IR 05000483/2017007

NRC Design Bases Assurance Inspection Report 05000483/2017007 and Notice of Violation

ML17283A392
Person / Time
Site:	Callaway
Issue date:	10/06/2017
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Diya F Ameren Missouri
References
IR 2017007
Preceding documents:	ML17341B170 (7 December 2017)
Download: ML17283A392 (43)

Text

October 6, 2017

SUBJECT:

CALLAWAY PLANT - NRC DESIGN BASES ASSURANCE INSPECTION REPORT 05000483/2017007 AND NOTICE OF VIOLATION

Dear Mr. Diya:

On August 28, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Callaway Plant. On August 4, 2017, the NRC team discussed the preliminary results of this inspection with Mr. T. Herrmann, Site Vice President, and other members of your staff. On August 28, 2017, the NRC team discussed the final results of this inspection with Ms. S. Kovaleski, Director, Design Engineering, and other members of your staff. The team documented the results of this inspection in the enclosed inspection report.

Based on the results of this inspection, the NRC has identified three issues that were evaluated under the significance determination process as having very low safety significance (Green).

The NRC has also determined that three violations are associated with these issues. The NRC is treating two of these violations as non-cited violations (NCVs) in accordance Section 2.3.2.a of the NRC Enforcement Policy. One violation is cited in the enclosed Notice of Violation (Notice) and the circumstances surrounding it are described in detail in the subject inspection report. The violation is being cited because the licensee failed to restore compliance, in a reasonable time, for not implementing procedures for performing maintenance that can affect the performance of safety-related equipment. The NRC previously identified this violation as NCV 05000483/2014007-01.

Further, the team documented a licensee-identified violation which was determined to be of very low safety significance in this report. The NRC is treating this violation as an NCV consistent with Section 2.3.2.a of the NRC Enforcement Policy.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. If you have additional information that you believe the NRC should consider, you may provide it in your response to the Notice. The NRCs review of your response to the Notice will also determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION IV

1600 E. LAMAR BLVD ARLINGTON, TX 76011-4511 If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Callaway Plant.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the Callaway Plant.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety

Docket No. 50-483 License No. NPF-30

Enclosure:

1. Notice of Violation 2. Inspection Report 05000483/2017007

w/Attachment: Supplemental Information

REGION IV==

Docket:

05000483 License:

NPF-30 Report Nos.:

05000483/2017007 Licensee:

Union Electric Company Facility:

Callaway Plant Location:

Junction Highway CC and Highway O, Fulton, Missouri Dates:

July 17 through August 28, 2017 Team Leader:

R. Kopriva, Senior Reactor Inspector, Engineering Branch 1 Inspectors:

I. Anchondo, Reactor Inspector, Engineering Branch 2 J. Watkins, Reactor Inspector, Engineering Branch 2 A. Palmer, Senior Reactor Technology Instructor, Technical Training Center Accompanying Personnel:

C. Baron, Contractor, Beckman and Associates J. Nicely, Contractor, Beckman and Associates Approved By:

Thomas R. Farnholtz Branch Chief, Engineering Branch 1 Division of Reactor Safety

SUMMARY

IR 05000483/2017007; 07/17/2017 - 08/28/2017; Callaway Plant; Baseline Inspection, NRC

Inspection Procedure 71111.21M, Design Basis Assurance Inspection.

The report covers an announced inspection by a team of three regional inspectors, two contractors, and one operations inspector from the NRC training facility. Four findings were identified. One of these findings was a licensee-identified violation. One of the three NRC-identified violations is being treated as a cited violation because the licensee had failed to restore compliance and it was a repeat of a previous NRC identified violation. The findings were of very low safety significance. The final significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process. Cross-cutting aspects were determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas. Findings for which the Significance Determination Process does not apply may be Green or be assigned a severity level after NRC management review. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated July 9, 2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 6, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The team identified a Green, cited violation of Technical Specification 5.4.1.a which requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33,

Revision 2, Appendix A, February 1978. Regulatory Guide 1.33, Appendix A, Section 9,

Procedures for Performing Maintenance, requires, in part, that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with documented instructions appropriate to the circumstances. Specifically, from May 2014 through August 4, 2017, as a result of ineffective corrective action of Callaway Action Requests CAR-201402827 and CAR-201405312, the licensee failed to performed preventative maintenance procedures to verify the operation and timing of the engineered safety feature transformer XNB01 load tap changer. This violation was previously identified by the NRC and documented as NCV 05000483/2014007-01. In accordance with Section 2.3.2.a of the NRC Enforcement Policy, this finding is being cited because the licensee failed to restore compliance within a reasonable amount of time after the violation was initially identified.

This finding was entered into the licensees corrective action program as Condition Report CR-201703992, VIO 05000458/2017007-01, Not Verifying the Operation and Timing of the Engineered Safety Feature Transformer XNB01 Load Tap Changer.

The team determined that the failure to implement maintenance procedures to periodically verify transformer XNB01 load tap changer operation and time testing was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failures to perform, periodic verification of the operation and time testing of the load tap changer could result in adverse operation of the load tap changer during a design basis event. If the load tap changer did not operate correctly, the safety-related buses may not have adequate voltage to reset the degraded voltage relay, thus spuriously disconnecting from the offsite power source. In accordance with Inspection Manual Chapter 0609, Appendix A,

Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The finding had a cross-cutting aspect in the area of human performance, work management, because the licensee failed to plan, control, and execute work activities such that nuclear safety is the overriding priority. Specifically, the licensee did not plan and execute the testing of the transformer XNB01 load tap changer in a timely manner (H.5). (Section 1R21.2.4)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, which requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written procedures. Specifically, prior to August 3, 2017, the licensee failed to have a program to completely test the interlock circuit for safety injection pump and recirculation suction isolation valves, EJ-HV-8804A and EJ-HV-8804B. When the licensee personnel performed a review the interlock circuits for the valves, they identified that there had been gaps in the testing. In response to this issue, the licensee investigated all of the testing activities associated with the valve interlock circuits and identified that in 2010, a comprehensive test of the circuits had been performed as the result of a modification. The licensee has entered this issue into their corrective action program as Condition Report CR-201703962.

The team determined that the failure to develop and implement testing programs for verifying that the circuits for the multiple interlocks associated with safety injection valve EJ-HV-8804A would perform as designed was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to establish a testing program to verify that the valve interlock circuits for valve EJ-HV-8804A were being tested. A failure of the interlocks and an operator error could result in an inadvertent release path to the environment. In accordance with Inspection Manual Chapter 0609,

Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

(Section 1R21.2.8.b.1)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which requires, in part, that measures shall be established to assure that the design basis is correctly translated into procedures and instructions.

Specifically, prior to on August 4, 2017, the licensee had design calculations that assumed operator actions to mitigate internal flooding of certain areas within specified time durations. These time requirements for the design basis flooding calculations had not been translated into any procedures or instructions. In response to this issue, the licensee performed a preliminary evaluation and determined that operator actions to support the design calculation could be performed within the time required. The licensee has entered this issue into their corrective action program as Condition Report CR-201703981.

The team determined that the failure to translate operator time requirements for mitigating design basis flooding of critical areas into procedures or instructions was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to confirm that design basis inputs had been translated into procedures or instructions. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2,

"Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; and did not result in the loss of one or more trains of nontechnical specification equipment. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.8.b.2)

Licensee-Identified Violations

A violation of very low safety significance was identified by the licensee and has been reviewed by the team. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. This violation and associated corrective action tracking numbers are listed in Section 4OA7 of this report.

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases and modifications made to structures, systems, and components verifies that plant components are maintained within their design basis.

Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. The inspection also monitors the implementation of modifications to structures, systems, and components. Modifications to one system may also affect the design bases and functioning of interfacing systems as well as introduce the potential for common cause failures. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity Cornerstones for which there are no indicators to measure performance.

1R21 Component Design Bases Inspection

The inspection team selected risk-significant components, industry operating experience issues, modifications, and operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included components, industry operating experience issues, modifications, and operator actions that had a risk achievement worth factor greater than 2 or a Birnbaum value greater than 1E-6.

.1 Inspection Scope for Components Selected

To verify that the selected components and modification would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The team selected permanent plant modifications, including permanent plant changes, design changes, set point changes, procedure changes, equivalency evaluations, suitability analyses, calculations, and commercial grade dedications to verify that design bases, licensing bases, and performance capability of components have not been degraded through modifications. The team determined whether post-modification testing established operability. The team verified that supporting design basis documentation, such as calculations, design specifications, vendor manuals, the updated final safety analysis report, technical specification and bases, and plant specific safety evaluation reports, were updated consistent with the design change. The team verified that other design basis features, such as structural, fire protection, flooding, environmental qualification, and potential emergency core cooling system strainer blockage mitigation, which could be affected by the modification, were not adversely impacted. The team verified that procedures and training plans, such as abnormal operating procedures, alarm response procedures, and licensed operator training manuals, affected by the modifications were updated.

The inspection procedure requires a review of four to six components based on risk significance and four to six modifications to mitigation structures, systems, and components. One of the inspection samples selected shall be associated with containment-related structures, systems, and components which are considered for large early release frequency (LERF) implications. The samples selected for this inspection were eight components (one containment-related component),five modifications, and three operating experience items.

The selected inspection items supported risk-significant functions as follows:

• Electrical power to mitigation systems: The team selected several components in the offsite and on-site electrical power distribution systems to verify operability to supply alternating current

(ac) and direct current

(dc) power to risk-significant and safety-related loads in support of safety system operation in response to initiating events, such as loss-of-offsite-power accident, station blackout, and a loss-of-coolant accident with offsite power available. As such, the team selected:

• Pressurizer pressure transmitters (BBPT-0455, -0456, -0457, and -0458).

• Pressurizer power-operated relief valve PCV455A, including its associated block valve.

• Modifications: pressurizer pressure transmitter replacement (MP-08-0054) and replace the Ametek Iso-Limiter transformers XPN07 and XPN08 (MP-09-0051).

• Operating Experience: IN 2012-003 Design Vulnerability in Electric Power Systems and associated Modification MP15-0008; RIS 2011-12, Revision 1, Adequacy of Station Electric Distribution System Voltages.

• Motor-operated valves BGLCV0112 B/C charging pump suction isolation valves from the volume control tank.

• Safety-related 4KV and 480V switchgear NB01 and NG01 and associated breaker replacement Modifications MP07-0070 and MP07-0069.

• Components that affect LERF: The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components:

• Safety Injection piggyback valve EJ-HV-8804A.

• Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected:

• Residual heat removal pump A.

• Essential service water returns to ultimate heat sink valve EFHV0037.

• Modifications: TM 14-0003 and MP 05-3025.

• Safety injection check valve EM8926A.

• Modification 10-0009 (reactor coolant pump seal replacement).

.2.1 Pressurizer Pressure Transmitters: BBPT0455, BBPT0456, BBPT0457, and BBPT0458

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the pressurizer pressure transmitters. The team also reviewed photos detailing the installed configuration and conducted interviews with system and design engineering personnel to ensure the capability of these components to perform their desired design basis function.

Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradations.

• As-built installation drawings and equipment to verify that the equipment and associated raceways are installed correctly to meet the environmental requirements.

• The environmental qualifications testing evaluations for the replacement transmitters, conduit seal assemblies, connector assemblies, and splicing procedures.

• Equivalency evaluations for the replacement transmitters for applicability.

b. Findings

No findings were identified.

.2.2 Pressurizer Power Operated Relief Valve PCV455A including its associated block valve

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance procedures, test procedures, and condition reports associated with the pressurizer power-operated relief valve PCV455A including its associated block valve. The team also reviewed photos detailing the installed configuration and conducted interviews with system engineering personnel to ensure capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

• Piping and instrumentation drawing, schematic control and power drawings for the power-operated relief valves and the associated block valves.

• Power-operated relief valve inservice test closing and opening speeds for the two previous in service tests.

• Motor-operated valve block valve sizing and torque calculations.

• Motor-operated valve block valve breaker and overload overcurrent protection specification calculations.

• Motor-operated valve block valve voltage drop calculations.

• Motor-operated valve block valve stroke timing tests.

b. Findings

No findings were identified.

.2.3 Motor-Operated Valves BGLCV0012 B/C Charging Pump Suction Isolation Valves from

the Volume Control Tank

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance procedures, test procedures, and condition reports associated with motor-operated valves BGLCV0012 B/C, charging pump suction isolation valves from the volume control tank. The team also conducted interviews with system engineering personnel to ensure capability of the component to perform its desired design basis function. Specifically, the team reviewed:

• Motor calculations that establish the motor voltage drop, protection and coordination and short circuit for the motor power supply and feeder cables.

• Calculations for the degraded voltage at the motor-operated valve terminals to ensure the proper voltage was utilized in the teams review of motor-operated valve torque calculations.

• Calculations that establish motor-operated valve control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing and application.

b. Findings

No findings were identified.

.2.4 Safety-Related 4KV and 480V SWGR NB01 and NG01 and Associated Breaker

Replacements

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and corrective action program reports associated with SR 4KV and 480V SWGR NB01 and NG01, and their associated breaker replacements.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• 4.16KV and 480V breaker replacement modifications MP-07-0069 and MP-07-0070 were reviewed to ensure the adequacy and consistency of design for the new replacement breakers.

• Corrective action and maintenance history documents and system health reports to determine whether there were any adverse operating trends and to assess the stations ability to evaluate and correct problems.

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• Protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

• Degraded and loss of voltage relays and associated time delays were set in accordance with calculations, and that associated calibration procedures were consistent with calculation assumptions, associated time delays and set point accuracy calculations.

• Coordination and interface with the transmission system operator for plant voltage requirements and notification set points were reviewed.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Visual non-intrusive inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses.

b. Findings

Not Verifying the Operation and Timing of the Engineered Safety Feature Transformer XNB01 Load Tap Changer

Introduction.

The team identified a Green, cited violation of Technical Specification 5.4.1.a, Procedures, involving the failure to implement adequate maintenance procedures to periodically verify transformer XNB01 load tap changer operation and time testing. Specifically, due to the ineffective corrective action of Callaway Action Requests CAR-200202970, CAR-201402827, CAR-201405312, and CAR-201508240, the licensee did not implement preventative maintenance activities to verify the operation and timing of the engineered safety feature transformer XNB01 load tap changer. As a result, the timing of the load tap changer may not be consistent with plant electrical analysis, ZZ-62, which credits the load tap changer operation in order to reset the degraded voltage relays between sequenced load steps.

Description.

In 2001, under modification MP 99-1083, the licensee installed engineered safety feature transformers XNB01 and XNB02 with load tap changers. During the installation, the licensee performed a review of industry operating experience and found information identifying that time testing of the load tap changer operation was required to confirm that the load tap changers would work properly. This would ensure operability of the off-site power sources. Operating experience had shown that the load tap changer mechanical operation could slow down over time due to aging mechanisms such as friction and hardened grease. This could result in the unmonitored degraded performance of the load tap changer to not provide acceptable voltages from the offsite power sources to the safety-related power distribution system. As a result, the expected speed of the load tap changer, to correct for low voltage, may not meet design requirements.

Callaway Action Request CAR-200202970 was written to ensure that a preventive maintenance activity was generated to periodically check for proper load tap changer operation and timing. Callaway Action Request CAR-200202970 was closed to the Maintenance Optimization Project.

In 2006, the preventative maintenance basis and transformer preventative maintenance was initially created, but the preventative maintenance activity did not include the timing requirements for the load tap changers. In CAR-200909389, as a result of Nuclear Electric Insurance Limited insurance requirements, the licensee changed the frequency of testing the on-site transformers, including the transformers XNB01 and XNB02, from every 8 refueling outages to every four refueling outages (every 6 years).

In May 2014, the NRC issued Violation 05000483/2014007-001 (CAR-201402827 and CAR-201405312), due to the ineffective corrective action of CAR-200202970, where the licensee had not established preventative maintenance procedures to verify the operation and timing of the engineered safety feature transformers XNB01 and XNB02 load tap changers. On June 9, 2014, Preventive Maintenance Procedures, PM1001510 and PM1001506 for transformers XNB01 and XNB02, respectively, were revised to include timing tests.

Under Job 08510933.510, the operation and timing test for transformer XNB02 was performed in the fall of 2014 (R19), after the 2014 violation was identified. The recorded time between steps of the load tap changer alternated between 0.9 and 2.9 seconds. This met the acceptance criteria of less than 3 seconds (identified in licensee calculation ZZ-62), but was not in accordance with the typical times from the Reinhausen (load tap changer manufacturer) Vendor Manual of 2 seconds per step.

During the 2017 NRC design basis assurance inspection, the team questioned the testing results. This had been the first time this test had been performed at the Callaway Plant.

During the licensees performance of Formal Self-Assessment 201500920-18, Problem and identification and Resolution Pre-Inspection Assessment, they identified three examples where response to non-cited violations had not been timely, potentially representing a violation of their procedures. One of these examples was the non-cited violation for failure to test the timing of engineered safety feature transformer load tap changers. The load tap changer for the B Train XNB02 was tested in RF20, by job 085109333, and had no issues identified. Therefore, the licensee felt as though there was reasonable assurance that the load tap changer for XNB01 was acceptable without testing and was scheduled to be tested on April 19, 2019, even though it had not been tested since 2001 and that there was operating experience available pertaining to a decline in load tap changer performance over time due to aging and hardening of lubrication. After further review, the licensee moved the testing of the load tap changer for XNB01 to the fall of 2017 (Refuel 21).

On August 2, 2017, the team identified that the licensee had not implemented PM1001510 to perform a timing test of the transformer XNB01 load tap changer and had credited the successful testing of transformer XNB02 in 2014 as partial justification to extend the testing on transformer XNB01 until 2019 (R22). As a result of initiating Callaway Action Report CAR-201508240, the licensee changed the scheduling of the testing of transformer XNB01, including the load tap changer, to the fall of 2017 (R21).

During the 2017 NRC design basis assurance inspection, the team questioned the 2014 testing results of XNB02 load tap changer. This had been the first time this test had been performed at the Callaway Plant, and none of the licensees personnel had questioned the differences in the licensees results of recorded data of 9.9 and 2.9 seconds between step changes versus the typical times from the Reinhausen (load tap changer manufacturer) Vendor Manual of 2 seconds per step. After two weeks of internal and external discussions with the load tap changer manufacturer, the licensee concluded that the test results were acceptable, but noted that the data obtained from the testing would be different depending on whether the measurements are taken of voltage changes versus load tap changer position changes. Since obtaining the timing data for the load tap changer in 2014 for transformer XNB02, the licensee had not questioned the differences in the testing data obtained compared to what the vendor identified as the expected time for position changes of the load tap changer. The team determined that acceptance of the load tap changer testing results in 2014 without a questioning attitude of why the results were not in accordance with the vendor manual was unacceptable.

Callaway Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Appendix A, Section 9, Procedures for Performing Maintenance, requires, in part, that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with documented instructions appropriate to the circumstances.

The team determined that the licensee had not: 1) adequately performed a timing test of the transformer XNB01 load tap changer to ensure proper operation; and 2) periodically performed a timing test of the transformer XNB01 load tap changer to ensure proper operation to maintain the operability of the offsite power sources. Since the time that the NRC issued the violation in 2014, the licensee had opportunities to perform a timing test of transformer XNB01 load tap changer (refueling outages in the fall of 2014, and the refueling outage in the spring of 2016).

Analysis.

The team determined that the failure to implement maintenance procedures to periodically verify transformer XNB01 load tap changer operation and time testing was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failures to perform, periodic verification of the operation and time testing of the load tap changer could result in adverse operation of the load tap changer during a design basis event. If the load tap changer did not operate correctly, the safety-related buses may not have adequate voltage to reset the degraded voltage relay, thus spuriously disconnecting from the offsite power source.

In accordance with Inspection Manual Chapter 0609, Appendix A, Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The finding had a cross-cutting aspect in the area of human performance, work management, because the licensee failed to plan, control, and execute work activities such that nuclear safety is the overriding priority.

Specifically, the licensee did not plan and execute the testing of the transformer XNB01 load tap changer in a timely manner (H.5).

Enforcement.

The team identified a Green, cited violation of Technical Specification 5.4.1.a, which requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Appendix A, Section 9, Procedures for Performing Maintenance, requires, in part, that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with documented instructions appropriate to the circumstances. Contrary to the above, from May 2014 through August 4, 2017, the licensee failed to ensure that maintenance that can affect the performance of safety-related equipment be properly pre-planned and perform in accordance with documented instructions appropriate to the circumstances.

Specifically, as a result of ineffective corrective action of Callaway Action Requests CAR-201402827 and CAR-201405312, the licensee failed to perform preventative maintenance procedures to verify the operation and timing of the engineered safety feature transformer XNB01 load tap changer. This violation was previously identified by the NRC and documented as NCV 05000483/2014007-01. In accordance with Section 2.3.2.a of the NRC Enforcement Policy, this finding is being cited because the licensee failed to restore compliance within a reasonable amount of time after the violation was initially identified. This finding was entered into the licensees corrective action program as Condition Report CR-201703992, VIO 05000458/2017007-01, Not Verifying the Operation and Timing of the Engineered Safety Feature Transformer XNB01 Load Tap Changer.

.2.5 Residual Heat Removal Pump A

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with residual heat removal pump A. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Calculations and equipment room survivability analysis associated with a loss of ventilation in the residual heat removal pump A room. The team verified that a loss of room ventilation would not result in the room temperature going above the maximum allowable pump motor design temperature.

• Recalculation of piping heat transfer into the residual heat removal pump A room.

The team verified that all insulated and uninsulated piping was accounted for and that the room coolers were capable of providing adequate cooling during worst-case scenarios.

• System health reports, component maintenance history, and corrective action program reports to verify the monitoring and correction of potential degradation.

b. Findings

No findings were identified.

.2.6 Essential Service Water Returns to Ultimate Heat Sink Valve EFHV0037

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, selected drawings, maintenance and test procedures, and condition reports associated with the essential service water returns to ultimate heat sink valve EFHV0037. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

• Calculations and implementation of the inservice testing program associated with maintaining an adequate margin for its safety function to open.

• System health reports, component maintenance history, and corrective action program reports to verify the monitoring and correction of potential degradation.

b. Findings

No findings were identified.

.2.7 Safety Injection check valve EM8926A

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, selected drawings, maintenance and test procedures, and condition reports associated with the safety injection check valve EM8926A. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically the team reviewed:

• Leakage test procedures to verify the allowable leakage from the emergency core cooling system to the refueling water storage tank under accident conditions.

• Recent inservice test results associated with this valve.

• The basis for the inservice leakage test acceptance criteria for this valve and associated valves to verify the total allowable leakage from the emergency core cooling system to the refueling water storage tank under accident conditions.

b. Findings

No findings were identified.

.2.8 Safety Injection Piggyback Valve EJ-HV-8804A.

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with safety injection piggyback valve EJ-HV-8804A. The team also performed walkdowns and conducted interviews with system and design engineering personnel to ensure the capability of these components to perform their desired design basis function. Specifically, the team reviewed:

• The design thrust calculations to verify the capability of the valve to perform its design function under limiting design conditions.

• Results of recent motor-operated valve diagnostic testing to verify the current capability of the valve.

• Calculations associated with the transfer of the emergency core cooling system from the refueling water storage tank to the containment sump to verify the basis of the valves required stroke time.

• Operating procedures associated with the use of the valve under post-accident conditions to verify its operation was consistent with its design.

• Testing of control circuits associated with valve interlocks to verify the capability of the interlocks to function as designed.

1. Safety Injection Piggyback Valve EJ-HV-8804A Valve Interlocks Not Tested.

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to fully test the control circuits associated with the interlocks for valve EJ-HV-8804A. Specifically, the team identified that the licensee failed to have a program to completely test the interlock circuit for safety injection pump and recirculation suction isolation valves, EJ-HV-8804A and B. Also, when the licensee did review the interlock circuits for the valves, they identified that there had been gaps in their testing (i.e. that some of the contacts in the circuit had not been tested).

Description.

The team questioned the licensee on whether the interlock circuits associated with valve EJ-HV-8804A were periodically tested. In accordance with the guidance of the Institute of Electrical and Electronics Engineers Standard 379-1972, potential undetectable failures must be assumed to be in their failed mode prior to a postulated accident. The team identified that the licensee failed to have a program to completely test the interlock circuit for safety injection pump and recirculation suction isolation valves, EJ-HV-8804A and EJ-HV-8804B. Also, when the licensee did review the interlock circuits for the valves, they identified that there had been gaps in their testing (i.e., that some of the contacts in the circuit had not been tested). The Final Safety Analysis Report, Section 6.3.2.1, states, The safety injection pump and emergency core cooling system charging pump recirculation suction isolation valves, EJ-HV-8804A and EJ-HV-8804B, can be opened provided that either the safety injection system minimum flow isolation valve, BN-HV-8813, or both safety injection pump minimum flow isolation valves, EM-HV-8814A and B, are closed. Additionally, one of the two residual heat removal hot leg suction valves on Loop 1, BB-PV-8702A and EJ-HV-8701A, and on Loop 4, BB-PV-8702B and EJ-HV-8701B, must be closed. In response to this issue, the licensee investigated all of the testing activities associated with the valve interlock circuits and identified that in 2010, a comprehensive test of the circuits had been performed, with acceptable results, as the result of a modification. In Condition Report CR-201703962, the licensees immediate operability determination concluded that based on review of the condition description, EJ-HV-8804A was operable, but degraded or nonconforming. The licensee stated that while these interlocks are not being programmatically tested on a periodic basis, all the valve interlocks in the OPEN circuit/logic for EJ-HV-8804A had been previously tested to verify they OPEN when their associated valve is OPEN. Based on previous testing, there was reasonable assurance that the interlocks contacts will open when their associated valves are open, to prevent inadvertent opening of EJ-HV-8804A. The licensee has entered this issue into their corrective action program as Condition Report CR-201703962.

Analysis.

The team determined that the failure to develop and implement testing programs for verifying that the circuits for the multiple interlocks associated with safety injection valve EJ-HV-8804A would perform as designed was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to establish a testing program to verify that the valve interlock circuits for valve EJ-HV-8804A were being tested. A failure of the interlocks and an operator error could result in an inadvertent release path to the environment. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of nontechnical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, which requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written procedures. Contrary to the above, prior to August 3, 2017, the licensee failed to establish a test program to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written procedures. Specifically, the licensee failed to have a program to completely test the interlock circuit for safety injection pump and recirculation suction isolation valves, EJ-HV-8804A and EJ-HV-8804B. When the licensee personnel performed a review the interlock circuits for the valves, they identified that there had been gaps in the testing. In response to this issue, the licensee investigated all of the testing activities associated with the valve interlock circuits and identified that in 2010, a comprehensive test of the circuits had been performed as the result of a modification. The licensee has entered this issue into their corrective action program as Condition Report CR-201703962. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000483/2017007-02, Safety Injection Piggyback Valve EJ-HV-8804A Interlocks Not Tested.

2. Inputs to Internal Flooding Calculations Not Translated into Procedures or

Instructions.

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to ensure that design basis requirements were correctly translated into procedures and instructions.

Specifically, design calculations assumed operator actions to mitigate an internal flood of certain areas within specified time durations. These time requirements for the design basis flooding calculations had not been translated into any procedures or instructions.

Description.

The licensee had performed numerous calculations to address internal flooding concerns for multiple areas throughout the plant. Several of these calculations did not clearly differentiate between commercial and design basis acceptance criteria. These calculations also assumed operator actions to mitigate the flood within specified time durations. These time requirements for the design basis flooding calculations had not been translated into any procedures or instructions. In a previous Callaway Action Request, CAR--200605158, the licensee confirmed that the credited operator response times had been evaluated. However, these times were not included in Procedure APA-ZZ-00395, Significant Operator Response Timing. In response to this issue, the licensee reviewed their flooding calculations to determine which calculations document commercial margin verses design basis margin. The licensee will be updating these documents to clearly describe the flooding program design basis requirements. Also, the licensee performed a preliminary evaluation and determined that operator actions to support the design calculations could be performed within the time required. The licensee has entered this issue into their corrective action program as Condition Report CR-201703981.

Analysis.

The team determined that the failure to translate operator time requirements for mitigating design basis flooding of critical areas into procedures or instructions was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensee failed to confirm that design basis inputs had been translated into procedures or instructions. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green)because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; and did not result in the loss of one or more trains of nontechnical specification equipment. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which requires, in part, that measures shall be established to assure that the design basis is correctly translated into procedures and instructions. Contrary to the above, prior to August 4, 2017, the licensee failed to ensure that design basis was correctly translated into procedures and instructions. Specifically, the licensee had design calculations that assumed operator actions to mitigate internal flooding of certain areas within specified time durations. These time requirements for the design basis flooding calculations had not been translated into any procedures or instructions. In response to this issue, the licensee performed a preliminary evaluation and determined that operator actions to support the design calculations could be performed within the time required. The licensee has entered this issue into their corrective action program as Condition Report CR-201703981. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000483/2017007-03, Inputs to Internal Flooding Calculations Not Translated into Procedures or Instructions.

.3 Results of Detailed Reviews of Permanent Plant Modifications

a. Inspection Scope

The team reviewed five permanent plant modifications that had been installed in the plant during the last three years. This review included in-plant walkdowns for portions of the accessible systems. The modifications were selected based upon risk significance, safety significance, and complexity. The team reviewed the modifications selected to determine if:

• Supporting design and licensing basis documentation was updated.

• Changes were in accordance with the specified design requirements.

• Procedures and training plans affected by the modification have been adequately updated.

• Test documentation as required by the applicable test programs has been updated.

• Post-modification testing adequately verified system operability and/or functionality.

The team also used applicable industry standards to evaluate acceptability of the modifications.

.3.1 Modification:

MP-08-0054, Replace Pressurizer Pressure Transmitters.

The team reviewed Modification MP 08-0054, implemented to replace pressurizer pressure transmitters BBPT0455, BBPT0456, BBPT0457, and BBPT0458. The purpose of the modification was to approve and replace obsolete Tobar 32PA1212 transmitters with Rosemount 1154 Type H pressure transmitters. Due to physical differences with the replacement transmitters and the environmental requirements of the installation, the modification package also required the replacement of the transmitter conduit seal and connector assembly. The pressurizer pressure transmitters are used in the reactor trip system and also provide input to the engineered safety feature actuation system and are required to operate before and during a design basis event to provide safety functions.

Modification MP-08-0054 evaluated several different replacement transmitters including Rosemount model 3154, Ametek model PG3200, and Ultra Model N-E11GH. The Rosemount 1154 was determined to be the best match and was also qualified for the environment. In addition to the transmitter replacement the conduit and connector assembly were required be included in the overall modification package in order to meet the environmental requirements of the installation. The team reviewed the environmental qualifications evaluations of the transmitters, conduit seal assemblies, connector assembly and required cable splicing methods to insure the final installation met all environmental requirements. The team did not identify any issues with the licensees implementation of this modification.

.3.2 Modifications MP07-0069, Replace 480V Load Center Breakers, and MP07-0070

Replace Safety-Related and Non-Safety Metal-Clad Breakers

The team reviewed the plant modification packages associated with the replacement of safety-related 4160V switchgear breakers and 480V load center switchgear breakers.

The existing plant breakers were becoming obsolete and spare parts becoming more expensive as maintenance and overhauls were coming due. The 4160V breakers are being replaced with Square D Magnum type SVR vacuum breakers and the 480V load center breakers with Square D Masterpact circuit breakers. The team reviewed the Appendix B purchase specifications, qualification reports, and resulting calculations revised to support the change in breakers. The team did not identify any issues with the licensees implementation of this modification.

.3.3 Modification:

MP 05-3025, Maximum Allowed Temperature of CST and AFW System

The team reviewed Modification MP 05-3025, which increased the design rating and service condition maximum temperature of pipes, valves and equipment in the condensate transfer and storage system and the auxiliary feedwater system from a normal operating temperature of 95 ºF to 110 ºF. The modification did not implement any physical changes to the plant.

The condensate storage tank water temperature has exceeded the 95 ºF normal operating temperature on multiple occasions throughout the operation of the plant. The primary concern of raising the water temperature involved the stress rating of the piping systems and the effects on the available net positive suction head of the auxiliary feedwater pump. The licensee verified that all piping, valves, and equipment were rated to operate at higher temperatures than the operating temperature of 95 ºF by referencing design documents, system calculations, and vendor correspondence. The team did not identify any issues with the licensees implementation of this modification.

.3.4 Modification¨ M 10-0009, Reactor Coolant Pump Seal Replacement

The team reviewed Modification Package 10-0009, implemented to new Westinghouse SHIELD passive thermal shutdown seal on each of the reactor coolant pumps.

Westinghouse developed a reactor coolant pump shutdown seal, the Westinghouse Reactor Coolant Pump SHIELD Passive Thermal Shutdown Seal, that restricts reactor coolant system inventory losses to very small values for plant events that result in the loss of all reactor coolant pump seal cooling. The shutdown seal is a thermally actuated, passive device that is integral to the No. 1 insert, and sits between the No. 1 seal and the No. 1 seal leak-off line, to provide a leak-tight seal in the event of a loss of all reactor coolant pump seal cooling. The review included the design change package, post-modification testing, and the associated 10 CFR 50.59 review. The team did not identify any issues with the licensees implementation of this modification.

b. Findings

No findings were identified.

.4.1 Inspection of IN 2012-003, Design Vulnerability in Electric Power System, and

associated Modification MP15-0008

The team reviewed the licensee evaluation of Information Notice 2012-003, Design Vulnerability in Electric Power System, to verify that the licensee initially performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice summary. The team additionally reviewed the licensees proposed design modification MP15-0008, Open Phase Condition Protection, to address and resolve the concerns described in the information notice.

The licensee entered this issue into their corrective action program as Callaway Action Requests CARs 201201245, 201201652, 201205441, 201302829, and 201309622. The team did not identify any concerns with how the licensee is addressing this operating experience.

.4.2 Inspection of RIS 2011-12, Revision 1, Adequacy of Station Electric Distribution System

Voltages

The team reviewed the licensees evaluation of Regulatory Issue Summary 2011-12, Revision 1, Adequacy of Station Electric Distribution System Voltages, to verify that the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the regulatory issue summary. This regulatory issue summary was issued to clarify the NRC staffs technical position on existing regulatory requirements. The licensee entered this issue into their corrective action program as Callaway Action Request CAR-201200050. The team did not identify any concerns with how the licensee addressed this operating experience.

.4.3 NRC Information Notice 2017-03, Anchor/Darling Double Disc Gate Valve Wedge Pin

and Stem-Disc Separation Failures

The team reviewed the licensees evaluation of Information Notice 2017-03, Anchor/Darling Double Disc Gate Valve Wedge Pin and Stem-Disc Separation Failures, and the associated Part 21 notification to verify that potential valve disc separation issues were appropriately addressed. This information notice addressed the failures of an Anchor/Darling gate valve due to stem-disc separation events. The team interviewed engineering personnel and reviewed corrective action documentation to verify that potentially vulnerable valves had been identified and evaluated. The team did not identify any concerns with how the licensee is addressing this operating experience.

.5 Results of Reviews for Operator Actions

a. Inspection Scope

The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than 2 or Birnbaum value greater than 1E-6.

For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant. The scenario was a Mode 1 full power Small Break Loss of Coolant Accident (5250 gpm) Reactor Coolant System Loop C which results in cold leg recirculation. The selected operator actions were:

• Manually trip reactor coolant pump 5 minutes from the time trip criteria is met

The team observed this task during the simulator scenario post trip and safety injection actuated. The crew performed the task in accordance with EOP E-0, Reactor Trip or Safety Injection, Revision 18. The team observed this activity being performed by a crew of operators. This activity was satisfactorily performed within the required time.

• Align component cooling water to residual heat removal heat exchangers 11 minutes from event initiation

The team observed this task during the simulator scenario post trip and safety injection actuated. The crew performed the task in accordance with EOP E-0, Reactor Trip or Safety Injection, Revision 18. The team observed this activity being performed by a crew of operators. This activity was satisfactorily performed within the required time.

• Complete switchover of emergency core cooling system from injection mode to cold-leg recirculation mode 8 minutes 20 seconds after the low-low 1 level is reached in the reactor water storage tank

The team observed this task during the simulator scenario post trip and safety injection actuated. The crew performed the task in accordance with EOP E-0, Reactor Trip or Safety Injection, Revision 18, EOP E-1, Loss of Reactor or Secondary Coolant, Revision 18, and EOP ES-1.3, Transfer to Cold Leg Recirculation, Revision 12. The team observed this activity being performed by a crew of operators. This activity was satisfactorily performed within the required time.

• Align containment spray for recirculation 3 minutes after low-low 2 level is reached in the reactor water storage tank

The team observed this task during a simulator Job Performance Measure URO-SEN-04-C193J(A)(TC). Two operators performed the task in accordance with EOP ES-1.3, Transfer to Cold Leg Recirculation, Revision 12.

One operator did not complete the task and the other operator successfully completed the task. This activity was satisfactorily performed by the station within the required time. The station wrote a condition report and remediated the failed operator.

The team reviewed the records for the last three years on these tasks to determine if their program described in APA-ZZ-00395, Significant Operator Response Timing, Revision 27, was being performed as required and documented in accordance with the procedure. All of the records reviewed were in compliance with the program procedure requirements.

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

On August 4, 2017, the NRC team discussed the preliminary results of this inspection with Mr. T. Herrmann, Site Vice President, and other members of your staff. On August 28, 2017, the NRC team discussed the final results of this inspection with Ms. S. Kovaleski, Director, Design Engineering, and other members of your staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

4OA7 Licensee Identified Violation

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements which meets the criteria of the NRC Enforcement Policy for being dispositioned as a licensee-identified, non-cited violation.

Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Section 8 of Regulatory Guide 1.33, Revision 2, Appendix A, Procedures for Control of Measuring and Test Equipment and for Surveillance Tests, Procedures, and Calibrations, Part b, requires, in part, that specific procedures for surveillance tests, inspections, and calibrations, should be written (implementing procedures are required for each surveillance test, inspection, or calibration, listed in the technical specifications).

Station Procedure EDP-ZZ-01114, Motor Operated Valve Program Guide, Revision 034, Section 3.6.3.b, requires, in part, that the motor-operated valve engineer document a signature analysis report within 60 days following a diagnostic test of motor operated valves. Contrary to the above, on July 17, 2016, the motor-operated valve engineer failed to generate a signature analysis report within 60 days following a recent diagnostic test of a motor-operated valve. Specifically, in May 2014, the NRC inspection team identified NCV 05000483/2014007-06, Failure to Review Motor Operated Valve (MOV) Data and Complete Analysis of the Data in a Timely Manner. This finding was entered into the licensee's corrective action program as Callaway Action Requests CARs 201402987 and 201402992.

During Refueling Outage RF21 (spring of 2016), 33 motor operated valves had been tested and should have had a signature analysis report completed by the end of June 2016. On July 17, 2016, the licensee personnel recognized that they had not completed the signature analysis report for 31 of the 33 valves tested. The team evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04, Initial Characterization of Findings, and 0609 Appendix A, The Significance Determination Process (SDP) for Findings at-Power, dated June 19, 2012. The team concluded the finding was of very low safety significance (Green) because all questions in Exhibit 2 could be answered no.

The licensee entered this issue into their corrective action program as Condition Report CR-201606143.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Abel, Director, Engineering Projects

R. Andreasen, Engineer, Design Engineering

S. Banker, Senior Director, Engineering

B. Bax, Consulting Engineer, Design Engineering

S. Beck, Technician, Operations

E. Berry, Technician, Operations

F. Bianco, Director, Nuclear Operations

L. Bland, Supervisor, Operations

J. Bock, Transformer Engineer, Systems Engineering

J. Bruemmer, Electrical System Engineer, Engineering Systems

J. Copeland, Supervisor, Operations

J. Cortez, Director, Training

M. Covey, Manager, Operations Support

B. Cox, Senior Director, Nuclear Operations

J. Czeschin, Shift Manager, Operations

R. Davis, Career Engineer, Engineering Programs

M. Dunbar, Acting Director, Maintenance

J. Easley, Technician, Operations

L. Eitel, Supervisor, Engineering Design

T. Elwood, Supervisor - Engineer, Regulatory Affairs and Licensing

S. Ewens, Engineer, Engineering Projects

D. Farnsworth, Director, Work Management

C. Farrow, Supervisor, Operations

M. Haag, Senior Electrical Engineer, Design Engineering

T. Herrmann, Site Vice President

S. Kovaleski, Director, Engineering Design

J. Little, Consulting Engineer, Regulatory Affairs and Licensing

B. Long, Shift Manager, Operations

D. Martin, Senior Electrical System Engineer, Engineering Systems

M. Otten, Manager, Operations Training

R. Pohlman, Engineer, Regulatory Affairs

B. Price, Supervisor, Operations

J. Raithel, Engineer, Engineering Projects

J. Sellers, Supervising Engineer, EFIN Support

M. Sellers, Licensed Supervisor, Operations

S. Slayden, Electrical Engineer, Design Engineering

R. Tiefenauer, Senior Training Supervisor, Operations

B. Wentz, Breaker Engineer, System Engineering

L. Wilhelm, Supervisor, Operations

NRC Personnel

D. Bradley, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000483/2017007-01 NOV Not Verifying the Operation and Timing of the Engineered Safety Feature Transformer XNB01 Load Tap Changer (Section 1R21.2.4)

Opened and Closed

05000483/2017007-02 NCV Safety Injection Piggyback Valve EJ-HV-8804A Valve Interlocks Not Tested (Section 1R21.2.8.b.1)

05000483/2017007-03 NCV Inputs to Internal Flooding Calculations Not Translated into Procedures or Instructions (Section 1R21.2.8.b.2)