IR 05000416/2015007: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
||
Line 2: | Line 2: | ||
| number = ML15317A126 | | number = ML15317A126 | ||
| issue date = 11/13/2015 | | issue date = 11/13/2015 | ||
| title = | | title = Ir 05000416/2015007, on 07/27/2015 - 10/01/2015, Grand Gulf Nuclear Station, Unit 1, NRC Component Design Bases | ||
| author name = Farnholtz T R | | author name = Farnholtz T R | ||
| author affiliation = NRC/RGN-IV/DRS/EB-1 | | author affiliation = NRC/RGN-IV/DRS/EB-1 |
Revision as of 02:08, 13 February 2018
ML15317A126 | |
Person / Time | |
---|---|
Site: | Grand Gulf ![]() |
Issue date: | 11/13/2015 |
From: | Thomas Farnholtz Region 4 Engineering Branch 1 |
To: | Kevin Mulligan Entergy Operations |
G. George | |
References | |
IR 2015007 | |
Download: ML15317A126 (74) | |
Text
November 13, 2015
Mr. Kevin Mulligan Site Vice President Operations Entergy Operations, Inc. Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150
SUBJECT: GRAND GULF NUCLEAR GENERATING STATION, UNIT 1 NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000416/2015007
Dear Mr. Mulligan:
On October 1, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Grand Gulf Nuclear Station Unit 1. On August 27, 2015, the NRC inspectors discussed the preliminary results of this inspection with you and other members of your staff. On October 1, 2015, the NRC inspectors discussed the final results of this inspection with you and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report. The NRC inspectors documented seven findings of very low safety significance (Green) in this report. All of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV under the traditional enforcement process. Additionally, the NRC inspectors documented three Severity Level IV violations with no associated finding. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy. If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Grand Gulf Nuclear Station. If you disagree with a crosscutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Grand Gulf Nuclear Station. In accordance with Title 10 of the Code of Federal Regulations 2.390 of the NRC's Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,/RA/ Thomas R. Farnholtz, Branch Chief Engineering Branch 1 Division of Reactor Safety Docket No: 05000416 License No: NPF-29
Enclosure:
Inspection Report 05000416/2015007
w/Attachment:
Supplemental Information cc w/encl: Electronic Distribution for Grand Gulf Nuclear Station
-1- Attachment U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 50-416 License: NPF-29 Report Nos.: 05000416/2015007 Licensee: Entergy Operations, Inc. Facility: Grand Gulf Nuclear Station, Unit 1 Location: 7003 Baldhill Road Port Gibson, MS 39150 Dates: July 27, 2015 to October 1, 2015 Team Leader: G. George, Senior Reactor Inspector, Engineering Branch 1, Region IV Inspectors: L. Brandt, Reactor Inspector, Engineering Branch 1, Region IV R. Latta, Senior Reactor Inspector, Engineering Branch 1, Region IV J. McHugh, Senior Reactor Technology Instructor, Reactor Technology Training (BWR) Branch, Technical Training Center J. Watkins, Reactor Inspector, Engineering Branch 2, Region IV Senior Reactor Analyst: D. Loveless, Senior Reactor Analyst, Plant Support Branch 2 Accompanying Personnel: H. Leake, Contractor, Beckman and Associates W. Sherbin, Contractor, Beckman and Associates Approved By: Thomas R. Farnholtz, Branch Chief Engineering Branch 1
-2- Attachment Grand Gulf Nuclear Station; baseline Green. The team identified two examples of a Green, non-cited violation of 10 CFR Part 50, shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the licensee failed to verify or check the adequacy of: (1) Safety-related motors and control power circuits fed from Division III 480 V ac emergency safety feature bus 17B01, which were not designed or analyzed to operate using higher voltage ranges that are supplied to the safety-related buses; and (2) safety-related equipment connected to the 125 V dc system were not verified for satisfactory operation at elevated equalizing voltage of 140 V dc. In response to this issue, the licensee performed an operability determination which determined that the condition would reduce the life of the equipment but not cause spurious malfunctions. This finding was Condition Reports CR-GGN-2015-4413 and CR-GGN-2015-5130. assure that allowable high voltage conditions are within alternating and direct current equipment ratings was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the operation of the equipment outside of its equipment ratings adversely affects the reliability of safety-related equipment. In Determination Process (SDP) for Findings At-safety significance (Green) because it was a design or qualification deficiency that did not
-3- Attachment represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.1.b.1) Green. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of from January 20, 2010, to August 26, 2015, the licensee issued Calculation EC-Q1111-to verify that the calculated fault current levels were within the ratings of the installed Division III circuit breakers. In response to this issue, the licensee performed an operability evaluation to support an operable but degraded/nonconforming condition, recommending an action to perform a detailed fault current study, and reviewing fault current levels at maximum switchyard voltage of 105 percent to verify that they do not create additional concerns. Condition Reports CR-GGN-2015-4607, CR-GGN-2015-4934, and CR-GGN-2015-5112. The team determined that failure to ensure that electrical interrupting devices are rated for available fault current levels was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the with a fault resulted in a reasonable doubt with the operability of Division III motor control center Significance Determination Process (SDP) for Findings At- was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a human performance crosscutting aspect associated with design margins, because the licensee failed to operate and maintain equipment within design margins [H.6]. (Section 1R21.2.2.b.1) Green. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, es, and Drawings, affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, proissued calculation EC-Q1111-the procedural requirement that other documents impacted by the change be identified and updated. In response to this issue, the licensee reviewed the affected calculations to
-4- Attachment determine if the design bases was met and created a corrective action to update calculations. This Condition Reports CR-GGN-2015-4647 and CR-GGN-2015-4859. revised calculation on other documents in accordance with EN-DC-126 was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, routinely failing to revise the obsolete input data in electrical calculations and other design documents was a significant programmatic deficiency which can result in incorrect conclusions regarding the ability of the equipment to meet its design bases. In accordance with Inspection Manual Chapter 0609, Appendix A, P) for Findings At-have very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a human performance crosscutting aspect associated with procedure adherence, because individuals failed to follow procedures, processes, and work instructions [H.8]. (Section 1R21.2.3.b.1) Green. The team identified a Green, non-cited violation of Technical Specification 3.8.1, AC Sources-Operating, LCO 3.8.1, which requires that three diesel generators be operable. Specifically, since July 1985, the licensee failed to perform Surveillance Requirement 3.8.1.9, because surveillance testing performed did not verify that each diesel generator could reject the single largest post-accident load and maintain engine speed within the required criteria. In response to this issue, the licensee performed an immediate operability determination to confirm that test results from full load reject indicated that, if performed correctly, the results of the Surveillance Requirement 3.8.1.9 test would be acceptable. This tive action program as Condition Reports CR-GGN-2015-4611 and CR-GGN-2015-4627. The team determined that the failure to perform Technical Specification Surveillance Requirement 3.8.1.9 was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems to respond to initiating events to prevent undesirable consequences. Specifically, the surveillance procedure error resulted in the acceptance of test results that did not satisfy Technical Specification Surveillance Requirement 3.8.1.9; therefore the test did not demonstrate diesel generator operability. In accordance with Inspection Manual Chapter 0609, Appendix A, -have very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to
-5- Attachment seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.4.b.1) Severity Level IV/Green. The team identified a Green, Severity Level IV non-cited violation ion) which requires that a licensee who desires to make a change in the facility described in the final safety analysis report, which involve an unreviewed safety question shall submit an application for amendment of the license pursuant to 10 CFR 50.90. Specifically, on August evaluation of tornado missiles into the Grand Gulf Final Safety Analysis Report Section 3.5.2.5 involved an unreviewed safety question because it increased the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the safety analysis report. In response to the issue, the licensee prepared a license amendment request to obtain approval to use probabilistic methods for tornado missile evaluations. This finding was entered into the corrective action program as Condition Reports CR-GGN-2015-04615 and CR-GGN-2015-4760. The team determined that the failure to obtain a license amendment prior to implementing a proposed change to the tornado missile protection design requirements was a performance deficiency. This performance deficiency was determined to be more than minor, and therefore a finding, because there was a reasonable likelihood the change would require NRC review and approval. This finding was evaluated using traditional enforcement, because the violation may impact the ability for the NRC to perform its regulatory oversight function. In accordance with the NRC Enforcement Policy, the significance determination process was used to inform the significance of the failure to obtain a license amendment prior to implementing a proposed change to the main control room design requirements. Process (SDP) for Findings At-total loss of a safety function, identified by the licensee through a probabilistic risk analysis, individual plant examination for external events, or similar analysis, that contributes to external event initiated core damage accident sequences. Therefore, detailed risk evaluation was necessary. The senior reactor analyst reviewed the Grand Gulf Individual Plant Examination for External Events because it was the best available information on missile damage to exposed safety-related equipment. The senior reactor analyst determined that the finding had very low safety significance (Green) because the probability of damage occurring to the exposed safety-related equipment was 7.7E-9/year, which is below the threshold for additional probabilistic risk evaluation. Since the violation was associated with a Green reactor oversight finding, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with paragraph 6.1.d(2) of the NRC Enforcement Policy. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.19.b.1) Green. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of licensee failed to
-6- Attachment verify that the safety-related alternating current equipment will operate satisfactorily at the extremes of the allowable alternating current frequency ranges as specified in the updated final safety analysis report and technical specifications. This finding was entered into the -GGN-2015-4672. The team determined that the failure to verify safety-related alternating current equipment for operation at the extremes of the allowed frequency range was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences. Specifically, lack of verification that the alternating current equipment would function at the extremes of the allowable frequency range can result in incorrect conclusions regarding the ability of the equipment to meet its design bases. In accordance with (SDP) for Findings At-(Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a problem identification and resolution crosscutting aspect associated with self-assessments, because the organization failed to conduct self-critical and objective assessment of its programs and policies [P.6]. (Section 1R21.3.2.b.1) Green. The team identified a Green, non-cited violation of Technical Specification 5.4, and maintained covering the following activities: (a) The applicable procedures recommended in RSpecifically, prior to August 10, 2015, the licensee failed to follow Procedures 01-S-07-43, GGNS-CS-for Prevention of Potentially Hazardous Seismic II/I Situations due -MA-were left in containment since the previous refueling outage. In response to this issue, the licensee immediately removed all loose items in containment that was not permitted by an associated engineering evaluation. This finding was entered into the corrective action program as Condition Report CR-GGN-2015-4568. The team determined that failure to implement procedures for prevention of loose items in the containment structure was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the failure to control materials and temporary equipment was a significant programmatic deficiency which would have the potential to cause unacceptable or degraded conditions if left undetected (MC 0612, App E). In accordance with Inspection Manual -issue screened as having very low safety significance (Green) because it was a design or
-7- Attachment qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of nontechnical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a human performance crosscutting aspect associated with avoid complacency, in that the licensee failed to recognize and plan for the possibility of latent issues, even while expecting successful outcomes [H.12]. (Section 1R21.4.b.1) Cornerstone: Miscellaneous Severity Level IV. The team identified a Severity Level IV, non-cited violation of 10 CFR Part 50, part, that sufficient records shall be maintained to furnish evidence of activities affecting quality and shall be identifiable and retrievable.Specifically, prior to August 11, 2015, the licensee failed to maintain and retrieve the cable tray overfill analysis for safety-related cable tray 1BATNQ01. In response to the issue, the licensee recreated the cable tray overfill analysis. This violation Condition Report CR-GGN-2015-4602. The team determined that the failure to retrieve the safety-related cable tray overfill analysis record in accordance with 10 CFR 50 Appendix B, Criterion XVII was a performance deficiency. Traditional enforcement was applied to this performance deficiency because it involved a violation that impacted the ability of the NRC to perform its regulatory oversight function. Assessing the violation in accordance with the NRC Enforcement Policy, the team determined it to be a Severity Level IV violation because the cable tray overfill analysis was not retrievable. This violation did not have an assigned crosscutting aspect because crosscutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.3.b.2) Severity Level IV. The team identified six examples of a Severity Level IV, non-cited states, in part, each person licensed to operate a nuclear power reactor shall update periodically the final safety analysis report originally submitted as part of the application for the license, to assure that the information included in the report contains the latest information developed. This submittal shall contain all the changes necessary to reflect information and analyses submitted to the Commission by the applicant or licensee or prepared by the applicant or licensee pursuant to Commission requirement since the submittal of the original or the last update to the final safety analysis report. Specifically, since July 18, 2012, the licensee failed to ensure the updated final safety analysis report reflected the current plant configuration. In response to these issues, the licensee initiated corrective actions to update the updated final safety analysis report with the correct information. This ctive action program as Condition Reports CR-GGN-2015-4381, CR-GGN-2015-4671, CR-GGN-2015-4733, CR-GGN-2015-4753, CR-GGN-2015-4811, and CR-GGN-2015-4867. The team determined that the failure to update the final safety analysis report in accordance with 10 CFR 50.71(e) was a performance deficiency. Traditional enforcement was applied to this performance deficiency because it involved a violation that impacted the ability of the
-8- Attachment NRC to perform its regulatory oversight function. Assessing the violation in accordance with the NRC Enforcement Policy, the team determined it to be a Severity Level IV violation because the lack of up-to-date information in the final safety analysis report has not resulted in any unacceptable change to the facility or procedures. This violation did not have an assigned crosscutting aspect because crosscutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.10.b.1) Severity Level IV. The team identified a Severity Level IV, non-cited violation of 10 CFR information provided to the Commission by an applicant for a license or by a licensee or conditions to be maintained by the applicant or the licensee shall be complete and accurate in all material respects. Specifically, since November 1, 1991, not include verification from the pump suppliers that the minimum flow rates were sufficient to ensure that there will be no pump damage from low flow operation, or a plan to obtain additional test data and/or modify the minimum flow capacity as needed, per Requested Actions 3 and 6 of NRC Bulletin 88-04. In response to this issue, the licensee initiated corrective actions to submit the correct information. This violation was entered into the -GGN-2015-4681. The team determined that the failure to correct an incomplete and inaccurate response to NRC Bulletin 88-04, Requested Actions 3 and 6 was a performance deficiency. Traditional enforcement was applied to this performance deficiency because it involved a violation that impacted the ability of the NRC to perform its regulatory oversight function. Assessing the violation in accordance with Section 6.9 of the NRC Enforcement Policy, the team determined it to be a Severity Level IV violation because it resulted in no or relatively inappreciable potential safety or security consequences. This violation did not have a crosscutting aspect because crosscutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.13.b.1)
-9- Attachment REPORT DETAILS This inspection of component design bases verifies that plant components are maintained within their design basis. Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design basis functions. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance. 1R21 Component Design Basis Inspection (71111.21) .1 Overall Scope To assess the ability of the Grand Gulf Nuclear Station, Unit 1, equipment and operators to perform their required safety functions, the team inspected risk significant components operating experience. The team selected risk significant components for review using information contained in the Grand Gulf Nuclear Station, Unit 1, probabilistic risk assessments and the U. S. Nuclear Regulatory In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and nonsafety-related systems including pumps, circuit breakers, heat exchangers, transformers, and valves. The team selected the risk significant operating experience to be inspected based on its collective past experience. To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design basis and that the tested capabilities met the required criteria. The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For selected components, the team observed operators during simulator scenarios, as well as during simulated actions in the plant. The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design basis have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result
-10- Attachment of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins. The inspection procedure requires a review of 15 to 25 total samples that include risk-significant and low design margin components, components that affect the large-early-release-frequency (LERF), and operating experience issues. The sample selection for this inspection was 19 components, 1 component that affects LERF, and 3 operating experience items. The selected inspection and associated operating experience items supported risk significant functions including the following: a. Electrical power to mitigation systems: The team selected several components in the electrical power distribution systems to verify operability to supply alternating current (ac) and direct current (dc) power to risk significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and a loss-of-coolant accident with offsite power available. As such the team selected: Emergency Safety Features Transformer 21 Division III 4.16 kV Circuit Breaker 152-1705 Division I 4.16 kV Switchgear 15AA Division I Emergency Diesel Generator Load Sequencer Division I 125 V dc Battery Charger 1DA4 and 1DA5 High Pressure Core Spray Actuation Circuit 480 V Load Center Feeder Breakers 152-1507 and 152-1604 Motor Control Center MCC 15B31 Reactor Protection System Actuation Circuit Condensate Storage Tank Level Instrumentation Reactor Core Isolation Cooling Actuation Circuit b. Components that affect LERF: The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components: Containment Vent Path c. Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected: Reactor Core Isolation Cooling Minimum Flow Valve 1E51-F019A Division II Residual Heat Removal Pump Division II Residual Heat Removal Heat Exchanger
-11- Attachment Standby Liquid Control Valves F004A and F004B Emergency Safety Features Switchgear Room Coolers High Pressure Core Spray Room Cooler T51B001-C Division I Emergency Diesel Generator Fuel Storage Tank .2 Results of Detailed Reviews for Components: .2.1 Emergency Safety Features Transformer 21 a. Inspection Scope The team reviewed the updated safety analysis report, design basis document, calculations, the current system health report, selected drawings, maintenance and test procedures, the vendor manual, and condition reports associated with emergency safety features transformer 21. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Voltage calculations and operating procedures to determine whether transformer taps and administrative controls for switchyard voltage would assure the capability and capacity of offsite power during normal and accident conditions. Loading calculations to determine whether the capacity of the transformer is adequate to supply worst-case accident loads. Component maintenance history to verify the monitoring of potential degradation. Corrective action histories to determine whether there had been any adverse operating trends. Visual inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses. b. Findings 1. Failure to Ensure Safety-Related Alternating Current and Direct Current Equipment Operability and Functionality at Maximum Allowable Voltage Levels Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, se the licensee failed to verify or check the adequacy of design of safety-related alternating current and direct current equipment. Specifically, the team identified two examples where the licensee failed to verify the adequacy of safety-related electrical equipment when operating within the maximum allowable voltage ranges. Description. Example 1: The design of the Grand Gulf Nuclear Station Class 1E alternating current power system is described in Grand Gulf Updated Final Safety
-12- Attachment Analysis Report SectiGrand Gulf Updated Final Safety Analysis Report Section 8.3.1.1.2.4 states: Voltage tap settings of the intervening transformers have been set to yield optimum voltage levels of the emergency buses for the full load and minimum load conditions expected throughout the anticipated voltage variations of the offsite power source. The adequacy of these voltage tap settings have been verified and these measurements were correlated wit Contrary to the Grand Gulf Updated Final Safety Analysis Report Section 8.3.1.1.2.4, the adequacy of voltage tap settings for Division III 4160 V ac to 480 V ac motor control center transformer, Q1E22S003-C, was not verified to ensure that the setting would yield optimum voltage levels of the emergency buses throughout the anticipated voltage variations of the offsite power source. According to Calculation EC-Q1111-90028, Attachment 7A.1, the maximum voltage on 480 V ac emergency safety features motor control centers 17B01 and 17B11 could be as high as 530 V ac. The calculated voltages were determined by setting the switchyard voltage at its highest allowable level (105 percent of 500kV), lightly loaded conditions, and a transformer Q1E22S003-C tap setting of -5 percent. The motors downstream of the transformer are rated at 460 V ac and designed in accordance with National Electric Manufacturers Association Standard MG-1, which specifies a maximum operating voltage of +10 percent = 506 V ac. Similarly, the emergency safety feature battery chargers are rated for a maximum voltage of 508 V ac per Vendor Manual 460000347. Therefore, the safety-related equipment downstream of motor control centers 17B01 and 17B11 would be operated outside of their rated voltage. Operation above 506 V ac was not evaluated for effects on the operability or functionality of the equipment. This condition was entered into the corrective action program as Condition Report CR-GGN-2015-operability evaluation to support an operable condition, initiating an action to perform an additional operability evaluation, and initiating an action to develop a long-term solution to the concern. On April 10, 2008, an overvoltage condition that caused a malfunction of a safety-related component occurred, as discussed in Licensee Event Report 2008-003. During testing of High Pressure Core Spray low flow valve 1E22-F012, the circuit breaker for the valve To correct the condition, the licensee raised the trip setting of the circuit breaker. Example 2: Grand Gulf Updated Final Safety Analysis Report Section 8.3.2.1.6.3 states: All direct current equipment for Grand Gulf has been specified for operation over the range of 105 V dc to 140 V dc. Components whose qualifications cannot meet this specified range are evaluated on a case b
-13- Attachment Furthermore, manufacturer for the calculated limiting voltage supplied to the equipment. The equipment connected to the safety-related 125 V dc system have a typical voltage rating of 125 V dc, +/- 10 percent. Therefore, the maximum operating voltage for equipment would be 137.5 V dc. However, the equalizing voltages observed at Grand Gulf included voltages at or near 140 V dc, which represents operation above the maximum voltage range of +10 percent. This condition was entered into the corrective action program as Condition Report CR-GGN-2015-corrective actions consisted of performing an operability evaluation to support an operable condition, initiating an action to perform an additional operability evaluation, and initiating an action to develop a long-term solution to the concern. Analysis. high voltage conditions are within alternating and direct current equipment ratings was a performance deficiency. This finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the operation of the equipment outside of its equipment ratings adversely affects the reliability of safety-related equipment. In accordance with (SDP) for Findings At-Sc(Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. Enforcement. The team identified two examples of a Green, non-cited violation of 10 art, control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing programContrary to the above, prior to September 3, 2015, the licensee failed to verify the adequacy of the design of safety-related alternating and direct current equipment, by design reviews, calculational methods, or a testing program, to ensure that the equipment would operate satisfactorily when the maximum voltage rating was exceeded. Specifically, the licensee failed to verify or check the adequacy of: (1) Safety-related motors and control power circuits fed from Division III 480 V ac emergency safety features bus 17B01, which were not designed or analyzed to operate using higher voltage ranges that are supplied to the safety-related buses; and (2) safety-related equipment connected to the 125 V dc system were not verified for satisfactory operation at elevated equalizing voltage of 140 V dc. In response to this issue, the licensee performed an operability determination
-14- Attachment which determined that the condition would reduce the life of the equipment but not cause spurious malfunctions. This finding was entered corrective action program as Condition Reports CR-GGN-2015-4413 and CR-GGN-2015-5130. Because corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-01Failure to Ensure Safety-Related Alternating Current and Direct Current Equipment Operability and Functionality at Maximum Allowable Voltage Levels .2.2 Division III 4.16 kV Circuit Breaker 152-1705 a. Inspection Scope The team reviewed the updated safety analysis report, design basis document, calculations, the current system health report, selected drawings, maintenance and test procedures, the vendor manual, and condition reports associated with Division III 4.16kV circuit breaker 152-1705. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Calculations for electrical distribution system loading, steady-state and transient voltages, and maximum short-circuit levels. Protective device settings and circuit breaker ratings to confirm adequate selective protection and coordination of connected equipment during worst-case short circuit conditions. Corrective action histories to determine whether there had been any adverse operating trends. Visual inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses. b. Findings 1. Failure to Ensure that Electrical Interrupting Devices are Rated for Available Fault Current Levels Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, because the licensee failed to verify or check the adequacy of design of fault interrupting devices. Specifically, the licensee failed to provide an analysis that ensures the ratings of interrupting devices, such as circuit breakers, are adequate to interrupt available fault current levels.
-15- Attachment Description. Grand Gulf Updated Final Safety Analysis Report Section 8.3.1.1.6.3 states: certified rating of the interrupting d Grand Gulf Updated Final Safety Analysis Report Section 8.3.1.1.4.2.5.2 states: are compatible with the short circuit current availabl .2.11-1974, ANSI N45.2.11 states: the process of reviewing, confirming, or substantiating the design by one or more The team determined that (1) Calculation EC-Q1111- calculated maximum fault current levels that do not bound worst-case levels, and (2) verification that interrupting devices are rated for the available fault current levels has not been documented. On January 22, 2010, the licensee issued Calculation EC-Q1111-alternating current distribution system buses. However, the model failed to calculate the worst-case fault current levels, because it did not set the switchyard voltage at its maximum level of 105 percent. The calculation states, in paragraph 2.3, that the er evaluation or calculation evaluation or calculation to verify that the ratings of the interrupting devices are compatible with the calculated fault current levels. The inspectors identified an example of interrupting devices that are not rated for the available fault current level. According to Drawing E-480 V. ontrol center 17B01 contains General Electric model TEC molded case circuit breakers. The licensee provided General Electric Application Guide GET2779F, which documents that TEC breakers are rated to interrupt a maximum of 10,000 amps. This is lower than the available fault current for motor control center 17B01 calculated in Calculation EC-QIIII-90028 of 15,389 amps, as stated on Attachment 7A.5, Page 3. Therefore, for these particular circuit breakers, the design bases are not met.
-16- Attachment The licensee acknowledged that the calculated fault current levels are not worst-case and that it has no analysis that verifies that interrupting device ratings are within action program as Condition Reports CR-GGN-2015-4607, CR-GGN-2015-4934, and CR-GGN-2015-performing an operability evaluation to support an operable/degraded/non-conforming condition, recommending an action to perform a detailed fault current study, and reviewing fault current levels at maximum switchyard voltage of 105 percent to verify that they do not create additional concerns. Analysis. The team determined that failure to ensure that electrical interrupting devices are rated for available fault current levels was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. adequacy of the interrupting equipment would operate with a fault resulted in a reasonable doubt with the operability of Division III motor control centers 17B01. In Determination Process (SDP) for Findings At-safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a human performance crosscutting aspect associated with design margins, because the licensee failed to operate and maintain equipment within design margins [H.6]. Enforcement. The team identified a Green, non-cited violation of 10 CFR Part 50, measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance oe above, from January 20, 2010, to August 26, 2015, the licensee failed to verify or check the adequacy of the design, such as by the use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee issued Calculation EC-Q1111-calculated fault current levels were within the ratings of the installed Division III circuit breakers. In response to this issue, the licensee performed an operability evaluation to support an operable/degraded/non-conforming condition, recommending an action to perform a detailed fault current study, and reviewing fault current levels at maximum switchyard voltage of 105 percent to verify that they do not create additional concerns. This Condition Reports CR-GGN-2015-4607, CR-GGN-2015-4934, and CR-GGN-2015-5112. Because corrective action program, this violation is being treated as a non-cited violation,
-17- Attachment consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-02Failure to Ensure that Electrical Interrupting Devices are 2. (Open) Unresolved Item URI 05000416/2015007-03: Lack of Coordination of Division III HPCS Switchgear 127N Undervoltage Relays Introduction. The team identified an unresolved item concerned with the coordination of the instantaneous time delay setting of the 127N undervoltage relays with high voltage system protective relays, switchgear overcurrent relays, and loss of voltage relays to allow time for the other relays to perform their required design functions. Description. The following issues were discussed during the inspection; however, the team must review additional information provided by the licensee to determine whether these issues result in a more than minor performance deficiency or a violation of NRC requirements. In accordance with Inspection Manual Chapter 0612, this issue will be characterized as an unresolved item. The incoming offsite power supply circuit breakers for Division III 4160 V switchgear 17AC are equipped with 127N undervoltage relays. According to Drawing E-System Bus According to drawing E-0121-instantaneous time response potentially results in lack of coordination of the 127N undervoltage relays with high voltage system protective relays, switchgear overcurrent relays, and loss of voltage relays, thus preventing the other relays from performing their credited design functions. Protective devices that the 127N undervoltage relays are potentially not coordinated with are as follows: Protective relays associated the main transformer and its output circuit: Lack of coordination between the 127N undervoltage relays and the protective relays associated with the main transformer and its output circuit can result in coincident loss of two alternating current power supplies, contrary to the requirements of General Design Criterion 17. Grand Gulf Updated Final Safety Analysis Report for safe shutdown is considered very high due to independence and ample redundancy; it equals or excGeneral Design Criterion Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit...Contrary to this General Design Criterion 17 requirement, a fault on the main transformer or its high voltage connection to the transmission system could cause coincident loss of electric power from both the main generator and the offsite power supply to Division III. The protective relaying on the main transformer and its output circuit is designed to initiate tripping of the main
-18- Attachment generator and isolation of the area of the fault without causing any cascading failures. However, the 127N undervoltage relay for the Division III 4160 V switchgear would also respond spuriously to the momentary voltage dip caused by the fault and cause loss of the offsite power supply to Division III. Transmission system bus protective relays: Grand Gulf Updated Final Safety Analysis Report isolated without interrupting service to any circuit other than that connected to the 127N relays would not coordinate with the transmission bus protective relays and would react to the momentary voltage dip caused by a transmission system bus fault, resulting also in spurious loss of the offsite power supply to Division III. Loss of Voltage Relays: In addition to the 127N undervoltage relays, Division III high pressure core spray 4160 V switchgear 17AC is equipped with 127S1, S2, S3, and S4 loss of voltage relays and 127 1A, 1B, 2A, and 2B degraded voltage relays, which also trip the offsite power supply to 17AC upon actuation. NRC Regulatory Issue Summary 2011-1, describes one of the functions of the degraded expected short duration grid disturbances, preserving availability of the offsite elevant to the other undervoltage relays that automatically trip the switchgear offsite power supply. This conclusion is consistent with Grand Gulf Updated Final Safety Analysis Report Section 8tems, particularly the ECCS, are set to maintain continuity of power as long as possible undervoltage relays do not preserve availability of power as long as possible in the event of harmless transmission grid voltage transients, such as those caused by lightning strikes and normally-cleared faults on transmission lines, because their instantaneous setting miscoordinates with the time delay setting of the Technical Specification credited loss of voltage relays 127S1, S2, S3, and S4. According to Technical Specification Table TR 3.3.8.1-1, the 127S1, S2, S3, and S4 loss of voltage relays have a time delay setting of 2.3 seconds. According to Section 6.17 of calculation JC-Q1P81-ision III Loss of Bus Voltage Setpoint Validation (T/S --Technical Specification 127N relays react instantaneously to trip the offsite power source during momentary voltage dips, their 0-second time delay setting invalidates this credited design function of the 2.3-second time delay of the 127S1, S2, S3, and S4 loss of voltage relays. Therefore, spurious segregation from the offsite source is not prevented, and a vulnerability exists for unnecessary loss of offsite power events initiated by, and subsequent to, harmless voltage transients from the transmission system. An actual event of this type occurred on April 2, 2012, as described in Licensee Event Report 2012-003. A lightning strike on a 500 kV transmission circuit resulted in
-19- Attachment actuation of the instantaneous 127N relay and unnecessary loss of the offsite power supply to the Division III electrical distribution system. Switchgear 17AC offsite power supply circuit breaker overcurrent relays: Grand Gulf Updated Final Safety Analysis Report preserving function and limiting loss of Class 1E equipment function in situations statement, the instantaneous setting of the 127N undervoltage relays prevents the offsite power supply circuit breaker overcurrent relays from preserving function and limiting loss of Class 1E equipment function in the event of a switchgear bus fault. Switchgear 17AC offsite power supply circuit breakers are equipped with 151B overcurrent relays that, when actuated, trip and lockout the switchgear supply breakers. The purpose of the lockout function is to prevent attempted reenergization of a faulted bus. However, due to the instantaneous response time of the 127N undervoltage relays, the fault would be cleared and the bus deenergized on the undervoltage signal before the overcurrent relays could respond and initiate the bus lockout signal. This would result in automatic starting of the Division III diesel generator, closure of the diesel generator output breaker onto the faulted bus, and the potential for damage to the diesel generator and further damage to the switchgear. Switchgear 17AC feeder circuit breaker overcurrent relays: The circuit breakers for feeders downstream of switchgear 17AC are equipped with 150/151M and 150/151T overcurrent relays that are designed to isolate downstream faults locally. Grand Gulf Updated Final Safety Analysis Report Section 8.3.1.1.2.3, application and coordination of the protective devices on Class 1E distribution has been conducted. This analysis shows that under design operation of these devices, faults, and undervoltages will be detected and corrected at the lowest level of d 150/151M and 150/151T overcurrent relays, Grand Gulf Updated Final Safety Analysis Report Section 8.3.1.1.4.2.5.3 the licensee failed to perform a coordination analysis or to ensure that interference of electrical service is limited as described. The voltage dip caused by a fault on a 4160 V circuit downstream of switchgear 17AC would be detected by the 127N relay, which would react instantaneously to trip the 17AC switchgear offsite power supply circuit breaker rather than isolating the fault locally at the downstream circuit breaker. This is contrary to the design criterion that the fault be detected and corrected at the lowest level of distribution and maintain continuity of power to the switchgear. These issues were Report CR-GGN-2015-4973.
-20- Attachment .2.3 Division I 4.16 kV Switchgear 15AA a. Inspection Scope The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with Division I 4.16 kV switchgear 15AA. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Calculations for electrical distribution system loading, steady-state and transient voltages, and maximum short-circuit levels. Protective device settings and circuit breaker ratings to confirm adequate selective protection and coordination of connected equipment during worst-case short circuit conditions. Degraded voltage and loss of voltage relay protection schemes that initiate automatic transfers from the offsite power supply to the diesel generator. Sizing of the incoming feeder cable was reviewed to determine its capability under worst case accident conditions. Corrective action histories to determine whether there had been any adverse operating trends. Visual inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses. b. Findings 1. Failure to Identify and Address Impacts of Revised Calculation Output Data Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, failed to accomplish activities affecting quality in accordance documented procedures. Specifically, the licensee failed to accomplish identifying and addressing the impacts of a revised calculation in accordance with Engineering Calculation Process Procedure EN-DC-126. Description. Grand Gulf Procedure EN-DC-Revision 5, Section 4, requires that the Responsible Engineer determines other documents that may be affected by the assigned calculation, and initiates appropriate changes or actions tracking items to ensure impacted documents are updated.
-21- Attachment On January 22, 2010, the licensee issued Calculation EC-QIIII-trical alternating current electrical system parameters, such as voltages and loading levels. In accordance with Procedure EN-DC-126, Attachment 9.3, the calculation included a the calculation change and an engineering change tracking number for the changes to the impacted documents. The Calculation Reference Sheet listed only one impacted output document, Calculation JC-Q1R21-90024-1, for which it failed to list an engineering change tracking number. The team identified examples of other impacted documents that were not included on the Calculation Reference Sheet and for which changes or action tracking items were not initiated. This resulted in the impacted documents containing obsolete input data taken from superseded revisions of Calculation EC-QIIII-90028. The following examples are other impacted documents that the team identified: Calculation EC-Q1R20-ses obsolete values for motor control center minimum voltages. Calculation EC-Q1R20-minimum voltages. Calculation EC-Q1R20-minimum voltages. Calculation EC-Q1R28- Uses obsolete values for motor control center minimum voltages. Calculation EC-Q1R28-minimum voltages. Calculation EC-Q1R28-9minimum voltages. This Reports CR-GGN-2015-4647 and CR-GGN-2015-4859.
-22- Attachment Analysisimpacts of the revised calculation on other documents in accordance with EN-DC-126 was a performance deficiency. This performance deficiency was more than minor, therefore a finding, because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, routinely failing to revise the obsolete input data in electrical calculations and other design documents was a significant programmatic deficiency which can result in incorrect conclusions regarding the ability of the equipment to meet its design bases. In accordance with Inspection Manual Chapter 0609, AFindings At-because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a human performance crosscutting aspect associated with procedure adherence, because individuals failed to follow procedures, processes, and work instructions [H.8]. Enforcement. The team identified a Green, non-cited violation of 10 CFR Part 50, which states, in part, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawinto the above, on January 22, 2010, the licensee failed to address impacts of revised calculation results as required by procedure EN-DC- Specifically, on January 22, 2010, the licensee issued calculation EC-Q1111-documents impacted by the change be identified and updated. In response to this issued the licensee reviewed the affected calculations to determine if the design bases was met. This Condition Reports CR-GGN-2015-4647 and CR-GGN-2015-4859. Because this finding was of very low safety significance and has been entered intaction program, this violation is being treated as a non-cited violation consistent with the Section 2.3.2a of the NRC Enforcement Policy: NCV 05000416/2015007-04, Failure to Identify and Address Impacts of Revised Calculation Output Data. 2. Failure to Maintain a Safety-Related Cable Tray Overfill Analysis Record Introduction. The team identified a Severity Level IV, non-cited violation of 10 CFR 50 retrieve a safety-related cable tray analysis record. Specifically, the licensee failed to retrieve the cable tray overfill analysis for safety-related cable tray 1BATNQ01. Description. During the inspection, the team requested documentation of the cable tray overfill analysis for safety-related cable tray 1BATNQ01 and seismic analysis for safety-related cable tray 1AATMH11. The licensee determined that the records were not readily available. The licensee documented this issue in the corrective action program
-23- Attachment as Condition Report CR-GGN-2015-4602, to begin searching for the documents. The investigation located the seismic analysis for 1AATMH11, but concluded the cable tray overfill analysis for 1BATNQ01 was not retrievable. After the licensee determined the documentation was not retrievable, the licensee recreated the cable tray overfill analysis. Analysis. The team determined that the failure to retrieve the safety-related cable tray overfill analysis record in accordance with 10 CFR 50, Appendix B, Criterion XVII was a performance deficiency. Traditional enforcement applied to this performance deficiency because it involved a violation may impact the ability for the NRC to perform its regulatory oversight function. Assessing the performance deficiency in accordance with the NRC Enforcement Policy, the team determined it to be a Severity Level IV violation because the cable tray overfill analysis was not retrievable. This violation did not have an assigned crosscutting aspect because crosscutting aspects are not assigned to traditional enforcement violations. Enforcement. The team identified a Severity Level IV, non-cited violation of 10 CFR 50 sufficient records shall be maintained to furnish evidence of activities affecting quality and shall be identifiable and retrievable. Contrary to the above, prior to August 11, 2015, the licensee did not maintain sufficient records to furnish evidence of activities affecting quality that were retrievable. Specifically, the licensee failed to maintain and retrieve the cable tray overfill analysis for safety-related cable tray 1BATNQ01. In response to the issue, the licensee recreated the cable tray overfill analysis. This violation was entered ort CR-GGN-2015-4602. Because this violation has Severity Level IV significance and was entered into the corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-05Maintain a Safety-Related Cable Tray Overfill Analysis Record .2.4 Division I 4.16 kV Load Sequencer a. Inspection Scope The team reviewed the updated safety analysis report, technical specifications, design basis documents, the current system health report, selected drawings, operating procedures, and condition reports associated with the Division I 4.16 kV load sequencer. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Load shed and load sequencing schedule drawings to verify that signals are in accordance with design. Sequencer logic drawing to verify consistency with design basis. Voltage and loading calculations to verify that they correctly model automatic sequencer actuations.
-24- Attachment Setting documents for loss of voltage and degraded voltage bistables to verify consistency with design bases and technical specifications. Alarm response procedure to determine whether they adequately address sequencer malfunctions. Corrective action histories to determine whether there had been any adverse operating trends. Visual inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses. b. Findings 1. Failure to Perform Surveillance Requirement 3.8.1.9 Introduction. The team identified a Green, non-cited violation of Technical Specification 3.8.1, AC Sources-Operating, Limiting Condition for Operation 3.8.1, because the licensee failed to maintain three operable diesel generators. Specifically, the licensee failed to perform Surveillance Requirement 3.8.1.9, because surveillance testing performed did not verify that each diesel generator could reject the single largest post-accident load and maintain engine speed within the required criterion. Description. Technical Specification Surveillance Requirement 3.8.1.9 requires associated single largest post-Surveillance Requirement 3.8.1.9 and surveillance test procedures for the Divisions I, II, and III diesel generators specify load rejection power values that are lower than the analyzed power demands of the single largest post-accident loads. Technical Specification Surveillance Requirement 3.8.1.9 states: post accident load and engine speed is maintained less than nominal plus 75% of the difference between nominal speed and the overspeed setpoint of 15% above According to Technical Specification Basis 3.8.1.9, the referenced load for diesel generator 11 is the 1200 kW low pressure core spray pump; for diesel generator 12, the 550 kW residual heat removal pump; and for diesel generator 13 the 2180 kW high pressure core spray pump. These load values are the same as values used as acceptance criteria in Surveillance Procedures 06-OP-1P75-R-Generator 11: Func-OP-1P75-R--OP-1P81-R-
-25- Attachment values in the surveillance procedures bounded the power demands of the largest loads, since, for Divisions I and II, these procedure values were less than those derived in Calculation MC-Q1P75- 1 and 4. In response, the licensee recalculated the pump loads. The conclusion of this reanalysis was that the values in Technical Specification Basis Surveillance Requirement 3.8.1.9 and the surveillance procedures were not conservative for all three Divisions. Results of this review were as follows: Division I: low pressure core spray pump motor power demand is 1314 kW rather than 1200 kW. Division II: residual heat removal pump C motor power demand is 685 kW rather than 550 kW. Division III: high pressure core spray pump motor power demand is 2410 kW rather than 2180 kW. Since the Surveillance Requirement 3.8.1.9 surveillance tests performed to date used load levels that were less than the actual largest post-accident loads, the licensee failed to maintain three operable diesel generators. This finding was entered into the Reports CR-GGN-2015-4611 and CR-GGN-2015-performing an operability evaluation to support an operable condition and recommending an action to investigate correcting the technical specification bases. Analysis. The team determined that the failure to perform Technical Specification Surveillance Requirement 3.8.1.9 was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems to respond to initiating events to prevent undesirable consequences. Specifically, the surveillance procedure error resulted in the acceptance of test results that did not satisfy Technical Specification Surveillance Requirement 3.8.1.9; therefore the test did not demonstrate diesel generator operability. In accordance with Inspection Findings At- because it was a design or qualification deficiency that did not represent a loss of functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.
-26- Attachment Enforcement. The team identified a Green, non-cited violation of Technical Specification 3.8.1, AC Sources-Operating, Limiting Condition for Operation 3.8.1, which requires that three diesel generators be operable. Contrary to the above, since July 1985, the licensee failed to maintain three operable diesel generators. Specifically, the licensee failed to perform Surveillance Requirement 3.8.1.9, because surveillance testing performed did not verify that each diesel generator could reject the single largest post-accident load and maintain engine speed within the required criteria. In response to this issue, the licensee performed an immediate operability determination to confirm that test results from full load reject indicated that, if performed correctly, the results of the Surveillance Requirement 3.8.1.9 test would be acceptable. This finding was s corrective action program as Condition Reports CR-GGN-2015-4611 and CR-GGN-2015-4627. Because this finding was of very low this violation is being treated as a non-cited violation consistent with the Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-06erform Surveillance Requirement .2.5 Division I Safety-related 125 Vdc Battery Chargers 1DA4 and 1DA5 a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with Division I 125 V dc battery chargers 1DA4 and 1DA5. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation. Calculations for electrical distribution, system load flow/voltage drop to verify that bus capacity and voltages remained within minimum acceptable limits. Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and that the battery cell is sized to perform the battery design basis function. Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance. Battery charger testing methodology was conducted to verify the battery chargers are being tested to ensure that design requirements are being met. Battery and battery charger vendor manuals, maintenance activities performed on the batteries and battery chargers.
-27- Attachment Modifications made to the battery chargers. Electrolytic capacitor replacement program. The material condition of the battery chargers to ensure the battery charger design criteria and maintenance requirements are met. b. Findings One example of a violation was identified and documented in Section 1R21.2.1.b.1. .2.6 High Pressure Core Spray Actuation Circuit a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the high pressure core spray actuation system including actuation for the support systems. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation. Sizing calculations, setpoint calculations for protective relaying, design specifications, installation drawings, modifications and upgrades made to the system. Procedures for preventive maintenance, procedures for calibrations, inspection, and testing to compare maintenance practices against industry and vendor guidance. b. Findings No findings were identified. .2.7 480 V Load Center Feeder Breakers 152-1507 and 152-1604 a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the 480 V load center feeder breakers 152-1507 and 152-1604. The team also performed walkdowns
-28- Attachment and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Maintenance and testing activities performed on the breakers in accordance with industry standards. Mechanical condition of breaker operating mechanisms. Vendor manuals for installation and maintenance. Maintenance and testing activities performed on the breakers in accordance with industry standards. b. Findings No findings were identified. .2.8 Motor Control Center MCC 15B31 a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with motor control center MCC 15B31. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Maintenance and testing activities performed on the breakers in accordance with industry standards. Mechanical condition of breaker operating mechanisms. Design specifications. Installation drawings. Vendor manuals for installation, maintenance, and testing of the motor control center and the associated installed molded case circuit breakers. The material condition of the motor control center to ensure the motor control center design criteria and maintenance requirements are met. b. Findings No findings were identified.
-29- Attachment .2.9 Reactor Protection System Relays a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the reactor protection system relays. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation. Operating experience documents created in the past 10 years to verify that similar experiences applicable to Grand Gulf have been evaluated appropriately. Corrective action documents and root cause evaluations for reactor scrams in the past 3 years to verify that the evaluations and identified causes were appropriate. Maintenance and testing activities performed on the breakers in accordance with industry and vendor standards, especially those associated with the scram discharge volume. Reactor protection system power distribution drawings and logic diagrams to verify drawings represented plant configuration noted during the walkdowns. b. Findings No findings were identified. .2.10 Condensate Storage Tank Level Instrumentation a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the condensate storage tank level instrumentation. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.
-30- Attachment Operating experience documents created in the past 10 years to verify that similar experiences applicable to Grand Gulf have been evaluated appropriately. Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance. Calculations and analyses associated with the condensate storage tank water capacity required for station blackout to verify the condensate storage tank had the necessary volume. Calculations, procedures, and analyses associated with both the automatic and manual suction swap over of high pressure core spray and reactor core isolation cooling from the condensate storage tank to the suppression pool to verify concerns associated with air entrapment and vortexing were appropriately incorporated. b. Findings 1. Failure to Update the Final Safety Analysis Report Introduction. The team identified six examples of a Severity Level IV, non-cited violation to update the final safety analysis report. Specifically, the team identified six examples where the licensee failed to ensure the final safety analysis report reflected the current plant configuration. Description. During the course of this inspection, the team identified six examples where the licensee failed to meet the requirements of 10 CFR 50.71(e) to update the final safety analysis report. The updated safety analysis report sections contained information and data that did not reflect the current plant configuration. The examples are: Table 6.2-5, -Term Accident Results for Containment reflect analyzed peak post-accident drywell pressure following the extended power uprate. Post power uprate analysis states that peak pressure is 27 psig. The table states peak pressure is 19.4 psig. wer (Station Section 8A.3, ,condensate storage tank is designed to ensure that more than the 115,278 gallons of water required to cope with a four hour station blackout event is maintained. However, the GGNS-NE-10-Extended Power Uprate Station Blackout Report, Revision 1, states the correct condensate storage tank volume under station blackout conditions is 136,014 gallons.
-31- Attachment ,ystem,states the minimum voltage of the 500 kV grid is 496 kV. Section 8.2.4, minimum 496 kV. However, the Amended and Restated Nuclear Plant Operating Agreement for Grand Gulf Nuclear Station dated December 18, 2013, states that the Grand Gulf 500 kV bus voltage minimum limit is 491 kV. ,-states that the total loss of coolant accident diesel generator load is 2,960.7 kW. However, Calculation EC-Q1111-AC Power Systemsttachment 7R.4, page 165, reports a load for bus 17 AC of 3216 kW. This is just one example of numerous such discrepancies in Tables 8.3-1, 8.3-2, and 8.3-3. -Loading and Unloading of Engineered Safety Features Bus,minimum operating requirement for Class 1E battery chargers is energization at 0 seconds during Forced Shutdown and Loss-of-Coolant Accident events. However, Table 8.3-Division 2 at 10 seconds for a bus undervoltage signal, 20 seconds for a loss of offsite power signal, and not at all for a loss-of-coolant accident signals. 115,278 gallons of water is required to cope with a four hour station blackout. However, the Extended Power Uprate Station Blackout Report, GGNS-NE-10-00034 Revision 1, states the correct condensate storage tank volume under station blackout conditions is 136,014 gallons. The licensee documented this issue in the corrective action program as Condition Reports CR-GGN-2015-4381, CR-GGN-2015-4671, CR-GGN-2015-4733, CR-GGN-2015-4753, CR-GGN-2015-4811, and CR-GGN-2015-4867. Analysis. The team determined that the failure to update the final safety analysis report in accordance with 10 CFR 50.71(e) was a performance deficiency. Traditional enforcement is applied to this performance deficiency because it involved a violation may impact the ability for the NRC to perform its regulatory oversight function. Assessing the performance deficiency in accordance with the NRC Enforcement Policy, the team determined it to be a Severity Level IV violation because the lack of up-to-date information in the final safety analysis report has not resulted in any unacceptable change to the facility or procedures. This violation did not have an assigned crosscutting aspect because crosscutting aspects are not assigned to traditional enforcement violations. Enforcement. The team identified six examples of a Severity Level IV, non-cited which states, in part, each person licensed to operate a nuclear power reactor shall
-32- Attachment update periodically the final safety analysis report originally submitted as part of the application for the license, to assure that the information included in the report contains the latest information developed. This submittal shall contain all the changes necessary to reflect information and analyses submitted to the Commission by the applicant or licensee or prepared by the applicant or licensee pursuant to Commission requirement since the submittal of the original or the last update to the final safety analysis report. Contrary to the above, since July 18, 2012, the licensee did not update the final safety analysis report to assure that the information included in the report contains the latest information developed. Specifically, the licensee failed to ensure the final safety analysis report reflected the current plant configuration. In response to these issue, the licensee created a corrective action to update the final safety analysis report. The violation was entered into the corrective action program as Condition Reports CR-GGN-2015-4381, CR-GGN-2015-4671, CR-GGN-2015-4733, CR-GGN-2015-4753, CR-GGN-2015-4811, and CR-GGN-2015-4867. Because this violation is Severity Level IV significance and entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-07Update the Final Safety Analysis Report. .2.11 Reactor Core Isolation Cooling Actuation Circuit a. Inspection Scope The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the reactor core isolation cooling actuation circuit. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this attribute to perform its desired design basis function. Specifically, the team reviewed: Automatic reactor core isolation cooling turbine trip setpoint settings for high exhaust back pressure, low pump suction pressure , high room temperature, and turbine overspeed to ensure setpoint bases are in accordance with design requirements . Periodic testing of the reactor core isolation cooling turbine initiation logic to ensure the reactor core isolation cooling pump is available to perform its design function when required. Periodic testing of the reactor core isolation cooling steam turbine to ensure speed controller operates as required. Logic diagrams of the reactor core isolation cooling system initiation to ensure the reactor core isolation cooling pump starts as required by Technical Specification logic settings.
-33- Attachment b. Findings No findings were identified. .2.12 Containment Vent Path a. Inspection Scope The team reviewed the updated safety analysis report, system description documentation, selected drawings, installation and test procedures, and condition reports associated with the 20-inch containment vent path including the associated containment isolation valves. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of these components to perform their desired design basis function. Specifically, the team reviewed: Component installation documentation and corrective action program reports to verify the configuration and functional testing of the components including valve differential pressure parameters. Procedures for inspection, testing, and operator actions, to insure performance, appropriate configuration control and adherence to industry and vendor guidance. The team also evaluated the functional testing methodology, and pressure values associated with acceptance criteria and whether the values appropriately supported design criteria. b. Findings No findings were identified. .2.13 Reactor Core Isolation Cooling Minimum Flow Valve 1E51F019A a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the reactor core isolation cooling minimum flow valve 1E51F019A. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.
-34- Attachment Operating experience documents created in the past 10 years to verify that similar experiences applicable to Grand Gulf have been evaluated appropriately. Maintenance rule functional failure evaluations to identify any potential underlying common causes. Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance. NRC Bulletin 88--Related Pump Loss. b. Findings 1. Incomplete and Inaccurate Response to NRC Bulletin 88-04 Introduction. The team identified a Severity Level IV, non-cited violation of 10 CFR 50.9, complete and accurate response to NRC Bulletin 88--Related Pump pump suppliers that the minimum flow rates were sufficient to ensure that there will be no pump damage from low flow operation, or a plan to obtain additional test data and/or modify the minimum flow capacity as needed, per Requested Actions 3 and 6. Description. NRC Bulletin 88-04, dated May 5, 1988, identified in part, a concern regarding the adequacy of minimum flow capacity for centrifugal pumps. The bulletin stated many licensees had accounted for thermal effects in establishing minimum flow capacities but had failed to consider flow instability effects. Including the flow instability effects could necessitate an increase in minimum flow settings to protect the pump. Requested Action 3 instructed licensees to evaluate the adequacy of the minimum flow bypass lines for safety-related centrifugal pumps with respect to damage resulting from operation and testing in the minimum flow mode. In addition, the evaluation should include verification from the pump suppliers that current minimum flow rates, or any proposed modifications, were sufficient to ensure there would be no pump damage from low flow operation. If the pump supplier did not verify the adequacy of the current minimum flow capacity, the licensees were instructed to provide a plan to obtain additional test data and/or modify the minimum flow line as necessary. Verification of the adequacy of current minimum flow capacity by the pump manufacturer was reiterated in Requested Action 6. NRC Bulletin 88-04 which were described in letters AECM-88/0136, dated July 8, 1988 and AECM-88/0158, dated August 9, 1988, and supporting engineering reports SERI-88-0016, dated July 11, 1988, and SERI-88-0018, dated August 2, 1988. Letter AECM-88/0158 identified that procedures for the residual heat removal pumps would be changed to maintain flow above 4000 gallons per minute in fuel pool cooling assist to alleviate minimum flow concerns. The letter and supporting engineering report SERI-88-0018 stated that minimum flow for the
-35- Attachment standby service water pumps was verified to be adequate by the pump vendor. For the remaining pressure core spray, high pressure core spray, and reactor core isolation cooling pumps, the letter stated that the pumps could be run intermittently for up 30 minutes but not more than 2 cumulative hours in a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, however this was a -to NRC Bulletin 88- None of the documents included information or verification from the pump suppliers regarding the adequacy of the minimum flow capacities of the low pressure core spray, high pressure core spray, and reactor core isolation cooling pumps, as requested by NRC Bulletin 88-04. At the time of the response, the licensee stated that no additional action was necessary. Upon further inspection, the team identified the reactor core isolation cooling pump had undergone a modification in 1995 to increase the minimum flow capacity from 90 gallons per minute to 95 gallons per minute. The licensee had received a letter in 1991, GEXI91-01686, from Sulzer Bingham Pumps Inc. that referenced NRC Bulletin 88-04 core isolation cooling pump had been modified to accommodate for flow instabilities, impeller recirculation, and vibration. This information was communicated to the -92-02553 and incorporated into the plant via Change Notice 95-0061 and Calculation MC-Q1E51-95027. Although the information provided the correct action, the licensee did not correct the erroneous information previously submitted to the NRC in the response to NRC Bulletin 88-04. as Condition Report CR-GGN-2015-4681. Analysis. The team determined that the failure to correct an incomplete and inaccurate response to NRC Bulletin 88-04, Requested Actions 3 and 6 was a performance deficiency. Traditional enforcement applied to this performance deficiency because it involved a violation may impact the ability for the NRC to perform its regulatory oversight function. Assessing the performance deficiency in accordance with Section 6.9 of the NRC Enforcement Policy, the team determined it to be a Severity Level IV violation because it resulted in no or relatively inappreciable potential safety or security consequences. This violation did not have a crosscutting aspect because crosscutting aspects are not assigned to traditional enforcement violations. Enforcement. The team identified a Severity Level IV, non-cited violation of 10 CFR requires information provided to the Commission by an applicant for a license or by a licensee or informatioconditions to be maintained by the applicant or the licensee shall be complete and accurate in all material respects. Contrary to the above, since November 1, 1991, the licensee provided information to the Commission that was not complete and accurate in from the pump suppliers that the minimum flow rates were sufficient to ensure that there will be no pump damage from low flow operation, or a plan to obtain additional test data and/or modify the minimum flow capacity as needed, per Requested Actions 3 and 6. In response to this issue, the licensee initiated corrective actions to submit the correct information. This violation
-36- Attachment Condition Report CR 2015-4681. Because this violation is Severity Level IV significance and entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-08- .2.14 Division II Residual Heat Removal Pump a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Division II residual heat removal pump. The team also performed system walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation. Corrective Action documents issued in the last 5 years to verify that repeat failures, and potential chronic issues, will not prevent the residual heat removal pumps from performing their safety function. Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance. Schematic diagrams to confirm the pump operation conformed to the design requirements. Voltage drop calculations to determine whether the motor had adequate voltage for starting and running under degraded voltage conditions. Cable sizing calculations to determine whether the motor circuit cabling had adequate ampacity. The maximum power demand of the pump was reviewed to verify it was properly reflected in alternating current distribution system and diesel generator loading analyses. b. Findings No findings were identified.
-37- Attachment .2.15 Division II Residual Heat Removal Heat Exchanger a. Inspection Scope The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Division II residual heat removal heat exchanger. The team also performed system walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation. Heat exchanger documentation associated with inspection results to ensure that the heat exchanger inspections adequately addressed structural integrity and cleanliness of their tubes. Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance. b. Findings No findings were identified. .2.16 Standby Liquid Control Tank, Pump, and Valves F004A and F004B a. Inspection Scope The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the standby liquid control tank, pump, and valves F004A and F004B. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Component maintenance history and corrective action program reports to verify the monitoring of potential degradation. Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance. System design basis documents and system modifications to provide sufficient shutdown margin associated with the extended power uprate.
-38- Attachment b. Findings No findings were identified. .2.17 Emergency Safety Feature Switchgear Room Coolers 1T46-B001A,B through 1T46-B005A,B a. Inspection Scope The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the emergency safety feature switchgear room coolers. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Heat load calculations used to size the room coolers. Periodic thermal performance monitoring to ensure the room coolers were capable of removing design bases heat loads. Preventive Maintenance activities to ensure the room coolers were maintained b. Findings No findings were identified. 2.18 High Pressure Core Spray Pump Room Cooler T51B001-C a. Inspection Scope The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the high pressure core spray pump room cooler. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed: Heat load calculations used to size the room cooler. Periodic thermal performance monitoring to ensure the room cooler was capable of removing design bases heat loads. Preventive maintenance activities to ensure the room cooler was maintained
-39- Attachment b. Findings No findings were identified. .2.19 Division I Emergency Diesel Generator Fuel Storage Tank a. Inspection Scope The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the Division I emergency diesel generator fuel storage tank. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this attribute to perform its desired design basis function. Specifically, the team reviewed: Fuel oil consumption calculations to ensure adequate fuel oil supply in tank to meet design and licensing requirements. Tornado missile protection for exposed fuel oil storage and fuel oil day tank vents. Fuel oil sampling activities to ensure the diesel fuel is delivered according to site specifications. b. Findings 1. Failure to Obtain a License Amendment for Use of Probabilistic Methods to Evaluate Tornado Missile Hazards Introduction. The team identified a Severity Level IV, Green non-cited violation of 10 CFR 50.59 c(2) failure to obtain a license amendment prior to changing the facility by incorporating the use or probabilistic methods to evaluate tornado missile generation. Description. On August, 31 1995, the licensee issued Updated Final Safety Analysis Report Change Notice 4268. The change to the updated final safety analysis report was to accurately reflect the as-built condition of the plant and to clearly state the basis for accepting unshielded components and openings which are vulnerable to tornado missile hazards. Specifically, the descriptions in Grand Gulf Updated Final Safety Analysis Report Section 3.5 and Table 3.5-8 did not accurately reflect that some safety-related components and building openings were partially exposed. These conditions were Plant Examination for External Events. To determine vulnerability of the exposed safety-related components to tornado missile damage, the licensee issued Calculation CC-Q1111-94004 to demonstrate that the cumulative annual probability of a tornado missile strike and its effects on vulnerable safety-related
-40- Attachment targets is 7.7E-9/year. Since the annual probability of tornado missile damage was smaller than 1E-7/year, as cited in NUREG 75/087, the change to the final safety analysis report did not deviate from any existing regulatory requirements. Therefore, the licensee determined that the accurate description and incorporation of the analysis into the updated final safety analysis report was not an unreviewed safety question. Or, implementation of the change would not result in an increase in the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the final safety analysis report. The incorporation of the analysis was included in the December 1995 revision of the Grand Gulf Outd -related components located outdoors as listed in Table 3.5- To, The protection against potential tornado missile damage which is afforded to partially exposed building openings and safety-related components located outdoors as listed in Table 3.5-8. The acceptability of these potential tornado missile targets is based upon a cumulative annual probability of tornado missile strike (and consequently a cumulative probability of target damage) smaller than 1 x 10-7. The use of 1 x 10-7 as an acceptable probability is in accordance with the criteria set forth in NUREG 75/087 section 3.5.1.4. Further, it is in accordance with the review procedures in NUREG 0800, section 3.5.1.4, and the acceptable probability described in Regulatory Guide 1.117 (See Appendix 3.A page 3A/1.117-1). Finally, the use of this value is consistent with industry practice as stated in EPRI Report NP- In addition, the licensee added page 3A/1.117-1 to the final safety analysis report, which April 1978, indicates that implementation of this guide is not applicable to Grand Gulf based upon the docket date of the Grand Gulf construction permit. It also reads that Grand Gulf complies with the requirements of the regulatory guide to the extent discussing in Grand Gulf Updated Final Safety Analysis Report Section 3.5.2.5. The team determined that the incorporation into the final safety analysis report the use of probabilistic methods to evaluate to vulnerability of tornado missile strikes on exposed equipment involved an unreviewed safety question, under the 10 CFR 50.59 rule in effect in 1995. The team determined that the change was an unreviewed safety question because it increased the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the safety analysis report. The change was an increase in probability of occurrence of malfunction of equipment report described all outdoor equipment was protected from the design basis tornado threat. Therefore, the probability of malfunction to the outdoor equipment was zero. The incorporation of the probabilistic method of evaluation accepts an increase in the
-41- Attachment probability of a malfunction because the probability associated with the malfunction increased from zero to 7.7E-9/year. In accordance with the NRC Enforcement Manual, the team reviewed this issue under the current 10 CFR 50.59 regulation to determine if this issue would require NRC review and approval. The team determined that this change would require prior approval because the change results in a departure from a method of evaluation described in the final safety analysis report used in establishing the design basis or in the safety analysis. Analysis. The team determined that the failure to obtain a license amendment prior to implementing a proposed change to the tornado missile protection design requirements was a performance deficiency. This performance deficiency was determined to be more than minor, and therefore a finding, because there was a reasonable likelihood the change would require NRC review and approval. The finding was evaluated using traditional enforcement, because the violation may impact the ability for the NRC to perform its regulatory oversight function. In accordance with the NRC Enforcement Policy, the significance determination process was used to inform the significance of the failure to obtain a license amendment prior to implementing a proposed change to the main control room design requirements. Using Inspection Manual Chapter 0609, - inspectors determined the finding involves the total loss of a safety function, identified by the licensee through a probabilistic risk analysis, individual plant examination for external events, or similar analysis, that contributes to external event initiated core damage accident sequences. Therefore, detailed risk evaluation was necessary. The senior reactor analyst reviewed the Grand Gulf Individual Plant Examination for External Events because it was the best available information on missile damage to exposed safety-related equipment. The senior reactor analyst determined that the finding had very low safety significance (Green) because the probability of damage occurring to the exposed safety-related equipment was 7.7E-9/year, which is below the threshold for additional probabilistic risk evaluation. Since the violation was associated with a Green reactor oversight finding, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with paragraph 6.1.d(2) of the NRC Enforcement Policy. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. Enforcement. The team identified a Green, Severity Level IV non-cited violation of 10 CFR 50.59, Changes, Tests, and Experiments, c(2), 1995 version, which requires that a licensee who desires to make a change in the facility described in the final safety analysis report, which involve an unreviewed safety question shall submit an application for amendment of the license pursuant to 10 CFR 50.90. Contrary to the abovemaking a change to the Grand Gulf final safety analysis report, as updated, that involved an unreviewed safety question. Specifically, tcorporation of the use of probabilistic methods for evaluation of tornado missiles into the Grand Gulf Final Safety Analysis Report Section 3.5.2.5 involved an unreviewed safety question because it increased the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the safety analysis report. In response to the issue, the licensee prepared a license amendment request to obtain approval of the use of probabilistic
-42- Attachment methods. This finding was entered into the corrective action program as Condition Reports CR-GGN-2015-4615 and CR-GGN-2015-4760. Because this violation is Severity Level IV significance and entered into the corrective action program the violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-0Failure to Obtain a License Amendment for Use of Probabilistic Methods to Evaluate Tornado Missile Hazards .3 Results of Reviews for Operating Experience .3.1 Inspection of NRC Information Notice 1994-71, Degradation of Scram Solenoid Pilot Valves a. Inspection Scope -71, Degradation of Scram Solenoid Pilot Valves, to verify that a program was in place to address replacement of the viton seals associated with the scram pilot solenoid valves. The review included a sample of five completed preventative maintenance items, along with a review of the required 15-year replacement frequency in the plants scheduling system. information notice. b. Findings No findings were identified. .3.2 Inspection of NRC Generic Letter 2006-Risk and the Operability of Offsite Power a. Inspection Scope -002, verify that interfaces between the nuclear power plant and the transmission system operator are in place and adequate to maintain the operability of offsite power. b. Findings 1. Failure to Ensure Equipment Operability and Functionality of Allowable Alternating Current Frequency Range Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, the adequacy of design of the alternating current electrical equipment. Specifically, the licensee failed to verify that the safety-related alternating current equipment will operate satisfactorily at the extremes of the allowable alternating current frequency ranges as specified in the updated final safety analysis report and technical specifications.
-43- Attachment Description. Grand Gulf Updated Final Safety Analysis Report, Section 8.2.4, states that the electrical distribution system is designed to operate within a frequency range of 58.5 Hz to 61.8 Hz. The Nuclear Plant Operating Agreement between the licensee and the transmission system operator, directs the transmission system operator to maintain the same range: Specification Surveillance Requirement 3.8.1.2 specifies that the diesel generators shall be verified to achieve a steady-state frequency of 58.8 to 61.2 Hz. Nuclear - the process of reviewing, confirming, or substantiating the design by one or more The team identified that verification that safety-related alternating current equipment will operate properly at the extremes of the allowable frequency range has not been documented. Implied in the current analyses was the non-conservative assumption that the power supply is providing 60 Hz. These analyses include diesel generator loading, diesel generator fuel consumption, pump developed head and flow, and motor operated valve torque. Off-nominal frequency operation affects the performance of alternating current equipment in various ways. For example, for induction motors, operation at low frequency causes increased torque and decreased operating speed. Operation at high frequency causes decreased torque, increased starting time, increased operating speed, and increased power demand. For pumps, operation at lower speed results in decreased flow and pressure, and operation at higher speed results in increased flow In May 2015, the licensee conducte-focused self-assessment in accordance with their Procedure EN-LI-- as documented in report LO-GLO-2015-00100. One of the requirements of the self-assessment was to review the issues identified in NRC Information Notice 2008-where the emergency diesel generators (EDGs) loading calculations failed to account for the increased electrical load resulting from EDG operation at the maximum frequency ress these issues in the self-assessment. Analysis. The team determined that the failure to verify safety-related alternating current equipment for operation at the extremes of the allowed frequency range in accordance
-44- Attachment with ANSI N45.2.11 was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences. Specifically, lack of verification that the alternating current equipment would function at the extremes of the allowable frequency range can result in incorrect conclusions regarding the ability of the equipment to meet its design bases. In accordance with (SDP) for Findings At-(Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a problem identification and resolution crosscutting aspect associated with self-assessments, because the organization failed to conduct self-critical and objective assessment of its programs and policies [P.6]. Enforcement. The team identified a Green, non-cited violation of 10 CFR Part 50, measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational above, prior to August 14, 2015, the licensee failed to verify or check the adequacy of design of the alternating current electrical equipment. Specifically, the licensee failed to verify that the safety-related alternating current equipment will operate satisfactorily at the extremes of the allowable alternating current frequency ranges as specified in the updated final safety analysis report and technical specifications. In response to this issue, the licensee is updating calculations to reflect the allowable frequency range. This program as Condition Report CR-GGN-2015-4672. Because this finding was of very low safety significance being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-10Failure to Ensure Equipment Operability and Functionality of Allowable Alternating Current Frequency Range 3.3 Inspection of NRC Information Notice 2012-06, Ineffective Use of Vendor Technical Information a. Inspection Scope The team 2012-06, Use of Vendor Technical Information,the receipt and evaluation of vendor information to ensure that adequate attention was applied to the importance of vendor-supplied information. Specifically, the team
-45- Attachment w adequately addressed the issues in the information notice. b. Findings No findings were identified. .4 Results of Reviews for Operator Actions a. Inspection Scope The team selected risk-significant components and operator actions for review using tic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6. For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant. The selected operator actions were Completion of the bypass of reactor core isolation cooling isolations within 30 minutes. Opening of the control room panel doors within 30 minutes. Operator response to the failure of the Division I emergency diesel generator load sequencer. Operator response to lowering condensate storage tank level due to reactor core isolation cooling 1E51-F019 valve failures. Fire water injection into the feedwater system to maintain adequate core cooling. b. Findings 1. Failure to Implement Equipment Control Procedures for Loose Items in Containment Introduction. The team identified a Green, non-cited violation of Technical Specification recommended in Regulatory Guide 1.33, Revision 2, Appendix A. Specifically, the licensee failed to follow equipment control procedures when multiple loose items were left in containment since the previous refueling outage. Description. The team performed a walkdown in the containment building and identified multiple loose items were found in the containment structure that had not been
-46- Attachment evaluated or secured. Examples of these items include ladders, tool boxes, carts, plastic coverings and oil pads. These items had the potential to either clog or damage emergency core cooling system strainers or to directly impact safety-related components. Following the walkdown, the team identified that the licensee failed to follow the following procedures: Standard GGNS-CS-Seismic II/I Situations due to Loose Items requires items which weigh more than 10 pounds not be left unattended in, on, or elevated above safety-related components or equipment without an engineering evaluation. Procedure 01-S-07-not be left unattended in Containment unless one of the following exists: a) the Procedure EN-MA-118, Foreign Material Exclusion Step 5.5.16(b) requires tools and materials to be made failsafe, secured to a tether or in an enclosure device. In response to this issue, the utility generated nine separate condition reports to identify, evaluate and, where necessary, remove items from containment. These were Condition Reports CR-GGN-2015-4346, CR-GGN-2015-4350, CR-GGN-2015-4352, CR-GGN-2015-4353, CR-GGN-2015-4402, CR-GGN-2015-4403, CR-GGN-2015-4499, CR-GGN-2015-4498, and CR-GGN-2015-4510. These conditions were combined into one condition report to assess any negative trends as Condition Report CR-GGN-2015-4568. Analysis. The team determined that failure to implement procedures for prevention of loose items in the containment structure is a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the failure to control materials and temporary equipment was a significant programmatic deficiency which would have the potential to cause unacceptable or degraded conditions if left undetected (MC 0612, App E). In Determination Process (SDP) for Findings At-significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of nontechnical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a human performance crosscutting aspect associated with avoid complacency, in that the licensee failed to recognize and plan for the possibility of latent issues, even while expecting successful outcomes [H.12].
-47- Attachment Enforcement. The team identified a Green, non-cited violation of Technical Specification 5.4 5.4.1, cedures shall be established, implemented, and maintained covering the following activities: (a) The applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, , the licensee failed to implement procedures covering equipment control, as recommended in Regulatory Guide 1.33, Revision 2, Appendix A. Specifically, the licensee failed to follow Procedures 01-S-07-43, er, and -CS--MA-Exclusion, when multiple loose items were left in containment since the previous refueling outage. In response to this issue, the licensee immediately removed all loose items in containment that was not permitted by an associated engineering evaluation. This finding was entered into the corrective action program as Condition Report CR-GGN-2015-4568. Because this finding was of very low safety significance and has as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2015007-Failure to Implement Equipment Control Procedures for Loose Items in Containment Component Design Basis Review The team reviewed condition reports associated with the selected components, operator actions, and operating experience notifications. Any related findings are documented in prior sections of this report. However, experienced challenges with the implementation of the corrective action program. These challenges include failures to recognize degraded or nonconforming conditions, and failures to adequately describe degraded or nonconforming conditions when identified. a low threshold and to promptly correct conditions adverse to quality.
-1- Attachment C. Boschetti, Manager, Nuclear Improvement Oversight K. Boudreaux, Manager, System Engineering R. Busick, Manager, Operations T. Coles, Engineer, Regulatory Assurance T. Coutu, Director, Regulatory and Performance Improvement V. Fallacara, General Plant Manager, Operations B. Grant, Manager, Production M. Greenough, Design Engineer, Design Engineering J. Hallenbeck, Manager, Design and Program Engineering G. Hawkins, Senior Manager, Site Projects-Maintenance J. Hendrick, Engineer, System Engineering L. Hendrick, Engineer, Design Engineering C. Landry, Engineer, Design Engineering C. Landry, Engineer, System Engineering N. Matthew, Engineer, System Engineering A. McMahan, Design Engineer, Design Engineering E. Meaders, Manager, Training R. Meister, Senior Specialist, Regulatory Assurance R. Meyer, Assistant Operations Manager, Operations M. Milly, Senior Manager, Maintenance