding seals, the licensee modified the flood mitigation strategy to rely on the construction of sandbag barriers in front of the affected doors when there is a forecast for 12 inches of rain or more. The design basis rainfall event is 16.4 inches of rain over the course of the probable maximum precipitation event. Regulatory Guide 1.102, Flood Protection for Nuclear Power Plants specified methods acceptable to the NRC for the types of flood protection. The licensee is stated in Appendix 3A of its Updated Final Safety Analysis Report that the station complies with Regulatory Guide 1.102. Regulatory Guide 1.102 states that temporary barriers (sandbags) can only be used if the licensee is not applying for a construction permit, there is an unusual circumstance that would warrant consideration of such barriers, and there is strong justification to the NRC. In its modification and 10 CFR 50.59 evaluation of the flooding protection, the licensee failed to ensure they were still in compliance with Regulatory Guide 1.102, when it incorrectly determined that the permanently-installed flooding barriers could be changed to temporary sandbag barriers without NRC approval.

The licensee is permitted to make changes to the facility as described in the Updated Final Safety Analysis Report without prior NRC approval, provided that these changes do not result in a more than minimal increase in the frequency of occurrence of an accident previously evaluated in the final safety analysis report. Regulatory Guide 1.187, Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments, states that the methods described in Nuclear Energy Institute NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations, Revision 1, are acceptable to the NRC staff for complying with the provisions of 10 CFR 50.59. NEI 96-07 Section 4.3.2 states that licensees can make changes to the facility if the change does not more than minimally increase the likelihood of a malfunction of a system important to safety. However, it also states that Although this criterion allows minimal increases, licensees must still meet applicable regulatory requirements and other acceptance criteria to which they are committed (such as contained in regulatory guides and nationally recognized industry consensus standards, e.g., the ASME B&PV Code and IEEE Standards).

In both examples, the team reviewed the associated 10 CFR 50.59 evaluations and found that the evaluations were inadequate. Specifically, the team concluded that the licensee failed to meet the specific regulatory requirements of Regulatory Guide 1.9 and Regulatory Guide 1.102.

Analysis.

The Reactor Oversight Significance Determination Process does not specifically consider the regulatory process impact in its assessment of licensee performance. Therefore, it is necessary to address this violation which impedes the NRCs ability to regulate using traditional enforcement to adequately deter non-compliance. The licensees failure to obtain a license amendment prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety as required by 10 CFR 50.59 was a performance deficiency. The first example of a performance deficiency for the change to the Division 3 diesel generator trip logic was more-than-minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the elimination of the diesel generator automatic trips increased the likelihood of a malfunction of systems important to safety. The second example of a performance deficiency for a change to the flood mitigation strategy to rely on the construction of temporary sandbag barriers was more-than-minor because it was associated with the protection against external hazards attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Additionally, the violation was similar to the more-than-minor example of a change in requirements in the NRC Enforcement Manual Appendix E, Minor Violations -

Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects.

Enforcement.

Title 10 CFR 50.59(c)(2) states, in part, that a licensee may make changes in the facility as described in the final safety analysis report, make changes in the procedures as described in the final safety analysis report, and conduct tests or experiments not described in the final safety analysis report without obtaining a license amendment only ifthe change, test, or experiment does not meet any of the criteria in paragraph (c)(2) of this section. Paragraph (c)(2), states in, part a licensee shall obtain a license amendment prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component, important to safety previously evaluated in the final safety analysis report. Contrary to this requirement, from October 7, 2016, to November 3, 2016, the licensee made a change to the facility as described in the final safety analysis report that resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety. Specifically, for the Division 3 diesel generator the removal of the high crankcase pressure trip was contrary to the requirements of Regulatory Guide 1.9 and resulted in a more than increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety.

Additionally, contrary to this requirement from March 5, 2013, until November 3, 2016, the licensee made a change to the facility as described in the final safety analysis report that resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety. Specifically, the elimination of the probable maximum precipitation door seals and reliance on temporary sandbag barriers were contrary to the requirements of Regulatory Guide 1.102 and resulted in a more than increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety.

In response to these issues, the licensee entered the issues into the corrective action program as Condition Reports CR-GGN-2016-08328 and CR-GGN-2016-08329 and will either prepare new evaluations under current regulatory guidelines, or submit a license amendment request to the NRC. Because the associated finding was of very low safety significance (Green) and because the licensee entered it into its corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000461/2016007-03, Failure to Obtain NRC Approval for Changes to Diesel Generator Trips and Flood Mitigation Strategy.

.4 Failure to Evaluate Delaying Inspection of Diesel Fuel Oil Storage Tank

Introduction.

The team identified a Severity Level IV non-cited violation of 10 CFR 50.59(d)(1), Changes, Tests, and Experiments, for the licensees failure to provide a written evaluation describing the basis for determining that a change to how often the Division 3 diesel fuel oil storage tank is cleaned and inspected did not require a license amendment. Specifically, the licensee made a change to the diesel fuel oil storage tank pursuant to 10 CFR 50.59(c). This change delayed the requirement to clean and inspect the fuel oil storage tank at 10-year intervals to approximately 14 years.

However, no evaluation was provided describing the basis for determining that this change would not result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety.

Description.

Regulatory Guide 1.137 specified methods acceptable to the NRC for diesel fuel oil systems. The licensee stated in Section 3A of its Updated Final Safety Analysis Report and its Technical Requirements Manual section of the Technical Specifications that the diesels comply with Regulatory Guide 1.137.

Specifically, Section 2.f of Regulatory Guide 1.137 states, in part, that at a minimum, the fuel oil stored in the supply tanks should be removed, the accumulated sediment removed, and the tanks cleanedat the required 10 year intervals. Additionally, the Technical Requirements Manual Surveillance Requirement TR3.8.3.6 confirms the requirement for the inspection and cleaning of the fuel tanks and also states, in part, tank cleaning is required at 10 year intervals by Regulatory Guide 1.137.

Engineering Change 64460, Engineering Change 61226, and 58035 provided the 10 CFR 50.59 screen and the licensees bases for extending the surveillance interval of Surveillance Requirement TR3.8.3.6 from 10 years to approximately 14 years for the Division 3 High Pressure Core Spray Diesel Generator.

Surveillance Requirement 3.0.2 allows an extension if the surveillance is performed within 1.25 times the interval specified in the frequency. The last time Surveillance Requirement TR3.8.3.6 was performed on the Division 3 Diesel Generator was March 4, 2003; with the Surveillance Requirement 3.0.2 extension the surveillance was due on August 30, 2015. However, in Engineering Change 58035 extended the due date of Surveillance Requirement TR3.8.3.6 to December 1, 2015 because the inspection work order was never scheduled. Additionally, in Engineering Change 61226 the Surveillance Requirement TR3.8.3.6 was extended again with a due date of May 2, 2016, to align with a maintenance outage window for the Division 3 Diesel Generator. Finally, a third extension was approved in Engineering Change 64460, which delayed the Surveillance Requirement TR3.8.3.6 until December 31, 2016.

Engineering Change 64460 stated that A Division III Allowed Outage Time (AOT) is required to complete the DG [Diesel Generator] Fuel Oil Tank inspection, and this task was unable to be completed hence this third time extension Deferment of a Technical Requirements Manual requirement against industry standards is not an earnestly approved evaluation from engineering at Grand Gulf Nuclear Station. However, under the circumstances of scheduling changes, this evaluation will be approved with the evaluation resolution specified below.

The Technical Specification Basis document states, The SRs for demonstrating OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 and Regulatory Guide 1.137.

The licensee is permitted to make changes to the facility as described in the Updated Final Safety Analysis Report without prior NRC approval, provided that these changes do not result in a more than minimal increase in the frequency of occurrence of an accident previously evaluated in the final safety analysis report. Regulatory Guide 1.187, Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments, states that the methods described in Nuclear Energy Institute NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations, Revision 1, are acceptable to the NRC staff for complying with the provisions of 10 CFR 50.59. NEI 96-07 Section 4.3.2 states that licensees can make changes to the facility if the change does not more than minimally increase the likelihood of a malfunction of a system important to safety. However, it also states that Although this criterion allows minimal increases, licensees must still meet applicable regulatory requirements and other acceptance criteria to which they are committed (such as contained in regulatory guides and nationally recognized industry consensus standards, e.g., the ASME B&PV Code and IEEE Standards).

The team reviewed Engineering Change 64460, which was the applicability determination and 10 CFR 50.59 screening for the change and found that the technical basis for deferring Surveillance Requirement TR3.8.3.6 was inadequate. Specifically, the team concluded this activity changed the surveillance interval of Surveillance Requirement TR3.8.3.6, altered the Technical Specification Basis, and no longer met the applicable regulatory requirements of Regulatory Guide 1.137. Based on those discrepancies, the team determined the licensee should have performed a full 10 CFR 50.59 evaluation to determine whether or not this change would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety.

Analysis.

The Reactor Oversight Process Significance Determination Process does not specifically consider the regulatory process impact in its assessment of licensee performance. Therefore, it is necessary to address this violation which impedes the NRCs ability to regulate using traditional enforcement to adequately deter non-compliance. The licensees failure to perform an evaluation prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety as required by 10 CFR 50.59 was a performance deficiency. This performance deficiency was more-than-minor because if left uncorrected has the potential to lead to a more significant safety concern.

Specifically, the failure to clean and inspect the Division 3 fuel oil storage tank could result in the failure of the Division 3 diesel system. Additionally, the violation was similar to the more-than-minor example of changes to requirements in the NRC Enforcement Manual Appendix E, Minor Violations - Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects.

Enforcement.

Title 10 CFR 50.59(d)(1) requires, in part, that the licensee to maintain records of changes in the facility, of changes in procedures, and of tests and experiments made pursuant 10 CFR 50.59(c). These records must include a written evaluation which provides the bases for the determination that the change, test, or experiment does not require a license amendment. Contrary to this requirement, from August 3, 2015, until November 4, 2016, the licensee failed to include a written evaluation which provided the bases for the determination that the change, test, or experiment does not require a license amendment. Specifically, the licensee failed to include a written evaluation for a change to the Division 3 fuel oil storage tank inspection frequency to determine whether or not this change would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety and would not require a license amendment.

In response to this issue, the licensee declared the Division 3 diesel generator inoperable until it performed the inspections required by Regulatory Guide 1.137. After the inspection was successfully completed without issues, the licensee declared the Division 3 diesel generator to operable. This issue was entered the issue into the corrective action program as Condition Report CR-GGN-2016-08327. Because the associated finding was of very low safety significance (Green) and because the licensee entered it into its corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000461/2016007-04, Failure to evaluate delaying inspection of diesel fuel oil storage tank.

.5 Failure to Establish Adequate Procedures for Building Sandbag Barriers

Introduction.

The team identified a Green, non-cited violation of Technical Specification 5.4.1(a), Procedures, for failure to establish adequate procedures for severe weather operations. Specifically, the licensee failed to establish adequate severe weather procedures to ensure the control building, diesel building, and standby service water pump houses would be adequately protected from flooding.

Description.

Grand Gulf Nuclear Station is licensed as a dry site (built above the design basis flooding level); however, it must consider water pooling that would occur from rainfall in a probable maximum precipitation event.

Until May 3, 2013, the licensee credited permanently-installed probable maximum precipitation door seals to protect all safety-related equipment in the areas that would be affected by the probable maximum precipitation event. These probable maximum precipitation door seals were installed on the exterior doors in the control building (door OC313), diesel building (doors 1D308, 1D309, 1D310, 1D312), and standby service water pump house 1 (doors 1M110 and 1M111) and 2 (doors 2M110 and 2M111).

On May 3, 2013, the licensee abandoned the probable maximum precipitation seals due to maintenance and operation concerns. Some of the specific concerns included foot traffic distorting the seals and insufficient mating between the seals and door surface when certain air ventilation systems were in operation. As a compensatory measure, the licensee credited the use of temporary sandbag barriers as protection against rainwater pooling due to a probable maximum precipitation event on site.

The licensee used guidance from the Army Corps of Engineers for construction of temporary sandbag barriers as the technical basis for its severe weather probable maximum precipitation procedures. The Army Corps of Engineers guidance shows the acceptable construction techniques for sandbag barriers. However, the Army Corps of Engineers guidance specially states that the sandbags are not leaktight and to expect some amount of leakage, which is dependent on the volume of water. The licensee modified the Army Corps standard because the intended use between concrete walls to stop water was different from the intended use in the Army Corps manual. The licensee uses plastic sheeting on the waterside of the sandbag barriers to increase the water-tightness of the barriers. However, the licensee failed to account for any leakage due to this modification to the guidance from the Army Corps of Engineers.

Procedure 05-1-02-VI-2, Off-Normal Event Procedure Hurricanes, Tornados, and Severe Weather, and Procedure 05-1-02-VI-1, Off-Normal Event Procedure Flooding, are the two procedures that the licensee credits for building the sandbag barriers when the site has a weather forecast of more than 12 inches of rainfall in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

These procedures require the construction of sandbag barriers up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months in advance of an incoming rainfall event. However, the procedures did not describe any mitigating actions for leakage past the sandbag barriers that would be expected.

Furthermore, the licensees procedures do not contain any provisions for the use of equipment to mitigate the effects of water leakage into the affected buildings. The procedure states that licensee personnel are to erect the barriers, but does not prescribe to ever revisit them to ensure leak-tightness.

The licensee performed a calculation, Maximum Leakage Past Sand Bag Wall During PMP [probable maximum precipitation] Flood, dated November 17, 2016, that determined the maximum water leakage through each sandbag barrier that can be tolerated before a structure, system, or component important to safety would be adversely affected. On December 2, 2016, the licensee performed a mock-up of the sandbag barriers to test how much leakage should be expected for each location. The results demonstrated that the expected leakage through each sandbag barrier was below the allowable limit, so therefore the equipment would not be affected.

Analysis.

The team determined that the failure to establish adequate procedures for severe weather operations to ensure compliance with Technical Specification 5.4.1(a),

Procedures, along with the Regulatory Guide 1.33, Appendix A, Section 6.w, Acts of Nature, was a performance deficiency. This performance deficiency was more-than-minor because it was associated with the protection against external factors attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to establish adequate procedures to ensure the sandbag barriers offer adequate flood protection during a probable maximum precipitation event that no structure, system, or components important to safety are affected. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of nontechnical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The team determined the finding had a cross-cutting aspect of Avoiding Complacency within the area of Human Performance because the licensee failed to recognize and plan for the possibility of mistakes, latent issues, and inherent risk in building the sandbag barriers, even while expecting successful outcomes [H.12].

Enforcement.

The team identified a Green, non-cited violation of Technical Specification 5.4.1, which states, in part, Written procedures shall be established, implemented, and maintained covering the following activities:

(a) The applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Contrary to this requirement, from May 3, 2013, to November 3, 2016, the licensee failed to establish adequate procedures covering severe weather operations, as recommended in Regulatory Guide 1.33, Revision 2, Appendix A.

Specifically, the licensee failed to ensure that Procedure 05-1-02-VI-2, Off-Normal Event Procedure Hurricanes, Tornados, and Severe Weather, and Procedure 05-1-02-VI-1, Off-Normal Event Procedure Flooding, provided adequate flood protection to the structure, system, or components important to safety in the control building, diesel building, and standby service water pump houses to preclude negative effects from water intrusion during a probable maximum precipitation event. In response to this issue, the licensee calculated the maximum allowable leakage of the sandbag barriers that would adequately protect any structure, system, or components important to safety from flooding. Additionally, the licensee performed a mock-up of the sandbag barriers and determined that the expected leakage through the sandbag barriers during a probable maximum precipitation event would be less than the maximum leakage allowed by the calculation. This finding was entered into the licensees corrective action program as Condition Reports CR-GGN-2016-08294 and CR-GGN-1-2016-08912.

Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 5000416/2016007-05, Failure to Establish Adequate Procedures for Building Sandbag Barriers.

OTHER ACTIVITIES

4OA2 Problem Identification and Resolution

.1 Review of Corrective Action Program Documents

a. Inspection Scope

The inspectors reviewed 23 corrective action program documents that identified or were related to 10 CFR 50.59 program and permanent plant modifications. The inspectors reviewed these documents to evaluate the effectiveness of corrective actions related to permanent plant modifications and evaluations of changes, tests, and experiments. In addition, corrective action documents written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problems into the corrective action system. The list of specific corrective action documents that were sampled and reviewed by the inspectors are listed in the to this report.

b. Findings

No findings were identified.

4OA6 Meetings

Exit Meeting Summary

On November 3, 2016, the inspectors presented the preliminary inspection results to Mr. T. Coutu, Director of Performance Improvement and Regulatory Assurance, and other members of the licensees staff. The licensee acknowledged the results as presented. While some proprietary information was reviewed during this inspection, no proprietary information was included in this report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

B. Busick, Manager, Production

T. Meyer (Coles), Engineer, Regulatory Assurance

T. Coutu, Director, Regulatory Assurance and Performance Improvement

B. Ford, Manager, Senior Fleet Regulatory Assurance

J. Hallenbeck, Manager, Design Engineering

G. Hawkins, Director, Recovery

J. Nadeau, Manager, Regulatory Assurance

P. Salgado, Manager, Performance Improvement

R. Sumrall, Manager, Chemistry

NRC Personnel

N. Day, Resident Inspector

W. Sifre, Senior Resident Inspector (Acting)

C. Smith, Reactor Inspector

C. Stott, Reactor Inspector

J. Watkins, Reactor Inspector

M. Young, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED

Opened and Closed

05000416-2016007- NCV Inadequate Technical Specification Surveillance Requirements for Reactor Protection System

05000416-2016007- NCV Failure to Obtain NRC Approval For Changes to the Reactor Protection System

05000416-2016007- NCV Failure to Obtain NRC Approval For Changes to Diesel Generator Trips and Flood Mitigation Strategy

05000416-2016007- NCV Failure to Evaluate Delaying Inspection of Diesel Fuel Oil Storage Tank

05000416-2016007- NCV Failure to Establish Adequate Procedures for Building Sandbag Barriers

LIST OF DOCUMENTS REVIEWED

IR 05000416/2016007

Text

SUBJECT:

Dear Mr. Fallacara:

Enclosure:

SUMMARY OF FINDINGS

NRC-Identified Findings

Cornerstone: Mitigating Systems

Cornerstone: Barrier Integrity

Licensee-Identified Violations

REPORT DETAILS

REACTOR SAFETY

1R17 Evaluations of Changes, Tests, and Experiments and Permanent Plant

.1 Evaluations of Changes, Tests, and Experiments

a. Inspection Scope

b. Findings

.2 Permanent Plant Modifications

a. Inspection Scope

.2.1 Engineering Change 47077: Disable Main Transformer A/B/C Cooler Oil Flow Switches

.2.2 Engineering Change 15848: Control Room and Lower Cable Spreading Room

.2.3 Engineering Change 52475: Flex Electrical Online Modifications

.2.4 Engineering Change 59387: Replacement of Division I Diesel Diodes VISHAYS

.2.5 Engineering Change 43890: Replacement of Condensate Demineralizer Drain Valves

.2.6 Engineering Change 62542: Installation of Universal Dry Tubes for Source Range

.2.7 Engineering Change 61256: Permanent Bypass of Primary Water Pump Vibration

.2.8 Engineering Change 64460: Third extension of 10-year inspection of Division III Fuel Oil

.2.9 Engineering Change 49880: Replacement of Turbine First Stage Pressure Signals With

b. Findings

.1 Inadequate Technical Specification Surveillance Requirements for Reactor Protection

Introduction.

Description.

Analysis.

Enforcement.

.2 Failure to Obtain NRC Approval for Changes to the Reactor Protection System

Introduction.

Description.

Analysis.

Enforcement.

.3 Failure to Obtain NRC Approval for Changes to Diesel Generator Trips and Flood

Introduction.

Description.

7. Engine overspeed

Analysis.

Enforcement.

.4 Failure to Evaluate Delaying Inspection of Diesel Fuel Oil Storage Tank

Introduction.

Description.

Analysis.

Enforcement.

.5 Failure to Establish Adequate Procedures for Building Sandbag Barriers

Introduction.

Description.

Analysis.

Enforcement.

OTHER ACTIVITIES

4OA2 Problem Identification and Resolution

.1 Review of Corrective Action Program Documents

a. Inspection Scope

b. Findings

4OA6 Meetings

Exit Meeting Summary

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

NRC Personnel

LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED

Opened and Closed

LIST OF DOCUMENTS REVIEWED

Navigation menu

Search