IR 05000313/2016008

NRC Component Design Bases Inspection and Confirmatory Action Letter Follow-Up Inspection Report 05000313/2016008 and 05000368/2016008

ML17059D000
Person / Time
Site:	Arkansas Nuclear
Issue date:	02/28/2017
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Richard Anderson Entergy Operations
Farmholtz T R
References
EA-14-008, EA-14-088, EA-16-124, EA-17-017 IR 2016008
Download: ML17059D000 (71)

Text

February 28, 2017

EA-14-008

EA-14-088

EA-16-124 EA-17-017

Rich Anderson, Site Vice President

Arkansas Nuclear One Entergy Operations, Inc.

1448 SR 333 Russellville, AR 72802-0967

SUBJECT: ARKANSAS NUCLEAR ONE - NRC COMPONENT DESIGN BASES INSPECTION AND CONFIRMATORY ACTION LETTER FOLLOW-UP INSPECTION REPORT 05000313/2016008 AND 05000368/2016008

Dear Mr. Anderson:

On December 2, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed the onsite portion of the subject inspection at the Arkansas Nuclear One (ANO), Units 1 and 2. On February 9, 2017, the NRC inspectors discussed the results of this inspection with Mr. Barry Davis, Director of Engineering, and other members of your staff. In conjunction with this inspection, the NRC inspection team also reviewed your progress in implementing the specific actions from the ANO Comprehensive Recovery Plan that were committed to in a Confirmatory Action Letter (CAL), dated June 17, 2016, (NRC's Agencywide Documents Access and Management System (ADAMS) Accession No. ML16169A193) (EA-16-124). The team discussed the results of this inspection with you and other members of your staff. The team documented the results of this inspection in the enclosed inspection report.

The team documented six findings of very low safety significance (Green) in this report. Five of these findings involved violations of NRC requirem ents. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Arkansas Nuclear One.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Arkansas Nuclear One. The team's review of ANO's progress in implementing the portions of the ANO Comprehensive Recovery Plan that were committed to in the CAL described above focused on those actions intended to improve the engineering vendor oversight, flood protection, and preventive maintenance classification. The inspection included a review of selected corrective actions to address the finding of substantial safety significance (Yellow) involving the failure to adequately approve the design and to load test a temporary lift assembly (EA-14-008), and the finding substantial safety significance (Yellow) involving the failure to assure that safety-related equipment below the design flood level was protected (EA-14-088). The enclosed report documents the basis for closing 9 of the 13 CAL actions reviewed, as well as observations related to the station's progress in addressing those actions that were not sufficiently complete or effective to close at this time. The NRC will further review your development and implementation of corrective actions for these risk-significant findings during future inspections. Attachment 3 of the enclosed report summarizes the NRC's inspection of the CAL actions to

date.

In accordance with Title 10 of the Code of Federal Regulations 2.390, "Public Inspections, Exemptions, Requests for Withholding," of the NRC's "Rules of Practice and Procedure," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC's Public Document Room or from ADAMS. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1

Division of Reactor Safety

Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6

Enclosure:

Inspection Report 05000313

/2016008 and 05000368/2016008 w/Attachment 1: Supplemental Information Attachment 2: Initial Request for Information Attachment 3: List of Confirmatory Action Letter Items Closed and Discussed Attachment 4: Detailed Risk Analysis for NCV 05000313/2016008-04 cc w/ encl: Electronic Distribution

ML17059D000 SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword: NRC-002 By: HAF Yes No Publicly Available Sensitive OFFICE RI/EB2 SRI/IPAT SOE/OB RI/EB2 SRA/PSB2 SES/ACES SRI/EB1 NAME IAnchondo HFreeman JKirkland NOkonkwo RDeese JKramer GGeorge SIGNATURE /RA/ /RA/ /RA/ /RA/ /RA/ /RA/ /RA/ DATE 02/21/17 02/21/17 02/21/17 02/23/17 02/23/17 02/28/17 02/17/17 OFFICE C/PBE C/EB1 NAME CO'keefe TFarnholtz SIGNATURE /RA/ /RA/ DATE 02/24/17 02/28/17 1 Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION IV

Dockets: 05000313; 05000368 Licenses: DPR-51; NPF-6 Report Nos.: 05000313/2016008; 05000368/2016008 Licensee: Entergy Operations, Inc. Facility: Arkansas Nuclear One, Units 1 and 2 Location: Junction of Highway 64 West and Highway 333 South Russellville, Arkansas Dates: October 31, 2016, to February 9, 2017 Team Leader: G. George, Senior Reactor Inspector Inspectors: H. Freeman, Senior Reactor Inspector I. Anchondo, Reactor Inspector N. Okonkwo, Reactor Inspector J. Kirkland, Senior Operations Engineer Accompanying Personnel: R. Deese, Senior Reactor Analyst G. Nicely, Contractor, Beckman and Associates M. Yeminy, Contractor, Beckman and Associates Approved By: Thomas R. Farnholtz Chief, Engineering Branch 1

Division of Reactor Safety

2

SUMMARY

IR 05000313/2016008; 05000368/2016008; 10/31/2016 - 02/09/2017; Arkansas Nuclear One;

IP 71111.21, "Component Design Bases Inspection;" IP 92702, "Follow-up on Traditional Enforcement Actions including Violations, Deviations, Confirmatory Action Letters, Confirmatory Orders, and Alternative Dispute Resolution Confirmatory Orders" The inspection activities described in this report were performed between October 31, 2016, and February 2, 2017, by five inspectors from the NRC's Region IV office and two NRC engineering contractors. Five findings of very low safety significance (Green) are documented in this report. Four of these findings involved a violation of NRC requirements.

Additionally, one violation was identified, and determined to be a violation related to and bounded by a previously issued Yellow finding regarding the ability to combat an external flooding event (Inspection Reports 05000313/2014009 and 05000368/2014009), and therefore was not characterized by color significance. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, "Significance Determination Process." Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects Within the Cross-Cutting Areas." Violations of NRC requirements are dis positioned in accordance with the NRCs Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process."

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, prior to December 2, 2016, the licensee failed to use appropriate assumptions in thermal overload device calculations and failed to establish a suitable periodic test program for safety-related Unit 1 motor operated valve thermal overload device trip setpoints, as discussed in Regulatory Guide 1.106, Regulatory Position C.2. In response to this issue, the licensee demonstrated reasonable assurance of operability by using the results of the 18-month high pressure injection system valve testing which required multiple stroking of block valves to obtain various flows without tripping the thermal overload devices. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2016-5017 and CR-ANO-1-2016-5130.

The team determined that the failure to meet the intent of Regulatory Guide 1.106,

Regulatory Position C.2 was a performance deficiency. The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify the adequacy of the design and perform suitable testing for thermal overload device setpoint drift did not ensure that the safety-related motor operated valves would be available to throttle the associated system flows during a design basis accident. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluations because the licensee failed to thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee failed to thoroughly evaluate Condition Report CR-ANO-1-2016-0778 which documented NRC inspector concerns associated with design and testing of motor operated valve thermal overload devices [P.2]. (Section 1R21.2.1.b.1)

Green.

The team identified Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," which states, "A test program shall be established to assure that all testing required to demonstrate that st ructures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents." Additionally, "Test results shall be documented and evaluated to assure that test requirements have been satisfied." Specifically, as of December 2, 2016, Units 1 and 2 emergency diesel generator surveillance procedures failed to incorporate the applicable voltage and frequency limits of NRC Safety Guide 9, and did not consistently document or evaluate results to assure test requirements have been satisfied. In response to this issue, the licensee provided the team test results which demonstrated that an immediate safety concern was not present. This finding was entered into the licensee's corrective action pr ogram as Condition Reports CR-ANO-1-2016-4785 and CR-ANO-2-2016-4257.

The team determined that the failure to incorporate the acceptance limits of NRC Safety Guide 9 into surveillance test procedures for emergency diesel generators and assure that test requirements have been satisfied in accordance with 10 CFR Part 50, Appendix B,

Criterion XI, "Test Control," was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences, and would have the potential to lead to a more significant safety concern. Specifically, the failure to incorporate appropriate acceptance criteria in test procedures and assure that the criteria have been satisfied had the potential to lead to a worse condition, if left uncorrected. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance. (Section 1R21.2.1.b.2)

Green.

The team identified a Green finding for the failure to meet the surveillance standards of IEEE 308-1971, "Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations," Section 5.2.3, "Preferred Power Supp ly." Specifically, from 2001 to December 2, 2016, the licensee failed to monitor the operation of the voltage regulator/load tap changer functions on startup transformers 1, 2, and 3. In response to this issue, the licensee provided reasonable assurance that the voltage regulator/load tap changer was operating properly based on review of plant computer voltage plot data following an Arkansas Nuclear One, Unit 1 trip that occurred on December 14, 2015. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2016-4777,

CR-ANO-C-2016-4879, and CR-ANO-C-2016-5015.

The team determined that the failure to monitor startup transformers 1, 2, and 3 voltage regulator/load tap changers to the extent that they are shown to be ready to perform their intended function, in accordance with IEEE Standard 308-1971, was a performance deficiency. The finding was determined to be more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to monitor the adequacy of the voltage supplied from startup transformers 1, 2, and 3 voltage regulator/load tap changer did not ensure that offsite power would be available to perform its necessary functions to provide power to the safety-related mitigation equipment. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

(Section 1R21.2.2.b.1)

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part that, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, prior to December 22, 2016, the licensee failed to verify the adequacy of the emergency feedwater suction transfer procedure by determining if the qualified condensate storage tank will be completely empty of water, possibly causing an air ingestion failure of the Unit 1 emergency feedwater pumps, prior to transferring to the credited safety-related alternate suction source. In response to this issue, the licensee resolved the immedi ate safety concern by revising the emergency feedwater pump operating procedure, removing the steps that were the cause of the concern. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-1-2016-5166, CR-ANO-1-2016-5725, and CR-ANO-1-2017-0040.

The team determined that the failure to verify the adequacy of the design of the Unit 1 emergency feedwater suction from the qualified condensate storage tank to alternate sources of water by performance of design review, by use of calculational methods, or by performance of a suitable testing program in accordance with 10 CFR Part 50, Appendix B,

Criterion III, "Design Control," was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the reliability, availability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to have adequate measures in place to ensure an acceptable design analysis or a suitable test program would verify that the process of transferring emergency feedwater suction from the qualified storage tank to the alternate sources ensures the capability of the Unit 1 emergency feedwater system to perform its safety function. In accordance with Inspection Manual Chapter 0609,

Attachment 4, "Initial Characterization of Findings," dated June 19, 2012, the team determined this finding affected the secondary short term heat removal function of the Mitigating Systems Cornerstone. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the finding represented a loss of the emergency feedwater system and function. Therefore, a detailed risk evaluation was necessary. The senior reactor analyst determined that the change in core damage frequency of this finding was 7 x 10

-7 per year, therefore the significance was of very low safety significance (Green). This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

(Section 1R21.2.7.b.1)

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, from December 17, 1979, to December 2, 2016, the licensee did not verify that the design of the protective devices for the loads required at the beginning of a loss-of-coolant accident were adequate to prevent tripping these devices under degraded voltage conditions, which would render the affected loads non-functional.

In response to this issue, the licensee performed a preliminary analysis to determine that the protective overload devices would not cause safety equipment to fail at degraded voltages allowed by technical specifications. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2016-5027 and CR-ANO-C-2016-5191.

The team determined that the failure to ensure that safety-related electrical components would not fail during the allowable time duration of a degraded voltage condition (in accordance with NRC Multi-Plant Action B-23, Position 1.C) was a performance deficiency. The finding was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to ensure that the protective devices for the loads required at the beginning of a Loss of Control Accident would not fail under degraded voltage conditions did not ensure that these loads would be available to perform their mitigating functions. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.3.1.b.1)

6

Green.

The team identified three examples of a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," which states, in part that, activities affecting quality sha ll be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances. Specifically, prior to December 2, 2016, Unit 1 Operating Procedure OP 1203.025, "Natural Emergencies," Revision 60 and Unit 2 Operating Procedure OP 2203.008 "Natural Emergencies," Revision 42 failed to ensure all actions required to establish external flood protection, as specified by flood protection design basis engineering report CALC-ANOC-CS-00003,

Revision 00 were implemented. This issue was entered into the licensee's corrective action program as Condition Report CR-ANO-2-2016-4265.

The licensee's failure to prescribe procedures appropriate to the circumstances for combating emergencies or other significant acts of nature such as flooding was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences, and would have the potential to lead to a more significant safety concern. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2,

"Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it does not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with identification because the licensee failed to identify issues, completely, accurately, and in a timely manner in accordance with the corrective action program. Specifically, the licensee failed to identify these deficiencies during a review of these same procedures as part of actions to close significant performance deficiencies as documented in Arkansas Nuclear One Area Acti on Plan FP-6 [P.1]. (Section 1R21.3.3.b.1)

7

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity This inspection of component design bases verifies that plant components are maintained within their design basis. Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design basis functions. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity Cornerstones for which there are no indicators to measure performance.

1R21 Component Design Basis Inspection

.1 Overall Scope

To assess the ability of the Arkansas Nuclear One, Units 1 and 2, equipment and operators to perform their required safety functions, the team inspected risk-significant components and the licensee's responses to industry operating experience. The team selected risk-significant components for review using information contained in the Arkansas Nuclear One, Units 1 and 2 probabilistic risk assessments and the U. S. Nuclear Regulatory Commission's (NRC's) standardized plant analysis risk model.

In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and nonsafety-related systems including pumps, circuit breakers, heat exchangers, transformers, and valves. The team selected the risk-significant operating experience to be inspected based on its collective past experience.

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design basis and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For selected components, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design basis have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the 8 selection of components for detailed review. These included items such as failed performance test results, significant corrective actions, repeated maintenance, 10 CFR 50.65(a)1 status, operable, but degraded conditions; NRC resident inspector input of problem equipment, system health reports, industry operating experience, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15 to 25 total samples that include risk-significant and low design margin components, components that affect the large-early-release-frequency (LERF), and operating experience issues. The sample selection for this inspection was 11 components, 1 of which affects LERF, and 4 operating experience items. The selected inspection and associated operating experience items supported risk-significant functions including the following:

a. Electrical power to mitigation systems: The team selected several components in the electrical power distribution systems to verify operability to supply alternating current

(ac) and direct current

(dc) power to risk-significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and a loss-of-coolant accident with offsite power available. As such the team selected:

• Unit 1 480 V Class 1E Load Control Center B-5

• Startup Transformer 1 and Open Phase Detection Modification

• Unit 1 125 VDC Battery Buses D-01 & D-02

• Unit 2 480 V Class 1E Load Control Center 2B-5

• Alternate AC Emergency Diesel Generator 2K-9 b. Components that affect large-early-release-frequency (LERF): The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components:

• Unit 1 Electromatic Relief Valve PSV-1000 c. Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected:

• Unit 1 Motor Driven Emergency Feedwater Pump P-7B

• Units 1 and 2 Service Water System Pumps and Motors

• Unit 1 Reactor Building Coolers

• Unit 2 Component Cooling Water Heat Exchanger 2E-28C

• Units 1 and 2 Emergency Diesel Generator Fuel Oil Storage Tanks

.2.1 Unit 1 480 V Class 1E Load Control Center B-5

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Unit 1 480 V Class 1E load control center B-5. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• Protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

• Degraded and loss of voltage relays selection and associated time delays to verify settings were in accordance with calibration procedures, time delay calculations, and accuracy calculations.

• Licensee responses to NRC Generic Le tter (GL) 2006-02, "Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power," dated February 1, 2006.

• Interface and coordination with the transmission system operator for plant voltage requirements and notification set points were reviewed.

• Emergency diesel generator loading calculations to determine whether the capacity of the emergency diesel generator is adequate to supply worst case accident loads.

• Emergency diesel generator surveillance test results to ensure that the voltage and frequency transients were within the NRC Safety Guide 9 acceptable limits.

1. Failure to Verify the Adequacy of Motor Operated Valve Thermal Overload Devices

Introduction.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to use appropriate assumptions in thermal overload device calculations and failed to establish a suitable periodic test program for safety-related Unit 1 motor operated valve thermal overload device trip setpoints.

Description.

The licensee initiated Condition Report CR CR-ANO-1-2016-0778 as a result of the February 2016 NRC Inspection Procedure 95003 inspection. The NRC inspection team had the following concern and questions associated with motor operated valve thermal overload devices for eight Unit 1 motor operated valves CV-1219, CV-1220, CV-1278, CV-1279, CV-1227, CV-1228, CV-1284,

and CV-1285:

1. The team was concerned that the thermal overloads may trip during accident conditions and prevent the valves from performing their safety function because the operators were expected to throttle flow to 20 gallons per minute.

2. The team asked if the thermal overloads were periodically tested to ensure the thermal overloads were working properly.

3. The team asked if the operators are trained to limit the number of throttling attempts, or if Unit 1 procedures limited the number of throttling attempts. The team gave an example that the motor manufacture, Flowserve, has guidance that a motor should have no more than 5 starts (throttle attempts) in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with a required cool down of 1.5 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> depending on motor frame size.

As part of the corrective report, the licensee reviewed results from Calculation 94-E-0018-02, "GL 89-10 MOV Cable, Breaker and TOL Evaluation," that evaluated thermal overload relay and heater size combinations for the various sizes and types of safety-related motor operated valves to determine if the thermal overloads would trip for the throttling/jogging function. The licensee determined that the thermal overloads would be able to complete approximately 25 throttling attempts before tripping. The licensee stated that the thermal overload devices on the 8 motor operated valves were not in a periodic test program.

The licensee's thermal overload device sizing criteria was based Arkansas Nuclear One Design Standard EES-12, "Motor Operated Valve Electrical Evaluation," Revision 4.

Section 6.1.1, "Regulatory Position - Regulatory Guide 1.106" discusses that Arkansas Nuclear One intends that Unit 1 meets position C.2 of Regulatory Guide 1.106, "Thermal Overload Protection for Electric Motors on Motor-Operated Valves." Regulatory Guide 1.106, Position C.2 states, for thermal overload protection devices that are not

bypassed:

"The trip setpoint of the thermal overload protection devices should be established with all uncertainties resolved in favor of completing the safety-related action. With respect to those uncertainties, consideration should be given to

(1) variations in the ambient temperature at the installed location of the overload protection devices and the valve motors,

(2) inaccuracies in motor heating data and the overload protection device trip characteristics and the matching of these two items, and

(3) setpoint drift.

In order to ensure continued functional reliability and the accuracy of the trip point, the thermal overload protection device should be periodically tested."

The team determined that the licensee did not meet the intent of Regulatory Guide 1.106, Position C.2. Calculation 94-E-0018-02, "GL 89-10 MOV Cable, Breaker and TOL Evaluation," did not establish a trip setpoint with all uncertainties resolved in favor of completing the safety-related function. Because the motor operated valves are used in throttling applications, the calculation requires additional considerations due to 11 wide variations in the motor operated valve duty cycle and multiple occurrences of motor operated valve motor inrush that the licensee had not considered in their sizing criteria. The calculation non-conservatively evaluated motor operated valve motors as starting unloaded with starting currents lasting only milliseconds. Since the motor operated valve will be mid-stroke, the motor operated valve will be started under load therefore the starting current may last up to 1 second which rapidly heats up the thermal overload bi-metallic element. The calculation non-conservatively divided the full stroke time into the thermal overload trip time at running current to determine how many throttles the motor could have without tripping the thermal overload. Additionally, the licensee did not establish a periodic test program to ensure continued functional reliability and accuracy of the trip point.

Analysis.

The team determined that the failure to meet the intent of Regulatory Guide 1.106, Regulatory Position C.2 was a performance deficiency. The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify the adequacy of the design and perform suitable testing for thermal overload device setpoint drift did not ensure that the safety-related motor operated valves would be available to throttle the associated system flows during a design basis accident. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluations because the licensee failed to thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee failed to thoroughly evaluate Condition Report CR-ANO-1-2016-0778 which documented NRC inspector concerns associated with design and testing of motor operated valve thermal overload devices [P.2].

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational

methods, or by the performance of a suitable testing program. Contrary to the above, prior to December 2, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program of motor operated valves thermal overload devices. Specifically, the licensee failed to use appropriate assumptions in thermal overload device calculations and failed to establish a suitable periodic test program for safety-related Unit 1 motor operated valve thermal overload device trip setpoints. In response to this issue, the licensee demonstrated reasonable assurance of operability by using the results of the 18-month high pressure injection system valve testing which required multiple stroking of block valves to obtain 12 various flows without tripping the thermal overload devices. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2016-5017 and CR-ANO-1-2016-5130. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016008-01, "Failure to Verify the Adequacy of Motor Operated Valve Thermal Overload Devices."

2. Failure to Incorporate NRC Safety Guide 9 Criteria into Surveillance Procedures

Introduction.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to incorporate the acceptance criteria into test procedures to ensure that Unit 1 and Unit 2 emergency diesel generator loads were energized within the applicable voltage and frequency limits of NRC Safety Guide 9. In addition, the licen see did not evaluate t he results to assure that test requirements have been satisfied in a timely manner.

Description.

Arkansas Nuclear One, Unit 1, Updated Safety Analysis Report, Section 8.3.1.1.7, "Emergency Power Supply System," states,

"The diesel generators are of such a size that, during the incremental adding of loads, the recommendations of NRC Safety Guide 9 will not be exceeded."

Arkansas Nuclear One, Unit 2, Updated Safety Analysis Report, Section 8.3.1.2, "Analysis," states, "The [Class 1E electric] system was designed to meet the requirements of IEEE 279-1971, IEEE 308-1971, IEEE 387-1972, 10CFR50 General Design Criteria 17 and 18, and Regulatory Guides 1.6 and 1.9."

NRC Safety Guide 9 (also known as Regulatory Guide 1.9, dated August 10, 1971),

"Selection of Diesel Generator Set Capacity for Standby Power Supplies," establishes voltage and frequency limits during diesel generator sequencing. Position C.4 of NRC Safety Guide 9 states, in part, that:

"At no time during the loading sequence should the frequency and voltage decrease to less than 95 percent of nominal and 75 percent of nominal, respectively."

Additionally, it states, "Voltage should be restored to within 10 percent of nominal and frequency should be restored to within 2 percent of nominal in less than 40 percent of each load sequence

time interval."

Although the Unit 1 and Unit 2 technical specifications do not specifically list the NRC Safety Guide 9 voltage and frequency criteria, the technical specification bases implies that the auto-sequenced loads were energized, both started and accelerated within the required criteria of NRC Safety Guide 9.

13 The team noted the following deficiencies related to the emergency diesel generator periodic 18-month technical specification surveillance testing in Unit 1 Procedure 1305.006, "Integrated ES System Test," and Unit 2 Procedure 2305.001, "Integrated Engineering Safeguards Test":

1. No acceptance criteria was incorporated into the test procedures to ensure compliance with NRC Safety Guide 9 starting and acceleration limits. 2. Prior to returning the emergency diesel generators to operable, the licensee did not consistently compare the test data with the applicable NRC Safety Guide 9 limits and consistently document those results to ensure operability of the emergency diesel generators. 3. The surveillance procedures only required the system engineer to receive the test data to develop system response trends and compare to NRC Safety Guide 9 criteria; however, the system engineer's review was not integral to determining a successful test. 4. The surveillance procedures did not include any criteria as to when the system engineer's review would be completed, specifically prior to returning to operable status. In some instances, the review was completed after the emergency diesel generator was restored to operable status.

Analysis.

The team determined that the failure to incorporate the acceptance limits of NRC Safety Guide 9 into surveillance test procedures for emergency diesel generators and assure that test requirements have been satisfied in accordance with 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences and would have the potential to lead to a more significant safety concern. Specifically, the failure to incorporate appropriate acceptance criteria in test procedures and assure that the criteria have been satisfied had the potential to lead to worse condition, if left uncorrected. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power,"

dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," which states, "A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents." Additionally, "Test results 14 shall be documented and evaluated to assure that test requirements have been satisfied." Contrary to the above, as of December 2, 2016, the licensee failed to assure that testing required to demonstrate that emergency diesel generator's would perform satisfactorily in service was identified and performed in accordance with written test procedures which incorporated the requirements and acceptance limits contained in applicable design documents and failed to document and evaluate the test results to assure that the test requirements have been satisfied. Specifically, Units 1 and 2 emergency diesel generator surveillance procedures failed to incorporate the applicable voltage and frequency limits of NRC Safety Guide 9 and did not consistently document or evaluate results to assure test requirements have been satisfied. In response to this issue, the licensee provided the team test results which demonstrated that an immediate safety concern was not present. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-1-2016-4785 and CR-ANO-2-2016-4257.

Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a

non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000313/2016008-02 and NCV 05000368/2016008-02, "Failure to Incorporate NRC Safety Guide 9 Criteria into Surveillance Procedures."

.2.2 Startup Transformer 1 and Open Phase Detection Modification

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis

documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the startup transformer 1 and open phase detection modification. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Transformer maintenance history to verify the monitoring of potential degradation.

• Transformer voltage regulator, controller, and automatic load tap changers periodic testing and maintenance procedures, and results to ensure adequate voltage was supplied to the control circuits and tap changer motor.

• Transformer loading calculations to determine whether the capacity of the transformer is adequate to supply worst-case loading.

• Voltage calculations to determine whether transformer taps for switchyard voltage were adequate to assure the availability of offsite power during accident conditions.

• Open phase detection circuit modifications being performed under Engineering Change 48771.

b. Findings

Failure to Monitor Startup Transformers 1, 2, and 3 Voltage Regulator/Tap Changer Functions

Introduction.

The team identified a Green finding for the failure to meet the surveillance standards of IEEE 308-1971, "Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations," Section 5.2.3, "Preferred Power Supply." Specifically, the licensee failed to monitor the operation of the voltage regulator/load tap changer functions on startup transformers 1, 2, and 3.

Description.

The Arkansas Nuclear One Units 1 and 2 Class 1E power system is designed to meet the requirements of IEEE Standard 308-1971, as discussed in Chapter 8 of both Unit 1 and 2 updated safety analysis reports. Additionally, as required by IEEE 308-1971 and 10 CFR 50, Appendix A, General Design Criterion 17, each redundant emergency safety features load can be powered by both onsite and offsite power supplies. Paragraphs

(3) and

(5) of Section 5.2.3, "Preferred Power Supply," of IEEE 308-1971 states the following in part:

(3) Capability - "The preferred power supply shall be capable of starting and operating all the required loads."

(5) Surveillance - "The distribution system shall be monitored to the extent that it is shown to be ready to perform its intended function."

The team noted the licensee did not monitor the operation of the Beckwith automatic voltage regulator/load tap changer functions of startup transformers 1, 2, and 3, that are credited in safety-related calculations to ensure that adequate voltage is provided to the required safety-related emer gency safety features electrical loads. Calculation 09-E-0016-01, "SUT [start up transformer] #1 and Unit Aux Millstone Studies," Revision 1 takes credit for a 1-second timing of the tap changes, and for the bypassing of a 20-second initial time delay to ensure adequate voltages are provided to safety-related loads and degraded voltage relays which are required to mitigate an event where offsite power was not lost.

Additionally, the team determined tasks do not currently exist to check the calibration of the Beckwith load tap changer controller associated with startup transformers 1, 2, and

3. There are currently no preventive maintenance tasks that functionally test the 20-second timer bypass function for the voltage regulators or functionally tests the timing between load tap changes are 1 second or less.

Further review by the licensee discovered that Entergy's transmission organization did have procedures in place to verify that the voltage regulators maintained their proper set points, the various control and alarm functions are properly operating, and verified the timing of the load tap changes; however, those requirements were deleted when Entergy transferred control of those transformers from the transmission organization to Arkansas Nuclear One in 2001. The licensee provided the team reasonable assurance that the voltage regulator/load tap changer was operating properly based on a review of plant display computer points following a Unit 1 trip that occurred on December 14, 2015.

Analysis.

The team determined that the failure to monitor startup transformers 1, 2, and 3 voltage regulator/load tap changers to the extent that they are shown to be ready to perform their intended function, in accordance with IEEE Standard 308-1971, was a performance deficiency. The finding was determined to be more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, from 2001 to December 2, 2016, the failure to monitor the adequacy of the voltage supplied from startup transformers 1, 2, and 3 voltage regulator/load tap changer did not ensure that offsite power would be available to perform its necessary functions to provide power to the safety-related mitigation equipment. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding does not have a cross-cutting aspect because the performance deficiency does not reflect current licensee

performance.

Enforcement.

This finding does not involve enforcement actions because no violation of a regulatory requirement was identified. In response to this issue, the licensee provided reasonable assurance that the voltage regulator/load tap changer was operating properly based on a review of plant computer voltage plots data following an Arkansas Nuclear One, Unit 1 trip that occurred on December 14, 2015. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2016-4777, CR-ANO-C-2016-4879, and CR-ANO-C-2016-5015. Because this finding does not involve a violation and was of very low safety significance, it is identified as FIN 05000313/2016008-03 and FIN 05000368/2016008-03, "Failure to Monitor Startup Transformers 1, 2, and 3 Voltage Regulator/Tap Changer Functions."

.2.3 Unit 1 125 VDC Battery Buses D-01 & D-02

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Unit 1 125 VDC Battery Buses D01 and D02. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this

component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Calculations for electrical distribution, system load flow/voltage drop to verify that bus capacity and voltages remained within minimum acceptable limits.

17

• Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and battery load contributions to ensure adequate design based bus loading.

• Bus procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.4 Unit 2 480 V Class 1E Load Control Center 2B-5

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Unit 2 480 V Class 1E load control center 2B-5. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance; including the cable aging management program.

• Results of completed preventative maintenance on switchgear and breakers, including breaker tracking.

b. Findings

No findings were identified.

.2.5 Alternate AC Emergency Diesel Generator 2K-9

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with alternate ac emergency diesel generator 2K-9. The team also performed walkdowns and conducted 18 interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component system health report, schematic and control diagrams to review system power distribution and coordination.

• Calculations for electrical system loading, load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

• The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

b. Findings

No findings were identified.

.2.6 Unit 1 Electromatic Relief Valve PSV-1000

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the Unit 1 electromatic relief valve PSV-1000. The team also performed walkdowns and conduc ted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history to verify the monitoring of potential degradation.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Component pipe sizing and load analysis to verify that the system can sustain normal and accident operation loads.

b. Findings

No findings were identified.

2.7 Unit 1 Motor Driven Emergency Feedwater Pump and Motor P-7B

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Unit 1 motor driven emergency feedwater pump and motor P-7B. The team also performed walkdowns and conducted interviews with 19 system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history to verify the monitoring of potential degradation.

• Condition Reports issued in the past 5 years to verify that repeat failures, and potential chronic issues, will not prevent the emergency feedwater pumps and associated components from performing their safety function.

• Component testing methodology and acceptance criteria to verify that the values supported design assumptions.

• Analysis of emergency feedwater suction transfer from safety-related sources to alternate sources to determine if air intrusion would occur.

• Calculations for voltage drop, ampacity, protection and coordination, motor brake horsepower requirements, and short circuit for the pump motor power supply and feeder cable.

b. Findings

Failure to Perform an Adequate Emergency Feedwater Pump Suction Transfer Design Calculation or Testing (EA 2017-017)

Introduction.

The NRC identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of the suction source transfer of the Unit 1 emergency feedwater system. Specifically, the licensee failed to ensure that the safety-related qualified condensate storage tank will not empty to a level that will introduce air into the Unit 1 emergency

feedwater pumps.

Description.

Unit 1 Operating Procedure 1106.006, "Emergency Feedwater Pump Operation," Revision 098, directed the operators to transfer suction of the emergency feedwater system from the safety-related qualified condensate storage tank (T-41B) to the nonsafety-related condensate storage tank (T-41). This was completed by opening condensate storage suction valve CS-275 from tank T-41 to the emergency feedwater system. Operating Procedure 1106.006 did not direct the operators to close the suction valves from tank T-41B upon completion of suction source transfer to tank T-41.

Operating Procedure 1106.006 stated:

"EFW suction should be transferred from T-41B to an alternate source prior to the QCST level dropping to < 2 feet. Transfer should be started whenever the T-41B level is < 3 feet."

Additionally, the procedure stated that "the two tank levels will equalize as CST is

pumped down to the QCST level."

The team was concerned that tank T-41B would continue to empty while tank T-41 was aligned as the alternate suction source for the emergency feedwater system. This 20 concern was based on the differences in flow resistances between the different pipe diameters and arrangement of pipe coming from T-41 and T-41B, respectively. Once the tank T-41B becomes empty, there would be a potential common cause failure mechanism for Unit 1 emergency feedwater pumps caused by the introduction of air into pumps. Based on this concern, the team requested the formal analysis or test record that verified emergency feedwater system operation through the alternate suction transfer process from tank T-41B to tank T-41. The licensee could not produce an analysis or test record because this was not the alternate suction source credited in the accident analysis.

To address the team's concern, the licensee commissioned a preliminary analysis MPR-0062-0170-LTR-001, "ANO EFW Pumps Suction Analysis," Revision 1. The analysis demonstrated that when suction source transfer begins at water level of 7 feet in tank T-41, the flow rate from tank T-41B exceeds the flow rate from tank T-41, even though the water level in tank T-41 was significantly higher. The analysis also shows that, through the design bases event, the water level in the tank T-41B would always be approximately 18 inches lower than the water level in tank T-41. The preliminary analysis also demonstrated that the water levels in the two tanks will not equalize, rather, that tank T-41B would empty first. Additionally, the licensee relied on monitoring of emergency feedwater pump suction pressure to transfer suction to the credited source when the suction pressure falls to 5 psig; however, the preliminary analysis demonstrated that suction pressure would remain above 5 psig throughout the event.

Furthermore, the team identified the following issues affecting the licensee's preliminary analysis:

1. The licensee's analysis assumed that suction from tank T-41 begins when the water level in tank T-41B was at 3 feet, while Operating Procedure 1106.006 states that suction "should be transferred to an alternate source prior to the T-41B level dropping to < 2 feet." Adding that, in order to accomplish this, "transfer should be transferred whenever the T-41B level is < 3 feet." Therefore, the analysis included 1 foot of additional margin that does not accurately reflect operation procedure requirements.

2. The preliminary analysis used a combined emergency feedwater system flow rate of 851 gallons per minute. This value may not be bounding as the actual flow rate may be significantly higher. A two pump flow rate of 1000 gallons per minute would also eliminate more margin as the pipe losses in tank T-41 suction piping are significantly higher.

3. The preliminary analysis began the transfer when the water level in tank T-41B was at 3 feet, assuming that the transfer will take 2 minutes to complete. The operation to operate condensate storage suction valve CS-275 is completed locally at the emergency feedwater system header. Since the procedure does not include evidence that an operator will be stationed at the valve, the team determined that the assumption of 2 minute completion did not conservatively reflect plant operation.

21 4. The preliminary analysis evaluated two separate runs of the suction transfer.

The analysis was completed with tank T-41 starting water level at 7 feet and at 10 feet. The team determined that neither level was conservative. Starting at 10 feet was not conservative because the water level in tank T-41B would rise until the water level in tank T-41 was approximately 7.8 feet because of minimum flow return. Then, tank T-41B level would decrease after the outflow from the tank T-41B would exceed the minimum flow return. Starting tank T-41 water level at 7 feet was not conservative because not enough time was given to deplete the water from tank T-41B, as this low water level will result in a transfer

to service water too early. Additionally, the licensee did not have any procedural requirement to maintain the water level in tank T-41 at any specific height. Starting the transient at the limiting water level in tank T-41 would result in additional loss of margin.

5. The preliminary analysis evaluated water level in tank T-41B, but did not confirm whether T-41B level zero is at the bottom of the tank or at about 6 inches, because the suction pipe protrudes 6 inches into the tank such that the final 6 inches of water is not available for emergency feedwater suction.

6. The preliminary analysis assumed that only the Unit 1's emergency feedwater system was operating, while there could be an event where Unit 2's emergency feedwater system may be drawing water from tank T-41B simultaneously. This would empty tank T-41B earlier than assumed in the analysis.

In response to these issues, the licensee resolved the immediate safety concern by revising the emergency feedwater pump operating procedure, removing the steps that were the cause of the finding.

The team determined that the licensee failed to verify the adequacy of the design of the transfer of Unit 1 emergency feedwater system suction from the qualified condensate storage tank T-41B to alternate sources of water by performance of design review, by use of calculational methods, or by performance of a suitable testing program.

Specifically, the licensee failed to verify the adequacy of the suction transfer by determining if tank T-41B would be completely empty of water, possibly causing an air ingestion failure of the Unit 1 emergency feedwater pumps, prior to transferring to service water, which is the credited safety-related alternate source.

Analysis.

The team determined that the failure to verify the adequacy of the design of the Unit 1 emergency feedwater suction from the qualified condensate storage tank to alternate sources of water by performance of design review, by use of calculational methods, or by performance of a suitable testing program in accordance with 10 CFR

Part 50, Appendix B, Criterion III, "Design Control," was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the reliability, availability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to have adequate measures in place to ensure an acceptable design analysis or a suitable test program would verify that the process of transferring emergency feedwater suction from the qualified storage tank to the alternate sources ensures the capability of the Unit 1 emergency feedwater system to perform its safety function. In accordance with Inspection Manual Chapter 0609, Attachment 4, "Initial Characterization of Findings,"

22 dated June 19, 2012, the team determined this finding affected the secondary short term heat removal function of the Mitigating Systems Cornerstone. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the finding represented a loss of the emergency feedwater system and function. Therefore, a detailed risk evaluation was necessary. The senior reactor analyst determined that the change in core damage frequency of this finding was 7 x 10-7 per year, therefore the significance was of very low safety significance (Green). Details of the evaluation are documented in Attachment 4 of this report. This finding did not have a cross-cutting aspect because the performance deficiency did not reflect current licensee performance.

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational

methods, or by the performance of a suitable testing program. Contrary to the above, prior to December 22, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Specifically, the licensee failed to verify the adequacy of the emergency feedwater suction transfer procedure by determining if the qualified condensate storage tank will be completely empty of water, possibly causing an air ingestion failure of the Unit 1 emergency feedwater pumps, prior to transferring to the credited safety-related alternate suction source. In response to this issue, the licensee resolved the immediate safety concern by revising the emergency feedwater pump operating procedure, removing the steps that were the cause of the finding. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-1-2016-5166, CR-ANO-1-2016-5725, and CR-ANO-1-2017-0040. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016008-04 (EA 2017-017), "Failure to Perform an Adequate Emergency Feedwater Pump Suction Transfer Design Calculation or Testing."

.2.8 Units 1 and 2 Service Water System Pumps and Motors

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Units 1 and 2 service water system pumps and motors.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history to verify the monitoring of potential degradation.

• Service water suction from the emergency cooling pond to assure that system operation can be satisfied following loss of suction from the lake.

23

• Analysis of emergency cooling pond design temperature to assure that the system can provide 30 days of inventory following a design bases accident.

• Component testing methodology and acceptance criteria to verify that the values supported design assumptions.

• Corrective actions associated with previous NRC violations regarding service water, to verify that the licensee follows up on all open items.

• Engineering calculations of service water supply and balancing of flow rates to safety-related components.

• Seismic design of the service water intake structure, including the sluice gates and their motor operators, to verify that the system would fulfill its safety function after a seismic event.

• Motor sizing calculations to verify input assumptions, design loading to ensure adequate design for pumping capacity.

b. Findings

No findings were identified.

.2.9 Unit 1 Reactor Building Coolers

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Unit 1 reactor building coolers. The team also performed walkdowns of associated equipment located outside of the Reactor Building, and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• The water hammer analysis performed for the service water discharge piping.

• Engineering calculations of service water supply and balancing of flow rates to safety-related components.

• Heat exchanger heat transfer analysis to ascertain the coolers capability to remove the assigned rate of heat removal.

• The licensee's response and commitments regarding Generic Letter 96-06 to verify that all actions were adequately implemented.

b. Findings

No findings were identified.

.2.10 Component Cooling Water Heat Exchanger 2E-28C

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the component cooling water heat exchanger 2E-28C.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Component and associated pipe sizing calculations to verify heat exchanger capabilities are consistent with those described in the updated safety analysis report.

b. Findings

No findings were identified.

.2.11 Units 1 and 2, Emergency Diesel Generator Fuel Oil Storage Tanks:

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the emergency diesel generator fuel oil storage tanks.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Fuel storage capacity and consumption calculations to verify the emergency diesel generators can operate during flooding conditions.

25

• Component operating and testing procedures to verify system capabilities to transfer suction from one storage tank to another.

b. Findings

No findings were identified.

.3.1 Inspection of NRC Regulatory Issues Summary 2011-12, Revision 1, "Adequacy of Station Electric Distribution System Voltages"

a. Inspection Scope

The team reviewed the licensee's evaluation of Regulatory Issue Summary 2011-12, Revision 1, "Adequacy of Station Electric Distribution System Voltages," to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the regulatory issue summary. This regulatory issue summary was issued to clarify the NRC staff's technical position on existing regulatory requirements. Specifically, this regulatory issue summary clarified voltage studies necessary for degraded voltage relay (second level undervoltage protection) setting bases and transmission network/offsite/station electric power system design bases for meeting the regulatory requirements specified in General Design Criteria 17 to 10 CFR

Part 50, Appendix A.

b. Findings

Failure to Ensure Safety System s Would Survive Sustained Degraded Voltage Conditions

Introduction.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for failure to verify that the design of the protective devices for the loads required at the beginning of a loss-of-coolant accident were adequate to prevent tripping these devices under degraded voltage conditions, which would render the affected loads non-functional.

Description.

Section 8.3.1.5.1 of the Arkansas Nuclear One, Unit 1, Updated Safety Analysis Report, discusses the NRC positions and licensee responses to a 1977 NRC Generic Action Multi-Plant Action B-23, "Statement of Staff Positions Relative to Emergency Power Systems for Operating Reactors," dated June 2, 1977. Section 8.3.1.6.1 of the Arkansas Nuclear One, Unit 2, Updated Safety Analysis Report, provides the same discussion for Unit 2. Position 1 of the Multi-Plant Action B-23 required that a second level of voltage protection (or degraded voltage relay) for the onsite power system be provided and that the second level voltage protection had to satisfy criteria concerning the selection, time, design, and surveillance controls of voltage protection. Specific criteria in Position 1.C states:

"The time delay selected should be based on the following conditions:

1. The allowable time delay, including margin, should not exceed the maximum time delay that is assumed in the FSAR accident analyses;

2. The time delay should minimize the effect of short duration disturbances from reducing the availability of the offsite power source(s); and,

3. The allowable time duration of a degraded voltage condition at all distribution system levels should not result in fa ilure of safety systems or components."

To determine that Multi-Plant Action B-23 position 1.C was satisfied, the team performed a detailed review of the licensee's 1978 and 1979 responses regarding the design, selection, and installation of the degraded voltage relays in Unit 1 and Unit 2 onsite alternating current distribution systems. The team performed a detail review of the October 27, 1978, NRC Order modifying the Unit 1 operating license to implement voltage protection as corrective actions for the 1978 Arkansas Nuclear One degraded

voltage condition event. Additionally, the team reviewed approved technical specification changes and engineering change documentation of changes to the Unit 1 and Unit 2 loss of voltage setpoints from 78 percent to 61.25 percent minimum expected

grid voltage.

The team reviewed Calculation 95-E-0001-01, "ANO Unit 1 Millstone Study - Main Calculation," Calculation 95-E-0001-02, "Millstone Study Connected LD, MCC Circuit VD, LC LD," Calculation 95-E-0001-06, "Unit 1 Control Circuit Voltage Drop," and other related calculations which verify that acceptable voltages are available during the selected second level voltage protection time delay for safety-related components in a degraded grid voltage condition.

The team determined that the licensee failed to demonstrate that, for the time delay selected, that safety-related electrical components would not fail for the allowable time duration of a degraded voltage condition. The team determined the following examples illustrate the licensee's failure to verify the degraded voltage relay design satisfied Multi-Plant Action B-23, Position 1.C:

1. Since 1999, the licensee failed to provide a calculation of record or design information that established that Units 1 and 2 safety-related 4160 V motors, 480 V motors, and control circuits would not fail, for the full 9-second degraded voltage relay time delay, when starting and running the equipment at sustained degraded voltages between the technical specification loss of voltage setpoint, 61.25 percent, and the previous acceptable technical specification setpoint of 78 percent grid voltage.

2. Since 1979, the licensee failed to consider the starting in-rush current (lock-rotor current) of Unit 1 480 V motors in a sustained degraded voltage condition to determine if thermal overload devices would trip the motors prior to the degraded voltage time delay. Calculation 95-E-0001-01, Section 5.2.3 evaluated the degraded voltage relay timer tolerance band during degraded grid voltage dips down to a 75 percent voltage for the 480 V motors to ensure that the thermal overload would not operate prior to 9 seconds. This calculation concluded that full load amperes of a motor would increase to less than 133 percent of full load amperes. At this full load amperes, the thermal overload would not operate for 1000 seconds. Therefore, the thermal overload devices would not trip the motors during the degraded voltage time delay of 8 seconds. The team determined this evaluation failed to consider the starting current (lock-rotor 27 current) of 480 V motors in a sustained degraded voltage condition. The team determined the use of starting current could produce an estimated 600 percent of full load amperes, which would reduce the time in which the thermal overload device operates.

Analysis.

The team determined that the failure to ensure that for the allowable time duration of a degraded voltage condition at all distribution levels would not result in failure of safety systems or components, in accordance with NRC Multi-Plant Action B-23, Position 1.C was a performance deficiency. The finding was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to ensure that the protective devices for the loads required at the beginning of a Loss-of-Coolant Accident would not fail under degraded voltage conditions did not ensure that these loads would be available to perform their mitigating functions. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee

performance.

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational

methods, or by the performance of a suitable testing program. Contrary to the above, from December 17, 1979, to December 2, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, the licensee did not verify that the design of the protective devices for the loads required at the beginning of a loss-of-coolant accident were adequate to prevent tripping these devices under degraded voltage conditions, which would render the affected loads non-functional. In response to this issue, the licensee performed a preliminary analysis to determine that the protective overload devices would not cause safety equipment to fail at degraded voltages allowed by technical specifications. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2016-5027 and CR-ANO-C-2016-5191. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000313/2016008-05 and NCV 05000368/2016008-05: "Failure to Ensure Safety Systems Would Survive Sustained Degraded Voltage Conditions."

.3.2 Inspection of NRC Information Notice 2012-06, Ineffective Use of Vendor Technical Recommendations

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2012-06, "Ineffective Use of Vendor Technical Recommendations," to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice. This information notice describes the NRC's review of recent operating experience involving ineffective use of vendor technical recommendations indicates that many of these events potentially allow latent failures to exist undetected and become an underlying cause of risk-significant initiating events.

The team verified that the licensee's review adequately addressed the issues in the event notification.

b. Findings

No findings were identified.

.3.3 Inspection of NRC Information Notice 2015-01, "Degraded Ability to Mitigate Flooding

Events"

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2015-01, "Degraded Ability to Mitigate Flooding Events," to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the examples described in the information notice. This information notice discusses operating experiences related to external flood protection where deficiencies with equipment, procedures, and analyses relied on to either prevent or mitigate the effects of external flooding at licensed facilities have resulted in degraded ability to mitigate flooding events. The team concluded that the licensee's evaluation addressed the specific Fukushima Daiichi and Arkansas Nuclear One flood protection issues; however, the licensee's evaluation did not address or document how other examples discussed in the information notice were either already addressed by a previously established process or were not applicable to the facility. The team did not identify any specific instances where the licensee's design or facility was vulnerable in a way similar to the other examples provided in the information notice.

b. Findings

Readiness to Cope with External Flooding

Introduction.

The team identified three examples of a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for failure to prescribe procedures appropriate to the circumstance for combating significant acts of nature such as flooding. Specifically, the licensee's procedures failed to ensure all components required to establish flood protection were installed in preparation for a flooding event.

Description.

During a follow-up inspection of Confirmatory Action Letter Area Action Plan FP-6 (Section 4OA5.1) on November 18, 2016, the inspectors reviewed licensee's procedures Operating Procedures OP-1203.025, "Natural Emergencies" [Unit 1] and OP-2203.008 "Natural Emergencies" [Unit 2]

and compared them to the flood protection design basis requirements as documented in engineering report CALC-ANOC-CS-00003 to ensure the adequacy of these procedures.

Area Action Plan FP-6 required the licensee to validate that all external flood gaps had been identified and included an associated corrective action (CA-34 of Condition Report CR-ANO-C-2014-0259) which directed the licensee to validate and update the natural emergencies procedures to ensure that all required operator actions were included in the procedures. The licensee closed this corrective action on April 26, 2014, indicating that the procedures had been validated to include all required operator actions and that no additional actions were required.

The inspectors found that while all of the components that were listed in engineering report CALC-ANOC-CS-00003 as being necessary to establish flood protection were included within Procedures OP 1203.025 and OP 2203.008, in some cases the procedures failed to ensure that the components were in their required positions prior to actual flooding occurring. Specifically:

1. Step 4 of Attachment B "Local Flooding Actions" of OP 1203.025 directed that the individual performing the step to ensure that appropriate personnel are informed to install the void area backflow preventer, but did not require verification that the backflow preventers were installed.

2. Step 5 of Attachment B "Local Flood Actions" of OP 2203.008 directed the individual performing the step to contact the Shift Manager if specified vault plugs were not installed, but required no further action.

3. Step 6 of Attachment B of OP 2203.008 directed the individual to verify that the technical support center was informed to install the void area backflow preventers if the flood was "expected to exceed 354 feet." In addition to not ensuring these components were in the required condition, it would not satisfy the Unit 2 Technical Specification 3.7.5.1 requirement to close openings and penetrations within 4-hours of exceeding 350 feet if the flood was not expected to

exceed 354 feet.

The licensee documented these issues in Condition Report CR-ANO-2-2016-4265.

Analysis.

The licensee's failure to prescribe procedures appropriate to the circumstances for combating emergencies or other significant acts of nature such as flooding was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences, and would have the potential to lead to a more significant safety concern. Specifically, the procedures' failure to ensure all components required to establish flood protection were installed in preparation for a flooding event had the potential to lead to a worse condition if left uncorrected. In accordance with 30 Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the issue screened as having very low safety significance (Green) because it does not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with identification because the licensee failed to identify issues, completely, accurately, and in a timely manner in accordance with the corrective action program. Specifically, the licensee failed to identify these deficiencies during a review of these procedures as part of actions to close significant performance deficiencies as documented in Arkansas

Nuclear One Area Action Plan FP-6 [P.1].

Enforcement.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," which states, in part that, activities affecting quality sha ll be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances. Contrary to the above, prior to December 2, 2016, the licensee's procedures prescribed to mitigate the consequences of external flooding were not appropriate to the circumstances. Specifically, Unit 1 Operating Procedure OP 1203.025, "Natural Emergencies,"

Revision 60, and Unit 2 Operating Procedure OP 2203.008, "Natural Emergencies,"

Revision 42 failed to ensure all actions required to establish external flood protection, as specified by flood protection design basis engineering report CALC-ANOC-CS-00003, Revision 00, were implemented. This issue was entered into the licensee's corrective action program as Condition Report CR-ANO-2-2016-4265. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016008-06 and NCV 0500368/2016008-06, "Readiness to Cope with External Flooding."

.3.4 Inspection of NRC Information Notice 2016-07, "Operating Experience Regarding Impacts On-Site Electrical Power Distribution from Inadequate Oversight of Contractor

Activities"

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2016-07, "Operating Experience Regarding Impacts On-Site Electrical Power Distribution from Inadequate Oversight of Contractor Activities" to verify the licensee performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice. This information notice discusses the adverse effects to off-site power availability that have resulted from inadequate oversight of contractor activities.

The team verified that the licensee's review adequately addressed the issues in the event notification.

b. Findings

No findings were identified.

.4 Results of Reviews for Operator Actions

a. Inspection Scope

The team selected risk-significant components and operator actions for review using information contained in the licensee's probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than 2 or Birnbaum value greater than 1E-6.

For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant.

The selected operator actions were:

• Scenario 1: The scenario was designed to place the Unit 2 crew in a loss of all alternating current power (station blackout) event. In the security event procedure, the crew directs cross-tying one of the Unit 2 safety-related buses with an operating Unit 1 Emergency Diesel Generator.

• Scenario 2: The scenario was designed to place the Unit 1 crew in a tornado situation. This results in a loss of all Condensate Storage Tanks, and the crew is expected to align the Emergency Feedwater Pump suction to the Essential Service Water System. The supporting analysis assumes that operators will complete this alignment within 30 minutes of a Low-Low level alarm on the qualified condensate storage tank.

• Job Performance Measure 1: This jo b performance measure was to evaluate the time it takes an operator to do a self-contained breathing apparatus, in the Unit 1 simulator.

b. Findings

No findings were identified.

4OA2 Problem Identification and Resolution

(Discussed) VIO 05000313/2013012-04 (EA-14-008), Unit 1 - Failure to Follow the Materials Handling Program during the Unit 1 Generator Stator Move, and VIO 05000368/2013012-05, Unit 2 - Failure to Follow the Materials Handling Program during the Unit 1 Generator Stator Move The team reviewed the licensee's root cause evaluations, and some completed and planned corrective actions. The licensee implemented a site-specific

Procedure EN-OM-126-ANO-RC, "Managemen t and Oversight of Supplemental Personnel," to address specific observations identified by the Vendor Oversight Team, Nuclear Independent Oversight, and the NRC. Several observations are documented in Section 4OA5.1 involving actions VO-15, VO-23, and VO-24 below.

32 The NRC will further review the licensee's evaluation of these issues and response to these risk-significant findings during future supplemental inspections. Violations VIO 05000313/2013012-04 and VIO 05000368/2013012-05 remain open.

(Discussed) VIO 05000313/20140009-01 (EA-14-088), Unit 1 - Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings, and VIO 05000368/2014009-01, Unit 2 - Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings The team reviewed the licensee's root cause evaluations, and some completed and planned corrective actions. The licens ee implemented external events procedure changes, training of personnel, performed walkdowns of internal and external flood barrier validation, and labeling of flood protection features. Several observations are documented in Section 4OA5.1 involving actions DB-3, FP-1, FP-2, FP-3, FP-6, FP-7, and FP-13 below.

The NRC will further review the licensee's evaluation of these issues and response to these risk-significant findings during future supplemental inspections. Violations VIO 05000313/2014009-01 and VIO 05000368/2014009-01 remain open.

4OA5 Other Activities

Confirmatory Action Letter Item Follow-up (IP 92702) (EA 16-124)

.1 Actions to Address Significant Performance Deficiency

DB-3 Provide training to Engineering, Operations, and Planners to increase the knowledge and skills of those groups regarding passive barriers and other Design Basis Features.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including personnel not sufficiently verifying whether plant configuration met licensing basis requirements for mitigation of flooding events when questions arose. Area action plan DB-3 was developed to address knowledge aspects of this root cause.

To evaluate the licensee's corrective action effectiveness the team reviewed corrective actions CR-ANO-C-2014-0259 CA-213, 214, 215, 219, 220, and 221; CR-ANO-C-2015-2833 CA-49, 50, 51, 52, 53, and 54.

The team reviewed corrective actions associated with developing and providing training to Engineering, Operations, and Planners to increase their knowledge and skills regarding passive barriers and other Design Basis Features, and found that the licensee had adequately documented that the training had been developed and provided to these groups (CR-ANO-C-2014-0259 CA-213, 214, and 215). The licensee also developed similar training for non-licensed operators (CA-219 and 220) and general employee training (CA-221).

The NRC team reviewed the training materials (ASLP-ESPC-DEBARRIER and ASLP-OPS-BARRIERS) developed in response to the corrective action and 33 found that they included sufficient information to support understanding flooding features and design basis requirements among the target audience.

The team determined that the corrective actions associated with tracking and verification of completion of the training corrective actions mentioned above were completed and documented and that the actions fulfilled the intent of the actions.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address DB-3 were effective. Therefore, DB-3 is closed.

FP-1 Develop external flooding design basis documentation so configuration control is defined and maintained.

• Develop an engineering report and flood prot ection drawings similar to Fire Protection drawings to clearly document the flooding design basis and credited flood protection features (credited external flood protection features and credited operator actions)

• Assign unique equipment identification to each flood protection feature and boundary During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including not having detailed design requirements of flooding features. Area action plan FP-1 was developed to address the external flooding aspects of this root cause.

To evaluate the licensee's corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-10 and supporting actions CA-52, 122, 131, 143, and 227; and CR-ANO-C-2013-0904 CA-114. The team reviewed the status of Engineering Change EC-57218 which implemented the actions specified by the corrective actions.

The team found that the licensee had clearly documented specific barriers required to provide external flood protection in their flood protection features database (CALC-ANOC-CS-15-00003) calculation and had developed a comprehensive set of external flood related drawings (A-7001 series). The license had also confirmed that similar vulnerabilities did not exist within the passive security barrier program as part of their extent of condition review.

During the team's review of CA-122, the team identified a minor violation of 10 CFR 50.36(c)(2), "Technical Specifications," which requires inclusion of limiting conditions for operation which are the lowest functional capability or performance levels of equipment required for safe operation of the facility.

Corrective action CA-122 directed the licensee to "verify the openings and the type of flooding protection required [as] described in Table 3.7-6 are in compliance with the Unit 2 Technical Specifications, specifically LCO 3/4.7.5."

34 Unit-2 Technical Specification 3.7.5.1 required flood protection be provided when the water level exceeds 350 feet above mean sea level, and initiation and completion [within 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />s] of the closure of the openings and penetrations in Table 3.7-6 using the equipment listed. Engineering Report No. CALC-ANOC-CS-15-00003, dated January 26, 2016, Section 7, "Procedures," describes those minimum actions necessary to establish external flood protection. The team found that the openings, penetrations, and equipment listed in Table 3.7-6 did not encompass all of the equipment listed in CALC-ANOC-CS-15-00003 required to establish external flood protection, and therefore, did not describe the lowest functional capability or performance level required for safe operation of the facility.

The team found that the issue of concern was the result of the licensee's failure to meet 10 CFR 50.36 which was within the licensee's ability to foresee and correct based upon corrective action CA-122 and was therefore a performance deficiency. The team concluded that the answers to all of the more-than-minor screening questions were "No" and, therefore, this issue was not more-than-minor. While minor performance violations are not routinely documented in inspection reports, Inspection Manual Chapter 0612 "Power Reactor Inspection Reports," Section 0612-14 allows for documentation when required to capture an inspection activity or conclusion. The licensee entered this issue into their corrective action program as CR-ANO-2-2016-4267. This failure to comply with 10 CFR 50.36(c)(2) constitutes a minor violation that is not subject to enforcement action in accordance with the NRC's Enforcement Policy.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-1 were effective. Therefore, FP-1 is closed.

FP-2 Develop internal flooding design basis documentation so configuration control is defined and maintained.

• Develop an engineering report and flood protection drawings similar to the Fire Protection drawings to clearly document the flooding design basis and credited flood protection features (credited internal flood protection features and credited operator actions).

• Update the Flooding ULD.

• Assign unique equipment identification to each flood protection feature and boundary.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including not having detailed design requirements of flooding features. Area action plan FP-2 was developed to address internal flooding aspect of this root cause.

To evaluate the licensee's corrective action effectiveness the team reviewed corrective actions CR-ANO-C-2014-0259 CA-248, reviewed the internal flood protection features listed in CALC-ANOC-CS-15-0003, and performed a 35 walkdown of selected areas. The team found that the licensee has developed an effective process for clearly identifying and documenting internal flood protection features similar to the actions taken for external flood protection (FP-1).

The team found that related corrective actions CA-230, 231, 232, 233, 234, 235, 236, 237, and 238 were scheduled to be completed on or after January 26, 2017. These actions were associated with standards performance deficiencies identified during a focused self-assessment of ANO HELB/MELB [high energy line break/medium energy line break] as documented in CR-ANO-C-2015-2309.

The team concluded that corrective actions to address these deficiencies could potentially impact the internal flood protections features. The team concluded that action FP-2 should remain open. Corrective actions CA-230, 231, 232, 233, 234, 235, 236, 237, and 238 will be reviewed in a future inspection after the licensee completion determining whether they have any impact on the internal flooding design protection features.

FP-3 Label external flood barriers in the plant to provide in-field awareness of flood protection features.

As part of the licensee's efforts to improve equipment reliability, the licensee committed to labeling external flood barriers in the plant to aid in configuration control. Area action plan FP-3 was developed as a corrective action to prevent recurrence.

To evaluate the licensee's corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-11 and

CR-ANO-C-2013-1304 CA-85. The team also performed a walkdown of selected areas of the plant to confirm actions taken and reviewed work process documents to verify completion status.

The team determined that the licensee had painted stripes on the floors, walls of the auxiliary building, and other structures (both internal and external) to provide visual reminders to personnel that they form a portion of the physical flood barrier. The licensee had stenciled penetration numbers and clearly denoted them as flood barriers where penetrations crossed a flood boundary and where a seal was located. Similarly, the licensee labeled floor drains that crossed the external flood boundary and have open drain paths on both sides (floor and ceiling) as appropriate.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-3 were effective. Therefore, FP-3 is closed.

FP-6 Validate that all external flood gaps identified from the review of documentation for credible flood paths and the follow-up walkdowns have been resolved.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including licensee personnel not sufficiently challenging and verifying whether plant conditions met license basis requirements for flood 36 mitigation and not having detailed design requirements of flooding features. Area action plan FP-6 was developed as one of the corrective actions to prevent recurrence to address external flooding aspect of this root cause.

To evaluate the licensee's corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-17 and supplemental actions CA-14, 20, 31, 32, 33, 34, 37, 39, 40, 59, 68, 69, 77, 142, 146, 202, 205, 206, 208, and 209.

During review of CA-34, the team identified additional examples of the Yellow flood finding associated with the adequacy of the licensee's natural emergency procedures for both Units 1 & 2. Corrective action CA-34 directed the licensee to validate and update natural emergencies procedures to ensure that all required operator actions are included. This action was closed on April 26, 2014, as complete. This finding was documented in Section 1R21.3.3.b of this report.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-6 were effective. Therefore, FP-6 is closed.

FP-7 Perform walkdowns of all credited internal flood protection features and document the results in an engineering report.

During the 95003 supplemental inspection, the NRC team acknowledged that one of the contributing cause to the flooding issue was Entergy personnel provided inadequate oversight of outside design agency activities related to Fukushima walkdowns. The licensee initiated area action plan FP-7 to walkdown the credited internal flood protection features to ensure adequate protection from internally generated flood events.

To evaluate the licensee's corrective action effectiveness the team reviewed corrective actions CR-ANO-C-2014-0259 CA-82, 18, and 112.

The team determined that the licensee had contracted supplemental personnel and completed walkdowns of all accessible areas in the plant that contained internal flood protection features and had initiated a corrective action to track the one inaccessible area while at power to schedule the walkdown during an outage. The licensee's documents show the licensee provided adequate oversight of the contractor's follow-up walkdowns to ensure that the Fukushima Near Term Task Force Recommendation 2.3 was properly implemented and all identified comments were addressed.

However, corrective action CA-112 directs that "after the internal flood analysis, verify silicone foam seals have been upgraded or modified to watertight seals in all locations requiring internal flood seals." This action was originally scheduled for completion by June 23, 2016, but was extended until December 31, 2017.

The justification for this extension states that "all identified concerns relative to internal - flood boundaries have been addressed through the CR process and related Operability Determination process," and "in general, silicone foam seals are currently deemed acceptable in internal flood boundary applications-."

37 However, it also states that "the full scope of the seals/locations that require upgrade or modification are not yet known."

The team concluded that the justification for the due date extension to CA-112 left it unclear whether the walkdowns of all credited internal flood protection features had been performed and whether all deficiencies had been identified, documented, and evaluated in the corrective action process. The team concluded that action FP-7 should remain open and that this action will be reviewed in a future inspection.

FP-13 Develop and conduct initial and continuing training essential to understanding and maintaining the license basis for flood barrier features. Address Operations, Engineering, and Work Planning groups.

During the 95003 supplemental inspection, the NRC team concluded that the licensee used appropriate processes in the development of the root causes for the flooding event including personnel not sufficiently verifying whether plant configuration met licensing basis requirements for mitigation of flooding events when questions arose. Similar to area action plan DB-3, this action FP-13 was developed to address knowledge aspects of this root cause.

The team found that the licensee had adequately documented that the training had been developed and provided to these groups. In addition to the documents reviewed for area action plan FP-1, the team reviewed corrective actions CR-ANO-C-2014-0259 CA-216, 217, and 218; and CR-ANO-C-2013-1304 CA-27. The additional corrective actions were initiated to determine whether the training provided for Engineering, Operations, and Work Planning would be conducted in initial and continuing training, or initial training only.

The licensee concluded that Operations and Engineering training would be provided on a recurring basis but that training provided to Work Planning groups would be one-time training. In response to the NRC team's questions, the licensee stated that the qualification of work planners was not an accredited training program and, therefore, did not have recurring training requirements. In addition, the licensee stated that the training was included in the program for becoming a work planner and that the macro for developing work planning documents included a question to remind the planner to consider the potential impact on design basis flood barriers. The team concluded that this appeared to be a reasonable conclusion.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address FP-13 were effective. Therefore, FP-13 is closed.

VO-15 Review current processes in Engineering related to the Vendor Oversight Fundamental Problem. Determine if additional actions are required to address less formal interfaces with suppliers of contract services. Assign additional actions as warranted to address any gaps identified.

During the 95003 supplemental inspection, the NRC team concluded that actions to improve contractor oversight were not fully effective; further action was needed 38 because oversight plans for contract outage workers were inadequate, qualification requirements for contractors to act as supervisors did not have a consistent standard, and designated ANO oversight personnel lacked adequate guidance and training to perform their oversight role.

To evaluate the licensee's corrective action effectiveness, the team reviewed corrective actions CR-ANO-C-2015-2838 CA-11, CR-ANO-C-2015-4620, CR-ANO-C-2016-0985, and Procedure EN-OM-126-ANO-RC, "Management and Oversight of Supplemental Personnel,"

Revision 1. Specifically, the team reviewed the gap analysis CR-ANO-C-2015-2838 of 14 engineering program procedures that control the use and acceptance of supplemental personnel or vendor services. Additionally, the team reviewed the apparent cause evaluation of CR-ANO-C-2016-0985 to determine if actions associated with the identified gaps in vendor oversight were corrected.

In their gap analysis, the licensee concluded that no action was required to document any less than formal interface between engineering staff and supplemental support. The review identified that the engineering procedures contained the appropriate language to ensure oversight of vendor activities were maintained. The review concluded that more focus was needed on the use of the current procedures. The team verified this conclusion by independently interviewing engineering and vendor staff on activities that were conducted in the recent ANO Unit 2 refueling outage. The team concluded that the engineering procedures and supplemental personnel procedures include appropriate language to complete effective oversight of vendors and supplemental personnel.

To determine the effectiveness of the corrective actions, the team reviewed oversight plans, oversight plan scorecards, and field verification/rapid trending forms for ten activities using supplemental workers completed under the vendor oversight program from the previous year. The team verified the licensee ensured vendor contract wording was appropriate, included appropriate oversight procedures and frequency in oversight plans, and completed periodic observation and trending of supplemental work activities. The team concluded that, through these activities, the licensee appropriately implemented the vendor oversight guidance of EN-OM-126-ANO-RC.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address VO-15 were effective. Therefore, VO-15 is closed.

VO-23 Revise Procedure EN-DC-114, "Project Management," to provide guidance in specifying contract language which will ensure detailed engineering calculations, quality requirements and standards are provided for internal and third party

review, in accordance with revised Procedure EN-MA-119, "Material Handling Program," when specially designed temporary lift assembles are to be used.

As part of the ANO's efforts to improve vendor oversight, the licensee committed

to revising Procedure EN-DC-114, "Project Management," to provide guidance on specifying contract language to provide documentation, requirements, and standards for internal, third-party reviews when temporary lift assemblies are 39 used. Area action plan VO-23 was developed as a corrective action to prevent recurrence of the stator lifting rig failure.

To evaluate the licensee's corrective action effectiveness, the team reviewed CR-ANO-C-2013-0888 CA-19, Procedure EN-DC-114, and Procedures EN-FAP-PM-003, "Project Implementation - Segment 1 & 2," and EN-FAP-PM-004, "Project Implementation - Segment 3 & 4." In addition, the team reviewed engineering change package EC 47488, which installed a temporary support structures to the Unit 2 containment building for ASME Code required tendon surveillance testing.

The team verified that the corrective actions to include guidance in the project management and implementation procedures were complete. The team verified through independent review of the engineering change package EC 47488, that the licensee implemented the guidance of Procedures EN-FAP-PM-003 and

EN-FAP-PM-004 effectively.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address area action plan VO-23 were effective. Therefore, VO-23 is closed.

VO-24 Revise Procedure EN-MA-119 to require a documented engineering response to evaluation critical lifts if using any s pecially designed temporary lifting device, any lifting device that cannot be load tested per EN-MA-119 criteria, or any lifting device without a certified load rating name plate rating affixed to it.

As part of the ANO's efforts to correct conditions that led to the stator lifting rig failure, the licensee committed to revise Procedure EN-MA-119, "Material Handling Program," to require an engineering response to evaluate critical lifts if using a special design temporary lifting device. Additionally, the licensee removed a Note from EN-MA-119 which led to the use of the stator lifting rig without appropriate qualification. Area action plan VO-23 was developed as a corrective action to prevent recurrence of the stator lifting rig failure.

To evaluate the licensee's corrective action effectiveness the team reviewed CR-ANO-C-2013-0888 CA-20 and revisions to Procedure EN-MA-119. In addition, the team reviewed engineering change packages EC 66908 and EC 66817, which documented formal evaluations of rigging components of the temporary lifting rig used to lift parts of the emergency diesel generator 2K-4.

The team verified that the corrective actions to revise Procedure EN-MA-119 to include an engineering response to evaluate critical lifts evaluations for temporary lift rigs and to remove the Note were complete. The team verified through independent review of the engineering change packages previously mentioned, that the licensee implemented the revisions of Procedure EN-MA-119 effectively.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address VO-24 were effective. Therefore, VO-24 is closed.

.2 Actions to Address Equipment Reliability and Engineering Programs

PM-1 Create a site specific procedure for component classification that will ensure appropriate classification of equipment for Preventive Maintenance based upon risk and safety.

During the 95003 supplemental inspection, the NRC team agreed with licensee's assessment that the preventive maintenance program was deficient in preventing risk-significant equipment failures. While no single event or action appears to have triggered the preventive maintenance program deficiencies, a gradual decline of licensee performance appears to have started at least 8 years ago and was accelerated by changes to Procedure EN-DC-324, "Preventive Maintenance Program."

To evaluate the licensee's preventive maintenance program effectiveness, the team reviewed CR-ANO-C-2015-2834 CA-0111, Procedure EN-DC-153-ANO-RC, Revision 0 "Preventive Maintenance Component Classification," Revision 0, Procedure EN-DC-324-ANO-RC, "Preventive Maintenance Program,"

Revision 0, and corrective action effectiveness review LO-ALO-2015-00001.

The team determined that the licensee had implemented the actions identified in CR-ANO-C-2015-2834 CA-0111, and ensured appropriate classification of equipment for preventive maintenance tasks based upon risk and safety. The licensee also created site specific Procedure EN-DC-153-ANO-RC, Revision 0, using the revised fleet procedure as a base and issued on April 6, 2016. Using the revised procedures, the licensee has since, through their corrective action

program, identified and revised the preventive maintenance classification of several components based upon risk and safety are assigned.

Based on the actions taken by the licensee, data evaluated by the team, and observations performed on site, the team concluded that the actions taken to address PM-01 were effective. Therefore, PM-01 is closed.

.3 Service Water System Self-Assessment

To ensure conditions adverse to quality are identified and resolved, the licensee will conduct a focused self-assessment of the Units 1 and 2 service water systems in accordance with station procedures and NRC Inspection Procedure 93810, "Service Water System Operational Performance Inspection," by December 2016.

The service water system self-assessment began in late September 2016 and was scheduled to be completed by December 31, 2016, with the issuance of the self-assessment report. The report was not issued at the time of the onsite portion of the inspection.

The team reviewed the licensee's focused self-assessment plan for the service water system operational performance inspection. The team compared the self-assessment activities to the guidelines in NRC Inspec tion Procedure 93810, "Service Water System Operation Performance Inspection." The team reviewed the self-assessment objectives, task descriptions, and self-assessment staffing. The team reviewed the contract, scope 41 of work, and qualifications of the self-assessment supplemental staff. The team verified that the licensee's service water self-assessment plan addressed every guideline and aspect of NRC Inspection Procedure 93810.

As of November 1, 2016, the team reviewed the 17 condition reports generated by the licensee's self-assessment. The team determined that these 17 issues identified were appropriately entered and classified in the corrective action program. Additionally, the team concluded that the licensee appropriately classified the associated operability determinations. The team did not review the resolution of the 17 issues identified because planned corrective actions were not complete at the time of the onsite inspection.

As the licensee was simultaneously performing the self-assessment, the component design bases inspection team inspected service water system components. The results of this inspection were compared with the licensee's self-assessment activities. The results of the component design basis inspection are documented in Section 1R21 of this report. There were some service water system conditions identified by the NRC that were previously identified by the licensee's self-assessment. Few of the service water system issues identified by the NRC had not been previously identified by the licensee's self-assessment; however, those aspects of the self-assessment under which they could be identified were not complete by the end of the onsite inspection. Therefore, based on this comparison, conclusions of effectiveness of the self-assessment would not be appropriate.

The team concluded that this action will remain open. This action will be reviewed during a future inspection after the licensee has issued the self-assessment report and developed a plan to address the findings and recommendations documented in the report. Additionally, the NRC will need to review a sample of corrective actions associated with the identified conditions to ensure resolution.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On February 9, 2017, the inspectors presented the inspection results to Mr. B. Davis, Director of Engineering, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

A1-

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Anderson, Site Vice President

T. Evans, General Manager

G. Sullins, Acting Director, Regulatory

Assurance and Performance Improvement

B. Davis, Director, Engineering

D. James, Director, Recovery

R. Penfield, Director, Regulatory Assurance

P. Butler, Manager, Design Engineering

M. Skartvedt, Manager, Systems and Components

D. Perkins, Senior Manager, Operations

S. Pyle, Manager, Regulatory Assurance

D. Marvel, Acting Manager, Maintenance

N. Mosher, Regulatory Assurance

M. Hall, Regulatory Assurance

L. Cloninger, Design Engineering

B. Miller, Design Engineering

L. McConnell, Design Engineering

M. Estep, Design Engineering

B. Buser, Design Engineering

B. Pace, Senior Manager, Production

B. Daiber, Manager, Engineering

J. Toben, Senior Manager, Project Management

D. Edgell, Manager, Recovery

NRC Personnel

R. Deese, Senior Reactor Analyst

C. O'Keefe, Chief, Projects Branch E

B. Tindell, Senior Resident Inspector

M. Tobin, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000313/2016008-01 NCV

Failure to Verify the Adequacy of Motor Operated Valve Thermal Overload Devices (Section 1R21.2.1.b.1)

05000313/2016008-02

05000368/2016008-02 NCV Failure to Incorporate NRC Safety Guide 9 Criteria into

Surveillance Procedures (Section 1R21.2.1.b.2)

05000313/2016008-03

05000368/2016008-03

FIN Failure to Monitor Startup Transformers 1, 2, and 3 Voltage Regulator/Tap Changer Function (Section 1R21.2.2.b.1)

05000313/2016008-04 NCV Failure to Perform an Adequate Emergency Feedwater Pump Suction Transfer Design Calculation or Testing (EA 2017-017) (Section 1R21.2.7.b.1)

Opened and Closed

05000313/2016008-05

05000368/2016008-05 NCV Failure to Ensure Safety Systems Would Survive Sustained

Degraded Voltage Conditions (Section 1R21.3.1.b.1)

05000313/2016008-06

05000368/2016008-06 NCV Readiness to Cope with External Flooding (Section 1R21.3.3.b.1)

Discussed

05000313/2013012-04

05000368/2013012-05

VIO Failure to Follow the Materials Handling Program during the

Unit 1 Generator Stator Move (Section 4OA2)

05000313/2014009-01

05000368/2014009-01

VIO Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings (Section 4OA2)

LIST OF DOCUMENTS REVIEWED

Calculations

Number Title Revision 0062-0174-CALC-001 MPR's calc ECP Vortexing Calculation 0 00-E-0012-07 Containment Cooler Performance Considering Flashing Due to Low Fouling

06-E-0002-01 ANO Offsite Power Requirements 1 09-E-0002-01 Startup @ Fast and Manual Transfer Capability 1 09-E-0016-01 SUT 1 & Unit Aux Millstone Studies

0

09-E-0019-01 Aux Transformer Short Circuit Study

1

2-4720-3 Emergency Cooling Reservoir 0

79-D-2153-01 Sizing of CCW Heat Exchanger Bypass of SW 0 80-D-1109-02 ARMCO Sluice Gate Installation Seismic Analysis 1 82-D-1114-06 Pressurizer SRV Piping Load Analysis 0

2-D-2086-01 Volume of CST T-41B Requiring Tornado Missile Protection 4

2-D-2086-146 Qualification of Addition of Valve

CS-275 to EFW Pump Suction 2

83-D-1040-01 ERV Flowrate Under Safety Valve Discharge Conditions 0

84-E-0083-01 Protective Device Coordination Study 11 84-E-0083-12 Bkr 152/311 Setting 1 84-E-0083-51 DC Load Center D02 3

86-E-0002-01

Diesel Generator 1 & 2 Load Study 18

87-D-1088-06 Steady State Containment Temperature Mathematical Model 0

88-1107-04 Engineering Evaluation for Altering the Return Air Flow Distribution

88-E-0098-20

ANO-1 DBA Reanalysis 2 88-E-0200-17 PT Calculation for Unit 2 Component Cooling Water System 4

Calculations

Number Title Revision89-D-2001-05 Unit 2 Intake Structure Free Convection Cooling 2 89-E-0044-02

ANO-1 SW Pump NPSH and Submergence Requirements 0 89-E-0044-03 Unit 2 Service Water Pump Suction Requirements 0

90-E-0045-01 Seismic Qualification for the RB Cooling Units

VSF-1A,

VSF-1B,

VSF-1C, and

VSF-1D

91-E-0099-04 ECP Heat Loads and Condensate Inventory Demand 2 91-E-0099-12 Emergency Cooling Pond Analysis with VPLUG 1 91-E-0099-14 ECP Peak temperature and Inventory Analysis 2 91-E-0099-14 ECP Peak Temperature and Inventory Loss Analysis 0

91-E-0107-01 Unit 2 Fuel Oil Transfer Pump NPSH 2

91-E-0107-02 2T-57A & B Capacity (Emergency Fuel Oil Storage Tanks) 1

91-E-0107-04 Emergency Diesel Generator (EDG) Fuel Oil Consumption 2 91-E-0107-05 EDG Day Tank T30A, T30B Capacity Evaluation 0 91-E-0107-06 EDG Day Tank T57A, T57B Capacity Evaluation 2

91-E-0107-07

ANO-1 EDG Fuel Consumption 1

91-E-0107-09 EDG Minimum FO Rating and Maximum Consumption 0

91-R-2013-01 Service Water Performance Testing Methodology 27

2-D-1019-01 Water System Water Hammer Analysis 0 92-D-1019-03 Water Hammer Mitigation Analysis 0 92-D-1019-11 Time Delay of RB Cooler Valves after ES actuation and Stroke times for

CV-3812,

CV-3813,

CV-3814, and

CV-3815

92-D-2011-07 Protective Device Settings for Circuit Breaker 2A1001 and Generator 2K9

92-D-2021-01 Voltage Settings for SU 1, SU 2, and SU 3 Regulators 1 92-E-0009-01 AC MOV Terminal Voltage

11

Calculations

Number Title Revision92-E-0021-02 D01 DC System Short Circuit Study 4 92-E-0021-03 D02 DC System Short Circuit Study 4 92-E-0021-08 Class 1E 125 VDC Train 1 DC Voltage Drop Study 1

2-E-0037-03 AC Equipment Models for SC and LF Studies 5

93-R-0003-01 Offsite Power System Voltage Re-evaluation 9

94-E-0018-02 GL89-10 MOV Cable, Breaker, and TOL Evaluation

3

94-SQ-1001-00 U1-SQUG SEWS and OSVS for Equipment Class 0 95-E-0001-01 Unit 1 Millstone Study - Main Calculation 0 95-E-0001-02 Millstone Study Connected LD, MCC Circuit VD, LC LD 4

95-E-0001-06 Unit 1 Control Circuit Voltage Drop

1

95-E-0023-01 Water Hammer Load Reconciliation for the Reactor Building Cooling Coil Service Water Supply and Return Lines

96-R-1006-01 USI A-46 (SQUG) Seismic Evaluation of

ANO-1 0 97-E-0034-01 SWS Containment Fan Cooler Water Hammer Analysis 0

99-E-0044-01 Agastat Time Delay Relay Life Extension 0

99-E-0099-10 ECP Peak Temperature and Inventory Loss Analysis Summary 3

CALC-ANOC-CS-15-00003 ANO Flood Protection Design Basis 4

ENS-DC-199 Offsite Power Supply Design and Interface Requirements 9

EES-12 MOV Electrical Evaluation

4

0062-0170-LTR-

001 ANO EFW Pumps Suction Analysis 0

Drawings

Number Title Revision12-CON-141 Large Pipe Isometric Emergency Feedwater, Sh. 1 2

Drawings

Number Title Revision2HBD-35-1 Service Water Branches 11 83-647 Floating Deck for Condensate Storage Tank T-41 0

C-2064 Emergency Cooling Pond Intake to Service Water Intake Bay, Unit 2 9 C-64 Emergency Cooling Pond Intake to Service Water Intake Bay, Unit 1 7 E-1, Sh. 1 Station Single line Diagram 59 E-100, Sh. 1 Schematic Diagram, Diesel Generator DG1

ACB 27 E-15 480V MCC B51 and B52 Single Line Diagrams 65

E-16

480V MCC B55 and B56 Single Line Diagrams

70

E-17, Sh. 1 Red Train Vital AC and 125 VDC Single line and Distribution 50

E-17, Sh. 1A Green Train Vital AC and 125 VDC Single line and Distribution 17 E-19 480V MCC B57 and B65 Single Line Diagrams 12 E-2001, Sh. 1 Station Single Line Diagram 37

E-2004, Sh. 1 Single Line Meter & Relay Diagram 4160 Volt System, Main Supply 19 E-2005 Single Line Meter & Relay Diagram, AAC Generator System 4.16KV Generator & Switchgear

E-2005, Sh. 1 Single Line Meter & Relay diagram, 4160 V Load Center Engineered Safety Features

E-2008, Sh. 1 Single Line Meter & Relay diagram, 480 V Load Center Engineered Safety Features & Main Supply

E-2042 Logic Diagram, AAC Generator System, Sheets 1 - 4 0 & 1 E-2116 Schematic Diagram, AAC Generator System, Sheets 1 - 14 0 E-2613 External Connection Diagram, AAC Generator System,

Sheets 12 - 13

E-275 Schematic Diagram Service Water Pump "A" P4A, Sheet 1 31

Drawings

Number Title RevisionE-280 Reactor Building Coolers VCC2C,D Service Water Isolation Valve CV3813, Sh. 2A

E-4 Single Line Meter & Relay Diagram, 4160 Volt System, Main Supply, Sheet 1

E-5 4160V System Engineered Safeguard Single Line Diagram 26 E-8 480V Load Centers Engineered Safeguard Single Line Diagram 28

M-204 Unit 1 Emergency Feedwater, Sheet 3

34 M-204 Unit 1 Emergency Feedwater, Sheet 5

18 M-210 Service Water - Sheet 1 150

M-217 Emergency Diesel Generators K-4A (DG1) - Sheet 2 43

M-217 Emergency Diesel Generators K-4B (DG2) - Sheet 3 24

M-217 Emergency Diesel Generators Fuel Oil Storage - Sheet 1 89 M-2210 Service Water - Sheet 1 90 M-2210 Service Water - Sheet 2 83

M-2210 Service Water - Sheet 3 91

M-2217 Emergency Diesel Generator Fuel Oil System - Sheet 1 64

M-2234 Component Cooling Water System - Sheet 1 70

M-2234 Component Cooling Water System - Sheet 2 65

Procedures

Number Title RevisionEN-DC-153-ANO-RC Preventive Maintenance Component Classification 0

EN-DC-324-ANO-RC Preventive Maintenance Program 0

OP-2203.008 Natural Emergencies ---

OP-1203.025 Natural Emergencies 60

Procedures

Number Title RevisionEN-DC-324 Preventive Maintenance Program 8

EN-HU-106 Procedure and Work Instruction Use and Adherence 3

EN-LI-102 Corrective Action Program 28

CEP-IST-4 Standard on Inservice Testing 308

CEP-IST-3 Inservice Testing Cross-Reference Document 315

CEP-IST-2 Inservice Testing Plan 319

CEP-IST-1 Inservice Testing Bases Document 316

EN-FAP-LI-001 Condition Review Group 6

SEP-ANO-1-IST-1 ANO Unit 1 Inservice Testing Bases Document 2

86-E-002-01 Emergency Diesel Generator Loading -

RED 18

1015.018 Plant Labeling 14

1015.050 Time Critical Operator Actions Program 6 1103.005 Pressurizer Operation 46 1104.036 Emergency Diesel Generator Operation 73

1106.006 Emergency Feedwater Pump Operation 98

1107.003 Inverter and 120V Vital AC Distribution 26

203-012 Annunciator K10 Corrective Action 55

1412-216 Unit 1 Vital 120VAC 10KVA Inverter Inspection, Test, and Maintenance Instructions

1203.012A Annunciator K01 Corrective Action 44 1203.012K Annunciator K12 Corrective Action 48

203.030 Loss of Service Water 24

203.048 Security Event 33 1403.179 Molded Case Circuit Breaker Testing 29

Procedures

Number Title Revision1412.057 480V Load Center Switchgear Cleaning and Inspection 12 1412.061 Unit 1 DC Motor Control Center Cleaning and Inspection 11 1416.038 Siemens Circuit Breaker Maintenance 15

1416.042 K-line Circuit Breaker

PM 12

1416.046 Unit 1 Emergency Diesel Generator Governor Maintenance 6

2104.007 Control Room Emergency Air Conditioning and Ventilation 65

2104.028 Component Cooling Water System Operations 14 2104.036 Emergency Diesel Generator Operation 91 2104.037 Alternate AC Diesel Generator Operations 32

2107-002 ESF Electrical System Operations 37

203-12H Annunciator 2K08 Corrective Action 37

202.001 Standard Post Trip Actions 15 2202.007 Loss of Offsite Power 13 2202.008 Station Blackout 13

203.008 Natural Emergencies 41

203.012H Annunciator 2K08 Corrective Action 37

203.012U Annunciator 2E12 Corrective Action 21

203.0121 Annunciator 2K09 Corrective Action 34 2203.025 RCP Emergencies 18

Quality Assurance Program Manual

30

EN-OP-104 Operability Determination Process 11

EN-OM-126-ANO-RC Management and Oversight of Supplemental Personnel 1

EN-LI-102 Corrective Action Program 28

Procedures

Number Title RevisionEN-DC-126 Engineering Calculation Process 6

Design Change Packages Number Title Revision/Date

27083036

ANO-1 & 2 Condensate Make-Up Degasification Project September 2, 1987 92-1019 U1 Service Water and Auxiliary Cooling Water Hammer Concerns September 16, 1994

DRN 04-295 Evaluation of EDG for Voltage and Frequency Variations 13

EC 40395 Load Center Transformer X-5 instrumentation Upgrade

WR 286709

EC 48771 SUT 1 Open Phase Detection 6

ER 974450 Design Package to Implement LOV/DV Setpoints February 16, 2001

ER 980912 Design Package to Implement Changes to LOV Settings December 2, 1998 ER-ANO-2000-

2670-004 Common Loop Operation of CCW 0

ER-ANO-2001-0511-011 CCW Heat Exchanger, 2E-28A, 2E-28B, 2E-29C, Tube Plugging Limits

EC 66908 2K-4A Generator End Bell Spreader Beams 2

EC 66817 2K-4A EDG Swivel Installation ---

Vendor Documents Number Title Revision/DateER-ANO-2001-

0396-01 EFW Pump with Impeller Patt. No. 5HMTA3, Dia. 10.25x9.625

August 31, 1970

TD-G080-3480 Application and Selection of General Electric Molded Case circuit breaker

Vendor Documents Number Title Revision/DateTDQ0110030 Qualitrol Corporation Remote Thermometer Controller 104

Series 0 TDS445-0020 Installation, Operating and Maintenance Instructions for Struthers Component Cooling Water Heat Exchangers

TD-W120-0570 Instructions

AB-DE-ION Circuit Breakers Standard Types ED, EHB, FB and Mark 75 Type HFB

TD-W120-0580 Instructions

AB-DE-ION Circuit Breakers Standard Types JB, KA, HKA and Mark 75

TD-W120-0600 Instructions

AB-DE-ION Circuit Breakers Standard Types Molded Case Switches

PO259769 Vendor Manual Step Voltage Regulator 12 M-0067E Vendor Manual Beckwith Tap Changer Control --- S210-40-3 Load Tap Changer Type 550CS --- 03040D Woodward Governor Type UG Dial ---

TDS188-0240

Vendor Instructions Siemens 3AF-GER Breakers October 4, 2000

Design Basis Documents Number Title Revision

ULD-1-SYS-16 4.16KV System

4

ULD-1-SYS-17 480VAC Distribution System

2

ULD-1-SYS-10 ANO Unit 1 Service Water System 15

ULD-2-SYS-01 ANO Unit 2 Emergency Diesel Generator System 9

ULD-2-SYS-10 ANO Unit 2 Service Water System 12

Correspondence Number Title Date 0CAN010702 Request for Additional Information to Generic Letter 2006-02 January 31, 2007

Correspondence Number Title Date 0CAN021401 Response to Request for Additional Information Regarding Bulletin 2012-01

February 3, 2014 0CAN029304 Letter from ANO to NRC, Station Blackout Commitment for One-Time Confirmatory Load Test February 26, 1993 0CAN030601 60 Day Response to Generic Letter 2006-02 March 29, 2006 0CAN049107 Letter from ANO to NRC, Response to Station Blackout Safety Evaluation Report April 15, 1991 0CAN049512 Letter from ANO to NRC, Notification of Completion of the Station Blackout, NUMARC Part B.12 Test April 18, 1995 0CAN051402 Additional Revised Response to

NRC 10

CFR 50.54(f) Request for Information Regarding Near-Term Task Force (NTTF) Recommendation 2.3, Flooding Arkansas Nuclear One -

Units 1 and 2 May 15, 2014 0CAN069302 Letter from ANO to NRC, Additional Information Regarding the Proposed SBO Diesel Generating Testing June 29, 1993 0CAN089203 Letter from ANO to NRC, Conceptual Design for Station Blackout Modification August 14, 1992 0CAN119507 Letter from ANO to NRC, Notification of Completion of Station Blackout Diesel Testing Commitments November 17, 1995 0CNA119310 Letter from NRC to ANO, Station Blackout (SBO) Commitment for a One-Time Confirmatory Load Test November 24, 1993 0CNA129208 Letter from NRC to ANO, Conceptual Design for Station Blackout (SBO) Modification December 18, 1992 1CAN087815 Proposed Plant Modifications Degraded Voltage August 23, 1978 1CAN090001 Proposed Technical Specification Changes for Loss of Voltage/Degraded Voltage Relay Settings September 28, 2000 1CNA030101 Amendment Loss of Voltage/Degraded Voltage Relay Setting Changes March 12, 2001 1CNA119903 Letter NRC to ANO, Completion of the ECP Licensing Basis Review November 19, 1999

Correspondence Number Title Date 1CNA127919 Safety Evaluation Report for Proposed Mods Degraded Voltage December 17, 1979

LIC-94-160 Technical Specification Clarification for EDG Operability in Mode 5 & 6 with Fuel Oil Transfer System Cross-Connected July 1, 1994

Other Numbers Title Revision\Date 87-2663 CST Operability Assessment Following Lid Seal Deterioration/Separation December 22, 1987 87-2663 10

CFR 50.59 Review September 15, 1987 C-12-1208 OE Review of NRC

IN 2012-06 May 23, 2012

EN-OE-100 Review of

SEN 283 Catawba Dual Unit Scram 9

NFPA-805 Implementation Oversight Plan 0

Condition Reports

CR-ANO-1-1998-0412

CR-ANO-1-2000-0182

CR-ANO-1-2005-2644

CR-ANO-1-2007-2338

CR-ANO-1-2013-0253

CR-ANO-1-2015-0394

CR-ANO-1-2015-0982

CR-ANO-1-2016-0327

CR-ANO-1-2016-0778

CR-ANO-1-2016-0985

CR-ANO-1-2016-1559

CR-ANO-1-2016-4333

CR-ANO-1-2016-4750

CR-ANO-2-2003-1483

CR-ANO-2-2003-1584

CR-ANO-2-2004-1033

CR-ANO-2-2006-0253

CR-ANO-2-2007-0313

CR-ANO-2-2009-1126

CR-ANO-2-2015-2361

CR-ANO-2-2016-4061

CR-ANO-2-2016-4065

CR-ANO-2-2016-4115

CR-ANO-2-2016-4194

CR-ANO-C-2003-0923 CR-ANO-

C-2009-0597

CR-ANO-C-2012-0657

CR-ANO-C-2012-0657 CR-ANO-

C-2013-0888

CR-ANO-C-2013-0888

CR-ANO-C-2013-0904 CR-ANO-

C-2013-1097

CR-ANO-C-2013-1304

CR-ANO-C-2014-0059 CR-ANO-

C-2014-0259

CR-ANO-C-2015-1578

CR-ANO-C-2015-1925 CR-ANO-

C-2015-1962

CR-ANO-C-2015-1963

CR-ANO-C-2015-2309 CR-ANO-

C-2015-2833

CR-ANO-C-2015-2834

CR-ANO-C-2015-2838 CR-ANO-

C-2015-4620

CR-ANO-C-2015-4961

CR-ANO-C-2016-0907 CR-ANO-

C-2016-1155

CR-ANO-C-2016-3234

CR-ANO-C-2016-3480

Condition Reports

Generated during the Inspection

CR-ANO-1-2016-4288

CR-ANO-1-2016-4341

CR-ANO-1-2016-4343

CR-ANO-1-2016-4344

CR-ANO-1-2016-4377

CR-ANO-1-2016-4382

CR-ANO-1-2016-4497

CR-ANO-1-2016-4785

CR-ANO-1-2016-4794

CR-ANO-1-2016-4820

CR-ANO-1-2016-5130

CR-ANO-1-2016-5166

CR-ANO-1-2016-5725

CR-ANO-2-2016-4091

CR-ANO-2-2016-4095

CR-ANO-2-2016-4103

CR-ANO-2-2016-4105

CR-ANO-2-2016-4113

CR-ANO-2-2016-4115

CR-ANO-2-2016-4120

CR-ANO-2-2016-4124

CR-ANO-2-2016-4165

CR-ANO-2-2016-4244

CR-ANO-2-2016-4257

CR-ANO-2-2016-4265

CR-ANO-2-2016-4366

CR-ANO-2-2016-4393

CR-ANO-1-2017-0040 CR-ANO-

C-2016-4745

CR-ANO-C-2016-4777

CR-ANO-C-2016-4841 CR-ANO-

C-2016-4854

CR-ANO-C-2016-4861

CR-ANO-C-2016-4879 CR-ANO-

C-2016-4980

CR-ANO-C-2016-4996

CR-ANO-C-2016-5012 CR-ANO-

C-2016-5013

CR-ANO-C-2016-5015

CR-ANO-C-2016-5016 CR-ANO-

C-2016-5017

CR-ANO-C-2016-5027

CR-ANO-C-2016-5046 CR-ANO-

C-2016-5147

CR-ANO-C-2016-5172

CR-ANO-C-2016-5191

Work Orders

23606

198454-01

308739

308747

331189

364641-01

379985

392439-01

392439

404627

404841

426848

426848

50238597-01

50278313

50278313

51002419

51561818

52382570

52415472

52464709

52464719

52507666

52508906

52508923 T-02

2508923 T-01

52511227

52516179

52533991

52571929-01

2571944

52574942

52579162

52588775

52596092

2611220

52661974

52661975

52661976

52661981

198424010

System Health Reports Number Title Date

Unit 1 Emergency Diesel Generator Q2-2016

Unit 1 FO - Diesel Fuel Oil Storage and

Transfer Q2-2016

Unit 2 Emergency Diesel Generator Q2-2016

System Health Reports Number Title Date

Unit 2 FO - Diesel Fuel Oil Storage and

Transfer Q2-2016

Unit 1 Service Water Q2-2016

Unit 2 Service Water Q2-2016

A-4160VAC Units 1 & 2 System Health Report - Q2-2016 September 21, 2016 B-480VAC Units 1 & 2 System Health Report - Q2-2016 September 21, 2016 EDG Units 1 & 2 System Health Report - Q2-2016 September 21, 2016 XFMR Units 1 & 2 System Health Report - Q2-2016 September 21, 2016

Attachment 2

Initial Request for Information Component Design Bases Inspection Arkansas Nuclear One, Units 1 and 2

Inspection Report:

05000313/2016008, 05000368/2016008

Information Gathering Dates:

October 12, 2016

Inspection Dates: October 31, 2016, through December 2, 2016

Inspection Procedures:

IP 71111.21, "Component Design Bases Inspection"

IP 92702, "Followup on Corrective Actions for Violations

and Deviations" Lead Inspector:

Gerond A. George, Senior Reactor Inspector

I. Information Requested Prior to Information Gathering Visit (please send by October 5, 2016)

The following information (Section I of this enclosure) should be sent to the Region IV

office in hard copy and electronic format (Certrec IMS preferred), to the attention of Gerond A. George.

The inspection team will finalize the selected list prior to the preparation week.

The specific items selected from the lists shall be available and ready for review on the day indicated in this request. *Please provide requested documentation electronically in "pdf" files, Excel, or other searchable formats, if possible. The information should contain descripti ve names, and be indexed and hyperlinked to facilitate ease of use.

Information in "lists" should contain enough information to be easily understood by someone who has knowledge of pressurized water reactor technology.

If requested documents are large and only hard copy formats are available, please inform the inspector(s), and provide subject documentation during the first day of the onsite inspection.

1. An Excel spreadsheet of equipment basic events (with definitions) including importance measures sorted by Birnbaum, risk achievement worth (RAW), and Fussell-Vesely (FV) from your internal events probabilistic risk assessment (PRA).

Include basic events with RAW value of 1.3 or greater.

2. Provide a list of the top 500 cut-sets from your PRA.

3. Copies of PRA "system notebooks," and the latest PRA summary document.

4. An excel spreadsheet of PRA human action basic events or risk ranking of operator actions from your site specific PSA sorted by Birnbaum, RAW, and FV.

Provide copies of your human reliability worksheets for these items.

5. If you have an external events or fire PSA model, provide the information requested in items 1-4 for external events and fire.

6. Any pre-existing evaluation or list of components and associated calculations with low design margins (i.e., pumps closest to the design limit for flow or pressure, diesel generator close to design required output, heat exchangers close to rated design heat removal, etc.). (Calculations should be available during the information gathering visit).

7. List of high risk maintenance rule systems/components and functions; based on engineering or expert panel judgment.

8. Site top 10 issues list.

9. Structure, system, and components in the Maintenance Rule (a)(1) category.

10. A list of operating experience evaluations for the last 2 years.

11. A list of all time-critical operator actions in procedures.

2. List of motor operated valves (MOVs) in the program, design margin and risk ranking.

13. List of air operated valves (AOVs) in the valve program, design margin and risk ranking.

14. Electronic copies of the Technical Specifications and the Updated Final Safety Analysis Report.

15. List of current "operator work arounds/burdens."

16. List of root cause evaluations associated with component failures or design issues initiated/completed in the last 3 years.

17. Current management and engineering organizational charts.

18. Arkansas Nuclear One, Units 1 and 2 IPEEEs, if available electronically.

19. Mechanical piping system drawings for:

• Engineered safety features

• Emergency core cooling systems

• Emergency diesel generators

20. Electrical one-line system drawings for:

• Offsite power/switchyard supplies

• Normal AC power systems

• Emergency AC/DC power systems (including 120VAC power and 125 VDC/24 VDC safety class systems)

21. List of any common-cause failures of components in the last 3 years.

2. An electronic copy of the Design Bases Documents.

23. An electronic copy of the System Health notebooks.

II. Information Requested for Follow-up of the ANO Comprehensive Recovery Plan and Confirmatory Action Letter (please send by October 5, 2016)

Provide the updated status, completion dates, and supporting documentation for the following corrective actions:

a.

C-2016-00614-023

b.

C-2014-00259, CAs 213-215, and 219-221 c.

C-2014-00259-010 d.

C-2014-00259-248

e.

C-2014-00259-014

f.

C-2014-00259-082

g.

C-2015-02834-111 h.

C-2015-02838-011 i.

C-2013-00888-019

j.

C-2013-00888-020

III. Information Requested to be Available on First Day of Preparation Week

(October 24, 2016)

1. List of condition reports (corrective action documents) associated with each of the selected components for the last 5 years.

2. The corrective maintenance history associated with each of the selected components for the last 2 years.

3. Copies of calculations associated with each of the selected components (if not previously provided), excluding data files.

Please review the calculations and also provide copies of reference material (such as drawings, engineering requests, and

vendor letters).

4. Copies of open operability determinations associated with each of the selected components and plans for restoring operability, if applicable.

5. Copies of selected operator work-around evaluations associated with each of the selected components and plans for resolution, if applicable.

6. Copies of any open temporary modifications associated with each of the selected components, if applicable.

7. A list of permanent modifications for previous 5 years for each of the selected components.

8. Trend data on the selected electrical/mechanical components' performance for last

3 years (for example, pumps' performance including in-service testing, other vibration monitoring, oil sample results, etc., as applicable).

9. A copy of any internal/external self-assessments and associated corrective action documents generated in preparation for the inspection.

10. A copy of engineering/operations related audits completed in the last 2 years.

11. Procedures used to accomplish operator actions associated with the basic events in your PRA.

2. List of licensee contacts for the inspection team with pager or phone numbers.

IV. Information Requested to be provided throughout the inspection.

1. Copies of any corrective action documents generated as a result of the team's questions or queries during this inspection.

2. Copies of the list of questions submitted by the team members and the status/resolution of the information requested (provide daily during the inspection to each team member).

3. Reference materials (available electronically and as needed during all onsite weeks):

• General set of plant drawings

• IPE/PRA report

• Procurement documents for components selected

• Plant procedures (normal, abnormal, emergency, surveillance, etc.)

• Technical Specifications

• Updated Final Safety Analysis Report

• Vendor manuals Inspector Contact Information: Gerond A. George Senior Reactor Inspector Gerond.George@nrc.gov

817-200-1562

Mailing Address: U.S. NRC, Region IV

Attn:

Gerond A. George

1600 East Lamar Blvd.

Arlington, TX

76011-4511

PAPERWORK REDUCTION ACT STATEMENT This request does not contain new or amended information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).

Existing information collection requirements were approved by the Office of Management and Budget, control number 3150-0011.

Attachment 3 LIST OF CONFIRMATORY ACTION LETTER ITEMS CLOSED AND DISCUSSED

Significant Performance Deficiencies Area Action Plan Description Inspection Dates Inspection Report Number(s)

Status

DB-3 Provide training to Engineering, Operations, and Planners to increase the knowledge and skills regarding passive barriers and other Design Basis Features.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

FP-1 Develop external flooding design basis documentation so configuration control is defined and maintained.

Develop an engineering report and flood protection drawings similar to fire protection drawings to clearly document the flooding design basis and credited flood protection features (credited external flood protection features and credited

operator actions), and assign unique equipment ID to each flood protection feature and boundary.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

FP-2 Develop internal flooding design basis documentation so configuration control is defined and

maintained.

Develop an engineering report and flood protection drawings similar to the fire protection drawings to clearly document the flooding design basis and credited flood protection features (credited internal flood protection features and credited

operator actions).

Update the Flooding Upper Level Document (ULD).

Assign unique equipment identification to each flood protection feature and boundary.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008 Discussed, awaiting licensee action

FP-3 Label external flood barriers in the plant to provide in-field awareness of flood protection features.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

FP-6 Validate that all external flood gaps identified from the review of documentation for credible flood paths and the follow-up walkdowns

have been resolved.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed Area Action Plan Description Inspection Dates Inspection Report Number(s)

Status

FP-7 Perform walkdowns of all credited internal flood protection features and document the results in an

engineering report.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008 Discussed, awaiting licensee action

FP-13 Develop and conduct initial and continuing training essential to understanding and maintaining the license basis for flood barrier features.

Address Operations, Engineering, and Work Planning groups. 10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

VO-1 Designate a Subject Matter Expert (SME) to oversee implementation of the procedure for Management and Oversight of Supplemental Personnel and contractor oversight for ANO. 8/29/16 -

9/16/16

05000313/2016010, 05000368/2016010

Closed

VO-4 Establish a Vendor Oversight Team to drive continuous improvement in Vendor Oversight.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

VO-15 Review current processes in Engineering related to Vendor Oversight Fundamental Problem. Determine if additional actions are required to address less formal interfaces with suppliers of contract services.

Assign additional actions as warranted to address any gaps identified.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

VO-18 Revise Project Management procedures to ensure projects are organized and managed with

(1) effective support by subject

experts and (2) effective vendor and technical oversight.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting licensee action

VO-23

Revise

EN-DC-114, Project Management, to provide guidance in specifying contract language which will ensure detailed engineering calculations, quality requirements and standards are provided for internal and third party review, in accordance with revised

EN-MA-119, Material Handling Program, when specially designed temporary lift assembles are to be used. 10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed Area Action Plan Description Inspection Dates Inspection Report Number(s)

Status

VO-24 Revise

EN-MA-119, to require a documented engineering response to evaluation critical lifts if using

any specially designed temporary lifting device, any lifting device that cannot be load tested per

EN-MA-119 criteria, or any lifting device without a certified load rating name plate rating affixed to it. 10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

Identifying, Assessing, and Correcting Performance Deficiencies Area Action Plan Description Inspection Dates Inspection Report Number Status

CA-5 Train investigators, managers, and Performance Improvement (PI)

Staff on proper causal techniques, manager oversight expectations and engagement, and conducting quality reviews of completed cause evaluations and corrective actions.

Establish initial and refresher training requirements in these areas.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

CA-7 Establish/refine key corrective action program station and group level performance indicators.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting licensee action

CA-9 Revise the CARB process to require the Performance Improvement Manager to present the status of the condition reporting process using established metrics to the CARB.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting

CA-7 closure and further inspection

CA-11 Revise

EN-LI-102, "Corrective Action Program" to require a focused self-assessment every

years focused primarily on

whether staffing levels support effective corrective action program implementation and oversight.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

CA-12 Develop metrics to evaluate and monitor the health of the operating experience program.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed Area Action Plan Description Inspection Dates Inspection Report Number Status

CO-3 Align ANO and fleet key performance indicators with the industry and establish goals that are challenging and consistent with industry practices.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

OC-6

LF-14 Create a simple tool to analyze externally identified performance issues both individually and in

aggregate to present actionable data to the Aggregate Performance Review Meeting (APRM). 8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting further inspection

TR-3 Define and incorporate practical guidance in Procedure

EN-LI-121, "Trending and Performance Review," to support consideration of training as a potential solution for organizational performance issues.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

Human Performance Area Action Plan Description Inspection Dates Inspection Report Number Status

LF-4 As an interim action, establish weekly leadership alignment

meetings for supervisors and above to reinforce actions and behaviors needed to achieve recovery objectives.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

LF-8 As an interim measure, establish and implement external coaching

for a sample of department and station performance review meetings in the Trending and Performance Review process.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

LF-10

NF-10 Establish and implement a paired observation program.

This is a "coach the coach" program to improve the quality of interactions

between supervisors and those they supervise.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

PQ-3 Perform scoping reviews to assess extent of procedure and work instruction quality issues.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed Area Action Plan Description Inspection Dates Inspection Report Number Status

PQ-5 Risk rank station procedures as safety-significant, important, or normal to facilitate procedure upgrade project scoping.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

Equipment Reliability and Engineering Programs Area Action Plan Description Inspection Dates Inspection Report Number Status

DM-20 Develop and implement a supply vs. demand model and metrics to

determine and monitor resource needs to meet workload demand.

The metrics will be used to measure resource demand and supply so that scheduled work has the correct resources assigned to complete the work scope.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting licensee action

PM-1 Create a site specific procedure for component classification that will ensure appropriate classification of equipment for PM based upon risk and safety.

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008

Closed

Safety Culture

Area Action Plan Description Inspection Dates Inspection Report Number Status

CA-2 Establish a Nuclear Safety Culture Observer function and

expectations to observe and provide feedback on leader behaviors (nuclear safety culture and safety conscience work environment) in key forums and to

provide trends for review by the Nuclear Safety Culture Monitoring Panel. 8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting licensee action Area Action Plan Description Inspection Dates Inspection Report Number Status

DM-2 Establish a decision making nuclear safety culture observation form to include the top leader

behaviors to be demonstrated and reinforced at ANO meetings.

The form should include decision making practices that emphasize

prudent choices over those that are simply allowable.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010

Closed

LF-9 Establish a Nuclear Safety Culture Observer function to observe and provide feedback on leader behaviors in key forums and to

provide observation data for review by the Nuclear Safety Culture

Monitoring Panel.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting licensee action

SC-14 Establish and implement a Nuclear Safety Culture Observations process including elements of leader behaviors, nuclear safety culture, and safety conscious work environment.

The observer

monitors leader performance on a daily basis and provides feedback to correct adverse trends in behaviors.

8/29/16 -

9/16/16 05000313/2016010, 05000368/2016010 Discussed, awaiting licensee action Service Water System Self-Assessment

Description Inspection Dates Inspection Report Number Status Service Water System Operational Performance Inspection

10/31/16 -

2/2/16 05000313/2016008, 05000368/2016008 Discussed

Attachment 4 Detailed Risk Analysis for

NCV 05000313/2016008-04 Failure to Perform an Adequate Emergency Feedwater Pump Suction Transfer Design Calculation or Testing (Section 1R21.2.7.b.1) (EA 2017-017)

A regional senior reactor analyst performed a detail risk evaluation in which the following assumptions were made: 1. The finding was applicable to Unit 1 only.

2. Exposure time was limited to 1 year.

This 1 year exposure time was before FLEX was implemented.

3. Losses of offsite power (LOOP) was the only initiator of significance because it would result in a loss of main and auxiliary feedwater and a loss of the power supply for filling the qualified condensate storage tank (QCST).

All other initiators would allow the QCST

to be refilled.

4. The licensee would not choose to cool down and would stay in hot standby indefinitely.

5. When the emergency feedwater pumps became air bound, they would be irreparable.

6. Sluicing from a Unit 2 condensate storage tank to the QCST would be ineffective while drawing off of the QCST.

7. A dual unit LOOP would lead to draining the QCST in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> as both units drew from it.

8. A single unit LOOP on Unit 1 would leave an infinite QCST because Unit 2 procedures would drive operators to refill the QCST.

9. The analyst adjusted the human error probabilit

y for the basic event

HPI-XHE-XM-HPIC from its baseline value in the SPAR model of 2.0E-2 to 3.0E-3.

Based on MAAP analyses provided by the licensee, the analyst considered that the available time for initiating HPI cooling was 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The analyst assumed action to initiate HPI cooling would take 30 minutes and assigned "nominal" time for action in the

SPAR-H human error probability analysis for the basic event.

All other performance shaping factors were maintained the same as the SPAR baseli ne basic event.

The analyst added a diagnosis element to the SPAR baseline basic event and assigned the remainder of the time for diagnosis which yielded "extra time" for diagnosis.

All other performance shaping factors were maintained as nominal.

These basic event adjustments yielded a sequence specific basic event value which the analyst applied to just the specific sequence.

The SPAR baseline value was retained for all other sequences.

Applying these assumptions, the analyst estimated the increase in core damage frequency from internal events to be 7.3E-7/year.

The analyst used the Arkansas Nuclear One, Unit 1, SPAR

model Version 8.19, run on SAPHIRE, Version 8.1.4, to estimate the increase in core damage frequency from external events. The analyst reviewed the IPEEE and Arkansas Nuclear One, Unit 1,

NFPA-805 documentation to screen external events as not being a significant contributor to the increase in core damage frequency.

Seismic and tornado events which damaged the QCST would lead operators to align service water to supply the emergency feedwater system prior to possible introduction of air into the pump suctions.

Seismic and tornado induced dual unit losses of offsite power were determined to be insignificant contributors to the increase in core damage frequency due to their low initiating event frequency relative to random losses of offsite power considered in the internal events model.

Fire events were screened because a credible fire with a high enough frequency of occurrence could be postulated which would cause a dual unit loss of offsite power.

The analyst reviewed the dominant sequences and compared them to Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process."

A screening was conducted using the LERF screening criteria to assess whether any of the core damage sequences affected by the finding were potential LERF contributors.

None of the sequences were determined to be LERF contributors and the increase in LERF was considered to be negligible. In summary, the total increase in core damage frequency was estimated to be 7.3E-7/year and the finding was determined to be of very low safety significance (Green).

Dominant sequences were dual unit losses of offsite power.

These sequences were mitigated by timely recovery of offsite power and successes in initiating high pressure injection cooling.