IR 05000416/2016008

NRC Special Inspection Report 05000416/2016008. Additional Document Associated with the This Report Located at ML17304A014

ML17303B200
Person / Time
Site:	Grand Gulf
Issue date:	10/27/2017
From:	Jason Kozal NRC/RGN-IV/DRP/RPB-C
To:	Emily Larson Entergy Operations
AMT JKozal
Shared Package
ML17303B150	List: IR 05000416/2016008
References
EA-16-277 IR 2017008
Download: ML17303B200 (65)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 1600 E. LAMAR BLVD ARLINGTON, TX 76011-4511 October 27. 2017 EA-16-277

Mr. Eric Larson, Site Vice President Entergy Operations, Inc.

Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150

SUBJECT: GRAND GULF NUCLEAR STATION - NRC SPECIAL INSPECTION REPORT 05000416/2016008

Dear Mr. Larson:

On October 6, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of configuration control problems, including the unplanned unavailability of the alternate decay heat removal system during the replacement of a residual heat removal pump, which occurred between September 9, 2016 and September 22, 2016, at your Grand Gulf Nuclear Station. Based on this initial assessment, the NRC sent a special inspection team to your site on October 31, 2016.

On May 31, 2017, the NRC completed its special inspection and discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented three findings of very low safety significance (Green) in this report.

All of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Grand Gulf Nuclear Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the Grand Gulf Nuclear Station. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding.

"

Sincerely,

/RA/

Jason Kozal, Chief

Project Branch C

Division of Reactor Projects

Docket No. 50-416 License No. NPF-29

Enclosure: Inspection Report 05000416/2016008 w/ Attachments:

1. Supplemental Information 2. Detailed Risk Evaluation 3. Special Inspection Charter

ML17303B200 SUNSI Review ADAMS: Non-Publicly Available Non-Sensitive Keyword: By: JKozal/dll Yes No Publicly Available Sensitive NRC-002 OFFICE RI:DRP/C SPE:DRP/B SRA:DRS/PSB2 C:DRS/PSB1 TL: ACES SPE:DRP/C NAME NDay DProulx DLoveless MHaire MHay CYoung SIGNATURE /RA/ /RA/ /RA/ /RA/ /RA/ /RA/ DATE 5/2/2017 5/1/2017 5/5/2017 5/4/2017 4/27/2017 4/27/2017 OFFICE C:DRP/C C:DRP/C D:DRP Non-Concurrence Approver NAME GWarnickJKozal TPruett KKennedy Non-Concur SIGNATURE

/RA/ /RA/ /RA/ /RA/ DATE 5/8/2017 10/27/2017 8/4/2017 10/27/2017

1 Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 05000416 License: NPF-29 Report: 05000416/2016008 Licensee: Entergy Operations, Inc. Facility: Grand Gulf Nuclear Station, Unit 1 Location: 7003 Baldhill Road Port Gibson, MS 39150 Dates: October 31, 2016 through May 31, 2017 Team Leader: Mark Haire, Chief, Plant Support Branch 1 Inspectors: David Proulx, Senior Project Engineer Neil Day, Resident Inspector David Loveless, Senior Reactor Analyst Approved By: Jason Kozal, Chief Project Branch C

Division of Reactor Projects

2

SUMMARY

IR 05000416/2016008; 10/31/2016 - 5/31/2017; Grand Gulf Nuclear Station; Special Inspection.

The inspection activities described in this report were performed between October 31, 2016, and May 31, 2017, by the resident inspector at Grand Gulf Nuclear Station and two inspectors from the NRC's Region IV office. Three findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green,

White, Yellow, or Red), determined using Inspection Manual Chapter 0609, "Significance Determination Process," dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects within the Cross-Cutting Areas," dated December 4, 2014. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," dated July 2016.

Cornerstone: Initiating Events

Green.

The team identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to have adequate procedures for activities affecting quality. Specifically, Grand Gulf Nuclear Station failed to have adequate procedures for feedwater, condensate, and shutdown cooling activities. The licensee implemented corrective actions to revise the procedures.

The licensee entered this issue into their corrective action program as Condition Reports CR-GGN-2016-08334, 08273, and 08290.

The failure to have adequate procedures for activities affecting quality was a performance deficiency. Example (1) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not having procedural guidance for the alternate decay heat removal system alignment resulted in misalignment of the system and its subsequent inability to perform its required function if needed. A detailed risk evaluation (Attachment 2)calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year, which has a very low safety significance (Green). Example (2) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown operations.

Specifically, not having procedural guidance for feedwater isolation valve operation resulted in inadvertent overfill of the reactor vessel. This violation is associated with a finding having very low safety significance (Green). The team did not assign a cross-cutting aspect because the performance deficiency was not reflective of current plant performance.

(Section 4OA3)

3

Cornerstone: Mitigating Systems

Green.

The team reviewed a self-revealed, non-cited violation of Technical Specification 3.4.10, "Residual Heat Removal Shutdown Cooling System - Cold Shutdown," for the licensee's failure to verify an alternate method of decay heat removal was available when residual heat removal subsystem A was inoperable and unavailable due to a pump replacement. Specifically, the licensee inappropriately credited the alternate decay heat removal system as an available alternate method of decay heat removal. Credit for this system was inappropriate because, although the licensee believed the system had been aligned in standby, the alternate decay heat removal heat exchanger isolation valves had remained tagged closed, rendering the system unavailable to satisfy the technical specification requirement during the time period that residual heat removal subsystem A was unavailable. The licensee restored compliance by restoring residual heat removal subsystem A to available status. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-07281.

The failure to perform the required action to verify an alternate method of decay heat removal was available, when a residual heat removal shutdown cooling system was inoperable, was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year. Therefore, this violation is associated with a finding having very low safety significance (Green). The team determined the finding had a cross-cutting aspect within the human performance area, field presence, because leaders failed to reinforce standards and expectations in the work areas of the plant [H.2]. (Section 4OA3)

Green.

The team identified a non-cited violation of Technical Specification 5.4.1.a, "Procedures," for the licensee's failure to implement procedures required by Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Specifically, contrary to procedures, on September 23, 2016, operations personnel failed to verify adequate plant service water flow to the alternate decay heat removal heat exchangers while placing the system in service. The licensee implemented corrective actions which included high intensity training to improve nuclear worker behaviors and clarifying the directions in the procedure. The licensee entered this issue into the corrective action program as Condition Report CR-GGN-2016-08333.

The failure to implement procedures, as required by Technical Specification 5.4.1.a, was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because, if left uncorrected, the failure to implement procedures as required by Technical Specification would have the potential to lead to a more significant safety concern. Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process," and Inspection Manual Chapter 0609, Appendix G, Attachment 1,

"Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings," the team determined that the finding was of very low safety significance (Green) because it did not affect the design or qualification of a mitigating system structure, system, or component and did not directly prevent the alternate decay heat removal system from maintaining its functionality. The team identified a cross-cutting aspect the area of human performance, challenge the unknown, because individuals failed to stop when faced with uncertain conditions and risks were not evaluated and managed before proceeding [H.11]. (Section 4OA3)

=

Licensee-Identified Violations===

None 5

REPORT DETAILS

4OA3 Follow-up of Events and Notices of Enforcement Discretion Review of Events Surrounding Unavailability of Alternative Decay Heat Removal System On September 4, 2016, the residual heat removal (RHR), subsystem A was declared inoperable due to a failure to meet Technical Specification (TS) Surveillance Requirement (SR) 3.5.1

.4 for required pump differential pressure. On September 8, 2016, the licensee completed a TS-required shutdown in order to replace the pump. With the plant in Mode 4 and RHR subsystem A inoperable, TS 3.4.10, Action A.1, required that an alternate method of decay heat removal be available. On September 9, 2016, the alternate decay heat removal (ADHR) system was inappropriately credited for compliance with TS 3.4.10, Action A.1, when licensee personnel removed RHR subsystem A from service for maintenance (making it inoperable and unavailable for decay heat removal). Operations personnel believed ADHR was properly aligned in standby mode to serve as the required alternate means of decay heat removal, but because the cooling water supplies to each of the ADHR heat exchangers from the plant service water (PSW) system were danger tagged closed (valves P44F481A, P44F481B, P44F482A, and P44F482B), the ADHR system was not actually in standby or available to satisfy TS 3.4.10. The RHR subsystem A pump was replaced, retested, and returned to available status on September 22, 2016. Therefore, Grand Gulf Nuclear Station failed to comply with TS 3.4.10, Action A.1, since RHR subsystem A was unavailable, and the ADHR system was misaligned/

unavailable, from September 9, 2016, until September 22, 2016.

The unavailability of the ADHR system was discovered on September 23, 2016, prior to placing the ADHR system in operation following replacement of the RHR pump. At that time, operations personnel discovered that the cooling water supplies to each of the ADHR heat exchangers from the PSW system were danger tagged closed. This configuration had been established on August 10, 2016, in order to isolate the system for power operations. Following the September 8, 2016, shutdown, operations personnel did not properly align the ADHR system for a standby lineup and did not verify that the system was available to meet TS requirements.

Management Directive (MD) 8.3, "NRC Incident Investigation Program," was used to evaluate the level of NRC response for this event. In evaluating the criteria of MD 8.3, it was determined that the event involved concerns pertaining to licensee operational performance. Specifically, operations personnel failed to recognize that an alternate method of decay heat removal was unavailable for a period of 13 days while operating in Mode 4 with one train of the RHR system inoperable. Based on the best available information at the time, the preliminary estimated conditional core damage probability was determined to be 9.8E-6/year.

Based on the deterministic criteria and risk insights related to the unavailability of the ADHR system, NRC Region IV management determined that the appropriate level of NRC response was to conduct a special in spection. This special inspection was chartered to identify the circumstances surrounding the ADHR event and review the licensee's actions to address the causes of the event.

Additional Operator Performance Concerns Several other operator performance events influenced the scope of the special inspection charter. These additional events included:

• On June 17, 2016, a malfunction in the electro-hydraulic control (EHC) system during turbine stop valve testing caused reactor power and pressure oscillations that resulted in an automatic reactor scram. Licensed operations personnel did not recognize that EHC control valve fluctuations were reactivity manipulations, and did not recognize that power oscillations should require termination criteria. Troubleshooting continued for over 40 minutes as power oscillations exceeded 20 percent, which was in excess of the station's 10 percent criteria to scram the reactor for thermal hydraulic instability concerns.

• On September 24, 2016, an operational performance issue occurred due to a plant configuration control issue. Prior to opening a main feedwater isolation valve, licensed operations personnel failed to secure a long cycle cleanup alignment of the condensate system, resulting in a rapid and unexpected increase in reactor vessel level from 33 inches to 151 inches. The rapid level increase occurred because licensed operations personnel did not anticipate the system response to opening a main feedwater isolation valve while in the long cycle cleanup alignment.

• On September 27, 2016, Grand Gulf Nuclear Station plant management notified the NRC of their intent to delay startup of the plant, following the forced outage, to implement corrective actions to assess and resolve the plant's operational performance concerns. The plant restart was delayed until January 31, 2017, while corrective actions were implemented in the areas of operator fundamentals, conservative decision-making, procedure quality, and the material condition of plant equipment.

a. Inspection Scope

The special inspection team performed data gathering and fact-finding to address the following items from the inspection charter (Attachment 3):

1. Provide a recommendation to Region IV management as to whether the inspection should be upgraded to an augmented inspection team response. This recommendation should be provided by the end of the first day on site.

An augmented inspection team was not warranted. The scope of and expertise utilized in the special inspection was adequate to review this event.

2. Develop a complete sequence of events related to the unavailability of the ADHR system that was discovered on September 23, 2016. The chronology should include plant mode changes as well as the status of plant decay heat removal systems.

August 10, 2016 - The licensee performed planned maintenance on the ADHR system. For this activity, the PSW supply to ADHR heat exchanger valves (P44F481A and P44F481B) and ADHR heat exchanger return to PSW valves 7 (P44F482A and P44F482B) were closed and danger tagged per tagout P44-002-1E12B003A/B. Although the planned maintenance was completed on August 15, 2016, these valves were not reopened until September 27, 2016.

September 4, 2016, 2:58 a.m. - The licensee entered TS 3.5.1, Action A, because the RHR subsystem A failed its quarterly surveillance test for required pump differential pressure. Although the pump was not able to maintain the required differential pressure for operability for its emergency core cooling function, the pump remained capable of delivering sufficient flow to support its decay heat removal function, and therefore the system remained available as an alternate means of decay heat removal.

September 8, 2016, 11:04 a.m. - The licensee manually scrammed the reactor for a planned shutdown to conduct repairs to RHR subsystem A. The licensee entered Mode 3.

September 8, 2016, 5:45 p.m. - The licensee entered TS 3.4.9, Condition A, due to RHR subsystem A being inoperable in Mode 3 with reactor steam dome pressure less than the RHR cut in permissive pressure. The required action, verify an alternate method of decay heat removal is available, was satisfied because RHR subsystem A was still available and capable of providing decay heat removal.

September 9, 2016, 3:32 a.m. - The licensee placed RHR, subsystem B, into shutdown cooling operation.

September 9, 2016, 4:39 a.m. - The ADHR system was in isolate mode due to a PSW system tagout (E12-021-ADHR ISOLAT). This tagout was separate from the tagout that was hung on August 10, 2016 (P44-002-1E12B003A/B). The tagout for ADHR isolate mode (E12-021-ADHR ISOLAT) was removed, but the PSW supply and return to the ADHR heat exchangers remained tagged closed (tagout P44-002-1E12B003A/B).

September 9, 2016, 5:09 a.m. - Operations personnel cooldown the plant to Mode 4 and exit TS 3.4.9, Condition A, which is not applicable in Mode 4. The licensee entered TS 3.4.10, Condition A, due to RHR subsystem A being inoperable in Mode

4. The required action was satisfied because RHR subsystem A was still available and capable of providing decay heat removal. The recurring action of verifying the system is available once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was done administratively by operations personnel verifying that no work or other manipulations were made to RHR

subsystem A.

September 9, 2016, 5:42 p.m. - The tagout for ADHR isolate mode had been cleared, but the ADHR heat exchanger isolation valves were still danger tagged closed from the August 10 PSW tagout, which prevented cooling water flow through the ADHR heat exchangers. Nonlicensed operations personnel who were aligning the system to standby noticed there were valves in the ADHR room with danger tags on them, but they did not recognize that t he valves were important to ADHR system operation and did not communicate to the control room the fact that danger tagged valves remained in the ADHR room.

8 September 9, 2016, 6:10 p.m. - RHR subsystem A was removed from service for a pump replacement. At this point, ADHR was unavailable due to the tagged closed heat exchanger isolation valves. The licensee operations personnel believed ADHR had been placed in standby alignment per Section 4.6 of Procedure 04-1-01-E12-2, "Shutdown Cooling and Alternate Decay Heat Removal Operation," Revision 119.

Operations staff inappropriately designated the ADHR system as the alternate

method of decay heat removal to satisfy the actions of TS 3.4.10, Condition A. RHR subsystem B was operable and in-service providing decay heat removal for the

reactor. September 22, 2016, 6:47 p.m. - Following pump replacement, RHR subsystem A was tested, and pump flow and discharge pressures showed that the system was capable of supplying shutdown cooling, if needed. At this time, RHR subsystem B was in operation for shutdown cooling, and RHR subsystem A was available as an alternate means of decay heat removal to satisfy the actions of TS 3.4.10, Condition A. RHR subsystem A was not yet declared operable.

September 22, 2016, 8:00 p.m. - The licensee made an operation's log entry

discussing shutdown risk and the status of RHR subsystem A as available but not operable.

September 22, 2016, 8:26 p.m. - RHR subsystem A passed its post-maintenance (pump replacement) test, but the licensee did not declare the system operable because they first wanted to remove all maintenance equipment from the area.

September 23, 2016, 2:26 p.m. - The licensee removed RHR subsystem B from shutdown cooling operation in order to perfo rm TS Surveillance Requirement 3.5.1.4 on the subsystem as an extent of condition evaluation based on the previous degradation of RHR subsystem A. The licensee attempted to place the ADHR

system into service for shutdown cooling operation to satisfy the actions of TS 3.4.10, Condition A, with the RHR subsystem A serving as the alternate source of decay heat removal.

September 23, 2016, 3:03 p.m. - While attempting to place the ADHR system into service for shutdown cooling operation, the licensee discovered that the PSW supply to ADHR heat exchanger valves (P44F481A and P44F481B) and ADHR heat exchanger return to PSW valves (P44F482A and P44F482B) were closed and danger tagged, rendering ADHR unavailable to provide decay heat removal. The

licensee decided to restore shutdown cooling using RHR subsystem B. Operators recognized that the ADHR system had not been in the appropriate configuration to be considered available for decay heat removal as previously believed.

September 24, 2016, 3:40 a.m. - The licensee declared RHR subsystem A operable and exited TS 3.4.10, Condition A since both subsystems of RHR were operable.

September 28, 2016, 6:31 p.m. - The licensee restored the ADHR system to the appropriate standby configuration.

3. Review the licensee's root cause analysis efforts and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the

problem.

Condition Report (CR) CR-GGN-2016-07281 was characterized as a Category B condition report. This characterization required an apparent cause evaluation (ACE), which is a second-tier evaluation, rather than a root cause evaluation, which is a top-tier and more probing/extensive evaluation. The team reviewed the licensee's screening process in Procedure EN-LI-102, "Corrective Action Program,"

Revision 27. The team noted that the general discussion section of the screening criteria defines a "Significance Category A" [significant condition adverse to quality (SCAQ) - requiring corrective actions to prevent repetition] as follows: "Adverse Conditions with high significance due to high risk, high actual or potential consequences." The team noted that the unavailability of ADHR event discussed in CR-GGN-2016-07281 resulted in an inadvertent and unrecognized entry into "Orange Risk," or high risk significance, as defined in the licensee's outage safety plan. The licensee, however, did not consider this a high-risk event because their initial

risk assessment for the event yielded a core damage probability of less than 1E-6/year. In addition, the chart of examples for the screening criteria contained in 9.1 of Procedure EN-LI-102 required screening events or conditions that resulted in a complete loss of safety function or a greater than Green finding as a Category A (SCAQ). TS violations and reportable events were listed as examples of a Category B CR, requiring an ACE. The unavailability of the ADHR system was reported in a licensee event report as a violation of TS 3.4.10. Thus, the licensee screened CR-GGN-2016-07281 as a Category B, as allowed by their procedure.

However, given the complexity and multiple barriers that failed leading to the extended unavailability of ADHR, the team determined that the rigor associated with a root cause evaluation would be the appropriate level of review. Given the definition of a Category A CR, Procedure EN-LI-102 allowed the licensee the latitude to conduct a root cause evaluation instead of an ACE.

Through interviews with the involved operating crews, the team identified details that the licensee did not have in their caus al evaluation. For example, crews communicated that some processes that could have prevented this event were considered as infrequently used recommendations and not requirements (e.g. use of "potential LCOs," return to service checklists, and caution tagging abnormal alignments). Also, the team learned through interviews that operators vented the ADHR heat exchangers to the floor adjacent to a contaminated area when they had no indication of ADHR flow, a minor violation of their general operating procedures and the applicable radiation work permit.

Overall, the licensee's ACE for the ADHR unavailability determined that the apparent cause was inadequate fundamental work practices exhibited by operations personnel for configuration control of the ADHR system. A contributing cause was listed as insufficient detail in the system and plant operating procedures. The team agreed that these were the likely apparent and contributing causes. Since this was an ACE, no corrective actions to preclude repetition were required per procedure. The licensee's key corrective actions for the apparent cause were the high intensity training for operator fundamentals and issuance of Standing Order 16-021 (interim until proceduralized), which reiterated management expectations for safe operator

practices.

10 By the end of the on-site inspection, the licensee indicated that they had decided to conduct a formal root cause evaluation of the event. The licensee determined root causes to be inconsistent reinforcement of nuclear professional behaviors in the operators and insufficient detail in operating procedures.

4. Determine the probable causes for the unavailability of the ADHR system during this forced outage.

As stated above, the licensee determined root causes to be inconsistent reinforcement of nuclear professional behaviors in the operators and insufficient detail in operating procedures. Inconsistent nuclear professional behaviors included procedure adherence, cognizance of over all system status, use of recommended operator guidance, proceeding in the face of uncertainty, inadequate pre-evolution briefings, inadequate turnover, and inadequate plant tours.

5. Evaluate the licensee's actions with regard to compliance with applicable TS requirements. Specifically, evaluate the licensee's actions to verify that an alternate method of decay heat removal was available, both initially as well as daily, during the time period in question.

As described above, on September 9, 2016, at 5:42 p.m., Grand Gulf Nuclear Station

erroneously concluded they had placed the ADHR system in a standby configuration to satisfy the TS requirement to verify the availability of an alternate means of decay heat removal.

The recurring TS action to verify the system was available once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was done administratively by operations personnel verifying no work, or other manipulations, were made to the ADHR system. No walk-downs of the ADHR system, or support systems, to determine appropriate configuration were done, or procedurally required, to comply with the recurring action of TS 3.4.10, Condition A. A non-cited violation associated with the failure to comply with TS 3.4.10 is described in Section 4OA3.b.1 of this report.

6. Review the licensee's cause evaluation efforts for the configuration control event that resulted in a rapid and unexpected increase in reactor vessel level on September 24, 2016, and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the problem.

The team noted that CR-GGN-2016-07280, which discussed the rapid reactor vessel overfill event of September 24, 2016, was also designated as a Category B CR, requiring an ACE to determine the cause. The team reviewed Procedure EN-LI-102 to determine if this designation was appropriate to the issue. The licensee determined that this issue would likely screen as a Green issue (very low safety significance), and thus, would meet the licensee's threshold for a Category B CR.

The team determined that this appeared to be the appropriate classification commensurate with the significance.

The licensee performed a barrier analysis that identified several barriers that broke down and contributed to the event. The listed barriers that failed were as follows:

11 a) Procedure 04-1-01-E12-2, "System Operating Instruction Shutdown Cooling and Alternate Decay Heat Removal Operation," Revision 120, was not written with the recognition that opening the feedwater isolation valve B21F065B could result in injection into the vessel if manipulated while the plant was in the long cycle cleanup alignment. The steps required for removing one train of residual heat removal from service restored the system to normal standby lineup, opening valve B21F065B. Following this procedure while the plant is in the long cycle cleanup alignment caused a reactor vessel overfill. No caution or alternative step existed for removing a train of RHR from service while long cycle cleanup was in service. b) Procedure 04-1-01-N21-1, "Long Cycle Cleanup," contained no direction to hang caution or danger tags on valve B21F065B to alert or prevent operations personnel from opening these valves while in the long cycle cleanup alignment to prevent inadvertently filling the vessel. c) Operators did not consider the interaction between the RHR system and the feedwater system. During planning for the evolution, operations personnel only referenced RHR system diagrams/prints and not interfacing systems (such as the feedwater and condensate systems, etc.) while walking through the procedure. d) The pre-shift brief was conducted by supervisory personnel, which inhibited their ability to remain in an oversight role during the briefing process. The pre-evolution brief did not include the potential effects on other systems, or overall status of the plant. The at-the-controls operator was also not included during the briefing. e) A contributor to the severity of the event was that operations personnel did not understand the full function of the operating modes of valve B21F065B. The valve has three push buttons: "OPEN," "CLOSE," and "STOP." Operators did not understand that valve movement could be interrupted mid-stroke by pushing the STOP button. This functionality was covered in training material, but not emphasized in training and not practiced in the simulator because no station procedures direct the use of the STOP button on this valve. The operator attempted to mitigate the event by depressing the CLOSE button several times, which had no effect until the valve stroked fully open. Based on simulator runs afterwards, had operators understood the function of the STOP pushbutton, the maximum level would have been approximately +78 inches vs. +151 inches. The licensee identified two apparent causes of the September 24, 2016, reactor vessel overfill. The first apparent cause, related to the failure to consider system interactions and lack of independent supervisory oversight, was inadequate knowledge or skill resulting in tunnel vision. The second apparent cause was inadequate procedural barriers.

In 2008, a similar inadvertent vessel overfill event occurred by opening valve B21F065B while in long cycle cleanup during inservice testing (IST). The corrective actions only revised the IST procedure to prevent performing this surveillance test during long cycle cleanup. The team considered this a missed opportunity to add a 12 precaution to the long cycle cleanup procedure or any other interfacing system's procedures to tag or otherwise prevent operation of the valve when inappropriate.

7. Determine whether there were any deficiencies in operator training that contributed to the ADHR unavailability or feedwater control events.

The team concluded that training was not a direct cause to these events. However, training may have contributed to these events. For example:

a) As discussed in Item 6 above, operations personnel were not fully trained on the function of the "STOP" push-button associated with valve FO-65A/B. This lack of training allowed reactor vessel level to rise uncontrollably to 151 inches. b) Operations personnel were not trained to review interfacing system tagouts when verifying system operability. This lack of training contributed to the failure to recognize, for 13 days, that the ADHR system was unavailable because the cooling water supplies to each of the ADHR heat exchangers from the PSW system were danger tagged closed. 8. Evaluate the licensee's compliance with, and adequacy of, procedural guidance for performing system alignments and for perform ing equipment tag-outs, as it pertains to the cause(s) of these events.

Following a previous forced outage on August 10, 2016, Grand Gulf Nuclear Station performed planned maintenance on the ADHR syst em. For this activity, the PSW supply to ADHR heat exchanger valves (P44F481A and P44F481B) and ADHR heat exchanger return to PSW valves (P44F482A and P44F482B) were closed and danger tagged per tagout P44-002-1E12B003A/B. Although the planned maintenance was completed on August 15, 2016, an individual failed to release this tagout by certifying work was complete. Procedure EN-OP-102, "Protective and Caution Tagging," Revision 18, Section 5.3.15 [5], states, "in the work order status window place a check in the work complete box for work orders that you are responsible for that no longer requires this tagout." The team noted that if the individual had certified work complete on this tagout at the appropriate time, in accordance with Procedure EN-OP-102, operations personnel may have opened the misaligned PSW valves in August 2016, which would have prevented the subsequent ADHR unavailability event.

Furthermore, the planned maintenance work was determined to be complete, and the work was closed out as complete in the work management computer program, on August 30, 2016. The team noted that, if the Mechanical Maintenance Supervisor would have appropriately checked the work order and the referenced tagouts before closing the item out in the work management computer program, he would have noted the active tagout. The work order should not have been changed to complete status in the work management software until the tagout was cleared.

Since tagout P44-002-1E12B003A/B was for the PSW system and Section 4.6 of Procedure 04-1-01-E12-2, "System Operating Instruction Shutdown Cooling and Alternate Decay Heat Removal Operation," Revision 120, does not discuss the correct alignment of these four valves, the tagout was not cleared and the valves were not opened during ADHR system alignments. The team concluded 13 Procedure 04-1-01-E12-2 was inadequate because it failed to direct verification that the PSW supply to ADHR heat exchanger valves were opened. A non-cited violation associated with this procedure inadequacy is described in Section 4OA3.b.2 of this report. 9. Determine whether the licensee's processes for shutdown risk management and plant configuration control were appropriate, including supervisory oversight from operations personnel and the outage control center (OCC).

a) Shutdown Risk Management: Grand Gulf Nuclear Station used "Shutdown Operations Protection Plan" (SOPP), Revision 19, for the forced outage to replace RHR pump A. The team reviewed the document, with a focus on the risk and mitigation of risk for SOPP, Condition 1, decay heat removal systems. The SOPP transitions from a traditional quantitative risk assessment to a qualitative outage risk assessment at reactor Mode 4. Per analysis and documentation of the SOPP, the team noted that the risk program and plan were appropriate and were documented before the outage began on September 8, 2016.

During shutdown activities, the licensee utilizes the SOPP in order to establish guidelines to address plant operational conditions in Mode 4 (Cold Shutdown), Mode 5 (Refuel), and in the defueled condition.

Section V of the SOPP discusses and defines different operational conditions and what equipment is needed to determine the plant risk impact. Decay heat

removal is one element of the SOPP.

Reactor Mode 4 correlates to SOPP, Condition 1. Specifically, the decay heat removal methods during SOPP, Condition 1, are: RHR A, RHR B, ADHR, and reactor water cleanup (RWCU) (demonstrated or calculated). Green risk is defined as having three methods available. Yellow risk is defined as having two methods available. Orange risk is defined as having one method available. Red risk is defined as having zero methods available.

Before every outage, the licensee performs analyses to determine core decay heat loads and how and when each method of decay heat removal is available for consideration in the risk analysis. For Revision 19 of the SOPP, the ADHR system and RWCU (together) were available as a decay heat removal method approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after plant shutdown. Furthermore, the ADHR system (by itself) was determined to be available approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after plant

shutdown.

The ADHR system is considered an availabl e system when it is placed in the standby mode, per Procedure 04-1-01-E12-2, "System Operating Instruction for Shutdown Cooling and Alternate Decay Heat Removal." However, the ADHR system does not begin to remove decay heat until it is placed in reactor pressure vessel cooling mode, per Procedure 04-1-01-E12-2. It takes plant operators approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 15 minutes (when it is an unplanned transition such as during a loss of shutdown cooling) to transition the ADHR system from standby to reactor pressure vessel cooling mode.

14 For the first several days following the start of an outage, the time to 200 degrees Fahrenheit (Mode 3) from the onset of a loss of shutdown cooling is typically less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 15 minutes. Furthermore, the ADHR system is not designed to be used during Modes 1, 2, or 3. Entergy Procedure EN-OU-108, "Shutdown Safety Management Program," Revision 8, Section 3.0,[1], discusses what is needed for an available system. This section states, "Credit may be taken for reasonable actions both in the Control Room and in-plant. A reasonable action would include an operator closing a breaker outside of the control room. Actions with implementing time approaching the time to boil are not reasonable."

The team noted that, under certain circumstances (shortly after shutdown), the

SOPP allowed the licensee to improperly credit the ADHR system as one of the systems available as an alternative means of decay heat removal. Credit for ADHR under those circumstances would be improper because it takes too long to place the system in service when the transition is unplanned. The team, however, was unable to identify occurrences during past outages where the ADHR system was placed in the standby mode, per Procedure 04-1-01-E12-2, and the licensee's inappropriate crediting of the system resulted in an actual plant risk configuration that was higher than planned. Therefore, the team identified a minor violation of 10 CFR 50.65(a)(4), for the failure to appropriately assess and manage the risk of the decay heat removal safety function for shutdown conditions. Specifically, the SOPP considered the ADHR system available and credited for risk reduction during conditions (shortly after shutdown)when the ADHR system was not capable of being placed in service before the plant decay heat would have caused the plant to return to Mode 3 following a loss of shutdown cooling (Mode 3 conditions are beyond the capability of the ADHR system). This minor violation has been entered into the licensee's corrective action program as Condition Report CR-GGN-2017-00263.

b) Plant Configuration Control: On September 24, 2016, operations personnel opened valve B21F065B per Procedure 04-1-01-E12-2 while securing RHR, subsystem B, in the shutdown cooling configuration. The result was the inadvertent fill of the reactor vessel with approximately 24,000 gallons of water.

The reactor water level was approximately 33 inches on the narrow range at the beginning of the evolution, and the maximum level was 151 inches on the upset range. The team noted that this event revealed planning, team work, communication, and equipment alignment issues between OCC and main control room operations personnel.

10. Review actions taken or planned by the licensee to evaluate and develop plans to address gaps in operations performance at the station, as evidenced by recent events discussed in this charter.

The licensee's evaluation and training plan for operators was still under development during the on-site inspection and was not available for team to review. However, subsequent reviews of the licensee's high intensity training during baseline

inspection activities documented in NRC Inspection Reports 05000416/2016004 (ADAMS Accession No. ML17039B078) and 05000416/2017009 (ADAMS Accession No. ML17074A265) showed that the training addressed operator performance gaps

and fundamental behaviors.

15 11. Review licensee corrective action plan(s), in place, prior to recent events in areas of operator fundamentals. Assess whether previous corrective actions in areas that contributed to recent events were appropriate, completed, and/or effective.

None of the corrective action plans from previous recent events were in place, such

that they had an opportunity to prevent the September 2016 events. Some of the planned corrective actions could have helped prevent the September 2016 events, but they were not scheduled to have been completed until early 2017.

Corrective actions from the June 17, 2016, EHC event would have been germane to the performance issues observed in September 2016, but had not been implemented prior to the September 2016 events. Of note was planned training focused on conservative decision-making and improved co ntrol room communications. From the root cause evaluation for the June 2016 event:

a) Root

Cause:

inadequate guidance on conservative decision-making when procedures are not adequate for the circumstance. b) Contributing

Cause:

poor communication in the control room. c) These areas of weakness appear to have contributed to the September 2016 events, since procedures were inadequate and operations personnel did not make conservative decisions (procedure inadequacies and failure to properly follow procedures are noted in the findings below). In addition, there was ineffective communication on September 9, 2016, when the operators in the field observed the danger tags hanging on the valves in the ADHR room and notified the control room, but did not use effective communication practices to ensure control room personnel heard and understood the observation.

12. Determine whether applicable internal or external operating experience involving configuration management of the ADHR system existed, and assess the effectiveness of any action(s) taken by the licensee in response to any such operating experience.

The team researched applicable internal and external operating experience to determine if corrective actions from previous events could have prevented the issues reviewed by this special inspection. Two applicable events were identified and the team concluded that both events constituted missed opportunities for the licensee to have implemented actions that might have prevented or mitigated the ADHR system configuration management problems experienced in September 2017.

a) The licensee had a missed opportunity to prevent the vessel overfill event because a similar event occurred during inservice testing in 2008 (discussed in Item 6 above), as discussed in Condition Report CR-GGN-2008-06110. On

October 20, 2008, with the plant in long cycle cleanup, the licensee performed inservice testing of valve B21F065B, in accordance with Procedure 06-OP-1B21-C-0003, "In-service Testing of Feedwater System Valves," Revision 112. Operations personnel were not aware of system status, and thus, reactor vessel level rapidly increased. In this case, however, the operator depressed the STOP pushbutton immediately to stop the valve stroke, and closed valve B21F065B to minimize the reactor vessel level increase.

16 Corrective actions added a precaution to Procedure 06-OP-1B21-C-0003 to ensure long cycle cleanup is secured prior to performing inservice testing, but did not require caution tags or add a similar precaution to any other applicable procedures that could possibly stroke valve B21F065B while the plant was in long cycle cleanup. b) A 1997 event at River Bend Station involved initiation of the alternate decay heat removal system (addressed in Grand Gulf Nuclear Station's interoffice memorandum GIN 1999-01279). The River Bend licensee made an inadvertent mode change to Mode 3 and developed saturation conditions in the reactor vessel while attempting to establish ADHR. Operations personnel were not cognizant that the calculated time to boil from the onset of a loss of shutdown cooling was less than the time required to implement the procedure to establish ADHR. Though not related directly to this event, the Grand Gulf Nuclear Station SOPP credited ADHR as a backup cooling source even though the time to boil during early portions of the outage was approximately 30 minutes, but the time to implement the procedure to est ablish ADHR was 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 10 minutes. 13. Evaluate the licensee's actions to comply with reporting requirements associated with this event.

From September 9, 2016, until September 22, 2016, Grand Gulf Nuclear Station failed to identify an alternate method of decay heat removal, when RHR subsystem A

was inoperable, as required per Action A.1 of TS 3.4.10.

NUREG-1022, "Event Report Guidelines 10 CFR 50.72 and 50.73," Revision 3, Section 3.2.2, discusses a licensee operating in a condition prohibited by TSs.

NUREG-1022 states that there is no 10 CFR 50.72 reporting requirement, but there is a 50.73 requirement to submit a licensee event report (LER), which the licensee completed on October 27, 2016, as LER 2016-008-00.

The team concluded that the licensee's actions to comply with reporting requirements associated with this event were adequate to meet the requirements of

10 CFR 50.72 and 10 CFR 50.73.

14. Collect data necessary to support completion of the significance determination process for any associated finding(s).

Findings were developed and documented below.

b. Findings

(1) Failure to Have Alternate Decay Heat Removal Capability

Introduction.

The team reviewed a Green, self-revealed non-cited violation of Technical Specification (TS) 3.4.10, "Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown," for the licensee's failure to verify the availability of an alternate method of decay heat removal when RHR subsystem A was inoperable and unavailable for a pump replacement. Specifically, the licensee inappropriately credited ADHR as an available alternate method of decay heat 17 removal. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-07281.

Description.

On September 8, 2016, at 11:04 a.m., Grand Gulf Nuclear Station inserted a manual reactor scram to enter an outage to replace RHR pump A. Although RHR subsystem A was inoperable for failing to meet its TS Surveillance Requirement 3.5.1.4 for rated flow and pressure for its safety function, it remained capable of providing the necessary flow and pressure for shutdown cooling (log entry September 8, 2016, 6:24 p.m.) until its removal from service on September 9, 2016.

The licensee entered Mode 4 on September 9, 2016, at 5:09 a.m. At this time, TS 3.4.10 was applicable. TS 3.4.10 requires, in part, that two residual heat removal shutdown cooling subsystems be operable in Mode 4. For the condition of one or two RHR shutdown cooling subsystems inoper able, Action A.1 requires the licensee to verify an alternate method of decay heat removal is available for each inoperable RHR shutdown cooling subsystem within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> thereafter.

The ADHR system was placed in standby alignment on September 9, 2016, at 5:42 p.m., but the licensee failed to recognize that the ADHR heat exchanger isolation valves (P44F481A, P44F481B, P44F482A, and P44F482B) remained tagged closed, and therefore, the ADHR system was not actually in standby alignment.

On September 9, 2016, at 6:10 p.m., in order to replace the RHR subsystem A

pump, it was removed from service. Starting at this time, the licensee inappropriately credited the ADHR system as their alternate method of decay heat removal for compliance with TS 3.4.10, Action A.1. Credit for the ADHR system was inappropriate because, although the licensee believed the ADHR system had been aligned in standby, the ADHR heat exchanger isolation valves had remained tagged closed, rendering the ADHR system unavailable to satisfy the TS requirement during the time period RHR subsystem A was unavailable. In attempting to verify the availability of the ADHR system as an alternate means of decay heat removal to satisfy TS 3.4.10, the licensee's administrative review of tagouts failed to consider tagouts on the PSW system that might impact ADHR system availability (i.e., tagout P44-002-1E12B003A/B that tagged closed the ADHR heat exchanger isolation valves). The RHR subsystem A pump was replaced, retested, and returned to available status on September 22, 2016, at 8:00 p.m. Therefore, the licensee was not in compliance with TS 3.4.10, Action A.1, since RHR subsystem A was inoperable and the licensee failed to verify an alternate method of decay heat removal available between September 9, 2016, and September 22, 2016.

On September 23, 2016, at 3:03 p.m., the misaligned ADHR heat exchanger

isolation valves were identified while the licensee was attempting to put the ADHR

system in service. Operations personnel corrected the ADHR system alignment error and put the ADHR system in standby alignment on September 28, 2016, at 6:31 p.m.

Analysis.

The failure to perform the TS required action to verify an alternate method of decay heat removal is available when an RHR shutdown cooling subsystem was 18 inoperable was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to follow TS requirements to ensure the availability, reliability, and capability of the alternate decay heat removal system directly affected the cornerstone objective. Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process (SDP)," and Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings," the team determined that an Appendix G, Phase 2, risk analysis was appropriate, since the cavity was not flooded, and the finding represents an actual loss of safety function of a non-TS train of equipment during shut down designated as risk-significant, for greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year. Therefore, this violation is associated with a finding having very low safety significance (Green).

The team determined the finding had a cross-cutting aspect within the human performance area, field presence, because leaders failed to reinforce standards and expectations in the work areas of the plant. Specifically, inconsistent procedure use and adherence led to the ADHR system misalignment and the failure to adequately verify the system was available as required by TS. As reflected in the licensee's root cause evaluation, this inconsistent procedure use and adherence indicates leaders were not effectively reinforcing standards and expectations for operators in the field [H.2].

Enforcement.

Technical Specification 3.4.10, requires, in part, that two residual heat removal shutdown cooling subsystems be operable in Mode 4. For the condition of one or two RHR shutdown cooling subsystems inoperable, Action A.1 requires the licensee to verify an alternate method of decay heat removal is available for each inoperable RHR shutdown cooling subsystem within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> thereafter. Contrary to the above, from September 9, 2016, to September 22, 2016, the licensee failed to verify an alternate method of decay heat removal was available when RHR subsystem A was inoperable. Spec ifically, the licensee inappropriately credited the ADHR system as their alternate method of decay heat removal even though the ADHR heat exchanger isolation valves were tagged closed, rendering the ADHR system unavailable to satisfy the TS requirement. In attempting to verify the availability of the ADHR system as an alternate means of decay heat removal to satisfy TS 3.4.10, the licensee's administrative review of tagouts failed to consider tagouts on the PSW system that might impact ADHR system availability. Corrective actions involved restoring RHR subsystem A to available status on September 22, 2016. Because this finding was determined to be of very low safety significance and has been entered into the licensee's corrective action program as Condition Report CR-GGN-2016-07281, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 050000416/2016008-01, "Failure to Have Alternate Decay Heat Removal Capability")

19

(2) Failure to Have Adequate Procedures

Introduction.

The team identified two examples of a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, for the licensee's failure to have adequate procedures for activities affecting quality. Specifically, Grand Gulf Nuclear Station failed to have adequate procedures for feedwater and shutdown cooling activities. The licensee entered this issue into their corrective action program as Condition Reports CR-GGN-2016-08334, 08273, and 08290.

Description.

Example

(1) Grand Gulf Nuclear Station Procedure 04-1-01-E-12-2, "Shutdown Cooling and Alternate Decay Heat Removal Operations," Revision 119, provided specific information for operation of the shutdown cooling mode of the RHR system and ADHR operations. Section 4.6 of Procedure 04-1-01-E-12-2 provided steps on how to place the alternate decay heat removal system into a standby configuration. The team identified that the procedure failed to ensure the proper configuration of the ADHR heat exchanger isolation valves, P44F481A, P44F481B, P44F482A, and P44F482B. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-08334.

Example

(2) Section 4.3 of Procedure 04-1-01-E-12-2 provided steps to secure an

operating RHR subsystem in the shutdown cooling configuration. Step 4.3.2.a(1)(b)

of Procedure 04-1-01-E-12-2 required operators to open valve B21F065B. Valve B21F065B serves as a feedwater isolation valve to keep condensate and feedwater from the reactor vessel when the condensate and feedwater system is operating in long cycle cleanup. Long cycle cleanup is a routine feedwater configuration established during reactor outage conditions to ensure the condensate and feedwater systems are being maintained to support reactor restart operations. The

team identified that Procedure 04-1-01-E-12-2 failed to prevent an inadvertent reactor vessel fill when the valve B21F065B was opened during the securing of shutdown cooling while the feedwater system is in long cycle cleanup. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2016-08290.

Analysis.

The failure to have adequate procedures for activities affecting quality was a performance deficiency. Example

(1) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not having adequate procedural guidance for ADHR alignment contributed the system's subsequent unavailability to perform if needed.

Example

(2) of this performance deficiency was more than minor, and therefore a finding, because it was associated with the procedure quality attribute of the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown operations. Specifically, not having adequate procedural guidance for operation of the feedwater isolation valve resulted in inadvertent overfill of the reactor vessel.

20 Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process (SDP)," and Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings," the team determined that an Appendix G, Phase 2, risk analysis was appropriate for Example

(1) of this finding, since the cavity was not flooded, and the finding represents an actual loss of safety function of a non-TS train of equipment during shut down designated as risk-significant, for greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 3.2E-7/year and an increase in large early release frequency of 7.3E-8/year. Therefore, this violation is associated with a finding having very low safety significance (Green). For Example

(2) of the finding, the team determined that the finding screened to Green (very low safety significance) because it did not increase the likelihood of a shutdown initiating event, or any other event listed in Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings".

The team did not assign a cross-cutting aspect because the performance deficiency was not reflective of current plant performance, because the portions of the procedures impacting these events have not been revised within the last 3 years.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, requires, in part, "Activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances." Contrary to the above, the licensee failed to ensure that activities affecting quality were prescribed by documented procedures that were appropriate to the circumstances.

Specifically, prior to September 24, 2016, Grand Gulf Nuclear Station Procedure 04-1-01-E-12-2, "Shutdown Cooling and Alternate Decay Heat Removal Operations," Revision 119, failed to have adequate instructions for the activities for which they were written, which contributed to the unavailability of the ADHR system and overfill of the reactor vessel. The licensee implemented corrective actions to revise the procedure. Because this finding was determined to be of very low safety significance and has been entered into the licensee's corrective action program as Condition Reports CR-GGN-2016-08334, 08273, and 08290, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 050000416/2016008-02, "Failure to Have Adequate Procedures")

(3) Failure to Follow Operations Procedures

Introduction.

The team identified a Green, non-cited violation of TS 5.4.1.a, "Procedures," for the licensee's failure to implement procedures required by Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Specifically, contrary to procedures, on September 23, 2016, operations personnel failed to verify adequate plant service water flow to the ADHR heat exchangers while placing the system in service.

Description.

The team identified four instances of the licensee's failure to implement procedures. Three of the examples were determined to be of minor significance, and one was determined to be of Green significance. All four are described as follows:

21

• Example (1): On August 8, 2016, operations personnel failed to initiate a potential limiting condition for operation (LCO) tracking sheet when initiating a tagout on the ADHR system. Procedure 02-S-01-17, "Control of Limiting Conditions for Operation," Revision 129, Section 5.1, states that a limiting condition for operation tracking record (LCOTR) will be activated for a "Potential TS LCOTR," which is defined as a LCOTR that has been activated, but the associated LCO has not been entered because the system is not required for current plant conditions, but the system would be required if plant mode changed. On August 8, 2016, with the plant in Mode 1 at 100 percent power, the ADHR system was tagged out for heat exchanger cleaning. Since the ADHR system is only credited during Modes 4 and 5 for decay heat removal, no LCO entry was required. However, operations personnel were required to initiate a potential LCOTR to track that the ADHR system may be a credited decay removal system, should the plant enter Mode 4. The failure to initiate a potential LCOTR for tagging out the ADHR system on August 8, 2016, was a minor violation of Procedure 02-S-01-17 and TS 5.4.1.a.

• Example (2): On August 12, 2016, maintenance personnel failed to sign off the tagout when work on the ADHR system was complete. Procedure EN-OP-102, "Protective and Caution Tagging," Revision 18, Step 5.15[5], required tagout holders to place a check in the work complete box of the work order status window for work orders that no longer require the tagout. The tagout holder for the ADHR heat exchanger tagout P44-002-1E12B003A/B, which was in place to support ADHR heat exchanger cleaning, failed to check the work complete box in violation of Procedure EN-OP-102. Because operations personnel were never notified that the work was complete, the tagout remained hanging until September 23, 2016, while the site believed that the ADHR system was available in standby and credited the ADHR system as an available method of decay heat removal. The failure to remove tagout P44-002-1E12B003A/B when work on the ADHR system was complete was a minor violation of Procedure EN-OP-102 and TS 5.4.1.a.

• Example (3): On September 23, 2016, operations personnel failed to verify adequate PSW flow to the ADHR heat exchangers while placing the system in service. Procedure 04-01-E-12-2, "Shutdown Cooling and Alternative Decay Heat Removal Operation," Revision 119, contained instructions for placing the ADHR system in service. Step 4.9.2.a(8) of this procedure required operations personnel to verify plant service water flow to the heat exchangers by observing local flow indication at temporary annubar gage P44-N154, which was installed in the auxiliary building. Further, because gage P44-N154 indicated in inches of

H 2O, Procedure 04-01-E12-2, Step 4.9.2.a(8), contained a conversion factor for calculation of flowrate in gallons per minute (513.893 x (inches H 2 O)). The SOPP for the outage contained the acceptance criteria of 3000 gallons per minute for plant service water flow to the ADHR heat exchangers.

On September 23, 2016, when placing the ADHR system in service and upon reaching Step 4.9.2.a(8), the equipment operators noted that local gage P44-N154 read 0 inches of H 20, which they interpreted as not satisfying the step. Operations personnel (including the senior reactor operator directing the task

from the control room) believed that annubar gages were often unreliable, and 22 thus did not believe the indication. In order to continue placing the system in service, in spite of the lack of indicated PSW flow, operations personnel decided to look for alternative indications of PSW flow. To accomplish this, without procedural direction, they opened one of the heat exchanger vent valves, observed a pressurized steady stream of water, concluded that this response was satisfactory indication of PSW system flow, and proceeded forward in the procedure. Operations personnel did not attempt to quantify the PSW flow for adequate heat removal, because they interpreted the step to mean any flow was satisfactory. The failure to verify adequate PSW flow by observing flow on annubar P44-N154 was a Green, non-cited violation of Procedure 04-01-E12-2 and TS 5.4.1.a.

• Example

(4) On September 23, 2016, operations personnel failed to follow general operating procedures when they vented the PSW system (as described above) without procedure guidance and without controlling the vented water with hoses to drain systems as required. Operations personnel took no precautions to prevent flooding, wetting of electrical equipment such as motor windings, or the spread of contamination in the area (the area in which the venting occurred was controlled as a contaminated area), and vented the water onto the floor of the room in the auxiliary building contrary to plant procedures. General Operating Procedure 04-S-04-1, "System Fill and Vent," Step 5.1.1, required protection from wetting adjacent equipment and uncontrolled venting by the use of tygon hoses directed to the proper drains when venting systems. On September 23, 2016, by venting the PSW side of the ADHR heat exchangers system to the floor and not taking precautions to install hoses to control the flow of water, operations personnel failed to follow Procedure 04-S-04-1, a minor violation of TS 5.4.1.a.

Analysis.

The failure to implement procedures as required by TS 5.4.1.a was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because, if left uncorrected, the failure to implement procedures as required by TS would have the potential to lead to a more significant safety concern. Using Inspection Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process (SDP)," and Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings,"

the team determined that the finding was of very low safety significance (Green)because it did not affect the design or qualification of a mitigating system structure, system or component and did not directly prevent the ADHR system from maintaining its functionality. The team identified a cross-cutting aspect in the area of human performance, challenge the unknown, because individuals failed to stop when faced with uncertain conditions and risks were not evaluated and managed before proceeding [H.11].

Enforcement.

Technical Specification 5.4.1.a requires that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 4.e of Appendix A to Regulatory Guide 1.33, Revision 2, requires procedures for energizing, filling, venting, draining, startup, shutdown, and changing modes of operation for the "Shutdown Cooling System." The licensee established Procedure 04-01-E12-2, "Shutdown Cooling and Alternative Decay Heat Removal 23 Operation," Revision 119, to meet the Regulatory Guide 1.33 requirement. Step 4.9.2.a(8) of Procedure 04-01-E12-2 required operations personnel to verify plant service water flow to the heat exc hangers by observing local flow indication at temporary annubar gage P44-N154. Contrary to the above, on September 23, 2016, operations personnel did not verify plant service water flow to the heat exchangers by observing local flow indication at temporary annubar gage P44-N154.

Specifically, operations personnel observed 0 inches of H 2O indicated on temporary annubar gage P44-N154, but discounted this reading and attempted to verify flow by an alternate means. As a result, operations personnel continued placing the ADHR system in standby without establishing cooling water to the heat exchangers. The licensee implemented corrective actions which included high intensity training for operators to reinforce operator fundamentals and procedure improvements.

Because this violation was of very low safety significance and has been entered into the licensee's corrective action program as Condition Report CR-GGN-2016-08333, it is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000416/2016008-03, "Failure to Follow Operations

Procedures")

4OA6 Meetings, Including Exit

Exit Meeting Summary

On May 31, 2017, the team presented the inspection results by telephone to Mr. T. Vehec, Director, Recovery, and other members of the licensee's staff. The team asked whether any of the material examined during the inspection shou ld be considered proprietary. No proprietary information was identified.

M. Haire Attachment 1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

A. Boyd, Electrical Maintenance

S. Dupont, Regulatory Assurance

R. Falk, Regulatory Assurance

V. Fallacara, Acting Site Vice President

M. Giacini, General Manager Plant Operations

J. Hallenback, Manager, Design Engineering

W. Johnson, Operations

R. Liddell, Superintendent, Operations Training

R. Meister, Senior Specialist, Regulatory Assurance

R. Myer, Assistant Operations Manager

J. Nadeau, Manager, Regulatory Assurance

L. Simmons, Work Week Manager

S. Sweet, Engineer, Regulatory Assurance

L. Wilmot, Equipment Reliability Coordinator

S. Wood, Specialist, Regulatory Assurance

NRC Personnel

W. Sifre, Acting Senior Resident Inspector

LIST OF ITEMS

Opened and Closed

05000416/2016008-01 NCV Failure to Have Alternate Decay Heat Removal Capability (Section 4OA3)

05000416/2016008-02 NCV Failure to Have Adequate Procedures (Section 4OA3)

05000416/2016008-03 NCV Failure to Follow Operations Procedures (Section 4OA3)

Section 4OA3:

Follow-up of Events and Notices of Enforcement Discretion