IR 05000483/2017003

NRC Integrated Inspection Report 05000483/2017003 and Exercise of Enforcement Discretion

ML17304A950
Person / Time
Site:	Callaway
Issue date:	10/31/2017
From:	Nick Taylor NRC/RGN-IV/DRP/RPB-B
To:	Diya F Ameren Missouri
Taylor N
References
EA-17-145 IR 2017003
Download: ML17304A950 (36)

Text

ctober 31, 2017

SUBJECT:

CALLAWAY PLANT - NRC INTEGRATED INSPECTION REPORT 05000483/2017003 AND EXERCISE OF ENFORCEMENT DISCRETION

Dear Mr. Diya,

On September 30, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Callaway Plant. On October 4, 2017, the NRC inspectors discussed the results of this inspection with Mr. B. Cox, Senior Director, Nuclear Operations, and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented one finding of very low safety significance (Green) in this report.

This finding involved a violation of NRC requirements. The NRC is treating this violation as a non-cited violation (NCV) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violation or the significance of this NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Callaway Plant.

If you disagree with a cross-cutting aspect assignment, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the Callaway Plant.

Tornado-generated missile protection violations were identified for the following of technical specifications: 3.7.1 Main Steam Safety Valves, 3.7.4 Atmospheric Steam Dump Valves, 3.7.5 Auxiliary Feedwater System, and 3.8.1 AC Sources - Operating. Because the violations were identified during the discretion period covered by Enforcement Guidance Memorandum 15-002, Revision 1, Enforcement Discretion for Tornado Missile Protection Non-compliance, and because the licensee was implementing compensatory measures, the NRC is exercising enforcement discretion by not issuing an enforcement action and is allowing continued reactor operation. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Nicholas H. Taylor, Chief Project Branch B Division of Reactor Projects Docket No. 50-483 License No. NPF-30

Enclosure:

Inspection Report 05000483/2017003 w/Attachments: 1. Supplemental Information 2. Request for Information

REGION IV==

Docket: 05000483 License: NPF-30 Report: 05000483/2017003 Licensee: Union Electric Company Facility: Callaway Plant Location: 8315 County Road 459 Steedman, MO 65077 Dates: July 1 through September 30, 2017 Inspectors: D. Bradley, Senior Resident Inspector S. Janicki, Resident Inspector B. Bartlett, Acting Senior Resident Inspector K. Clayton, Senior Operations Engineer C. Cowdrey, Operations Engineer M. Hayes, Operations Engineer C. Stott, Reactor Inspector Approved By: Nicholas H. Taylor Chief, Project Branch B Division of Reactor Projects 1 Enclosure

SUMMARY

IR 05000483/2017003, 07/01/2017 - 09/30/2017; Callaway Plant; Maintenance Effectiveness.

The inspection activities described in this report were performed between July 1 and September 30, 2017, by the resident inspectors at the Callaway Plant and inspectors from the NRCs Region IV office and other NRC offices. One finding of very low safety significance (Green) is documented in this report. This finding involved a violation of NRC requirements. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green, White, Yellow, or Red), determined using Inspection Manual Chapter 0609,

Significance Determination Process, dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The inspectors reviewed a self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to implement Preventative Maintenance Basis document IC-LSELS, Load Shed and Emergency Load Sequencer (LSELS), Revision 0. Specifically, the licensee failed to replace load shed and emergency load sequencer relay driver Card NF039AR06SL23, a Consolidated Controls 6N232 relay driver card, within the scheduled periodicity. On June 28, 2017, containment spray train A pump, PEN01A, spuriously started due to the cards failure. As a result, one train of the containment spray system was rendered inoperable for a total of 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />, of which all 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> were unplanned. As immediate corrective actions, the licensee replaced the circuit card under Job 17002747, completed post-maintenance testing, and restored the system to operable status on June 30, 2017. The licensee entered this issue into the corrective action program under Condition Report 201703433.

The failure to replace load shed and emergency load sequencer relay driver Card NF039AR06SL23 within the scheduled periodicity was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it adversely affected the equipment performance attribute of the Mitigating Systems Cornerstone and its objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, on June 28, 2017, containment spray train A pump, PEN01A, spuriously started due to the cards failure. As a result, one train of the containment spray system was rendered inoperable for a total of 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. Using Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012, the inspectors determined the finding was of very low safety significance (Green) because (1) the finding was not a deficiency affecting the design or qualification of a mitigating system; (2) the finding did not represent a loss of system and/or function; (3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and (4) the finding does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Specifically, the total duration of inoperability was 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> which is less than the technical specification allowed completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for this system. The finding had a cross-cutting aspect in the area of problem identification and resolution associated with resolution because the licensee failed to take effective corrective actions to address issues in a timely manner commensurate with their safety significance. Specifically, the licensee did not replace load shed and emergency load sequencer relay driver Card NF039AR06SL23 prior to failure although this issue was documented in corrective actions ranging from April 2008 to January 2017 [P.3]. (Section 1R12)

PLANT STATUS

Callaway Plant began the inspection period at 100 percent power. On September 25, 2017, the licensee began power coast down to a refueling outage, ending the inspection period at 98 percent power.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R01 Adverse Weather Protection

Readiness for Impending Adverse Weather Conditions

a. Inspection Scope

On July 19, 2017, the inspectors completed an inspection of the stations readiness for impending adverse weather conditions. The inspectors reviewed plant design features, the licensees procedures to respond to extreme high temperatures, and the licensees implementation of these procedures. The inspectors evaluated operator staffing and accessibility of controls and indications for those systems required to control the plant.

These activities constituted one sample of readiness for impending adverse weather conditions, as defined in Inspection Procedure 71111.01.

b. Findings

No findings were identified.

1R04 Equipment Alignment

.1 Partial Walk-Down

a. Inspection Scope

The inspectors performed partial system walk-downs of the following risk-significant systems:

• July 12, 2017, component cooling water train B

• August 28, 2017, essential service water train A The inspectors reviewed the licensees procedures and system design information to determine the correct lineup for the systems. They visually verified that critical portions of the trains were correctly aligned for the existing plant configuration.

These activities constituted two partial system walk-down samples as defined in Inspection Procedure 71111.04.

b. Findings

No findings were identified.

.2 Complete Walk-Down

a. Inspection Scope

On August 17, 2017, the inspectors performed a complete system walk-down inspection of emergency diesel generator train A. The inspectors reviewed the licensees procedures and system design information to determine the correct lineup for the existing plant configuration. The inspectors also reviewed outstanding work orders, open condition reports, in-process design changes, and other open items tracked by the licensees operations and engineering departments. The inspectors then visually verified that the system was correctly aligned for the existing plant configuration.

These activities constituted one complete system walk-down sample, as defined in Inspection Procedure 71111.04.

b. Findings

No findings were identified.

1R05 Fire Protection

.1 Quarterly Inspection

a. Inspection Scope

The inspectors evaluated the licensees fire protection program for operational status and material condition. The inspectors focused their inspection on four plant areas important to safety:

• July 7, 2017, component cooling water train A, fire area A-16 north

• August 10, 2017, containment spray pump train A, fire area A-2

• August 13, 2017, control building cable chase trains A and B, fire areas C-11 and C-12

• August 21, 2017, component cooling water train B, fire area A-16 south For each area, the inspectors evaluated the fire plan against defined hazards and defense-in-depth features in the licensees fire protection program. The inspectors evaluated control of transient combustibles and ignition sources, fire detection and suppression systems, manual firefighting equipment and capability, passive fire protection features, and compensatory measures for degraded conditions.

These activities constituted four quarterly inspection samples, as defined in Inspection Procedure 71111.05.

b. Findings

No findings were identified.

.2 Annual Inspection

a. Inspection Scope

The inspectors completed their annual evaluation of the licensees fire brigade performance. This evaluation included observation of two fire drills:

• July 25, 2017, announced fire brigade drill, fire area A-27

• August 27, 2017, unannounced fire brigade drill, fire area TB-1 During these drills, the inspectors evaluated the capability of the fire brigade members, the leadership ability of the brigade leader, the brigades use of turnout gear and fire-fighting equipment, and the effectiveness of the fire brigades team operation. The inspectors also reviewed whether the licensees fire brigade met NRC requirements for training, dedicated size and membership, and equipment.

These activities constituted one annual inspection sample, as defined in Inspection Procedure 71111.05.

b. Findings

No findings were identified.

1R06 Flood Protection Measures

a. Inspection Scope

On September 20, 2017, the inspectors completed an inspection of the stations ability to mitigate flooding due to internal causes. After reviewing the licensees flooding analysis, the inspectors chose the component cooling water pump area containing risk-significant structures, systems, and components that were susceptible to flooding.

The inspectors reviewed plant design features and licensee procedures for coping with internal flooding. The inspectors walked down the selected areas to inspect the design features, including the material condition of seals, drains, and flood barriers. The inspectors evaluated whether operator actions credited for flood mitigation could be successfully accomplished.

In addition, on July 27, 2017, the inspectors completed an inspection of underground bunkers susceptible to flooding. The inspectors selected manhole MH01B, an underground vault that contained risk-significant or multiple-train cables, whose failure could disable risk-significant equipment.

The inspectors observed the material condition of the cables and splices contained in the vault and looked for evidence of cable degradation due to water intrusion. The inspectors verified that the cables and vaults met design requirements.

These activities constituted completion of two flood protection measures samples, including one bunker/manhole sample, as defined in Inspection Procedure 71111.06.

b. Findings

No findings were identified.

1R11 Licensed Operator Requalification Program and Licensed Operator

Performance (71111.11)

.1 Review of Licensed Operator Requalification

a. Inspection Scope

On July 20, 2017, the inspectors observed an evaluated emergency drill in the simulator performed by an operating crew. The inspectors assessed the performance of the operators and the evaluators critique of their performance. The inspectors also assessed the modeling and performance of the simulator during the simulator scenario.

These activities constituted completion of one quarterly licensed operator requalification program sample, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

.2 Review of Licensed Operator Performance

a. Inspection Scope

The inspectors observed the performance of on-shift licensed operators in the plants main control room. At the time of the observations, the plant was in a period of heightened activity due to surveillance testing. The inspectors observed the operators performance of the following activities:

• July 5, 2017, component cooling water train A surveillance testing

• August 23, 2017, emergency diesel generator train B surveillance testing In addition, the inspectors assessed the operators adherence to plant procedures, including Procedure ODP-ZZ-00001, Operations Department - Code of Conduct, Revision 102, and other operations department policies.

These activities constituted completion of one quarterly licensed operator performance sample, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

.3 Biennial Review

The licensed operator requalification program involves two training cycles that are conducted over a 2 year period. In the first cycle, the annual cycle, the operators are administered an operating test consisting of job performance measures and simulator scenarios. In the second part of the training cycle, the biennial cycle, operators are administered an operating test and a comprehensive written examination.

To assess the performance effectiveness of the licensed operator requalification program, the inspectors reviewed both the written examination and operating test quality and observed licensee administration of an annual requalification test while on site. The operating tests observed included six job performance measures and two scenarios that were used in the current biennial requalification cycle. These observations allowed the inspectors to assess the licensee's effectiveness in conducting the operating test to ensure operator mastery of the training program content and to determine if feedback of performance analyses into the requalification training program was being accomplished.

On September 15, 2017, the licensee informed the inspectors of the completed cycle results for the Callaway Plant for both the written examinations and the operating tests:

• 8 of 9 crews passed the simulator portion of the operating test

• 51 of 57 licensed operators passed the simulator portion of the operating test

• 57 of 57 licensed operators passed the job performance measure portion of the operating test

• 52 of 56 licensed operators passed the written examination The individuals that failed the written examination and simulator scenario portions of the operating test were remediated, retested, and passed their retake examinations or tests with one exception. One licensed operator was still in the remediation process during the reporting process and has not been retested. The licensee is administratively restricting this operator from watchstanding duties until remediation is complete and a passing score is achieved on the retake written examination.

The difference between the number of operators that took the written examination and the number of operators that took the operating test is that one operator dropped their license between administration of the operating test and the written examination.

The inspectors observed examination security measures in place during administration of the exams (including controls and content overlap) and reviewed any remedial training and re-examinations. The inspectors also reviewed medical records of seven licensed operators for conformance to license conditions and the licensees system for tracking qualifications and records of license reactivation for two operators.

The inspectors reviewed simulator performance for fidelity with the actual plant and the overall simulator program of maintenance, testing, and discrepancy correction.

The inspectors completed one inspection sample of the biennial licensed operator requalification program.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

Routine Maintenance Effectiveness

a. Inspection Scope

The inspectors reviewed two instances of degraded performance or condition of safety-significant structures, systems, and components:

• August 13, 2017, containment spray pump train A spurious start

• September 8, 2017, component cooling water isolation valves cycle time The inspectors reviewed the extent of condition of possible common cause structure, system, and component failures and evaluated the adequacy of the licensees corrective actions. The inspectors reviewed the licensees work practices to evaluate whether these may have played a role in the degradation of the structures, systems, and components. The inspectors assessed the licensees characterization of the degradation in accordance with 10 CFR 50.65 (the Maintenance Rule), and verified that the licensee was appropriately tracking degraded performance and conditions in accordance with the Maintenance Rule.

These activities constituted completion of two maintenance effectiveness samples, as defined in Inspection Procedure 71111.12.

b. Findings

Introduction.

The inspectors reviewed a Green, self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to implement Preventative Maintenance Basis document IC-LSELS, Load Shed and Emergency Load Sequencer (LSELS), Revision 0. Specifically, the licensee failed to replace LSELS relay driver Card NF039AR06SL23, a Consolidated Controls 6N232 relay driver card, within the scheduled periodicity. On June 28, 2017, containment spray train A pump, PEN01A, spuriously started due to the cards failure. As a result, one train of the containment spray system was rendered inoperable for a total of 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. As immediate corrective actions, the licensee replaced the circuit card under Job 17002747, completed post-maintenance testing, and restored the system to operable status on June 30, 2017.

Description.

On June 28, 2017, the containment spray train A pump started without an associated actuation signal. The control room staff noticed the spurious pump start, validated that there were no conditions requiring the system to start, and confirmed that no other system components repositioned. When the pump was taken to stop, it automatically restarted. The control room staff disabled the pump via the hand-switch, declared containment spray system train A inoperable, and declared LSELS train A inoperable. Upon troubleshooting, the licensee determined that a single circuit on the LSELS relay driver Card NF039AR06SL23, a Consolidated Controls 6N232 relay driver card, had failed. The relay driver cards function is to send actuation signals to safety-related components when associated accident signals are received. The other three circuits on the LSELS card were functioning correctly and were associated with the residual heat removal train A pump, the component cooling water train A pump, and the component cooling water train C pump. The licensee replaced the LSELS relay driver card, completed post-maintenance testing, and restored the systems to operable status on June 30, 2017.

The inspectors reviewed the maintenance and corrective action history for this component. In 2008, the licensee generated Callaway Action Request 200803108 to establish periodic replacement of circuit cards based on an independent assessment of maintenance performance. This action was implemented in 2010 by the creation of Preventative Maintenance Basis document IC-LSELS, Load Shed and Emergency Load Sequencer (LSELS), Revision 0. This preventative maintenance plan required Consolidated Controls 6N232 relay driver cards to be replaced on an 18-year frequency.

Since LSELS relay driver Card NF039AR06SL23 was last replaced in 1993, the card was not immediately due for replacement and the licensee deferred the replacement of this type of card due, in part, to obsolescence concerns. The deferrals were documented as system health issues in 2013, in Condition Report 201400839, and as recently as January 2017 under due date extensions for action assignments for the same condition report. Specifically, the extensions were approved due to the relative priority of issue with no impacts to any system components.

The inspectors concluded that the licensee failed to replace LSELS relay driver Card NF039AR06SL23 within the scheduled periodicity of 18 years and it failed after 24 years of service. The inspectors determined one train of the containment spray system was rendered inoperable for a total of 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. The inspectors noted that Technical Specification 3.6.6.A, one containment spray train inoperable, has a completion time limit of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

As immediate corrective actions, the licensee replaced the circuit card under Job 17002747, completed post-maintenance testing, and restored the systems to operable status on June 30, 2017. The licensee entered this issue into the corrective action program under Condition Report 201703433.

Analysis.

The failure to replace LSELS relay driver Card NF039AR06SL23 within scheduled periodicity was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it adversely affected the equipment performance attribute of the Mitigating Systems Cornerstone and its objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, on June 28, 2017, containment spray train A pump, PEN01A, spuriously started due to the cards failure.

As a result, one train of the containment spray system was rendered inoperable for a total of 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. Using Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012, the inspectors determined the finding was of very low safety significance (Green) because

(1) the finding was not a deficiency affecting the design or qualification of a mitigating system;

(2) the finding did not represent a loss of system and/or function;

(3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and

(4) the finding does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Specifically, the total duration of inoperability was approximately 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> which is less than the technical specification allowed completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for this system. The finding had a cross-cutting aspect in the area of problem identification and resolution associated with resolution because the licensee failed to take effective corrective actions to address issues in a timely manner commensurate with their safety significance. Specifically, the licensee did not replace LSELS relay driver Card NF039AR06SL23 prior to failure although this issue was documented in several corrective actions ranging from April 2008 to January 2017 [P.3].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 9.b of Appendix A to Regulatory Guide 1.33, Revision 2, which requires, in part, preventative maintenance schedules should be developed for replacement of parts that have a specific lifetime. The licensee established Preventative Maintenance Basis document IC-LSELS, Load Shed and Emergency Load Sequencer, Revision 0, to meet the Regulatory Guide 1.33 requirement. Document IC-LSELS requires replacement of Consolidated Controls 6N232 relay driver cards on an 18-year frequency. Contrary to the above, prior to June 28, 2017, the licensee failed to replace Consolidated Controls 6N232 relay driver cards on an 18-year frequency. Specifically, the licensee failed to replace LSELS relay driver Card NF039AR06SL23 within the scheduled periodicity. As a result, one train of the containment spray system was rendered inoperable for a total of 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. As immediate corrective actions, the licensee replaced the circuit card under Job 17002747, completed post-maintenance testing, and restored the system to operable status on June 30, 2017. The licensee entered this issue into the corrective action program under Condition Report 201703433. Because this finding is of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000483/2017003-01, Spurious Containment Spray Pump Start.

1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed one risk assessment performed by the licensee prior to changes in plant configuration and the risk management actions taken by the licensee in response to elevated risk:

• July 10, 2017, component cooling water train A technical specification outage The inspectors verified that this risk assessment was performed timely and in accordance with the requirements of 10 CFR 50.65 (the Maintenance Rule) and plant procedures. The inspectors reviewed the accuracy and completeness of the licensees risk assessment and verified that the licensee implemented appropriate risk management actions based on the result of the assessment.

The inspectors also observed portions of two emergent work activities that had the potential to cause an initiating event or to affect the functional capability of mitigating systems:

• August 1, 2017, digital rod position indication train A power failure

• September 13, 2017, main feedwater regulating valve control issues for steam generator A The inspectors verified that the licensee appropriately developed and followed a work plan for these activities. The inspectors verified that the licensee took precautions to minimize the impact of the work activities on unaffected structures, systems, and components.

These activities constituted completion of three maintenance risk assessments and emergent work control inspection samples, as defined in Inspection Procedure 71111.13.

b. Findings

No findings were identified.

1R15 Operability Determinations and Functionality Assessments

a. Inspection Scope

The inspectors reviewed five operability determinations that the licensee performed for degraded or nonconforming structures, systems, or components:

• July 5, 2017, safety injection accumulator D level trend

• July 24, 2017, essential service water train A valve position for vital switchgear room coolers

• July 27, 2017, essential service water fan calculation margin for thermal overload

• August 1, 2017, vital switchgear room coolers configuration during maintenance including standing order

• September 5, 2017, tornado-generated missile protection for selected systems:

auxiliary feedwater, atmospheric steam dump valves, main steam safety valves, emergency diesel generator fuel oil The inspectors reviewed the timeliness and technical adequacy of the licensees evaluations. Where the licensee determined the degraded structure, system, or component to be operable, the inspectors verified that the licensees compensatory measures were appropriate to provide reasonable assurance of operability. The inspectors verified that the licensee had considered the effect of other degraded conditions on the operability of the degraded structure, system, or component.

These activities constituted completion of five operability and functionality review samples as defined in Inspection Procedure 71111.15.

b. Findings

Enforcement Action EA-17-145, Enforcement Discretion for Tornado-Generated Missile Protection Non-compliances

Description.

10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants, Criterion 2, Design Bases for Protection Against Natural Phenomena, states, in part, that structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena, such as tornadoes. Criterion 4, Environmental and Dynamic Effects Design Basis, states, in part, that structures, systems, and components important to safety shall be appropriately protected against dynamic effects including missiles that may result from events and conditions outside the nuclear power unit. Section 3.5.3.1, Tornado Missile Barrier Design Procedures, of the Final Safety Analysis Report (FSAR) describes the parameters of tornado-resistant structures including wall thickness and concrete strength. Table 3.3-1, Tornado-Resistant Buildings and Structures, of the FSAR lists the structures that are designed to withstand tornado-generated missile impact.

On February 7, 2017, the NRC issued Enforcement Guidance Memorandum (EGM) 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Non-compliance, Revision 1 (ADAMS Accession Number ML16355A286). The EGM referenced a bounding, generic risk analysis performed by the NRC staff that concluded that tornado-generated missile vulnerabilities pose a low risk significance to operating nuclear plants. Because of this, the EGM described the conditions under which the NRC staff may exercise enforcement discretion for non-compliance with the current licensing basis for tornado-generated missile protection. Specifically, if the licensee could not meet the technical specification required actions within the required completion time, the EGM allows the staff to exercise enforcement discretion provided the licensee implements initial compensatory measures prior to the expiration of the time allowed by the limiting condition for operation. The compensatory actions should provide additional protection such that the likelihood of tornado-generated missile effects are lessened.

The EGM then requires the licensee to implement more comprehensive compensatory measures within approximately 60 days of issue discovery. The compensatory measures must remain in place until permanent repairs are completed, or until the NRC dispositions the non-compliance in accordance with a method acceptable to the NRC such that discretion is no longer needed. Because EGM 15-002 listed Callaway as a Group A plant, enforcement discretion will expire on June 10, 2018.

During this inspection period, the licensee invoked EGM 15-002 on three occasions.

1. Auxiliary Feedwater Section 10.4.9, Auxiliary Feedwater System, of the FSAR describes the safety function of the auxiliary feedwater (AFW) system, in conjunction with safety valves in the main steam system, to remove thermal energy from the reactor coolant system. Safety design basis 1 of this section further states, The [AFW system] is protected from the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, and external missiles (GDC-2).

On August 15, 2017, the licensee identified that the recirculation lines from the condensate storage tank to the following AFW system pumps were not protected from tornado-generated missiles: motor driven AFW train A, motor driven AFW train B, and turbine-driven AFW. Specifically, the affected recirculation lines are contained in the condensate storage tank valve house which is not a tornado-resistant structure. Note that the AFW recirculation lines ensure the respective AFW pump always has a discharge flow path, when operating, to prevent pump damage. Impact of a tornado-generated missile could crimp the recirculation line shut and lead to pump damage. This vulnerability was identified as part of the licensees review of industry operating experience with tornado issues.

The licensee concluded that an unanalyzed condition that significantly degrades plant safety existed for the AFW system recirculation lines. Further, this condition could have prevented the fulfillment of the safety function of systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, or mitigate the consequences of an accident. This issue was entered into the corrective action program as Condition Report 201704176 and reported under 10 CFR 50.72 as Event Notification 52905, Discovery of Nonconforming Conditions During Tornado Hazards

Analysis.

As a result of this issue, the licensee declared all AFW pumps inoperable, complied with the applicable technical specification action statements, initiated Condition Report 201704176, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status. The licensee instituted compensatory measures intended to reduce the likelihood of tornado-generated missile effects. These included verifying that guidance was in place for severe weather procedures, abnormal and emergency operating procedures, and diverse and flexible coping strategies (FLEX)support guidelines, that training on these procedures was current, and that a heightened level of awareness of the vulnerability was established.

2. Atmospheric Steam Dumps and Main Steam Safety Valves

Section 10.3, Main Steam Supply System, of the FSAR describes the safety function of the atmospheric steam dumps (ASDs) and the main steam safety valves (MSSVs).

Specifically, MSSVs provide overpressure protection for the secondary side of the steam generators and the main steam piping. The ASDs permit reduction of main steam line pressure and removal of stored energy to achieve an orderly shutdown. Safety design basis 1 of this section further states, The safety-related portion of the [main steam supply system] is protected from the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, and external missiles (GDC-2).

On August 31, 2017, the licensee identified that the discharge piping for the ASDs and MSSVs extend beyond tornado-resistant structures and were not protected from tornado-generated missiles. The effect of a potential tornado-generated missile impact on ASD and MSSV piping, such as being crimped shut, has not been analyzed and could lead to a failure of the systems. Note that both the ASDs and MSSVs discharge secondary-side steam to the atmosphere via vertical pipes extending from the roof of the building. This vulnerability was identified as part of the licensees review of industry operating experience with tornado issues. This issue was entered into the corrective action program as Condition Report 201704531.

As a result of this issue, the licensee declared all ASDs and MSSVs inoperable, complied with the applicable technical specification action statements, initiated Condition Report 201704531, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status. The licensee instituted compensatory measures intended to reduce the likelihood of tornado-generated missile effects. These included verifying that guidance was in place for severe weather procedures, abnormal and emergency operating procedures, and FLEX support guidelines, that training on these procedures was current, and that a heightened level of awareness of the vulnerability was established.

3. Diesel Generator Fuel Vent Lines

Section 9.5.4, Emergency Diesel Engine Fuel Oil Storage and Transfer System, of the FSAR describes the safety function of the emergency diesel generator fuel oil systems to achieve and maintain the plant in a safe shutdown condition. Specifically, following a loss of offsite power, the system provides fuel oil to the emergency diesel generators at their continuous rating. Safety design basis 1 of this section further states, the

[emergency diesel generator fuel oil storage and transfer system] is protected from the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, and external missiles (GDC-2).

In the component description of FSAR section 9.5.4.2.2, the effect of tornados on the emergency fuel oil system is discussed, The fuel oil storage tank vent and fill lines penetrate the building wall to the outside. failure of these lines does not jeopardize operation of the diesel should the storage tank vent be totally restrictedventing can occur through the day tank. Since failure of the nonseismic storage tank vent and fill lines will not prevent system operation, no tornado protection is provided.

On September 21, 2017, the licensee identified that the strategy for recovering from damage to the emergency diesel generator fuel oil vent lines had not been evaluated.

Specifically, the effect of venting fuel oil tanks to a diesel room has not been evaluated.

Further, the ability to recognize a vent line blockage, from tornado-generated missile impact, and respond in an appropriate timeframe before the blockage could affect the emergency diesel generator had not been demonstrated. The effect of a potential tornado-generated missile impact on emergency diesel generator fuel oil vent lines could lead to inadequate fuel transfer and a failure of the emergency diesel generator to continue operating. Fuel oil tank vents ensure a vacuum is not drawn in the storage tanks while transferring fuel to the emergency diesel generator. This vulnerability was identified as part of the licensees review of industry operating experience with tornado issues. This issue was entered into the corrective action program as Condition Report 201704906.

As a result of this issue, the licensee declared both emergency diesel generators inoperable, complied with the applicable technical specification action statements, initiated Condition Report 201704906, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status. The licensee instituted compensatory measures intended to reduce the likelihood of tornado-generated missile effects. These included verifying that guidance was in place for severe weather procedures, abnormal and emergency operating procedures, and FLEX support guidelines, that training on these procedures was current, and that a heightened level of awareness of the vulnerability was established.

Enforcement.

Technical Specification 3.7.5 requires, in part, that three AFW trains shall be operable in Modes 1, 2, and 3. Technical Specification 3.7.5.E requires that, for three AFW trains inoperable, initiate action to restore one AFW train to operable status immediately. Contrary to the above, prior to August 15, 2017, three AFW trains were not operable and action was not initiated to restore one AFW train to operable status immediately. Specifically, the AFW recirculation lines to the condensate storage tank were not designed to withstand the effects of natural phenomena, such as tornadoes.

The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status. The inspectors verified through inspection sampling that the EGM 15-002 enforcement discretion criteria were met and that the issue was documented in Condition Report 201704176. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.

Technical Specification 3.7.1 requires, in part, that five MSSVs per steam generator shall be operable in Modes 1, 2, and 3. Technical Specification 3.7.1.C requires that, for one or more steam generators with greater than four MSSVs inoperable, be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Contrary to the above, prior to August 31, 2017, one or more steam generators with greater than four MSSVs were not operable, and action was not initiated to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Specifically, the discharge piping to atmosphere for MSSVs was not designed to withstand the effects of natural phenomena, such as tornadoes. The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status. The inspectors verified through inspection sampling that the EGM 15-002 enforcement discretion criteria were met and that the issue was documented in Condition Report 201704531. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.

Technical Specification 3.7.4 requires, in part, that four ASD lines shall be operable in Modes 1, 2, and 3. Technical Specification 3.7.4.C requires that, for three or more required ASD lines inoperable for reasons other than excessive ASD seat leakage, restore all but two required ASD lines to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Contrary to the above, prior to August 31, 2017, four ASD lines were not operable, and action was not initiated to restore all but two required ASD lines to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Specifically, the discharge piping to atmosphere for ASDs was not designed to withstand the effects of natural phenomena, such as tornadoes. The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status.

The inspectors verified through inspection sampling that the EGM 15-002 enforcement discretion criteria were met and that the issue was documented in Condition Report 201704531. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.

Technical Specification 3.8.1 requires, in part, that two diesel generators capable of supplying the onsite class 1E power distribution subsystems shall be operable in Modes 1, 2, 3, and 4. Technical Specification 3.8.1.E requires that, for two diesel generators inoperable, restore one diesel generator to operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Contrary to the above, prior to September 21, 2017, two diesel generators were not operable, and action was not initiated to restore one diesel generator to operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Specifically, the strategy for recovering from damage to the emergency diesel generator fuel oil vent lines had not been evaluated. The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the structures, systems, and components to an operable-degraded/nonconforming status.

The inspectors verified through inspection sampling that the EGM 15-002 enforcement discretion criteria were met and that the issue was documented in Condition Report 201704906. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.

1R18 Plant Modifications

a. Inspection Scope

The inspectors reviewed two permanent plant modifications that affected risk-significant structures, systems, and components:

• August 7, 2017, battery charger NK25 fuses, Modification 15-0020

• August 11, 2017, component cooling water heat exchanger drain lines, Modification 16-0036 The inspectors reviewed the design and implementation of the modifications. The inspectors verified that work activities involved in implementing the modifications did not adversely impact operator actions that may be required in response to an emergency or other unplanned event. The inspectors verified that post-modification testing was adequate to establish the operability of the structures, systems, and components as modified.

These activities constituted completion of two samples of permanent modifications, as defined in Inspection Procedure 71111.18.

b. Findings

No findings were identified.

1R19 Post-Maintenance Testing

a. Inspection Scope

The inspectors reviewed five post-maintenance testing activities that affected risk-significant structures, systems, or components:

• July 27, 2017, ultimate heat sink fan thermal overload maintenance

• August 9, 2017, containment hydrogen analyzer train B maintenance

• August 16, 2017, feedwater bypass valve maintenance

• September 7, 2017, main control room ventilation boundary maintenance

• September 12, 2017, component cooling water train B maintenance The inspectors reviewed licensing- and design-basis documents for the structures, systems, or components and the maintenance and post-maintenance test procedures.

The inspectors observed the performance of the post-maintenance tests to verify that the licensee performed the tests in accordance with approved procedures, satisfied the established acceptance criteria, and restored the operability of the affected structures, systems, or components.

These activities constituted completion of five post-maintenance testing inspection samples, as defined in Inspection Procedure 71111.19.

b. Findings

No findings were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors observed four risk-significant surveillance tests and reviewed test results to verify that these tests adequately demonstrated that the structures, systems, and components were capable of performing their safety functions:

In-service tests:

• July 19, 2017, component cooling water train B

• August 1, 2017, containment spray pump train A Other surveillance tests:

• July 5, 2017, component cooling water pump train A surveillance

• July 18, 2017, moderator temperature coefficient surveillance The inspectors verified that these tests met technical specification requirements, that the licensee performed the tests in accordance with their procedures, and that the results of the test satisfied appropriate acceptance criteria. The inspectors verified that the licensee restored the operability of the affected structures, systems, and components following testing.

These activities constituted completion of four surveillance testing inspection samples, as defined in Inspection Procedure 71111.22.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security

4OA1 Performance Indicator Verification

.1 Unplanned Scrams per 7000 Critical Hours (IE01)

a. Inspection Scope

The inspectors reviewed licensee event reports for the period of third quarter 2016 through second quarter 2017 to determine the number of scrams that occurred. The inspectors compared the number of scrams reported in these licensee event reports to the number reported for the performance indicator. Additionally, the inspectors sampled monthly operating logs to verify the number of critical hours during the period. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned scrams per 7000 critical hours performance indicator, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.2 Unplanned Power Changes per 7000 Critical Hours (IE03)

a. Inspection Scope

The inspectors reviewed operating logs, corrective action program records, and operating reports for the period of third quarter 2016 through second quarter 2017 to determine the number of unplanned power changes that occurred. The inspectors compared the number of unplanned power changes documented to the number reported for the performance indicator. Additionally, the inspectors sampled monthly operating logs to verify the number of critical hours during the period. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned power outages per 7000 critical hours performance indicator, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.3 Unplanned Scrams with Complications (IE04)

a. Inspection Scope

The inspectors reviewed the licensees basis for including or excluding in this performance indicator each scram that occurred between third quarter 2016 and second quarter 2017. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned scrams with complications performance indicator, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

4OA2 Problem Identification and Resolution

.1 Routine Review

a. Inspection Scope

Throughout the inspection period, the inspectors performed daily reviews of items entered into the licensees corrective action program and periodically attended the licensees condition report screening meetings. The inspectors verified that licensee personnel were identifying problems at an appropriate threshold and entering these problems into the corrective action program for resolution. The inspectors verified that the licensee developed and implemented corrective actions commensurate with the significance of the problems identified. The inspectors also reviewed the licensees problem identification and resolution activities during the performance of the other inspection activities documented in this report.

b. Findings

No findings were identified.

.2 Annual Follow-up of Selected Issues

a. Inspection Scope

The inspectors selected one issue for an in-depth follow-up:

• On September 1, 2017, the inspectors reviewed the licensees actions for operating experience related to environmental qualification deficiencies on cables and containment penetration pigtails across the industry. In March of 2017, the licensee determined that containment high range radiation monitors GTRE0059 and GTRE0060 used a type and configuration of cabling identified as susceptible to thermally induced currents and documented the issue in Condition Report 201701358. Thermally induced currents, which could result from the high temperature environment during a design basis accident, may cause inaccurate readings on affected radiation monitors. Based on the operating experience review, Callaway declared the susceptible monitors inoperable for post-accident monitoring and complied with Technical Specification 3.3.3, Post Accident Monitoring (PAM) Instrumentation, and Technical Specification 5.6.8, PAM Report, by submitting a report to the NRC in April of 2017 (ADAMS Accession Number ML17094A615).

The inspectors assessed the licensees problem identification threshold, cause analyses, extent of condition reviews, emergency action levels and compensatory actions. The inspectors verified that the licensee appropriately prioritized the planned corrective actions and that these actions will correct the condition.

These activities constituted completion of one annual follow-up sample as defined in Inspection Procedure 71152.

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On September 20, 2017, the regional licensed operator requalification program inspectors presented the inspection results to Mr. P. Swan, Examination Developer, and other members of the licensee's staff. The licensee acknowledged the issues presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

On October 4, 2017, the resident inspectors presented the inspection results to Mr. B. Cox, Senior Director, Nuclear Operations, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Banker, Senior Director, Engineering

F. Bianco, Director, Nuclear Operations

J. Cortez, Director, Training

B. Cox, Senior Director, Nuclear Operations

T. Elwood, Supervising Engineer, Regulatory Affairs

T. Herrmann, Site Vice President

A. Hunt, Licensing Engineer

L. Kanuckel, Director, Nuclear Oversight

J. Kovar, Licensing Engineer

S. Lange, Operations Manager

M. McLachlan, Senior Director, Plant Support

M. Otten, Operations Training Manager

R. Pohlman, Licensing Engineer

G. Rauch, Manager, Emergency Preparedness

P. Swan, Examination Developer

D. Turley, Supervisor, Engineering

R. Wink, Manager, Regulatory Affairs

NRC Personnel

D. Loveless, Senior Reactor Analyst

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000483/2017003-01 NCV Spurious Containment Spray Pump Start (Section 1R12)