IR 05000416/2016008

Grand Gulf Nuclear Station - NRC Special Inspection Report 05000416/2016008. Additional Document Associated With the This Report Located at Ml17304A014

ML17303B200
Person / Time
Site:	Grand Gulf
Issue date:	10/27/2017
From:	Kozal J W NRC/RGN-IV/DRP/RPB-C
To:	Emily Larson Entergy Operations
AMT JKozal
Shared Package
ML17303B150	List: IR 05000416/2016008
References
EA-16-277 IR 2017008
Download: ML17303B200 (65)

Text

October 27. 2017 EA-16-277 Mr. Eric Larson, Site Vice President Entergy Operations, Inc.

Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150

SUBJECT: GRAND GULF NUCLEAR STATION - NRC SPECIAL INSPECTION REPORT 05000416/2016008

Dear Mr. Larson:

On October 6, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of configuration control problems, including the unplanned unavailability of the alternate decay heat removal system during the replacement of a residual heat removal pump, which occurred between September 9, 2016 and September 22, 2016, at your Grand Gulf Nuclear Station. Based on this initial assessment, the NRC sent a special inspection team to your site on October 31, 2016.

On May 31, 2017, the NRC completed its special inspection and discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented three findings of very low safety significance (Green) in this report. All of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Grand Gulf Nuclear Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the Grand Gulf Nuclear Station. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding."

Sincerely,/RA/

Jason Kozal, Chief Project Branch C Division of Reactor Projects Docket No. 50-416 License No. NPF-29

Enclosure:

Inspection Report 05000416/2016008 w/

Attachments:

1. Supplemental Information 2. Detailed Risk Evaluation 3. Special Inspection Charter

SUMMARY

IR 05000416/2016008; 10/31/2016 - 5/31/2017; Grand Gulf Nuclear Station; Special Inspection.

The inspection activities described in this report were performed between October 31, 2016, and May 31, 2017, by the resident inspector at Grand Gulf Nuclear Station and two inspectors from the NRC's Region IV office. Three findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green,

White, Yellow, or Red), determined using Inspection Manual Chapter 0609, "Significance Determination Process," dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects within the Cross-Cutting Areas," dated December 4, 2014. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," dated July 2016.

Cornerstone: Initiating Events

Green.

The team identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to have adequate procedures for activities affecting quality. Specifically, Grand Gulf Nuclear Station failed to have adequate procedures for feedwater, condensate, and shutdown cooling activities. The licensee implemented corrective actions to revise the procedures.

The licensee entered this issue into their corrective action program as Condition Reports CR-GGN-2016-08334, 08273, and 08290.

The failure to have adequate procedures for activities affecting quality was a performance deficiency. Example (1) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not having procedural guidance for the alternate decay heat removal system alignment resulted in misalignment of the system and its subsequent inability to perform its required function if needed. A detailed risk evaluation (Attachment 2)calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year, which has a very low safety significance (Green). Example (2) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown operations.

Specifically, not having procedural guidance for feedwater isolation valve operation resulted in inadvertent overfill of the reactor vessel. This violation is associated with a finding having very low safety significance (Green). The team did not assign a cross-cutting aspect because the performance deficiency was not reflective of current plant performance.

(Section 4OA3)3

Cornerstone: Mitigating Systems

Green.

The team reviewed a self-revealed, non-cited violation of Technical Specification 3.4.10, "Residual Heat Removal Shutdown Cooling System - Cold Shutdown," for the licensee's failure to verify an alternate method of decay heat removal was available when residual heat removal subsystem A was inoperable and unavailable due to a pump replacement. Specifically, the licensee inappropriately credited the alternate decay heat removal system as an available alternate method of decay heat removal. Credit for this system was inappropriate because, although the licensee believed the system had been aligned in standby, the alternate decay heat removal heat exchanger isolation valves had remained tagged closed, rendering the system unavailable to satisfy the technical specification requirement during the time period that residual heat removal subsystem A was unavailable. The licensee restored compliance by restoring residual heat removal subsystem A to available status. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-07281.

The failure to perform the required action to verify an alternate method of decay heat removal was available, when a residual heat removal shutdown cooling system was inoperable, was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year. Therefore, this violation is associated with a finding having very low safety significance (Green). The team determined the finding had a cross-cutting aspect within the human performance area, field presence, because leaders failed to reinforce standards and expectations in the work areas of the plant [H.2]. (Section 4OA3)

Green.

The team identified a non-cited violation of Technical Specification 5.4.1.a, "Procedures," for the licensee's failure to implement procedures required by Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Specifically, contrary to procedures, on September 23, 2016, operations personnel failed to verify adequate plant service water flow to the alternate decay heat removal heat exchangers while placing the system in service. The licensee implemented corrective actions which included high intensity training to improve nuclear worker behaviors and clarifying the directions in the procedure. The licensee entered this issue into the corrective action program as Condition Report CR-GGN-2016-08333.

The failure to implement procedures, as required by Technical Specification 5.4.1.a, was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because, if left uncorrected, the failure to implement procedures as required by Technical Specification would have the potential to lead to a more significant safety concern. Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process," and Inspection Manual Chapter 0609, Appendix G, Attachment 1,

"Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings," the team determined that the finding was of very low safety significance (Green) because it did not affect the design or qualification of a mitigating system structure, system, or component and did not directly prevent the alternate decay heat removal system from maintaining its functionality. The team identified a cross-cutting aspect the area of human performance, challenge the unknown, because individuals failed to stop when faced with uncertain conditions and risks were not evaluated and managed before proceeding [H.11]. (Section 4OA3)

=

Licensee-Identified Violations===

None 5

REPORT DETAILS

4OA3 Follow-up of Events and Notices of Enforcement Discretion Review of Events Surrounding Unavailability of Alternative Decay Heat Removal System On September 4, 2016, the residual heat removal (RHR), subsystem A was declared inoperable due to a failure to meet Technical Specification (TS) Surveillance Requirement (SR) 3.5.1

.4 for required pump differential pressure. On September 8, 2016, the licensee completed a TS-required shutdown in order to replace the pump. With the plant in Mode 4 and RHR subsystem A inoperable, TS 3.4.10, Action A.1, required that an alternate method of decay heat removal be available. On September 9, 2016, the alternate decay heat removal (ADHR) system was inappropriately credited for compliance with TS 3.4.10, Action A.1, when licensee personnel removed RHR subsystem A from service for maintenance (making it inoperable and unavailable for decay heat removal). Operations personnel believed ADHR was properly aligned in standby mode to serve as the required alternate means of decay heat removal, but because the cooling water supplies to each of the ADHR heat exchangers from the plant service water (PSW) system were danger tagged closed (valves P44F481A, P44F481B, P44F482A, and P44F482B), the ADHR system was not actually in standby or available to satisfy TS 3.4.10. The RHR subsystem A pump was replaced, retested, and returned to available status on September 22, 2016. Therefore, Grand Gulf Nuclear Station failed to comply with TS 3.4.10, Action A.1, since RHR subsystem A was unavailable, and the ADHR system was misaligned/unavailable, from September 9, 2016, until September 22, 2016.

The unavailability of the ADHR system was discovered on September 23, 2016, prior to placing the ADHR system in operation following replacement of the RHR pump. At that time, operations personnel discovered that the cooling water supplies to each of the ADHR heat exchangers from the PSW system were danger tagged closed. This configuration had been established on August 10, 2016, in order to isolate the system for power operations. Following the September 8, 2016, shutdown, operations personnel did not properly align the ADHR system for a standby lineup and did not verify that the system was available to meet TS requirements. Management Directive (MD) 8.3, "NRC Incident Investigation Program," was used to evaluate the level of NRC response for this event. In evaluating the criteria of MD 8.3, it was determined that the event involved concerns pertaining to licensee operational performance. Specifically, operations personnel failed to recognize that an alternate method of decay heat removal was unavailable for a period of 13 days while operating in Mode 4 with one train of the RHR system inoperable. Based on the best available information at the time, the preliminary estimated conditional core damage probability was determined to be 9.8E-6/year.

Based on the deterministic criteria and risk insights related to the unavailability of the ADHR system, NRC Region IV management determined that the appropriate level of NRC response was to conduct a special inspection. This special inspection was chartered to identify the circumstances surrounding the ADHR event and review the licensee's actions to address the causes of the event.

Additional Operator Performance Concerns Several other operator performance events influenced the scope of the special inspection charter. These additional events included:

• On June 17, 2016, a malfunction in the electro-hydraulic control (EHC) system during turbine stop valve testing caused reactor power and pressure oscillations that resulted in an automatic reactor scram. Licensed operations personnel did not recognize that EHC control valve fluctuations were reactivity manipulations, and did not recognize that power oscillations should require termination criteria. Troubleshooting continued for over 40 minutes as power oscillations exceeded 20 percent, which was in excess of the station's 10 percent criteria to scram the reactor for thermal hydraulic instability concerns.

• On September 24, 2016, an operational performance issue occurred due to a plant configuration control issue. Prior to opening a main feedwater isolation valve, licensed operations personnel failed to secure a long cycle cleanup alignment of the condensate system, resulting in a rapid and unexpected increase in reactor vessel level from 33 inches to 151 inches. The rapid level increase occurred because licensed operations personnel did not anticipate the system response to opening a main feedwater isolation valve while in the long cycle cleanup alignment.

• On September 27, 2016, Grand Gulf Nuclear Station plant management notified the NRC of their intent to delay startup of the plant, following the forced outage, to implement corrective actions to assess and resolve the plant's operational performance concerns. The plant restart was delayed until January 31, 2017, while corrective actions were implemented in the areas of operator fundamentals, conservative decision-making, procedure quality, and the material condition of plant equipment.

a. Inspection Scope

The special inspection team performed data gathering and fact-finding to address the following items from the inspection charter (Attachment 3): 1. Provide a recommendation to Region IV management as to whether the inspection should be upgraded to an augmented inspection team response. This recommendation should be provided by the end of the first day on site.

An augmented inspection team was not warranted. The scope of and expertise utilized in the special inspection was adequate to review this event. 2. Develop a complete sequence of events related to the unavailability of the ADHR system that was discovered on September 23, 2016. The chronology should include plant mode changes as well as the status of plant decay heat removal systems. August 10, 2016 - The licensee performed planned maintenance on the ADHR system. For this activity, the PSW supply to ADHR heat exchanger valves (P44F481A and P44F481B) and ADHR heat exchanger return to PSW valves 7 (P44F482A and P44F482B) were closed and danger tagged per tagout P44-002-1E12B003A/B. Although the planned maintenance was completed on August 15, 2016, these valves were not reopened until September 27, 2016. September 4, 2016, 2:58 a.m. - The licensee entered TS 3.5.1, Action A, because the RHR subsystem A failed its quarterly surveillance test for required pump differential pressure. Although the pump was not able to maintain the required differential pressure for operability for its emergency core cooling function, the pump remained capable of delivering sufficient flow to support its decay heat removal function, and therefore the system remained available as an alternate means of decay heat removal.

September 8, 2016, 11:04 a.m. - The licensee manually scrammed the reactor for a planned shutdown to conduct repairs to RHR subsystem A. The licensee entered Mode 3.

September 8, 2016, 5:45 p.m. - The licensee entered TS 3.4.9, Condition A, due to RHR subsystem A being inoperable in Mode 3 with reactor steam dome pressure less than the RHR cut in permissive pressure. The required action, verify an alternate method of decay heat removal is available, was satisfied because RHR subsystem A was still available and capable of providing decay heat removal.

September 9, 2016, 3:32 a.m. - The licensee placed RHR, subsystem B, into shutdown cooling operation.

September 9, 2016, 4:39 a.m. - The ADHR system was in isolate mode due to a PSW system tagout (E12-021-ADHR ISOLAT). This tagout was separate from the tagout that was hung on August 10, 2016 (P44-002-1E12B003A/B). The tagout for ADHR isolate mode (E12-021-ADHR ISOLAT) was removed, but the PSW supply and return to the ADHR heat exchangers remained tagged closed (tagout P44-002-1E12B003A/B).

September 9, 2016, 5:09 a.m. - Operations personnel cooldown the plant to Mode 4 and exit TS 3.4.9, Condition A, which is not applicable in Mode 4. The licensee entered TS 3.4.10, Condition A, due to RHR subsystem A being inoperable in Mode

4. The required action was satisfied because RHR subsystem A was still available and capable of providing decay heat removal. The recurring action of verifying the system is available once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was done administratively by operations personnel verifying that no work or other manipulations were made to RHR

subsystem A.

September 9, 2016, 5:42 p.m. - The tagout for ADHR isolate mode had been cleared, but the ADHR heat exchanger isolation valves were still danger tagged closed from the August 10 PSW tagout, which prevented cooling water flow through the ADHR heat exchangers. Nonlicensed operations personnel who were aligning the system to standby noticed there were valves in the ADHR room with danger tags on them, but they did not recognize that the valves were important to ADHR system operation and did not communicate to the control room the fact that danger tagged valves remained in the ADHR room.

8 September 9, 2016, 6:10 p.m. - RHR subsystem A was removed from service for a pump replacement. At this point, ADHR was unavailable due to the tagged closed heat exchanger isolation valves. The licensee operations personnel believed ADHR had been placed in standby alignment per Section 4.6 of Procedure 04-1-01-E12-2, "Shutdown Cooling and Alternate Decay Heat Removal Operation," Revision 119.

Operations staff inappropriately designated the ADHR system as the alternate method of decay heat removal to satisfy the actions of TS 3.4.10, Condition A. RHR subsystem B was operable and in-service providing decay heat removal for the reactor. September 22, 2016, 6:47 p.m. - Following pump replacement, RHR subsystem A was tested, and pump flow and discharge pressures showed that the system was capable of supplying shutdown cooling, if needed. At this time, RHR subsystem B was in operation for shutdown cooling, and RHR subsystem A was available as an alternate means of decay heat removal to satisfy the actions of TS 3.4.10, Condition A. RHR subsystem A was not yet declared operable.

September 22, 2016, 8:00 p.m. - The licensee made an operation's log entry discussing shutdown risk and the status of RHR subsystem A as available but not operable.

September 22, 2016, 8:26 p.m. - RHR subsystem A passed its post-maintenance (pump replacement) test, but the licensee did not declare the system operable because they first wanted to remove all maintenance equipment from the area.

September 23, 2016, 2:26 p.m. - The licensee removed RHR subsystem B from shutdown cooling operation in order to perform TS Surveillance Requirement 3.5.1.4 on the subsystem as an extent of condition evaluation based on the previous degradation of RHR subsystem A. The licensee attempted to place the ADHR system into service for shutdown cooling operation to satisfy the actions of TS 3.4.10, Condition A, with the RHR subsystem A serving as the alternate source of decay heat removal.

September 23, 2016, 3:03 p.m. - While attempting to place the ADHR system into service for shutdown cooling operation, the licensee discovered that the PSW supply to ADHR heat exchanger valves (P44F481A and P44F481B) and ADHR heat exchanger return to PSW valves (P44F482A and P44F482B) were closed and danger tagged, rendering ADHR unavailable to provide decay heat removal. The licensee decided to restore shutdown cooling using RHR subsystem B. Operators recognized that the ADHR system had not been in the appropriate configuration to be considered available for decay heat removal as previously believed. September 24, 2016, 3:40 a.m. - The licensee declared RHR subsystem A operable and exited TS 3.4.10, Condition A since both subsystems of RHR were operable.

September 28, 2016, 6:31 p.m. - The licensee restored the ADHR system to the appropriate standby configuration. 3. Review the licensee's root cause analysis efforts and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the problem.

Condition Report (CR) CR-GGN-2016-07281 was characterized as a Category B condition report. This characterization required an apparent cause evaluation (ACE), which is a second-tier evaluation, rather than a root cause evaluation, which is a top-tier and more probing/extensive evaluation. The team reviewed the licensee's screening process in Procedure EN-LI-102, "Corrective Action Program,"

Revision 27. The team noted that the general discussion section of the screening criteria defines a "Significance Category A" [significant condition adverse to quality (SCAQ) - requiring corrective actions to prevent repetition] as follows: "Adverse Conditions with high significance due to high risk, high actual or potential consequences." The team noted that the unavailability of ADHR event discussed in CR-GGN-2016-07281 resulted in an inadvertent and unrecognized entry into "Orange Risk," or high risk significance, as defined in the licensee's outage safety plan. The licensee, however, did not consider this a high-risk event because their initial risk assessment for the event yielded a core damage probability of less than 1E-6/year. In addition, the chart of examples for the screening criteria contained in 9.1 of Procedure EN-LI-102 required screening events or conditions that resulted in a complete loss of safety function or a greater than Green finding as a Category A (SCAQ). TS violations and reportable events were listed as examples of a Category B CR, requiring an ACE. The unavailability of the ADHR system was reported in a licensee event report as a violation of TS 3.4.10. Thus, the licensee screened CR-GGN-2016-07281 as a Category B, as allowed by their procedure.

However, given the complexity and multiple barriers that failed leading to the extended unavailability of ADHR, the team determined that the rigor associated with a root cause evaluation would be the appropriate level of review. Given the definition of a Category A CR, Procedure EN-LI-102 allowed the licensee the latitude to conduct a root cause evaluation instead of an ACE.

Through interviews with the involved operating crews, the team identified details that the licensee did not have in their causal evaluation. For example, crews communicated that some processes that could have prevented this event were considered as infrequently used recommendations and not requirements (e.g. use of "potential LCOs," return to service checklists, and caution tagging abnormal alignments). Also, the team learned through interviews that operators vented the ADHR heat exchangers to the floor adjacent to a contaminated area when they had no indication of ADHR flow, a minor violation of their general operating procedures and the applicable radiation work permit.

Overall, the licensee's ACE for the ADHR unavailability determined that the apparent cause was inadequate fundamental work practices exhibited by operations personnel for configuration control of the ADHR system. A contributing cause was listed as insufficient detail in the system and plant operating procedures. The team agreed that these were the likely apparent and contributing causes. Since this was an ACE, no corrective actions to preclude repetition were required per procedure. The licensee's key corrective actions for the apparent cause were the high intensity training for operator fundamentals and issuance of Standing Order 16-021 (interim until proceduralized), which reiterated management expectations for safe operator practices.

10 By the end of the on-site inspection, the licensee indicated that they had decided to conduct a formal root cause evaluation of the event. The licensee determined root causes to be inconsistent reinforcement of nuclear professional behaviors in the operators and insufficient detail in operating procedures. 4. Determine the probable causes for the unavailability of the ADHR system during this forced outage.

As stated above, the licensee determined root causes to be inconsistent reinforcement of nuclear professional behaviors in the operators and insufficient detail in operating procedures. Inconsistent nuclear professional behaviors included procedure adherence, cognizance of overall system status, use of recommended operator guidance, proceeding in the face of uncertainty, inadequate pre-evolution briefings, inadequate turnover, and inadequate plant tours.

5. Evaluate the licensee's actions with regard to compliance with applicable TS requirements. Specifically, evaluate the licensee's actions to verify that an alternate method of decay heat removal was available, both initially as well as daily, during the time period in question. As described above, on September 9, 2016, at 5:42 p.m., Grand Gulf Nuclear Station erroneously concluded they had placed the ADHR system in a standby configuration to satisfy the TS requirement to verify the availability of an alternate means of decay heat removal.

The recurring TS action to verify the system was available once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was done administratively by operations personnel verifying no work, or other manipulations, were made to the ADHR system. No walk-downs of the ADHR system, or support systems, to determine appropriate configuration were done, or procedurally required, to comply with the recurring action of TS 3.4.10, Condition A. A non-cited violation associated with the failure to comply with TS 3.4.10 is described in Section 4OA3.b.1 of this report. 6. Review the licensee's cause evaluation efforts for the configuration control event that resulted in a rapid and unexpected increase in reactor vessel level on September 24, 2016, and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the problem.

The team noted that CR-GGN-2016-07280, which discussed the rapid reactor vessel overfill event of September 24, 2016, was also designated as a Category B CR, requiring an ACE to determine the cause. The team reviewed Procedure EN-LI-102 to determine if this designation was appropriate to the issue. The licensee determined that this issue would likely screen as a Green issue (very low safety significance), and thus, would meet the licensee's threshold for a Category B CR.

The team determined that this appeared to be the appropriate classification commensurate with the significance.

The licensee performed a barrier analysis that identified several barriers that broke down and contributed to the event. The listed barriers that failed were as follows:

11 a) Procedure 04-1-01-E12-2, "System Operating Instruction Shutdown Cooling and Alternate Decay Heat Removal Operation," Revision 120, was not written with the recognition that opening the feedwater isolation valve B21F065B could result in injection into the vessel if manipulated while the plant was in the long cycle cleanup alignment. The steps required for removing one train of residual heat removal from service restored the system to normal standby lineup, opening valve B21F065B. Following this procedure while the plant is in the long cycle cleanup alignment caused a reactor vessel overfill. No caution or alternative step existed for removing a train of RHR from service while long cycle cleanup was in service. b) Procedure 04-1-01-N21-1, "Long Cycle Cleanup," contained no direction to hang caution or danger tags on valve B21F065B to alert or prevent operations personnel from opening these valves while in the long cycle cleanup alignment to prevent inadvertently filling the vessel. c) Operators did not consider the interaction between the RHR system and the feedwater system. During planning for the evolution, operations personnel only referenced RHR system diagrams/prints and not interfacing systems (such as the feedwater and condensate systems, etc.) while walking through the procedure. d) The pre-shift brief was conducted by supervisory personnel, which inhibited their ability to remain in an oversight role during the briefing process. The pre-evolution brief did not include the potential effects on other systems, or overall status of the plant. The at-the-controls operator was also not included during the briefing. e) A contributor to the severity of the event was that operations personnel did not understand the full function of the operating modes of valve B21F065B. The valve has three push buttons: "OPEN," "CLOSE," and "STOP." Operators did not understand that valve movement could be interrupted mid-stroke by pushing the STOP button. This functionality was covered in training material, but not emphasized in training and not practiced in the simulator because no station procedures direct the use of the STOP button on this valve. The operator attempted to mitigate the event by depressing the CLOSE button several times, which had no effect until the valve stroked fully open. Based on simulator runs afterwards, had operators understood the function of the STOP pushbutton, the maximum level would have been approximately +78 inches vs. +151 inches. The licensee identified two apparent causes of the September 24, 2016, reactor vessel overfill. The first apparent cause, related to the failure to consider system interactions and lack of independent supervisory oversight, was inadequate knowledge or skill resulting in tunnel vision. The second apparent cause was inadequate procedural barriers.

In 2008, a similar inadvertent vessel overfill event occurred by opening valve B21F065B while in long cycle cleanup during inservice testing (IST). The corrective actions only revised the IST procedure to prevent performing this surveillance test during long cycle cleanup. The team considered this a missed opportunity to add a 12 precaution to the long cycle cleanup procedure or any other interfacing system's procedures to tag or otherwise prevent operation of the valve when inappropriate.

7. Determine whether there were any deficiencies in operator training that contributed to the ADHR unavailability or feedwater control events.

The team concluded that training was not a direct cause to these events. However, training may have contributed to these events. For example:

a) As discussed in Item 6 above, operations personnel were not fully trained on the function of the "STOP" push-button associated with valve FO-65A/B. This lack of training allowed reactor vessel level to rise uncontrollably to 151 inches. b) Operations personnel were not trained to review interfacing system tagouts when verifying system operability. This lack of training contributed to the failure to recognize, for 13 days, that the ADHR system was unavailable because the cooling water supplies to each of the ADHR heat exchangers from the PSW system were danger tagged closed. 8. Evaluate the licensee's compliance with, and adequacy of, procedural guidance for performing system alignments and for performing equipment tag-outs, as it pertains to the cause(s) of these events.

Following a previous forced outage on August 10, 2016, Grand Gulf Nuclear Station performed planned maintenance on the ADHR system. For this activity, the PSW supply to ADHR heat exchanger valves (P44F481A and P44F481B) and ADHR heat exchanger return to PSW valves (P44F482A and P44F482B) were closed and danger tagged per tagout P44-002-1E12B003A/B. Although the planned maintenance was completed on August 15, 2016, an individual failed to release this tagout by certifying work was complete. Procedure EN-OP-102, "Protective and Caution Tagging," Revision 18, Section 5.3.15 [5], states, "in the work order status window place a check in the work complete box for work orders that you are responsible for that no longer requires this tagout." The team noted that if the individual had certified work complete on this tagout at the appropriate time, in accordance with Procedure EN-OP-102, operations personnel may have opened the misaligned PSW valves in August 2016, which would have prevented the subsequent ADHR unavailability event.

Furthermore, the planned maintenance work was determined to be complete, and the work was closed out as complete in the work management computer program, on August 30, 2016. The team noted that, if the Mechanical Maintenance Supervisor would have appropriately checked the work order and the referenced tagouts before closing the item out in the work management computer program, he would have noted the active tagout. The work order should not have been changed to complete status in the work management software until the tagout was cleared.

Since tagout P44-002-1E12B003A/B was for the PSW system and Section 4.6 of Procedure 04-1-01-E12-2, "System Operating Instruction Shutdown Cooling and Alternate Decay Heat Removal Operation," Revision 120, does not discuss the correct alignment of these four valves, the tagout was not cleared and the valves were not opened during ADHR system alignments. The team concluded 13 Procedure 04-1-01-E12-2 was inadequate because it failed to direct verification that the PSW supply to ADHR heat exchanger valves were opened. A non-cited violation associated with this procedure inadequacy is described in Section 4OA3.b.2 of this report. 9. Determine whether the licensee's processes for shutdown risk management and plant configuration control were appropriate, including supervisory oversight from operations personnel and the outage control center (OCC).

a) Shutdown Risk Management: Grand Gulf Nuclear Station used "Shutdown Operations Protection Plan" (SOPP), Revision 19, for the forced outage to replace RHR pump A. The team reviewed the document, with a focus on the risk and mitigation of risk for SOPP, Condition 1, decay heat removal systems. The SOPP transitions from a traditional quantitative risk assessment to a qualitative outage risk assessment at reactor Mode 4. Per analysis and documentation of the SOPP, the team noted that the risk program and plan were appropriate and were documented before the outage began on September 8, 2016.

During shutdown activities, the licensee utilizes the SOPP in order to establish guidelines to address plant operational conditions in Mode 4 (Cold Shutdown), Mode 5 (Refuel), and in the defueled condition.

Section V of the SOPP discusses and defines different operational conditions and what equipment is needed to determine the plant risk impact. Decay heat removal is one element of the SOPP. Reactor Mode 4 correlates to SOPP, Condition 1. Specifically, the decay heat removal methods during SOPP, Condition 1, are: RHR A, RHR B, ADHR, and reactor water cleanup (RWCU) (demonstrated or calculated). Green risk is defined as having three methods available. Yellow risk is defined as having two methods available. Orange risk is defined as having one method available. Red risk is defined as having zero methods available.

Before every outage, the licensee performs analyses to determine core decay heat loads and how and when each method of decay heat removal is available for consideration in the risk analysis. For Revision 19 of the SOPP, the ADHR system and RWCU (together) were available as a decay heat removal method approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after plant shutdown. Furthermore, the ADHR system (by itself) was determined to be available approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after plant shutdown.

The ADHR system is considered an available system when it is placed in the standby mode, per Procedure 04-1-01-E12-2, "System Operating Instruction for Shutdown Cooling and Alternate Decay Heat Removal." However, the ADHR system does not begin to remove decay heat until it is placed in reactor pressure vessel cooling mode, per Procedure 04-1-01-E12-2. It takes plant operators approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 15 minutes (when it is an unplanned transition such as during a loss of shutdown cooling) to transition the ADHR system from standby to reactor pressure vessel cooling mode.

14 For the first several days following the start of an outage, the time to 200 degrees Fahrenheit (Mode 3) from the onset of a loss of shutdown cooling is typically less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 15 minutes. Furthermore, the ADHR system is not designed to be used during Modes 1, 2, or 3. Entergy Procedure EN-OU-108, "Shutdown Safety Management Program," Revision 8, Section 3.0,[1], discusses what is needed for an available system. This section states, "Credit may be taken for reasonable actions both in the Control Room and in-plant. A reasonable action would include an operator closing a breaker outside of the control room. Actions with implementing time approaching the time to boil are not reasonable." The team noted that, under certain circumstances (shortly after shutdown), the SOPP allowed the licensee to improperly credit the ADHR system as one of the systems available as an alternative means of decay heat removal. Credit for ADHR under those circumstances would be improper because it takes too long to place the system in service when the transition is unplanned. The team, however, was unable to identify occurrences during past outages where the ADHR system was placed in the standby mode, per Procedure 04-1-01-E12-2, and the licensee's inappropriate crediting of the system resulted in an actual plant risk configuration that was higher than planned. Therefore, the team identified a minor violation of 10 CFR 50.65(a)(4), for the failure to appropriately assess and manage the risk of the decay heat removal safety function for shutdown conditions. Specifically, the SOPP considered the ADHR system available and credited for risk reduction during conditions (shortly after shutdown)when the ADHR system was not capable of being placed in service before the plant decay heat would have caused the plant to return to Mode 3 following a loss of shutdown cooling (Mode 3 conditions are beyond the capability of the ADHR system). This minor violation has been entered into the licensee's corrective action program as Condition Report CR-GGN-2017-00263.

b) Plant Configuration Control: On September 24, 2016, operations personnel opened valve B21F065B per Procedure 04-1-01-E12-2 while securing RHR, subsystem B, in the shutdown cooling configuration. The result was the inadvertent fill of the reactor vessel with approximately 24,000 gallons of water.

The reactor water level was approximately 33 inches on the narrow range at the beginning of the evolution, and the maximum level was 151 inches on the upset range. The team noted that this event revealed planning, team work, communication, and equipment alignment issues between OCC and main control room operations personnel. 10. Review actions taken or planned by the licensee to evaluate and develop plans to address gaps in operations performance at the station, as evidenced by recent events discussed in this charter.

The licensee's evaluation and training plan for operators was still under development during the on-site inspection and was not available for team to review. However, subsequent reviews of the licensee's high intensity training during baseline inspection activities documented in NRC Inspection Reports 05000416/2016004 (ADAMS Accession No. ML17039B078) and 05000416/2017009 (ADAMS Accession No. ML17074A265) showed that the training addressed operator performance gaps and fundamental behaviors.

15 11. Review licensee corrective action plan(s), in place, prior to recent events in areas of operator fundamentals. Assess whether previous corrective actions in areas that contributed to recent events were appropriate, completed, and/or effective. None of the corrective action plans from previous recent events were in place, such that they had an opportunity to prevent the September 2016 events. Some of the planned corrective actions could have helped prevent the September 2016 events, but they were not scheduled to have been completed until early 2017.

Corrective actions from the June 17, 2016, EHC event would have been germane to the performance issues observed in September 2016, but had not been implemented prior to the September 2016 events. Of note was planned training focused on conservative decision-making and improved control room communications. From the root cause evaluation for the June 2016 event: a) Root

Cause:

inadequate guidance on conservative decision-making when procedures are not adequate for the circumstance. b) Contributing

Cause:

poor communication in the control room. c) These areas of weakness appear to have contributed to the September 2016 events, since procedures were inadequate and operations personnel did not make conservative decisions (procedure inadequacies and failure to properly follow procedures are noted in the findings below). In addition, there was ineffective communication on September 9, 2016, when the operators in the field observed the danger tags hanging on the valves in the ADHR room and notified the control room, but did not use effective communication practices to ensure control room personnel heard and understood the observation. 12. Determine whether applicable internal or external operating experience involving configuration management of the ADHR system existed, and assess the effectiveness of any action(s) taken by the licensee in response to any such operating experience.

The team researched applicable internal and external operating experience to determine if corrective actions from previous events could have prevented the issues reviewed by this special inspection. Two applicable events were identified and the team concluded that both events constituted missed opportunities for the licensee to have implemented actions that might have prevented or mitigated the ADHR system configuration management problems experienced in September 2017. a) The licensee had a missed opportunity to prevent the vessel overfill event because a similar event occurred during inservice testing in 2008 (discussed in Item 6 above), as discussed in Condition Report CR-GGN-2008-06110. On October 20, 2008, with the plant in long cycle cleanup, the licensee performed inservice testing of valve B21F065B, in accordance with Procedure 06-OP-1B21-C-0003, "In-service Testing of Feedwater System Valves," Revision 112. Operations personnel were not aware of system status, and thus, reactor vessel level rapidly increased. In this case, however, the operator depressed the STOP pushbutton immediately to stop the valve stroke, and closed valve B21F065B to minimize the reactor vessel level increase.

16 Corrective actions added a precaution to Procedure 06-OP-1B21-C-0003 to ensure long cycle cleanup is secured prior to performing inservice testing, but did not require caution tags or add a similar precaution to any other applicable procedures that could possibly stroke valve B21F065B while the plant was in long cycle cleanup. b) A 1997 event at River Bend Station involved initiation of the alternate decay heat removal system (addressed in Grand Gulf Nuclear Station's interoffice memorandum GIN 1999-01279). The River Bend licensee made an inadvertent mode change to Mode 3 and developed saturation conditions in the reactor vessel while attempting to establish ADHR. Operations personnel were not cognizant that the calculated time to boil from the onset of a loss of shutdown cooling was less than the time required to implement the procedure to establish ADHR. Though not related directly to this event, the Grand Gulf Nuclear Station SOPP credited ADHR as a backup cooling source even though the time to boil during early portions of the outage was approximately 30 minutes, but the time to implement the procedure to establish ADHR was 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 10 minutes. 13. Evaluate the licensee's actions to comply with reporting requirements associated with this event. From September 9, 2016, until September 22, 2016, Grand Gulf Nuclear Station failed to identify an alternate method of decay heat removal, when RHR subsystem A was inoperable, as required per Action A.1 of TS 3.4.10.

NUREG-1022, "Event Report Guidelines 10 CFR 50.72 and 50.73," Revision 3, Section 3.2.2, discusses a licensee operating in a condition prohibited by TSs.

NUREG-1022 states that there is no 10 CFR 50.72 reporting requirement, but there is a 50.73 requirement to submit a licensee event report (LER), which the licensee completed on October 27, 2016, as LER 2016-008-00.

The team concluded that the licensee's actions to comply with reporting requirements associated with this event were adequate to meet the requirements of 10 CFR 50.72 and 10 CFR 50.73.

14. Collect data necessary to support completion of the significance determination process for any associated finding(s).

Findings were developed and documented below.

b. Findings

(1) Failure to Have Alternate Decay Heat Removal Capability

Introduction.

The team reviewed a Green, self-revealed non-cited violation of Technical Specification (TS) 3.4.10, "Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown," for the licensee's failure to verify the availability of an alternate method of decay heat removal when RHR subsystem A was inoperable and unavailable for a pump replacement. Specifically, the licensee inappropriately credited ADHR as an available alternate method of decay heat 17 removal. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-07281.

Description.

On September 8, 2016, at 11:04 a.m., Grand Gulf Nuclear Station inserted a manual reactor scram to enter an outage to replace RHR pump A. Although RHR subsystem A was inoperable for failing to meet its TS Surveillance Requirement 3.5.1.4 for rated flow and pressure for its safety function, it remained capable of providing the necessary flow and pressure for shutdown cooling (log entry September 8, 2016, 6:24 p.m.) until its removal from service on September 9, 2016. The licensee entered Mode 4 on September 9, 2016, at 5:09 a.m. At this time, TS 3.4.10 was applicable. TS 3.4.10 requires, in part, that two residual heat removal shutdown cooling subsystems be operable in Mode 4. For the condition of one or two RHR shutdown cooling subsystems inoperable, Action A.1 requires the licensee to verify an alternate method of decay heat removal is available for each inoperable RHR shutdown cooling subsystem within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> thereafter.

The ADHR system was placed in standby alignment on September 9, 2016, at 5:42 p.m., but the licensee failed to recognize that the ADHR heat exchanger isolation valves (P44F481A, P44F481B, P44F482A, and P44F482B) remained tagged closed, and therefore, the ADHR system was not actually in standby alignment.

On September 9, 2016, at 6:10 p.m., in order to replace the RHR subsystem A pump, it was removed from service. Starting at this time, the licensee inappropriately credited the ADHR system as their alternate method of decay heat removal for compliance with TS 3.4.10, Action A.1. Credit for the ADHR system was inappropriate because, although the licensee believed the ADHR system had been aligned in standby, the ADHR heat exchanger isolation valves had remained tagged closed, rendering the ADHR system unavailable to satisfy the TS requirement during the time period RHR subsystem A was unavailable. In attempting to verify the availability of the ADHR system as an alternate means of decay heat removal to satisfy TS 3.4.10, the licensee's administrative review of tagouts failed to consider tagouts on the PSW system that might impact ADHR system availability (i.e., tagout P44-002-1E12B003A/B that tagged closed the ADHR heat exchanger isolation valves). The RHR subsystem A pump was replaced, retested, and returned to available status on September 22, 2016, at 8:00 p.m. Therefore, the licensee was not in compliance with TS 3.4.10, Action A.1, since RHR subsystem A was inoperable and the licensee failed to verify an alternate method of decay heat removal available between September 9, 2016, and September 22, 2016.

On September 23, 2016, at 3:03 p.m., the misaligned ADHR heat exchanger isolation valves were identified while the licensee was attempting to put the ADHR system in service. Operations personnel corrected the ADHR system alignment error and put the ADHR system in standby alignment on September 28, 2016, at 6:31 p.m.

Analysis.

The failure to perform the TS required action to verify an alternate method of decay heat removal is available when an RHR shutdown cooling subsystem was 18 inoperable was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to follow TS requirements to ensure the availability, reliability, and capability of the alternate decay heat removal system directly affected the cornerstone objective. Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process (SDP)," and Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings," the team determined that an Appendix G, Phase 2, risk analysis was appropriate, since the cavity was not flooded, and the finding represents an actual loss of safety function of a non-TS train of equipment during shut down designated as risk-significant, for greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year. Therefore, this violation is associated with a finding having very low safety significance (Green).

The team determined the finding had a cross-cutting aspect within the human performance area, field presence, because leaders failed to reinforce standards and expectations in the work areas of the plant. Specifically, inconsistent procedure use and adherence led to the ADHR system misalignment and the failure to adequately verify the system was available as required by TS. As reflected in the licensee's root cause evaluation, this inconsistent procedure use and adherence indicates leaders were not effectively reinforcing standards and expectations for operators in the field [H.2].

Enforcement.

Technical Specification 3.4.10, requires, in part, that two residual heat removal shutdown cooling subsystems be operable in Mode 4. For the condition of one or two RHR shutdown cooling subsystems inoperable, Action A.1 requires the licensee to verify an alternate method of decay heat removal is available for each inoperable RHR shutdown cooling subsystem within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> thereafter. Contrary to the above, from September 9, 2016, to September 22, 2016, the licensee failed to verify an alternate method of decay heat removal was available when RHR subsystem A was inoperable. Specifically, the licensee inappropriately credited the ADHR system as their alternate method of decay heat removal even though the ADHR heat exchanger isolation valves were tagged closed, rendering the ADHR system unavailable to satisfy the TS requirement. In attempting to verify the availability of the ADHR system as an alternate means of decay heat removal to satisfy TS 3.4.10, the licensee's administrative review of tagouts failed to consider tagouts on the PSW system that might impact ADHR system availability. Corrective actions involved restoring RHR subsystem A to available status on September 22, 2016. Because this finding was determined to be of very low safety significance and has been entered into the licensee's corrective action program as Condition Report CR-GGN-2016-07281, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 050000416/2016008-01, "Failure to Have Alternate Decay Heat Removal Capability")

19 (2) Failure to Have Adequate Procedures

Introduction.

The team identified two examples of a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, for the licensee's failure to have adequate procedures for activities affecting quality. Specifically, Grand Gulf Nuclear Station failed to have adequate procedures for feedwater and shutdown cooling activities. The licensee entered this issue into their corrective action program as Condition Reports CR-GGN-2016-08334, 08273, and 08290.

Description.

Example (1) Grand Gulf Nuclear Station Procedure 04-1-01-E-12-2, "Shutdown Cooling and Alternate Decay Heat Removal Operations," Revision 119, provided specific information for operation of the shutdown cooling mode of the RHR system and ADHR operations. Section 4.6 of Procedure 04-1-01-E-12-2 provided steps on how to place the alternate decay heat removal system into a standby configuration. The team identified that the procedure failed to ensure the proper configuration of the ADHR heat exchanger isolation valves, P44F481A, P44F481B, P44F482A, and P44F482B. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-08334.

Example (2) Section 4.3 of Procedure 04-1-01-E-12-2 provided steps to secure an operating RHR subsystem in the shutdown cooling configuration. Step 4.3.2.a(1)(b)of Procedure 04-1-01-E-12-2 required operators to open valve B21F065B. Valve B21F065B serves as a feedwater isolation valve to keep condensate and feedwater from the reactor vessel when the condensate and feedwater system is operating in long cycle cleanup. Long cycle cleanup is a routine feedwater configuration established during reactor outage conditions to ensure the condensate and feedwater systems are being maintained to support reactor restart operations. The team identified that Procedure 04-1-01-E-12-2 failed to prevent an inadvertent reactor vessel fill when the valve B21F065B was opened during the securing of shutdown cooling while the feedwater system is in long cycle cleanup. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-08290.

Analysis.

The failure to have adequate procedures for activities affecting quality was a performance deficiency. Example (1) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not having adequate procedural guidance for ADHR alignment contributed the system's subsequent unavailability to perform if needed.

Example (2) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown operations. Specifically, not having adequate procedural guidance for operation of the feedwater isolation valve resulted in inadvertent overfill of the reactor vessel.

20 Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process (SDP)," and Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings," the team determined that an Appendix G, Phase 2, risk analysis was appropriate for Example (1) of this finding, since the cavity was not flooded, and the finding represents an actual loss of safety function of a non-TS train of equipment during shut down designated as risk-significant, for greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year. Therefore, this violation is associated with a finding having very low safety significance (Green). For Example (2) of the finding, the team determined that the finding screened to Green (very low safety significance) because it did not increase the likelihood of a shutdown initiating event, or any other event listed in Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings".

The team did not assign a cross-cutting aspect because the performance deficiency was not reflective of current plant performance, because the portions of the procedures impacting these events have not been revised within the last 3 years.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, requires, in part, "Activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances." Contrary to the above, the licensee failed to ensure that activities affecting quality were prescribed by documented procedures that were appropriate to the circumstances. Specifically, prior to September 24, 2016, Grand Gulf Nuclear Station Procedure 04-1-01-E-12-2, "Shutdown Cooling and Alternate Decay Heat Removal Operations," Revision 119, failed to have adequate instructions for the activities for which they were written, which contributed to the unavailability of the ADHR system and overfill of the reactor vessel. The licensee implemented corrective actions to revise the procedure. Because this finding was determined to be of very low safety significance and has been entered into the licensee's corrective action program as Condition Reports CR-GGN-2016-08334, 08273, and 08290, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 050000416/2016008-02, "Failure to Have Adequate Procedures") (3) Failure to Follow Operations Procedures

Introduction.

The team identified a Green, non-cited violation of TS 5.4.1.a, "Procedures," for the licensee's failure to implement procedures required by Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Specifically, contrary to procedures, on September 23, 2016, operations personnel failed to verify adequate plant service water flow to the ADHR heat exchangers while placing the system in service.

Description.

The team identified four instances of the licensee's failure to implement procedures. Three of the examples were determined to be of minor significance, and one was determined to be of Green significance. All four are described as follows:

21

• Example (1): On August 8, 2016, operations personnel failed to initiate a potential limiting condition for operation (LCO) tracking sheet when initiating a tagout on the ADHR system. Procedure 02-S-01-17, "Control of Limiting Conditions for Operation," Revision 129, Section 5.1, states that a limiting condition for operation tracking record (LCOTR) will be activated for a "Potential TS LCOTR," which is defined as a LCOTR that has been activated, but the associated LCO has not been entered because the system is not required for current plant conditions, but the system would be required if plant mode changed. On August 8, 2016, with the plant in Mode 1 at 100 percent power, the ADHR system was tagged out for heat exchanger cleaning. Since the ADHR system is only credited during Modes 4 and 5 for decay heat removal, no LCO entry was required. However, operations personnel were required to initiate a potential LCOTR to track that the ADHR system may be a credited decay removal system, should the plant enter Mode 4. The failure to initiate a potential LCOTR for tagging out the ADHR system on August 8, 2016, was a minor violation of Procedure 02-S-01-17 and TS 5.4.1.a.

• Example (2): On August 12, 2016, maintenance personnel failed to sign off the tagout when work on the ADHR system was complete. Procedure EN-OP-102, "Protective and Caution Tagging," Revision 18, Step 5.15[5], required tagout holders to place a check in the work complete box of the work order status window for work orders that no longer require the tagout. The tagout holder for the ADHR heat exchanger tagout P44-002-1E12B003A/B, which was in place to support ADHR heat exchanger cleaning, failed to check the work complete box in violation of Procedure EN-OP-102. Because operations personnel were never notified that the work was complete, the tagout remained hanging until September 23, 2016, while the site believed that the ADHR system was available in standby and credited the ADHR system as an available method of decay heat removal. The failure to remove tagout P44-002-1E12B003A/B when work on the ADHR system was complete was a minor violation of Procedure EN-OP-102 and TS 5.4.1.a.

• Example (3): On September 23, 2016, operations personnel failed to verify adequate PSW flow to the ADHR heat exchangers while placing the system in service. Procedure 04-01-E-12-2, "Shutdown Cooling and Alternative Decay Heat Removal Operation," Revision 119, contained instructions for placing the ADHR system in service. Step 4.9.2.a(8) of this procedure required operations personnel to verify plant service water flow to the heat exchangers by observing local flow indication at temporary annubar gage P44-N154, which was installed in the auxiliary building. Further, because gage P44-N154 indicated in inches of H2O, Procedure 04-01-E12-2, Step 4.9.2.a(8), contained a conversion factor for calculation of flowrate in gallons per minute (513.893 x (inches H2O)). The SOPP for the outage contained the acceptance criteria of 3000 gallons per minute for plant service water flow to the ADHR heat exchangers.

On September 23, 2016, when placing the ADHR system in service and upon reaching Step 4.9.2.a(8), the equipment operators noted that local gage P44-N154 read 0 inches of H20, which they interpreted as not satisfying the step. Operations personnel (including the senior reactor operator directing the task from the control room) believed that annubar gages were often unreliable, and 22 thus did not believe the indication. In order to continue placing the system in service, in spite of the lack of indicated PSW flow, operations personnel decided to look for alternative indications of PSW flow. To accomplish this, without procedural direction, they opened one of the heat exchanger vent valves, observed a pressurized steady stream of water, concluded that this response was satisfactory indication of PSW system flow, and proceeded forward in the procedure. Operations personnel did not attempt to quantify the PSW flow for adequate heat removal, because they interpreted the step to mean any flow was satisfactory. The failure to verify adequate PSW flow by observing flow on annubar P44-N154 was a Green, non-cited violation of Procedure 04-01-E12-2 and TS 5.4.1.a.

• Example (4) On September 23, 2016, operations personnel failed to follow general operating procedures when they vented the PSW system (as described above) without procedure guidance and without controlling the vented water with hoses to drain systems as required. Operations personnel took no precautions to prevent flooding, wetting of electrical equipment such as motor windings, or the spread of contamination in the area (the area in which the venting occurred was controlled as a contaminated area), and vented the water onto the floor of the room in the auxiliary building contrary to plant procedures. General Operating Procedure 04-S-04-1, "System Fill and Vent," Step 5.1.1, required protection from wetting adjacent equipment and uncontrolled venting by the use of tygon hoses directed to the proper drains when venting systems. On September 23, 2016, by venting the PSW side of the ADHR heat exchangers system to the floor and not taking precautions to install hoses to control the flow of water, operations personnel failed to follow Procedure 04-S-04-1, a minor violation of TS 5.4.1.a.

Analysis.

The failure to implement procedures as required by TS 5.4.1.a was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because, if left uncorrected, the failure to implement procedures as required by TS would have the potential to lead to a more significant safety concern. Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process (SDP)," and Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings,"

the team determined that the finding was of very low safety significance (Green)because it did not affect the design or qualification of a mitigating system structure, system or component and did not directly prevent the ADHR system from maintaining its functionality. The team identified a cross-cutting aspect in the area of human performance, challenge the unknown, because individuals failed to stop when faced with uncertain conditions and risks were not evaluated and managed before proceeding [H.11].

Enforcement.

Technical Specification 5.4.1.a requires that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 4.e of Appendix A to Regulatory Guide 1.33, Revision 2, requires procedures for energizing, filling, venting, draining, startup, shutdown, and changing modes of operation for the "Shutdown Cooling System." The licensee established Procedure 04-01-E12-2, "Shutdown Cooling and Alternative Decay Heat Removal 23 Operation," Revision 119, to meet the Regulatory Guide 1.33 requirement. Step 4.9.2.a(8) of Procedure 04-01-E12-2 required operations personnel to verify plant service water flow to the heat exchangers by observing local flow indication at temporary annubar gage P44-N154. Contrary to the above, on September 23, 2016, operations personnel did not verify plant service water flow to the heat exchangers by observing local flow indication at temporary annubar gage P44-N154.

Specifically, operations personnel observed 0 inches of H2O indicated on temporary annubar gage P44-N154, but discounted this reading and attempted to verify flow by an alternate means. As a result, operations personnel continued placing the ADHR system in standby without establishing cooling water to the heat exchangers. The licensee implemented corrective actions which included high intensity training for operators to reinforce operator fundamentals and procedure improvements.

Because this violation was of very low safety significance and has been entered into the licensee's corrective action program as Condition Report CR-GGN-2016-08333, it is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000416/2016008-03, "Failure to Follow Operations Procedures")

4OA6 Meetings, Including Exit

Exit Meeting Summary

On May 31, 2017, the team presented the inspection results by telephone to Mr. T. Vehec, Director, Recovery, and other members of the licensee's staff. The team asked whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

M. Haire Attachment 1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

A. Boyd, Electrical Maintenance

S. Dupont, Regulatory Assurance

R. Falk, Regulatory Assurance

V. Fallacara, Acting Site Vice President

M. Giacini, General Manager Plant Operations

J. Hallenback, Manager, Design Engineering

W. Johnson, Operations

R. Liddell, Superintendent, Operations Training

R. Meister, Senior Specialist, Regulatory Assurance

R. Myer, Assistant Operations Manager

J. Nadeau, Manager, Regulatory Assurance

L. Simmons, Work Week Manager

S. Sweet, Engineer, Regulatory Assurance

L. Wilmot, Equipment Reliability Coordinator

S. Wood, Specialist, Regulatory Assurance

NRC Personnel

W. Sifre, Acting Senior Resident Inspector

LIST OF ITEMS

OPENED, CLOSED AND DISCUSSED

Opened and Closed

05000416/2016008-01 NCV Failure to Have Alternate Decay Heat Removal Capability (Section 4OA3)

05000416/2016008-02 NCV Failure to Have Adequate Procedures (Section 4OA3)

05000416/2016008-03 NCV Failure to Follow Operations Procedures (Section 4OA3)

Section 4OA3: Follow-up of Events and Notices of Enforcement Discretion Calculations Number Title Date

MC-Q1E12-93008 Calculation of Flow Needed for RHR System Flows August 23, 1999

Drawings

Number Title Revision M-1085D Residual Heat Removal System 004 M-1072H Plant Service Water System 009

Miscellaneous Documents

Number Title Revision/Date E12-021-ADHR ISOLAT

E12-026-1E12C002A Tagout Outage TS 1-OTS-16-0054 Tracker

GIN 1999-01279 (RBS Inadvertent Mode Change)

P44-002-1E12B003A/B Tagout Risk of Grand Gulf due to 9/26/2016 Site Clock Reset

Shutdown Operations Protection Plan 19

TS 1-TS-16-0343 Tracker

EN-MA-125 Troubleshooting for RHR Subsystem Pump A

September 7, 2016

LER 05000416/ 2016-008 Entry into Mode of Applicability with the ADHR System Inoperable 0 TS 3.0.2 TSs 152 TS 3.4.9 TSs 142

TS 3.4.10 TSs 142

UFSAR Section 3C.3.2 5

UFSAR Section 5.4.7.5 9

Procedures

Number Title Revision/Date01-S-02-9 Procedure Change Process 001 01-S-18-6 Risk Assessment of Maintenance Activities 018 02-S-01-4 Shift Relief and Turnover 043 02-S-01-17 Control of Limiting Conditions for Operation 129

2-S-01-27 Operations Philosophy 066

03-1-01-1 Integrated Operating Instructions for Cold Shutdown to Generator Minimum Load 169 04-1-01-E12-2 Shutdown Cooling and Alternate Decay Heat Removal Operation 119 and 120 04-1-01-N21-1 Feedwater System 074 04-1-01-P44-1 Plant Service Water/Radial Well System 105

04-S-04-1 System Fill and Vent 012

05-1-02-III-1 Inadequate Decay Heat Removal 044

Procedures

Number Title Revision/Date06-OP-1E12-Q-0023 LPCI/RHR Subsystem A Quarterly Functional Test 131

EN-LI-102 Corrective Action Program 027

EN-LI-108 Shutdown Safety Management Program 8

EN-OP-102 Protective and Caution Tagging 018

EN-OP-102-01 Protective and Caution Tagging Forms and Checklist 10

EN-OP-105 Conduct of Operations 017

EN-OU-108 Shutdown Safety Management Program 008

EN-WM-105 Work Order Instructions for Obtaining Pump Curves for RHR Subsystem A Post Replacement June 21, 2011

Condition Reports (CR-GGN-)

2016-06110 2016-07133 2016-07281 2016-07560 2016-07584 2016-07591 2016-07730 2016-07731 2016-07853 2016-07858

2016-07902 2016-08008 2016-08009 2016-08128 2016-08129

2016-08130 2016-08131 2016-08132 2017-00263

Work Orders

00450270

M. Haire

Attachment 2 Grand Gulf Detailed Risk Evaluation CONCLUSION: This analysis concludes the best estimate of risk for this event is a CDF of 3.2E-7/year (Green) and a LERF of 7.3E-8/year (Green). (1) Phase 3 Model Revision Used Version 8.22 of the Grand Gulf (GG) simplified plant analysis risk (SPAR) model was used to determine the risk significance for this performance deficiency.

The

GG at-power SPAR model includes shutdown event trees.

The shutdown event trees use the same support fault trees as the at-power model, with some modifications.

Since the exposure time began one day after shutdown while the plant was in Mode 4, this performance deficiency was modeled using the Mode 4

Early (M4E) event trees in the

SPAR-SD model.

There are three M4E event trees in the GG

SPAR-SD model: loss of inventory outside containment (LOIOC), loss of offside power (LOOP), and loss of shutdown cooling (LOSDC).

The LOOP event tree was not quantified because the alternate decay heat removal

(ADHR) system is not powered from an emergency bus.

As a result, ADHR

would not be credited for heat removal during a LOOP, and there would be no change in core damage frequency (~CDF) between the base case and the conditional case.

The LOIOC and LOSDC event trees were both quantified to determine the risk significance of this performance deficiency.

The LOIOC event tree is shown in Figures 1 and 2.

The LOSDC event tree is shown in Figures 3

and 4. (2) Assumptions

Exposure time:

The exposure time for calculation of ~CDF was the period between September 9, 2016 and September 22, 2016, when ADHR was required by technical specification (TS) to be available, but was not available, which was days.

GG shut down on September 8, 2016, in order to replace the residual heat removal (RHR) pump A.

The RHR A subsystem was removed from service beginning September 9, 2016, until September 22, 2016, for the pump replacement.

During this time, the RHR B subsystem was required to be operable, and ADHR was required to be available per TS 3.4.10.

However, ADHR was not available because its heat exchanger isolation valves were misaligned.

ADHR was restored to an available condition on September 28, 2016.

The exposure time for calculation of the change in large early release frequency (~LERF) at shutdown is limited to 8 days after shutdown, in accordance with Inspection Manual Chapter (IMC) 0609, Appendix H, "Containment Integrity Significance Determination Process."

Because the performance deficiency occurred 1 day after shutdown, the maximum exposure time for calculation of ~LERF for this finding is 7 days.

LOIOC Initiating Event Frequency (IEF):

The best available IEF for the LOIOC event tree was presented in Electric Power Research Institute (EPRI) technical review (TR)

1003113, "An Analysis of Loss of Decay Heat Removal Trends and Initiating Event Frequencies (1989-2000)."

This document, which was completed in 2001, provides industry initiating event frequencies at shutdown using data from 1989-2000.

This EPRI report gives an IEF for reactor pressure vessel (RPV) leaks or diversions at shutdown of 3.2E-5/hour (.27/year).

The EPRI IEF of 0.27/year was chosen as the best estimate IEF for this risk evaluation because it is based on the broadest set of data available and has a well-documented basis.

Another EPRI report was published in 2011, EPRI

TR 1021176, "An Analysis of Loss of Decay Heat Removal and Loss of Inventory Event Trends (1990-2009)," which updated the trends for loss of inventory (LOI) events with more recent data, but did not provide updated IEFs.

The updated trend information shows that LOI events for boiling water reactors (BWRs) are steady from the previous period.

This trend information suggests that the IEF reported in the 2001 report is still appropriate.

LOSDC IEF:

The best available initiating event frequency for the LOSDC event tree is also presented in the 2001 EPRI report.

This report gives IEFs for loss of the running RHR pump or RHR flow, loss of cooling water or heat transfer to the

RHR heat exchangers, shutdown cooling (SDC) isolation, and RPV isolation events.

When added together, these four IEFs give a total IEF of 1.37/year for LOSDC events in BWRs.

The total IEF of 1.37/year was chosen as the best estimate IEF for this risk evaluation because it is based on the broadest set of data available and has a well-documented basis.

The 2011 EPRI report shows that much fewer LOSDC events occurred in BWRs in the time period after 1995 than during the previous period.

The updated trend information showed that the number of LOSDC events has continued to decrease slightly since 2000 until 2010.

However the time spent in shutdown has also decreased during that time frame.

This trend information suggests that the IEF reported in the 2001 report is still appropriate.

Timing of LOIOC:

Timing in the top of the LOIOC event tree is based on a 500 gpm leak, which takes 25 minutes to get to the low level SDC isolation setpoint (200 gal/in in RPV) and another 35 minutes to get to top of active fuel

(TAF) and cause core damage.

Since the top of the LOIOC event tree doesn't assume a loss of SDC, none of this information was influential to the final risk result.

Success in Isolating a LOIOC:

Operations personnel could successfully isolate a reactor coolant system leak prior to loss of shutdown cooling.

A new branch was added to the bottom branch of the LOIOC event tree that allowed just enough time for operations personnel to isolate the leak if no injection sources were successful.

The new branch is shown on the LOIOC event tree and leads to core damage (CD) Sequence 44.

The event tree has a human error probability (HEP)

of 0.5.

This was based on operations personnel having 35 minutes until TAF to isolate the leak.

Time to Boiling in the Core and Containment Isolation:

As provided by the licensee, boiling in the core would take place in about 25 minutes and containment isolation would occur in 100 minutes on high drywell (DW) pressure.

Shutdown Cooling Isolation:

SDC isolates on 135 psig in the reactor coolant system, high DW pressure, or low RPV level.

High DW pressure would occur first, at 100 minutes.

This was based on a calculation provided by the licensee.

ADHR Recovery:

ADHR was unavailable for recovery because it is unable to pump saturated water (procedurally isolated at 200 degrees Fahrenheit), would take at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 15 minutes to restore, and core boiling would occur within minutes.

None of the licensee calculations provided show reactor temperature going back below boiling.

Core Damage Timing:

With no operator actions and no injection it would take about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for level to lower to the top of active fuel.

In the dominant sequence, core damage is expected to occur 12-21 hours after reaching the top of active fuel.

Suppression Pool Boiling:

It would take 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to boil the suppression pool if the 25 megawatts of heat from the core were being directed to the suppression pool.

This does not account for heat losses to the RPV/DW environment.

Suppression Pool Cooling:

Failure of RHR A and B also fails suppression pool cooling.

Shutdown Cooling Recovery:

The average amount of time it took to restore SDC per the data in the 2011 EPRI report was 42 minutes.

This was applied to all sequences when RHR, train B, was considered to be in a recoverable condition.

The running train was considered to fail in a condition that would not be recoverable 10 percent of the time, as documented in Section (3) b. below.

Reactor Water Cleanup (RWCU) and Control Rod Drive (CRD) Availability:

RWCU and CRD were both available during the exposure time.

However, they were not capable of providing sufficient core cooling.

Therefore, they were not credited in the model.

Power Conversion System (PCS) Availability:

The main steam isolation valves (MSIVs) were closed and there was no vacuum in the main condenser during the exposure time.

Therefore, the PCS was not credited for decay heat removal from the reactor coolant system (RCS).

However, the condensate system was available for injection and was credited as an injection source in the model.

Alternate Heat Removal Success:

Because RWCU and PCS were not credited, the top event

SD-ALT-HEAT always fails.

Reactor Pressure Vessel Venting:

The RPV head was in place and the RPV was vented throughout the exposure period.

However, the vent was inadequate to prevent repressurization of the system.

Automatic Pressure Relief:

The high pressure core spray (HPCS) system is capable of lifting a safety relief valve (SRV).

Therefore, there is no need to depressurize the reactor to avoid core damage whenever HPCS is running.

This is modeled in the SPAR.

Automatic Injection:

HPCS and low pressure core spray (LPCS) would automatically inject on Level II and Level I low reactor vessel level signals, respectively (given depressurization for LPCS).

The shutdown SPAR model was changed to incorporate this.

Availability of RHR Train C:

RHR, train C, was available throughout the exposure time.

This train is an injection source, but has no heat exchanger and cannot provide decay heat removal or suppression pool cooling.

Reactor Recirculation:

A recirculation pump was always running throughout the exposure period.

Therefore, complete reactor coolant system mixing was assumed.

Firewater Injection:

The firewater system was available for injection throughout the exposure period and was credited as an injection source.

Pressure/Level Control:

Immediately following the event, operations personnel would respond in accordance with Procedure 05-1-02-III-1, "Inadequate Decay Heat Removal," Revision 30.

This procedure directs the operations personnel to attempt to restore SDC.

Upon failure to restore a SDC system, operations personnel are directed to open two SRVs and raise reactor pressure vessel level to get flow through the SRVs to the suppression pool.

At some point in the dominant sequences, operations personnel would have transitioned to Emergency Operating Procedure 05-S-01-EP-2, "RPV Control," Revision 38, and may maintain a lower reactor water level band, start steaming, and use SRVs for pressure control.

In both procedures, all of the heat is going to the suppression pool via the SRVs.

Emergency Operating Procedures (EOP):

Emergency Operating Procedure 05-S-01-EP-3, "Containment Control," Revision 27, would have been used for containment control once the containment isolation setpoint was reached.

EOP Attachments 13 and 14, provide direction for containment venting.

Operations personnel might attempt venting earlier via normal means but the small vent path provided would not prevent containment isolation.

After containment isolation, jumpers need to be installed to vent containment.

Procedure

05-S-01-EP-1, "Emergency/Severe Accident Procedure Support Documents," Revision 18, was also referenced.

Late Recovery of Shutdown Cooling:

The late recovery was modeled in the plant-specific shutdown SPAR.

The values used were based on the NRC's model-makers guide and were as provided by Idaho National Laboratories.

Change in Core Damage Frequency (CDF):

The analyst used the change in CDF as the metric for the risk evaluation as documented in the Risk Assessment of Operational Events Handbook, Volume 4, "Shutdown Events," Revision 2.0.

The change was calculated as documented in Section 6.0, "Shutdown Condition Analysis - Multiple POSs."

Shutdown Test and Maintenance:

The analyst left the test and maintenance basic events in the SPAR at their nominal values for the risk assessment.

These basic event parameters were established for a reactor at power.

Therefore, these events are likely to underestimate the risk of the subject performance deficiency.

A sensitivity analysis was performed, as documented in Section (7),

"Sensitivities," below.

Containment Venting Human Error Probability:

The ability and failure probability for containment venting is uniquely different than the operator failure probability for removing heat from the containment using the power conversion system.

Therefore, the analyst added a basic event (SD-XHE-XM-VENT) to Fault Tree

SD-CVS, "Containment Venting - SD."

Evacuation Timing: "GGNS Development of Evacuation Time Estimates Report, Rev 1, dated November 2012 states that 100% evacuation of the entire emergency planning zone (EPZ), including special groups which require two waves of busing for evacuation, can be accomplished in less than 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 50 min).

Evacuation is triggered when a General Emergency is declared.

In accordance with Emergency Plan Procedure 10-S-01-1, "Activation of the Emergency Plan," a General Emergency would be declared 30 minutes after level lowered to the top of active fuel if containment was challenged and inventory was lost.

The analyst estimated that it would take an additional hour after declaration of a General Emergency for an evacuation to begin. (3) Internal Events Risk Analysis Base Case Conditions: The following modifications were made to the base

SPAR-SD model in order to align the model with the plant operating state during the exposure time:

a. The performance deficiency existed because RHR A was inoperable.

Both the LOIOC and LOSDC event trees assume that RHR A is the running subsystem and that it is failed as part of the initiating event.

This is accomplished by house events (HE-SD-LOIOC,

HE-SD-LOSDC) placed in the fault tree for RHR A (SD-SDC-A-M4M5) that are set to TRUE when the respective initiating event occurs.

Therefore, no changes were required to model unavailability of the RHR A subsystem in this plant mode.

b. The EPRI IEFs are based on the full range of possible event severities.

The data shows that the vast majority of events do not result in a nonrecoverable LOSDC.

Review of the EPRI data and consultation with other probabilistic risk assessment (PRA) analysts concluded that less than 1 percent of loss of inventory (LOI) events and approximately 1 to 10 percent of LOSDC events may be nonrecoverable.

Therefore, the analyst assumed that 10 percent of events are nonrecoverable as a best estimate.

As a surrogate, the failure to run basic event for the RHR, pump B,

RHR-MDP-FR-PUMPB, was set to a probability of 0.1.

Sensitivity Evaluation 2 was performed to explore the impact of this assumption.

c. The original LOIOC event tree assumed that every LOI event caused a nonrecoverable loss of the running SDC train, and therefore, the HEP in the first top event, "Failure to Diagnose LOI before SDC Isolation," was originally set to TRUE (i.e., a failure probability of 1.0).

The EPRI IEFs are not based on this assumption.

Instead, they are based on any LOI events, regardless of whether the event caused an LOSDC or not.

Therefore, the NRC analyst changed the value of this top event from TRUE to an appropriate probability.

As such, the HEP (SD-XHE-XD-LOIM4), was changed from TRUE to 0.01 (nominal time to perform the diagnosis, no action required), to activate the sequences in the top of the event tree in which the LOI is successfully diagnosed prior to loss of the running SDC train.

Those sequences which were not previously active were not fully modeled because they did not include any HEPs.

The NRC analyst completed modeling of the newly activated sequences.

The changes mimic the modeling already in place in the bottom of the event tree and ensure that each fault tree called upon includes an appropriate HEP.

These changes are shown in the LOIOC event tree shown in Figure 1.

d. Station service water (SSW), pump B, which provides cooling water for the RHR B heat exchanger, was running for the duration of the exposure time.

Therefore, its failure to start basic event (SSW-MDP-FS-PUMPB) was set to

FALSE.

e. HPCS and LPCS would have automatically initiated on low level during the exposure time.

The basic events for failure of auto initiation of the HPCS and LPCS systems (SD-ICC-FC-HCS and

SD-ICC-FC-LPI, respectively) were set to their hardware failure values.

These basic events were originally set to

TRUE in the base model.

f. RWCU was in service during the exposure time, but would not have been sufficient to provide adequate core cooling.

The power conversion system was also unavailable to provide alternate heat removal from the core during the exposure time.

A new basic event was created in the alternate heat removal (SD-ALT-HEAT) fault tree and set to TRUE in order to fail the use of these alternate heat removal methods. g. CRD was in service during the exposure time, but would not have been sufficient to provide adequate core cooling.

The basic event for failure to initiate CRD (SD-XHE-XM-CRD) was set to TRUE to fail use of CRD as a method of core cooling in the

SPAR-SD model. h. The LOIOC and LOSDC event trees in the

SPAR-SD model assume that failure to vent containment results in core damage.

This is based on the assumption that containment failure causes an adverse environment in the auxiliary building, which causes failure of the injection systems in the building.

This is a conservative assumption because GG has a steel-reinforced concrete containment which is expected to leak when over-pressurized, not rupture. GG provided a calculation,

PRA-GG-01-001S01 Rev 0, "GGNS At-

Power Level 1 Accident Sequence Analysis," which showed that approximately 1% of containment failures would result in failure of the high pressure core spray (HPCS) system in the lower elevation of the auxiliary building.

NRC personnel reviewed the calculation and determined that the licensee's assumptions were reasonable.

As a result, the analyst modified the LOSDC event tree to include a new top event,

SD-CONTFAIL,

"Containment Failure Causes a loss of Injection," after the top event SD-

VENT, as shown in Figures 3 and 4.

The

SD-CONTFAIL top event is questioned in sequences where an injection source is available but containment venting fails.

If a high pressure injection source had succeeded in the sequence, the top event was assigned a value of 0.01 to reflect the 1% probability that containment failure would cause a loss of the high pressuring injection source.

If a low pressure injection source had succeeded in the sequence, the top event was assigned a value of 0.04, which is the combined probability that a high pressure source would have failed if demanded, plus the 1% probability that containment failure would have failed the high pressure injection source.

The LOIOC event tree was not modified because it does not dominate the risk analysis.

Human Error Probability Screening:

The M4E event trees include placeholder HEPs.

Precise HEPs were not included in the off-the-shelf model because the model builders did not know what conditions the model would be tasked to resolve.

The HEPs would be significantly different for an event that occurs early in an outage when decay heat levels are high and time available to perform the actions is limited in contrast to late in the outage when significantly more time is available.

The placeholder HEPs, shown in the table below, have values of 1E-3

or smaller for operator actions to restart SDC, depressurize the reactor coolant system, start HPCS or low pressure injection (LPI), align firewater or other injection sources, provide suppression pool cooling or vent containment.

Human Error Event Description Original Value

SD-XHE-XM-RHR-NOM Fails to establish SDC/SPC cooling (> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 1E-3

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 5E-4

SD-XHE-XM-ECS-NOM FAILS TO ESTABLISH LPI/HPI INJECTION (NOMINAL TIME) 1E-3

SD-XHE-XM-ALTI-NOM FAIL TO INITIATE ALTERNATE INJECTION GIVEN LO/HI PRESSURE

INJECTION (ECCS) FAILS 4E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT 1E-3

Since these HEPs were placeholders, the analyst increased all of these HEPs to

a screening value of 1E-2 in order to identify which operator actions significantly influence the final risk results.

The

SPAR-SD model accounts for dependency between HEPs by replacing the calculated HEP with a combined HEP when multiple individual HEPs appear in a cutset.

The combined HEPs were increased from 1E-3 to 1E-2 to account for the increase in the individual HEPs as part of the screening analysis.

Using screening values in this manner is consistent with the guidance found in Section 3.3.3.2 of

NUREG-1792, "Good Practices for Implementing HRA," regarding post-initiator screening.

This screening identified that the HEP associated with venting containment,

SD-XHE-XM-VENT, is significant to the results.

A detailed evaluation was performed for this operator action and this HEP was assigned a value of 1.1E-3 (extra time for diagnosis and action since depressurization and injection were both successful in the sequences where this dominates).

Containment venting was estimated to be required sometime between 66 and 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after loss of SDC.

The analyst considered providing more credit for the time performance shaping factor.

As a sensitivity, the HEP was lowered to 2E-4 per demand.

This had very little impact to the final result because the valve and equipment failures begin to dominate in this range.

The HEP screening also identified that the HEP associated with depressurizing the reactor,

ADS-XHE-XM-DEP, is significant to the results.

A detailed evaluation was performed for this operator action and this HEP was assigned a value of 1E-3 (extra time for action since there is more than 5 times the time required for this action where this dominates).

For the nonsignificant HEPs, the NRC analyst determined that the screening values were better estimates than the original placeholder values, so the remaining HEPs were left at their screening values of 1E-2.

Since the remaining HEPs were not significant to the analysis, leaving them at their screening value has very little effect on the results, as shown in Sensitivity Evaluation 3.

Results:

The conditional case assumes that ADHR is failed due to the misalignment.

ADHR was failed in the conditional case by setting the basic event for failure of the ADHR heat exchanger cooling water supply valve to open

(ADH-XVM-CC-F483) to TRUE.

The internal events CDF was calculated by subtracting the CDF calculated using the base case conditions discussed above from the conditional case CDF with ADHR failed, and multiplying by the exposure time of 13 days.

The total internal events CDF was calculated for 2 cases.

A total internal events CDF of 5.8E-6 (White) was calculated for Case 1 where containment failure always causes core damage due to loss of all injection sources.

A total internal events CDF of 3.2E-7 (Green) was calculated for Case 2 where containment failure only causes loss of injection 1% of the time that high pressure injection is available (Base Case Condition h above).

The internal events CDF results for the 2 cases are show in the table below:

Event Tree Base Case CDFConditional Case CDF CDF (full year) CDF for exposure time Case 1: Containment failure always causes core damage N-SD-M4E-LOIOC 5.3E-6 5.6E-6 2.8E-7 1E-8 N-SD-M4E-LOSDC 1.5E-5 1.8E-4 1.6E-4 5.8E-6 Total for Internal Events

5.8E-6

Case 2: Containment failure causes core damage 1% of the time that high pressure injection is available N-SD-M4E-LOSDC 3.7E-6 1.25E-5 8.8E-6 3.1E-7 Total for Internal Events

3.2E-7

The cut sets for Case 1 that contribute to at least 1 percent of the risk for the LOIOC event tree are shown in Table 1 at the end of this report.

The cut sets for Case 1 that contribute to at least 1 percent of the risk for the LOSDC event tree are shown in Table 2 at the end of this report.

The cut sets for Case 2 (proposed Base Case) that contribute to at least 1 percent of the risk for the LOSDC event tree are shown in Table 3 at the end of this report. (The LOIOC was not modified for Case 2 (Base Case) using the new information provided by the licensee because it was not significant to the risk results.)

The cut set reports were generated by setting the basic event

ADH-XVM-CC-F483 to 1.0 and then viewing only the cut sets that include this basic event.

This analysis concludes the best estimate of risk for this event is represented by Case 2 with a CDF of 3.2E-7/year (Green).

Dominant Sequence:

The dominant sequence for Case 1 is Sequence 7 in the LOSDC event tree (as shown in Figure 3), which includes the following top events:

Successful diagnosis of the LOSDC before SDC isolation (/SD-XD-SDC) Failure of heat removal using SDC (SD-SDC)

Successful reactor depressurization (/SD-DEP)

Successful low pressure injection (/SD-LPI)

Failure of suppression pool cooling (SD-SDC) Failure of containment venting (SD-CVS) Failure of late recovery of RHR (SD-RECLT-3D)

This sequence accounts for approximately 70 percent of the risk associated with the LOSDC conditional case for Case 1 and approximately 50% of the risk for Case 2 (proposed Base Case). (4) External Events Risk Analysis (NOTE: The external event risk analysis was not modified to incorporate the low probability that containment failure would result in core damage (Case 2) because it has no impact on the significance)

Review of the Grand Gulf Nuclear Station Individual Plant Examination of External Events (IPEEE) did not reveal any external events specifically applicable to this performance deficiency because ADHR is not credited for decay heat removal in the IPEEE.

In addition, external event data is not available specifically for the shutdown condition.

Seismic events and high winds are generally assumed to cause a LOOP, but the LOOP event tree is not applicable to this performance deficiency because ADHR is not powered from an emergency bus.

Flooding is not a dominant risk contributor at the site.

Therefore, the risk significance of seismic, high winds, and flooding events were determined to be negligible for this evaluation.

Fire is the dominant applicable external event.

Dominant fire scenarios would include fires that affect the running SDC train.

The licensee provided a calculation showing the fire ignition frequencies (FIF) for all of the fire areas that could impact RHR B.

The total FIF, including transient combustibles, was 2E-3/year.

The licensee argued that this value would be even lower since transients would be limited in any areas containing RHR B equipment because it was the protected train and because transient combustible fires could be suppressed before affecting RHR B operation.

As such, the licensee suggested lowering the transient combustible contribution.

This resulted in a reduced total FIF of 4E-4/year.

The NRC analyst determined that the higher FIF

was the best estimate for use in this SDP because protecting the running train does not preclude transient combustibles from being taken into the area.

An external event risk evaluation was performed using the LOSDC tree with RHR B failed as a surrogate and setting the LOSDC IEF to the FIF of 2E-3/year.

The resulting evaluation gives an external event risk due to fire of 5E-8 for the exposure period.

Therefore, external event risk is not a significant contributor to risk for this performance deficiency.

(5) Large Early Release Frequency (LERF)

LERF is defined

NUREG-1765, "Basis Document for Large Early Release Frequency (LERF) Significance Determination Process (SDP)," as the frequency of all events that involve core damage accidents that can lead to large, unmitigated releases from containment before effective evacuation of the nearby population and, therefore, have the potential to cause prompt fatalities.

The analysts analyzed the LERF issue for the base case (Case 2) only.

Overall, the analysts (a) recognized that all dominant sequences had the potential to result in LERF, (b) modified LERF to factor in the differences in exposure time for CDF and LERF, and (c) evaluated the margin between times at which releases could occur against the estimates of the evacuation times for GGNS.

In accordance with Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process," issued May 6, 2004, the analyst determined that this was a Type A finding, because the finding affected the plant core damage frequency.

All of the core damage sequences that contribute to ~CDF involve failure to vent containment, which results in containment failure.

Therefore, all of the core damage sequences that contribute to CDF are also potential contributors to ~LERF.

The analysts determined the ~LERF by performing the following hand calculations:

a) Adjustment of exposure time:

As stated in the Assumptions, the exposure time for calculation of the LERF at shutdown is limited to 8 days after shutdown, because, after 8 days, it is assumed that the short-lived, volatile isotopes that are principally responsible for early health effects have decayed sufficiently that the finding would not contribute to LERF.

Therefore, since the performance deficiency began 1 day after shutdown, for short core damage sequences, the LERF exposure period was 7 days.

For sequences where core damage was assumed to take place after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the LERF exposure time was 4 days, because any core damage sequence that started after 4 days would go to core damage after the 8 day limit.

If LERF is assumed to occur in all core damage sequences, but each sequence is adjusted for the more limiting exposure period, the result would be 1.3E-7.

b) Removal of non-early sequences:

There is a note in Chapter 0308, Attachment 3, Appendix H, stating that during a Phase 3 analysis (detailed risk evaluation) the analyst can eliminate some sequences from LERF reducing the color of the finding "because the licensee would have evacuated."

As shown in Table 3, more than half of the core damage sequences took 72-

hours to go to core damage.

Those sequences had injection available but containment venting failed.

During these sequences, containment failure would not occur until 3 days after the postulated event.

It would take approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after containment failure to reach the top of active fuel and an additional 12-21 hours until core damage would occur.

Based on site procedures, a general emergency declaration would occur upon reaching the top of active fuel.

A timeline, consistent with the licensee's evacuation time evaluation, indicates that evacuation would start within 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of reaching the top of active fuel.

Since it would take at least another 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> for core damage to occur, sufficient time exists for an effective evacuation of the EPZ

since current evacuation time estimates show evacuation can, in all cases, be effected within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> of initiation.

Therefore, per the guidance in Chapter 0308, it is appropriate to eliminate these sequences from LERF because the affected population could be evacuated before core damage is postulated to occur.

As shown in Table 3, the analyst removed these sequences and calculated an estimated LERF of 7.3E-8 (Green).

Table 3 ADHR Issue Dominant Sequences Length of Sequence Sequence Number Case (/year) Base (/year) Delta (/year)

Short

30 6.79E-063.03E-06 3.76E-06Long 7 4.99E-063.46E-07 4.64E-06Short 22 5.94E-081.31E-09 5.81E-08Short 54 1.22E-091.22E-09 0.00E+00Short 62 3.17E-073.17E-07 0.00E+00Long 13 2.52E-081.70E-10 2.50E-08Long 19 1.15E-110 1.15E-11Long 28 1.80E-097.81E-10 1.02E-09Long 37 3.28E-075.30E-09 3.23E-07Long 44 1.57E-100 1.57E-10Long 51 00 0.00E+00Long 60 7.81E-117.81E-11 0.00E+00Totals 1.25E-053.70E-06 8.81E-06

Short

7.17E-063.35E-06 3.82E-06Long

5.35E-063.52E-07 4.99E-06

Short 7-day Exposure 7.32E-08Long

4-day Exposure 5.47E-08

Estimated LERF

7.32E-08 c) Sensitivity:

As a sensitivity analysis, the analyst made a bounding assumption that evacuation failed 10% of the time.

The analyst noted that a full evaluation using

SPAR-H would result in a lower probability.

The result of this evaluation was 7.9E-8, indicating that the finding would remain Green. (6) Uncertainties Analytical:

Shutdown events are generally dominated by HEPs.

The HEPs in the

SPAR-SD model are point estimates, and an uncertainty analysis could not be performed using the

SPAR-SD model.

Sensitivity analyses were conducted in order to account for uncertainties.

Qualitative Considerations:

ADHR was unavailable because the cooling water isolation valves to the heat exchangers were tagged closed.

This failure mechanism is potentially recoverable.

The licensee and resident inspectors estimated that it would take more than an hour to restore ADHR to the correct alignment.

However, ADHR is designed for operation when the reactor is less than 200 degrees Fahrenheit, and is procedurally directed to be isolated when the reactor is above 200 degrees Fahrenheit.

The licensee's calculation estimated that the time to boil one day after shutdown was approximately 25 minutes.

Because it is assumed that ADHR is not capable of pumping saturated water, no credit was given for recovery of ADHR in this risk analysis.

However, recovery of ADHR may prevent core damage in sequences where depressurization of the reactor was successful and injection was available, if injection was able to maintain water temperature below 200 degrees Fahrenheit.

CRD and RWCU were available and running during the exposure time but were not sufficient to provide adequate core cooling.

Therefore, no credit was given for their use.

Even though CRD and RWCU were not sufficient to provide adequate core cooling, their use would have potentially increased the time to boil and time to core uncovery. (7) Licensee Results The licensee provided three risk evaluations related to ADHR being out of service.

The NRC assessment of these evaluations is as follows:

Hand Calculation:

The licensee does not have a shutdown risk model.

Therefore, the licensee prepared a hand calculation to estimate the increased risk of having ADHR out of service for 13 days.

The licensee used EPRI data for their initiating event frequency, calculated an HEP for operations personnel responding before RCS boiling, and provided an equipment failure probability for

HPCS to fail to automatically start and inject.

The resulting conditional core damage probability was 1E-10.

The NRC analysts identified several issues with this evaluation.

First, the licensee provided a human error probability of 1E-5 for operations personnel failing to inject before core damage.

The analysts determined that this value was too low for an operator failure probability over 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> with the same crew and no new cues.

Second, the evaluation the licensee performed was not the dominant sequence in the NRC's evaluation.

The dominant sequence in the NRC's evaluation included successful injection with failure to vent primary containment.

Third, the licensee did not include an analysis for LOI events.

The licensee argued that LOI events are not applicable to the performance deficiency since any LOI would come from the RHR system.

An LOI from the RHR system would require the isolation valves to be closed, making both RHR and ADHR

unavailable.

The NRC analyst acknowledges that many BWR LOI events are from sources that would be isolated by closing the SDC suction isolation valves but has determined that this does not apply to all LOI events (e.g., improper valve manipulations in either the RWCU or reactor recirculating system have caused LOI events).

In fact, the EPRI data is based on LOI events from all locations with the potential to lower level, not just from RHR.

However, the NRC

analyst agrees that LOI events are not the dominant contributor to risk because they rarely result in an LOSDC at BWRs.

The risk results reflect this.

Fourth, the licensee did not use all four of the EPRI IEFs that result in an LOSDC

for its evaluation.

The licensee argued that the RHR/RPV isolation events and loss of cooling water to RHR events would impact both RHR and ADHR equally, and therefore, there should be no change in risk from these types of LOSDC

events.

The NRC analyst agrees that isolation events would initially impact both RHR and ADHR; however, the risk model tests and credits all means of recovering from an isolation event, including use of ADHR which was not available for use because of the performance deficiency.

Therefore, the NRC

analyst determined that the isolation and loss of cooling water initiating events are applicable to this risk evaluation.

Sensitivity Calculation:

The licensee performed a sensitivity evaluation using the same approach as in Method 1 above.

The resulting conditional core damage probability was 2.3E-9.

The primary difference in the sensitivity evaluation was to lower the HEP by an order of magnitude.

While the NRC analysts still believe this is too low, the lack of understanding and evaluation of the dominant sequence is the major difference between the licensee's and NRC's result.

Inspection Manual Chapter (IMC) 0609, Appendix G, Approach:

The licensee utilized the significance determination process Phase 2 method to quantify the risk of ADHR being unavailable.

The result included two sequences that added up to 7, which indicates a conditional core damage probability in the Green range.

The NRC analysts noted that the licensee used a credit of 3 for operator action in decay heat removal recovery before shutoff head is reached.

Worksheet 4 provides this value based on an assumption that operator action was the limiting factor in quantifying this parameter.

However, because RHR A

was out of service, ADHR was unavailable, and RHR B had just failed, the limiting factor is actually the equipment credit.

Providing an equipment recovery value of 1 as indicated by the Phase 2 approach, the Phase 2 result would include two sequences that add up to 5, which indicates a conditional core damage probability in the Yellow range.

The licensee also provided calculations related to heat transfer and timing during the proposed dominant core damage sequences.

The licensee recently provided a new thermal hydraulics calculation indicating that the time to core bulk boiling would be 47 minutes and the time to containment isolation would be 206 minutes.

This calculation and its potential impact on the subject evaluation is being reviewed by NRC staff.

(8) References * EPRI

TR 1003113, "An Analysis of Loss of Decay Heat Removal Trends and Initiating Event Frequencies (1989-2000)," November 2001 * EPRI

TR 1021176, "An Analysis of Loss of Decay Heat Removal and Loss of Inventory Event Trends (1990-2009)," December 2010 * Grand Gulf IPEEE * Grand Gulf SPAR Model, Version 8.22 *

IMC 0609, Appendix G, "Shutdown Operations Significance Determination Process," dated May 9, 2014 *

IMC 0609, Appendix H, "Containment Integrity Significance Determination Process," dated May 6, 2004 *

NUREG-1792, "Good Practices for Implementing HRA," April 2005. * RASP Manual, Volume 1, "Risk Assessment of Operational Events Handbook, Internal Events," Revision 2 * RASP Manual Volume 4, "Risk Assessment of Operational Events Handbook, Shutdown Events," Revision 1 *

SPAR-SD Model Makers Guide, Revision 2.4 (ADAMS Accession No. ML092160242)

M. Haire

A2-15 Figure 1 - Top of the LOIOC Event Tree

SD-M4E-LOIOCLOSS OF INVENTORY OUTSIDE CONTAINMENT- M4SD-XD-LOIFAIL TO DIAGNOSE LOI BEFORE SDC ISOLATIONSD-HPIHI PRESSURE INJECTIONS (HCS/CRD)SD-LPILOW PRESSURE COOLANT INJECTIONSD-ALT-INJALTERNATE INJECTION - CDS, SWS, AND

FWSSD-ISOL-LEAKOPERATOR FAILURE TO ISOLATE

LOISD-SDCHEAT REMOVAL USING

SDCSD-DEPMANUAL REACTOR DEPRESSSD-SPCHEAT REMOVAL USING SUPPRESSION

POOLSD-ALT-HEATPROVIDE ALTERNATE HEAT REMOVAL

PATHSD-CVSCONTAINMENT VENTING -

SDSD-REC-LTLATE RECOVERY#End State(Phase - CD)SD-XD-LOI-M4SD-HPI-NOMSD-ISOL-LOI-EXPN1OKSD-ISOL-LOI-EXPN2OKSD-RECLT-1D3CDSD-HPI-NOMSD-LPI-NOMSD-ISOL-LOI-EXPN4OKSD-ISOL-LOI-EXPN5OKSD-RECLT-1D6CDSD-LPI-NOMSD-ALTI-NOMSD-ISOL-LOI-EXPN7OKSD-ISOL-LOI-EXPN8OKSD-RECLT-1D9CDSD-ALTI-NOM10OKSD-RECLT-1D11CDSD-XD-LOI-M4

Figure 2 - Bottom of LOIOC Event Tree

SD-M4E-LOIOCLOSS OF INVENTORY OUTSIDE CONTAINMENT- M4SD-XD-LOIFAIL TO DIAGNOSE LOI BEFORE SDC ISOLATIONSD-HPIHI PRESSURE INJECTIONS (HCS/CRD)SD-LPILOW PRESSURE COOLANT INJECTIONSD-ALT-INJALTERNATE INJECTION - CDS, SWS, AND

FWSSD-ISOL-LEAKOPERATOR FAILURE TO ISOLATE

LOISD-SDCHEAT REMOVAL USING

SDCSD-DEPMANUAL REACTOR DEPRESSSD-SPCHEAT REMOVAL USING SUPPRESSION

POOLSD-ALT-HEATPROVIDE ALTERNATE HEAT REMOVAL

PATHSD-CVSCONTAINMENT VENTING -

SDSD-REC-LTLATE RECOVERY#End State(Phase - CD)SD-XD-LOI-M4SD-XD-LOI-M4SD-HPI-NOMSD-ISOL-LOI-EXTSD-SDC-NOM12OKSD-SDC-NOMSD-SPC-NOM13OKSD-SPC-NOM14OK15OK16OKSD-RECLT-3D

17CDSD-ISOL-LOI-EXT18OKSD-RECLT-1D19CDSD-HPI-NOMSD-LPI-NOMSD-ISOL-LOI-EXTSD-SDC-NOM20OKSD-SDC-NOMSD-SPC-NOM21OKSD-SPC-NOM22OK23OK24OKSD-RECLT-3D25CD26OK27OKSD-RECLT-12H28CDSD-ISOL-LOI-EXT29OKSD-RECLT-1D30CDSD-LPI-NOMSD-ALTI-NOMSD-ISOL-LOI-EXTSD-SDC-NOM31OKSD-SDC-NOMSD-SPC-NOM32OKSD-SPC-NOM33OK34OK35CDSD-RECLT-3D36CD37OK38OKSD-RECLT-12H39CDSD-ISOL-LOI-EXT40OKSD-RECLT-1D41CDSD-ALTI-NOMSD-ISOL-LOI-JET42OKSD-RECLT-6H43CDSD-ISOL-LOI-JET44CD

Figure 3 - Top of LOSDC Event Tree

SD-M4E-LOSDCLOSS OF SHUTDOWN COOLING - M4ESD-XD-SDCFAIL TO DIAGNOSE LOSDC BEFORE SDC ISOLATIONSD-SDCHEAT REMOVAL USING

SDCSD-DEPMANUAL REACTOR DEPRESSSD-LPILOW PRESSURE COOLANT INJECTIONSD-ALT-INJALTERNATE INJECTION - CDS, SWS, AND

FWSSD-HPIHI PRESSURE INJECTIONS (HCS/CRD)SD-SDC-LHEAT REMOVAL USING

SDCSD-SPCHEAT REMOVAL USING SUPPRESSION

POOLSD-ALT-HEATPROVIDE ALTERNATE HEAT REMOVAL

PATHSD-CVSCONTAINMENT VENTING -

SDSD-CONTFAILContainment Failure causes LO

ECCSSD-REC-LTLATE RECOVERY#End State(Phase - CD)SD-XD-SDC-NOMSD-SDC-NOM1OKSD-SDC-NOMSD-LPI-NOMSD-SPC-NOM2OKSD-SPC-NOM3OK4OK5OKSD-CONTFAILS-01HPCS Unavailable or Fails with Containment

6OKSD-RECLT-3D7CDSD-LPI-NOMSD-ALTI-NOMSD-SPC-NOM8OKSD-SPC-NOM9OK10OK11OKSD-CONTFAILS-01LPCI/LPCS Fails with Containment

12OKSD-RECLT-3D13CDSD-ALTI-NOMSD-HPI-NOMSD-SPC-NOM14OKSD-SPC-NOM15OK16OK17OKSD-CONTFAILS-03HPCS Fails with Containment

18OKSD-RECLT-3D19CDSD-HPI-NOMNo Injection Available

20OKSD-RECLT-6H21CDSD-HPI-NOMSD-SPC-NOM22OKSD-SPC-NOM23OK24OK25OKSD-CONTFAILS-03HPCS Fails with Containment

26OKSD-RECLT-3D27CDSD-HPI-NOM28OKSD-RECLT-6H29CDSD-XD-SDC-NOM

Figure 4 - Bottom of LOSDC Event Tree

SD-M4E-LOSDCLOSS OF SHUTDOWN COOLING - M4ESD-XD-SDCFAIL TO DIAGNOSE LOSDC BEFORE SDC ISOLATIONSD-SDCHEAT REMOVAL USING

SDCSD-DEPMANUAL REACTOR DEPRESSSD-LPILOW PRESSURE COOLANT INJECTIONSD-ALT-INJALTERNATE INJECTION - CDS, SWS, AND

FWSSD-HPIHI PRESSURE INJECTIONS (HCS/CRD)SD-SDC-LHEAT REMOVAL USING

SDCSD-SPCHEAT REMOVAL USING SUPPRESSION

POOLSD-ALT-HEATPROVIDE ALTERNATE HEAT REMOVAL

PATHSD-CVSCONTAINMENT VENTING -

SDSD-CONTFAILContainment Failure causes LO

ECCSSD-REC-LTLATE RECOVERY#End State(Phase - CD)SD-XD-SDC-NOMSD-XD-SDC-NOMSD-LPI-NOMSD-SDC-NOM30OKSD-SDC-NOM

SD-SPC-NOM

31OKSD-SPC-NOM32OK33OK34OKSD-CONTFAILS-01HPCS Unavailable or Fails with Containment

35OKSD-RECLT-3D36CDSD-LPI-NOMSD-ALTI-NOMSD-SDC-NOM37OKSD-SDC-NOM

SD-SPC-NOM38OKSD-SPC-NOM39OK40OK41OKSD-CONTFAILS-01HPCS Unavailalble or Fails with Containment

42OKSD-RECLT-3D43CDSD-ALTI-NOMSD-HPI-NOM

SD-SDC-NOM44OKSD-SDC-NOM

SD-SPC-NOM45OKSD-SPC-NOM46OK47OK48OKSD-CONTFAILS-03HPCS Fails with Containment

49OKSD-RECLT-3D50CDSD-HPI-NOMNo Injection Available

51OKSD-RECLT-6H52CDSD-HPI-NOMSD-SPC-NOM53OKSD-SPC-NOM54OK55OK56OKSD-CONTFAILS-03HPCS Fails with Containment

57OKSD-RECLT-3D58CDSD-HPI-NOM59OKSD-RECLT-6H60CD

M. Haire

A2-19 Table 1- LOIOC Event Tree Cut Sets for Case 1 (NOTE: Cut set sequence numbers do not match Figures 1 and 2) # Prob/Freq Total% Cut Set Description 1 5.64E-8 19.83

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 2 2.44E-8 8.57

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV36 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 3 2.44E-8 8.57

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV34 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 4 2.44E-8 8.57

SD-M4E-LOIOC : 17

1. Prob/Freq Total% Cut Set Description

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV37 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 5 2.44E-8 8.57

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV35 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 6 1.79E-8 6.28

SD-M4E-LOIOC : 28

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

5.00E-1

SD-XHE-XR-SDC-12H FAIL TO RECOVER SDC LATE - 12 HRS

1.32E-2

SSW-MDP-TM-PUMPCSSW PUMP C IS UNAVAILABLE BECAUSE OF MAINTENANCE 7 1.71E-8 6.01

SD-M4E-LOIOC : 17

1. Prob/Freq Total% Cut Set Description

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

3.33E-5

ACP-BAC-LP-DII 4160 V

BUS 16AB HARDWARE FAILURES

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 8 9.21E-9 3.24

SD-M4E-LOIOC : 28

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

6.82E-3

HCS-MDP-TM-HPCS HPCI TRAIN IS UNAVAILABLE BECAUSE OF MAINTENANCE

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

5.00E-1

SD-XHE-XR-SDC-12H FAIL TO RECOVER SDC LATE - 12 HRS 9 7.47E-9 2.63

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPBSSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 10 7.22E-9 2.54

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.41E-5

DCP-BAT-LP-BATTB DIVISION II BATTERIES FAIL

1. Prob/Freq Total% Cut Set Description

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 11 4.05E-9 1.42

SD-M4E-LOIOC : 28

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

3.00E-3

HCS-MOV-FT-SUCTR HPCS SUCTION TRANSFER FAILS

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

5.00E-1

SD-XHE-XR-SDC-12H FAIL TO RECOVER SDC LATE - 12

HRS 12 3.23E-9 1.14

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV35 VENT VALVE FAILS TO OPEN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPBSSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 13 3.23E-9 1.14

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV34 VENT VALVE FAILS TO OPEN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1. Prob/Freq Total% Cut Set Description

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPBSSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 14 3.23E-9 1.14

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV37 VENT VALVE FAILS TO OPEN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPBSSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 15 3.23E-9 1.14

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV36 VENT VALVE FAILS TO OPEN

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE 4

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPBSSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 16 2.89E-9 1.02

SD-M4E-LOIOC : 17

2.70E-1

SD-M4E-LOIOC LOSS OF INVENTORY OUTSIDE CONTAINMENT- M4

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

5.64E-6

DCP-BDC-LP-DII DIVISION

II 125VDC BUS FAILS

1.00E-2

SD-XHE-XD-LOIM4 FAIL TO DIAGNOSE LOI (OC) BEFORE SDC ISOLTATION ON LOW LEVEL - MODE

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

Table 2: LOSDC Event Tree Cut Sets for Case 1 (NOTE: Cut set sequence numbers do not match Figures 3 and 4) # Prob/Freq Total% Cut Set Description 1 2.86E-5 17.44

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 2 1.36E-5 8.29

SD-M4E-LOSDC : 25

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS

1.32E-2

SSW-MDP-TM-PUMPC SSW PUMP C IS UNAVAILABLE BECAUSE OF MAINTENANCE 3 1.24E-5 7.54

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV35 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 4 1.24E-5 7.54

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV34 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 5 1.24E-5 7.54

SD-M4E-LOSDC : 06

1. Prob/Freq Total% Cut Set Description

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV37 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 6 1.24E-5 7.54

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV36 VENT VALVE FAILS TO OPEN

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 7 8.67E-6 5.28

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

3.33E-5

ACP-BAC-LP-DII 4160 V

BUS 16AB HARDWARE FAILURES

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 8 7.01E-6 4.27

SD-M4E-LOSDC : 25

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

6.82E-3

HCS-MDP-TM-HPCS HPCI TRAIN IS UNAVAILABLE BECAUSE OF MAINTENANCE

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS 9 3.79E-6 2.31

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1. Prob/Freq Total% Cut Set Description

1.32E-2

SSW-MDP-TM-PUMPB SSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 10 3.66E-6 2.23

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.41E-5

DCP-BAT-LP-BATTB DIVISION II BATTERIES FAIL

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 11 3.08E-6 1.88

SD-M4E-LOSDC : 25

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

3.00E-3

HCS-MOV-FT-SUCTR HPCS SUCTION TRANSFER FAILS

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6

HRS 12 2.86E-6 1.74

SD-M4E-LOSDC : 31

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-2

SD-XHE-XD-SDC-NOMFAIL TO DIAGNOSE LOSDC BEFORE SDC ISOLATION ON HI PRESSURE - NOMINAL

TIME

1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 13 1.64E-6 1.00

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV36 VENT VALVE FAILS TO OPEN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPB SSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 14 1.64E-6 1.00

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1. Prob/Freq Total% Cut Set Description

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV34 VENT VALVE FAILS TO OPEN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPB SSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 15 1.64E-6 1.00

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV37 VENT VALVE FAILS TO OPEN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPB SSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 16 1.64E-6 1.00

SD-M4E-LOSDC : 06

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E

1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

9.51E-4

CVS-AOV-CC-AV35 VENT VALVE FAILS TO OPEN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D

1.32E-2

SSW-MDP-TM-PUMPB SSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE

M. Haire

A2-28

Table 2: LOSDC Event Tree Cut Sets for Case 2 # Prob/Freq Total% Cut Set Description 1 1.36E-6 10.87

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E 1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-3

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6

HRS1.32E-2

SSW-MDP-TM-PUMPC SSW PUMP C IS UNAVAILABLE BECAUSE OF MAINTENANCE 2 1.36E-6 10.87

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E-4

SD-XHE-XM-REPLC1 MULTIPLE OPERATOR FAILURES < 1.E-06 - 5.0E-07 7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6

HRS1.32E-2

SSW-MDP-TM-PUMPC SSW PUMP C IS UNAVAILABLE BECAUSE OF MAINTENANCE 1.00E+0

XADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 1.00E+0

XSD-XHE-XM-RHR-NOM Fails to establish SDC/SPC cooling (> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 3 1.14E-6 9.10

SD-M4E-LOSDC : 07

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN 1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 4 7.01E-7 5.60

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E6.82E-3

HCS-MDP-TM-HPCS HPCI TRAIN IS UNAVAILABLE BECAUSE OF MAINTENANCE 1.00E-4

SD-XHE-XM-REPLC1 MULTIPLE OPERATOR FAILURES < 1.E-06 - 5.0E-07

1. Prob/Freq Total% Cut Set Description

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS 1.00E+0

XADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 1.00E+0

XSD-XHE-XM-RHR-NOM Fails to establish SDC/SPC cooling (> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 5 7.01E-7 5.60

SD-M4E-LOSDC : 29

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E 1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN

1.00E-3

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 6.82E-3

HCS-MDP-TM-HPCS HPCI TRAIN IS UNAVAILABLE BECAUSE OF MAINTENANCE 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN 7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS6 4.93E-7 3.94

SD-M4E-LOSDC : 07 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 9.51E-4

CVS-AOV-CC-AV37 VENT VALVE FAILS TO OPEN 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 7 4.93E-7 3.94

SD-M4E-LOSDC : 07 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 9.51E-4

CVS-AOV-CC-AV34 VENT VALVE FAILS TO OPEN 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN 5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 8 4.93E-7 3.94

SD-M4E-LOSDC : 07

1. Prob/Freq Total% Cut Set Description

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E 1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 9.51E-4

CVS-AOV-CC-AV36 VENT VALVE FAILS TO OPEN

3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure

1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY

1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 9 4.93E-7 3.94

SD-M4E-LOSDC : 07 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 9.51E-4

CVS-AOV-CC-AV35 VENT VALVE FAILS TO OPEN 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN 5.00E-1

SD-XHE-XM-CVS OPERATOR FAILS TO OPEN CVS VALVE MANUALLY 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 10 3.45E-7 2.76

SD-M4E-LOSDC : 07 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E 3.33E-5

ACP-BAC-LP-DII 4160 V

BUS 16AB HARDWARE FAILURES 1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 11 3.08E-7 2.46

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 1.00E-3

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 3.00E-3

HCS-MOV-FT-SUCTR HPCS SUCTION TRANSFER FAILS 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN

1. Prob/Freq Total% Cut Set Description

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS12 3.08E-7 2.46

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E3.00E-3

HCS-MOV-FT-SUCTR HPCS SUCTION TRANSFER FAILS

1.00E-4

SD-XHE-XM-REPLC1 MULTIPLE OPERATOR FAILURES < 1.E-06 - 5.0E-07

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS 1.00E+0

XADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

1.00E+0

XSD-XHE-XM-RHR-NOM Fails to establish SDC/SPC cooling (> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 13 1.51E-7 1.21

SD-M4E-LOSDC : 07 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.10E-3

SD-XHE-XM-VENT OPERATOR FAILURE TO VENT CONTAINMENT 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 1.32E-2

SSW-MDP-TM-PUMPB SSW PUMP B IS UNAVAILABLE BECAUSE OF MAINTENANCE 14 1.46E-7 1.16

SD-M4E-LOSDC : 07

1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E 1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 1.41E-5

DCP-BAT-LP-BATTB DIVISION II BATTERIES FAIL 3.98E-2

HPCS-SP-SURVIVE HPCS is Available and Survives Containment Failure 1.90E-1

SD-XHE-XR-SDC-3D FAIL TO RECOVER SDC LATE - 3D 15 1.40E-7 1.12

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E+0

ADH-XVM-CC-F483 ADHR HTX F483 (PSW) XVM FAILS TO OPEN 1.00E-3

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 1.00E-1

RHR-MDP-FR-PUMPB RHR PUMP B FAILS TO RUN 7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS

1. Prob/Freq Total% Cut Set Description

1.36E-3

SSW-MDP-FS-PUMPC SSW PUMP C FAILS TO START 16 1.40E-7 1.12

SD-M4E-LOSDC : 29 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E-4

SD-XHE-XM-REPLC1 MULTIPLE OPERATOR FAILURES < 1.E-06 - 5.0E-07

7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6 HRS 1.36E-3

SSW-MDP-FS-PUMPC SSW PUMP C FAILS TO START

1.00E+0

XADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR

1.00E+0

XSD-XHE-XM-RHR-NOM Fails to establish SDC/SPC cooling (> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 17 1.36E-7 1.09

SD-M4E-LOSDC : 60 1.37E+0

SD-M4E-LOSDC LOSS OF SHUTDOWN COOLING - M4E1.00E-3

ADS-XHE-XM-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 1.00E-2

SD-XHE-XD-SDC-NOM FAIL TO DIAGNOSE LOSDC BEFORE SDC ISOLATION ON HI PRESSURE - NOMINAL TIME 7.50E-1

SD-XHE-XR-SDC-6H FAIL TO RECOVER SDC LATE - 6

HRS1.32E-2

SSW-MDP-TM-PUMPC SSW PUMP C IS UNAVAILABLE BECAUSE OF MAINTENANCE

M. Haire

October 20, 2016

MEMORANDUM TO: Mark Haire, Chief Plant Support Branch 1

Division of Reactor Safety

FROM: Troy Pruett, Director

Division of Reactor Projects

SUBJECT: SPECIAL INSPECTION CHARTER TO EVALUATE ALTERNATE DECAY HEAT REMOVAL SYSTEM UNAVAILABILITY AT GRAND GULF NUCLEAR STATION

In response to the unplanned unavailability of the alternate decay heat removal system during the replacement of a residual heat removal pump, a Special Inspection will be performed.

This event revealed weaknesses in the operator fundamentals area associated with configuration control, turnover, risk management, and oversight.

You are hereby designated as the Special Inspection team leader.

The following members are assigned to your team: * David Proulx, Senior Project Engineer, Division of Reactor Projects * Neil Day, Resident Inspector, Division of Reactor Projects

A. Basis

On September 4, 2016, residual heat removal (RHR) train A was declared inoperable due to a failure to meet Technical Specification (TS) Surveillance Requirement (SR) 3.5.1.4 for required pump differential pressure.

On September 8, the licensee completed

a TS-required shutdown in order to replace the pump.

With RHR train A inoperable, TS

3.4.9 and 3.4.10 required that an alternate method of decay heat removal be available in Modes 3 and 4, respectively.

The alternate decay heat removal (ADHR) system was identified as the alternate method of decay heat removal to meet the requirements of TS.

On September 23, prior to placing the ADHR system in operation following replacement of the RHR pump, operators discovered that the cooling water supplies to each of the ADHR heat exchangers from the plant service water (PSW) system were danger tagged closed.

This configuration had been established on August 10, 2016, to isolate the system for power operations.

Following the September 8 shutdown, operators did not properly align the ADHR system for a standby lineup and did not verify that the system was available to meet TS requirements.

Management Directive 8.3, "NRC Incident Investigation Program," was used to evaluate the level of NRC response for this event.

In evaluating the criteria of MD 8.3, it was determined that the event involved concerns pertaining to licensee operational performance.

Specifically, operators failed to recognize that the designated alternate method of decay heat removal was unavailable for a period of 14 days while operating in

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION

IV 1600 E. LAMAR BLVD. ARLINGTON, TX

76011-4511

M. Haire - 2 -

Mode 4.

Licensed operators did not identify the system misalignment that caused the ADHR system to be unavailable until September 23.

The preliminary Estimated Conditional Core Damage Probability was determined to be 9.8 x 10-6.

Based on the deterministic criteria and risk insights related to the unavailability of the

ADHR system, Region IV management determined that the appropriate level of NRC

response was to conduct a Special Inspection.

This Special Inspection is chartered to identify the circumstances surrounding the ADHR event and review the licensee's actions to address the causes of the event.

Additional Operator Performance Concerns On September 24, 2016, an operational performance issue occurred due to a plant configuration control issue.

Prior to opening a main feedwater isolation valve, licensed operators failed to secure long cycle cleanup, resulting in a rapid and unexpected increase in reactor vessel level from 33 inches to 151 inches.

The rapid level increase occurred because licensed operators did not understand the controls for the feedwater isolation valve.

On June 17, 2016, a malfunction in the electro-hydraulic control (EHC) system during turbine stop valve testing caused reactor power and pressure oscillations that resulted in an automatic reactor scram.

Licensed operators did not recognize that EHC control valve fluctuations were reactivity manipulations, and did not recognize that power oscillations should require termination criteria.

Troubleshooting continued for over 40

minutes as power oscillations exceeded 20 percent, which was in excess of the station's 10 percent criteria to scram the reactor for thermal hydraulic instability concerns.

On September 27, 2016, Grand Gulf Nuclear Station plant management notified the

NRC of their intent to delay startup of the plant, following the forced outage, to implement corrective actions to assess and resolve the operational performance concerns.

The timeline for a plant restart is under review by plant leadership while they determine a path forward.

B. Scope The inspection is expected to perform data gathering and fact-finding in order to address the following:

1. Provide a recommendation to Region IV management as to whether the inspection should be upgraded to an augmented inspection team response.

This recommendation should be provided by the end of the first day on site.

2. Develop a complete sequence of events related to the unavailability of the ADHR system that was discovered on September 23, 2016.

The chronology should include plant mode changes as well as the status of plant decay heat removal systems.

3. Review the licensee's root cause analysis efforts and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the problem.

M. Haire

4. Determine the probable causes for the unavailability of the ADHR system during this forced outage.

5. Evaluate the licensee's actions with regard to compliance with applicable technical specification requirements.

Specifically, evaluate the licensee's actions to verify that an alternate method of decay heat removal was available, both initially as well as daily, during the time period in question.

6. Review the licensee's cause evaluation efforts for the configuration control event that resulted in a rapid and unexpected increase in reactor vessel level on September 24, 2016, and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the problem.

7. Determine whether there were any deficiencies in operator training that contributed to the ADHR unavailability or feedwater control events.

8. Evaluate the licensee's compliance with, and adequacy of, procedural guidance for performing system alignments, and for performing equipment tag-outs, as it pertains to the cause(s) of these events.

9. Determine whether the licensee's processes for shutdown risk management and plant configuration control were appropriate, including supervisory oversight from operations personnel and the outage control center (OCC).

10. Review actions taken or planned by the licensee to evaluate and develop plans to address gaps in operations performance at the station, as evidenced by recent events discussed in this charter.

11. Review licensee corrective action plan(s) in place prior to recent events in areas of operator fundamentals.

Assess whether previous corrective actions in areas that contributed to recent events were appropriate, completed, and/or effective.

2. Determine whether applicable internal or external operating experience involving configuration management of the ADHR system existed, and assess the effectiveness of any action(s) taken by the licensee in response to any such operating experience.

13. Evaluate the licensee's actions to comply with reporting requirements associated with this event.

14. Collect data necessary to support completion of the significance determination process for any associated finding(s).

C. Guidance

Inspection Procedure 93812, "Special Inspection," provides additional guidance to be used by the Special Inspection Team.

Your duties will be as described in Inspection Procedure 93812.

The inspection should emphasize fact-finding in its review of the circumstances surrounding the event.

It is not the responsibility of the team to examine

M. Haire - 4 - the regulatory process.

Safety concerns identified that are not directly related to the event should be reported to the Region IV office for appropriate action.

You will formally begin the Special Inspection with an entrance meeting to be conducted no later than October 31, 2016.

You should provide a daily briefing to Region IV

management during the course of your inspections and prior to your exit meeting.

A report documenting the results of the inspection should be issued within 45 days of the completion of the inspection.

This Charter may be modified should you develop significant new information that warrants additional review.

CONTACT: Greg G. Warnick, Chief, DRP Branch C

817-200-1144