IR 05000416/2009006

Download: ML091200372

Text

April 30, 2009

James Vice President Operations Entergy Operations, Inc. Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150

SUBJECT: GRAND GULF NUCLEAR STATION- NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000416/2009006

Dear Mr. Douet:

On February 27, 2009, the US Nuclear Regulatory Commission (NRC) completed a component design bases inspection at your Grand Gulf Nuclear Plant. The enclosed report documents our inspection findings. The preliminary findings were discussed on February 27, 2009, with you and other members of your staff. After additional in-office inspection, a final telephonic exit meeting was conducted on April 2, 2009, with Mr. Browning and others of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The team reviewed selected procedures and records, observed activities, and interviewed cognizant plant personnel.

Based on the results of this inspection, the NRC has identified six findings that were evaluated under the risk significance determination process. Violations were associated with all of the findings. One of the violations had multiple examples. All six of the findings were found to have very low safety significance (Green) and the violations associated with these findings are being treated as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any of the noncited violations, or the significance of the violations you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the US Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 East Lamar Blvd., Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, US Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Grand Gulf Nuclear Station. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at Grand Gulf Nuclear Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

Entergy Operations, Inc. - 2 - In accordance with Code of Federal Regulations, Title 10, Part 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA/

Thomas Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety Dockets: 50-416 License: NPF-29

Enclosure:

Inspection Report 05000416/2009006

w/Attachments:

1 - Supplemental Information Senior Vice President Entergy Nuclear Operations P.O. Box 31995 Jackson, MS 39286-1995 Senior Vice President and COO Entergy Operations, Inc. P.O. Box 31995 Jackson, MS 39286-1995 Vice President, Oversight Entergy Services, Inc. P.O. Box 31995 Jackson, MS 39286-1995 Chief, Energy and Transportation Branch Environmental Compliance and Enforcement Division Mississippi Department of Environmental Quality P.O. Box 10385 Jackson, MS 39289-0385 Entergy Operations, Inc. - 3 - President Claiborne County Board of Supervisors 510 Market Street Port Gibson, MS 39150 Senior Manager Nuclear Safety & Licensing Entergy Nuclear Operations P.O. Box 31995 Jackson, MS 39286-1995 Manager, Licensing Entergy Operations, Inc. Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150 Attorney General Department of Justice State of Louisiana P.O. Box 94005 Baton Rouge, LA 70804-9005 Office of the Governor State of Mississippi P.O. Box 139 Jackson, MS 39205 Attorney General Assistant Attorney General State of Mississippi P.O. Box 220 Jackson, MS 39205 State Health Officer State Health Board P.O. Box 1700 Jackson, MS 39215 Associate General Counsel Entergy Nuclear Operations P.O. Box 31995 Jackson, MS 39286-1995 Louisiana Dept. of Environmental Quality Radiological Emergency Planning and Response Division P.O. Box 4312 Baton Rouge, LA 70821-4312 Entergy Operations, Inc. - 4 - Electronic distribution by RIV: Regional Administrator (Elmo.Collins@nrc.gov ) Deputy Regional Administrator (Chuck.Casto@nrc.gov ) DRP Director (Dwight.Chamberlain@nrc.gov ) DRP Deputy Director (Anton.Vegel@nrc.gov ) DRS Director (Roy.Caniano@nrc.gov ) DRS Deputy Director (Troy.Pruett@nrc.gov) Senior Resident Inspector Rich.Smith@nrc.gov) Resident Inspector (Andy.Barrett@nrc.gov ) Branch Chief, DRP/C (Geoffrey.Miller@nrc.gov ) Senior Project Engineer, DRP/C (David.Proulx@nrc.gov ) GG Site Secretary (Nancy.Spivey@nrc.gov ) Public Affairs Officer (Victor.Dricks@nrc.gov ) Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov ) RITS Coordinator (Marisa.Herrera@nrc.gov ) DRS STA (Dale.Powers@nrc.gov ) OEDO RIV Coordinator, Primary (John.Adams@nrc.gov ) ROPreports

File located: R:\REACTORS\GG CDBI 2009006 RAK ml SUNSI Rev Compl. Yes No ADAMS Yes No Reviewer Initials TRF Publicly Avail Yes No Sensitive Yes No Sens. Type Initials TRF EB 1 EB 1 EB 1 EB 1 EB 1 R. Kopriva K. Clayton J. Adams M. Bloodgood T. Farnholtz /RA/ /RA/ /RA/ /RA/ /RA/ 4/7/09 4/8/09 4/8/09 4/16/09 4/30/09 DD:DRS EB 1 G. Miller T. Farnholtz /RA/ /RA/ 4/22/09 4/30/09 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax Enclosure ENCLOSURE U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 50-416 License: NPF-29 Report Nos.: 05000416/2009006 Licensee: Entergy Operations, Inc. Facility: Grand Gulf Nuclear Station Location: Waterloo Road Port Gibson, MS Dates: February 2-6, 2009 February 16-27, 2009 Team Leader: R. Kopriva, Senior Reactor Inspector, Engineering Branch 1 Inspectors: K. Clayton, Senior Reactor Inspector, Engineering Branch 1 M. Bloodgood, Reactor Inspector, Engineering Branch 1 J. Adams, Ph.D., Reactor Inspector, Engineering Branch 1 Accompanying Personnel: J. Nicely, Electrical Contractor C. Edwards, Mechanical Contractor Others: I. Anchondo, Reactor Inspector, Engineering Branch 1 C. Ryan, Reactor Inspector, Engineering Branch 1 M. Runyan, Senior Reactor Analyst Approved By: Thomas Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000416/2009006; February 2-6, 2009 and February 16-27, 2009; Grand Gulf Nuclear Station: baseline inspection, NRC Inspection Procedure 71111.21, "Component Design Bases Inspection."

The report covers an announced inspection by a team of four regional inspectors, two contractors and two inspectors in training. Six findings were identified. All of the findings were of very low safety significance. The final significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for failure to comply with the licensee's Generic Letter 89-13 program, which specifically states that cleaning of heat exchangers covered by this program is prohibited prior to performing an as-found thermal performance test. Specifically, in early 2006, the Division II Standby Diesel Generator (i.e. Emergency Diesel Generator) jacket water cooling heat exchanger was cleaned just prior to performing a five year thermal performance test. The licensee has entered this into their corrective action program as CR-GGN-2009-00904. This finding is more than minor because it affected the mitigating systems cornerstone attribute of equipment performance of ensuring the availability, reliability, and capability of safety systems that respond to initiating events. Also, using Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. The inspectors reviewed the finding for cross-cutting aspects and none were identified (Section 2.8).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for failure to establish adequate measures for the selection and review for suitability of equipment and processes that are essential to the safety-related functions of structures, systems and components. Specifically, the licensee failed to properly design for pulsation effects on flow rate instrumentation used for leak detection in the Standby Service Water system. This instrumentation is needed to meet licensee commitment 10 CFR Part 50, Appendix A, General Design Criterion 13, "Instrumentation and Control," to monitor trends in the ultimate heat sink basin inventory with the system in operation. The system was designed to detect a leakage rate of 1250 gallons per minute, and alarm in the control room at this leak rate, but due to design inadequacies in the instrumentation, the leak rate would have to exceed 3350 gallons per minute before activating the alarm. The licensee has entered this into their corrective action program as CR-GGN-2009-00054. This finding was more than minor because it affected the mitigating systems cornerstone attribute of equipment performance of ensuring the availability, reliability, and capability of systems that respond to initiating events. Also, using Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. The finding was reviewed for cross-cutting aspects and none were identified (Section 2.10).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control" for failing to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee used non-conservative inputs or methodologies in calculating terminal voltages to safety-related motor-operated valve motors that would be required to operate for mitigation of design bases events. The licensee's electrical calculations used non-conservative 50 percent locked-rotor currents and neglected thermal overload resistance to determine the terminal voltages to safety-related motor-operated valves which would predict higher terminal voltages than would actually exist. The calculated terminal voltages were direct design inputs into the applicable motor-operated valves mechanical thrust and torque calculations. The licensee has entered this issue into their corrective action program as CR-GGN-2009-00985. This finding was more than minor because it affected the mitigating systems cornerstone attribute of equipment performance of ensuring the availability, reliability, and capability of systems that respond to initiating events. Also, using Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. This finding has a cross-cutting aspect in the area of Problem Identification and Resolution, in that self assessments are of sufficient depth, are comprehensive, are appropriately objective, and are self critical.

The licensee had conducted a Component Design Bases Assessment, LO-GLO-2008-00044 in August 2008, and failed to adequately assess an identical finding identified at River Bend Station during their 2008 Component Design Bases

Inspection. The licensee had determined that this issue was not applicable at Grand Gulf Nuclear Station P.3(a) (Section 2.11).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," for failure to identify and correct a condition adverse to quality related to the seismic qualification of the Division III High Pressure Core Spray safety-related battery. Specifically, the licensee failed to identify an incorrectly installed end bracket after replacement of the Division III safety-related battery in 2002 using procedures, work instructions, and drawings that were supposed to have been corrected after this same issue was identified during a 1997 battery replacement activity. The licensee has entered this into their corrective action program as CR-GGN-2009-00830. This finding was more than minor because it affected the mitigating systems cornerstone attribute of external events for ensuring the availability, reliability, and capability of systems that respond to initiating events. Also, using Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was confirmed to not result in a loss of operability or functionality. The finding was reviewed for cross-cutting aspects and none were identified (Section 2.13).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," with two examples. Specifically, the team identified that the licensee failed to develop and implement adequate testing programs for Class 1E molded-case circuit breakers, and for the voltage and frequency response of the standby diesel generators that met design or vendor requirements and recommendations. In response, the licensee entered these examples in the corrective action program as CR-GGN-2009-01024, and CR-GGN-2009-01057. This finding was more than minor because it affected the mitigating systems cornerstone attribute of external events for ensuring the availability, reliability, and capability of systems that respond to initiating events. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, each example was determined to be of very low safety significance (Green) because they did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time, did not represent an actual loss of one or more risk-significant non-Technical Specification trains of equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding has a cross cutting aspect in the area of Problem Identification and Resolution, in that self assessments are of sufficient depth, are comprehensive, are appropriately objective, and are self critical. The licensee had conducted a Component Design Bases Assessment, LO-GLO-2008-00044 in August 2008, and failed to adequately assess an identical finding identified at River Bend Station during their 2008 Component Design Bases Inspection. The licensee had determined that this issue was not applicable at Grand Gulf Nuclear Station P.3(a) (Section 3.1).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for failure to adequately demonstrate operability for the 4160 volt Standby Service Water Pump kerite cables through adequate testing and analysis in a continuously submerged environment. Furthermore, the environment for these continuously submerged cables exists because each of the two vaults that contain these cables (MH 20 and MH 21) has a design flaw, in that several other vaults gravity drain to them and the design of these vaults did not include a sump pump or other means for water to be removed or drained from them. The licensee has entered this into their corrective action program as CR-GGN-2009-01028. This finding is more than minor because it affected the mitigating systems cornerstone attribute of design control of ensuring the availability, reliability, and capability of safety systems, and closely parallels Inspection Manual Chapter 0612, Appendix E, Example 3.j, because there was reasonable doubt on the continued operability of the Standby Service Water system. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to be of very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. The inspectors determined that the finding has a crosscutting aspect in the area of Problem Identification and Resolution in that the licensee failed to implement Operating Experience directly communicated with a Generic Letter through changes to station processes, procedures, and equipment P.2(b) (Section 3.4).

B. Licensee-Identified Violations

. None were identified.

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. As plants age, their design bases may be difficult to determine and important design features may be altered or disabled during modifications. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Bases Inspection

The team selected risk-significant components and operator actions for review using information contained in the licensee's probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than two or a Birnbaum value greater than 1E-6.

a. Inspection Scope

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria. The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios, as well as during simulated actions in the plant. The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 20 to 30 total samples that include 10 to 20 risk-significant and low design margin components, 3 to 5 relatively high-risk operator actions, and 4 to 6 operating experience issues. The sample selection for this inspection was 14 components, 5 operator actions, and 5 operating experience items.

.2.1 115/4.16 kV Engineered Safety Feature Transformer #12:

a. Inspection Scope

The team reviewed the system one-line diagrams, voltage tap settings, nameplate data, and protective relay settings, and loading requirements to determine the adequacy of the transformer to supply required power to the associated 4160 Vac buses. The team reviewed the results of recently completed transformer preventive maintenance. The team reviewed offsite power connections and the Transmission Operator notification protocols for the 115 kV switchyard. The team interviewed system engineers and performed a visual inspection of the transformer and its connection to the 115 kV switchyard to assess the installation configuration, material condition, and potential vulnerability of the transformer to external hazards.

b. Findings

No findings of significance were identified.

.2.2 4160 V Switchgear Bus 16AB (Division II):

a. Inspection Scope

The team inspected the 4 kV switchgear to verify that it would operate during design basis events. The team reviewed selected calculations for electrical distribution system load flow/voltage drop, degraded voltage protection, short-circuit, and electrical protection and coordination. This review was conducted to assess the adequacy and appropriateness of design assumptions, and to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. Additionally, the switchgear's protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst-case, short-circuit conditions. The team evaluated selected portions of the licensee response to NRC Generic Letter (GL) 2006-02, "Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power," dated February 1, 2006. The station's interface and coordination with the transmission system operator for plant voltage requirements and notification set points were reviewed. The team reviewed the degraded and loss of voltage relay protection schemes. To determine if breakers were maintained in accordance with industry and vendor recommendations, the team reviewed the preventive maintenance inspection and testing procedures. The 125 Vdc voltage calculations were reviewed to determine if adequate voltage would be available for the breaker open/close coils and spring charging motors. Finally, the team performed a walkdown of portions of the safety-related 4160 Vac switchgear to assess the installation configuration, material condition, and potential vulnerability to hazards.

b. Findings

No findings of significance were identified.

.2.3 480 Vac Load Center 16BB3 and 4160/480 Vac 16BB3 (Division II): The team reviewed selected calculations for electrical distribution system load flow/voltage drop, short-circuit, and electrical protection and coordination.

The adequacy and appropriateness of design assumptions and calculations were reviewed to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. The switchgear's protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst-case, short-circuit conditions. To ensure that breakers were maintained in accordance with industry and vendor recommendations, the team reviewed the preventive maintenance inspection and testing procedures. The team performed a visual non-intrusive inspection of observable portions of the safety-related 480 Vac load center to assess the installation configuration, material condition, and the potential vulnerability to hazards. The team assessed the sizing, loading, protection, and voltage taps for transformer 16BB3 to ensure adequate voltage to the 480 Vac Load Center 16BB3. The team reviewed the protective device settings to ensure that the feeder cables and transformer was protected in accordance with industry standards. A review of the testing requirements and preventive maintenance was performed. The team performed a visual non-intrusive inspection of observable portions of the transformer to assess the installation configuration, material condition, and potential vulnerability to hazards.

b. Findings

No findings of significance were identified.

.2.4 480 Vac Motor Control Center- 16B31 (Division II):

a. Inspection Scope

The team reviewed selected calculations for electrical distribution system load flow/voltage drop, short-circuit, and electrical protection and coordination. The adequacy and appropriateness of design assumptions and calculations were reviewed to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. The motor control center's protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst-case short-circuit conditions. The team performed a visual non-intrusive inspection of observable portions of the safety-related 480 Vac load center to assess the installation configuration, material condition, and the potential vulnerability to hazards.

b. Findings

No findings of significance were identified.

.2.5 4160 Vac Standby Diesel Generator 12 and Feeder Breaker 152-1608 (Div II):

a. Inspection Scope

The team inspected the electrical portions of the standby diesel generator and associated supply breaker to verify the adequacy of the equipment to respond to design basis events. The team reviewed diesel generator starting logic and output breaker control logic to verify the appropriate functionality was implemented. The team reviewed completed surveillances to verify that the technical specification requirements were met. The team reviewed protection/coordination and short-circuit calculations to verify the standby diesel generator was adequately protected by protective devices during test mode and emergency operation. Additionally, the team reviewed calculations to verify that: 1) steady-state loading was within design capabilities; 2) adequate voltage would be present to start and operate connected loads; and, 3) operation at maximum allowed frequency would be within the design capabilities. The team reviewed the standby diesel generator load sequence time delays. The team reviewed the standby diesel generator feeder breaker maintenance and control voltage to verify that the components would function when required. Finally, the team performed a walk down of the standby diesel generator and breaker to assess the installation configuration, material condition, and potential vulnerability to hazards.

b. Findings

No findings of significance were identified.

.2.6 High Pressure Core Spray Injection Valve - 1E22F004:

a. Inspection Scope

The team reviewed safety function, modifications, calculations, in-service testing data, system health notebook, and procedures. Specifically, the team verified that this valve continues to have sufficient margin in opening time for fulfilling its safety function even after losing a significant amount of margin due to actuator modifications. The team verified that the actuator would have a safety-related source of power and that it would produce sufficient torque to operate the valve when needed.

b. Findings

No findings of significance were identified.

.2.7 Reactor Core Isolation Cooling Minimum Flow Valve - 1E51F019:

a. Inspection Scope

The team reviewed the Updated Final Safety Analysis Report, Design Basis Documents, selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the Motor-Operated Valve (MOV) to perform its intended function during design basis events. The team reviewed NRC Generic Letter 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance," calculations and requests for resolution to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations. The team reviewed the design and testing of the control interlocks and set-points associated with the valve. The team reviewed electrical calculations to verify the appropriate voltage values were included in the valve calculations. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis.

b. Findings

No findings of significance were identified.

.2.8 Division II Standby Diesel Generator Jacket Cooler - 1P75B004B:

a. Inspection Scope

The team reviewed the design basis heat load sizing analysis for this heat exchanger to verify its capability to meet design basis heat removal requirements. A compliance review with NRC Generic Letter 89-13 program requirements for thermal performance testing and corrective actions was conducted. Vendor manual requirements were reviewed for agreement with plant operating and maintenance procedures/records. The team reviewed the current system health report, history of corrective actions, trending data, applicable operating experience, and any related apparent cause evaluations and root cause analysis for impact on design basis margin. b Findings Preconditioning of Division II Standby Diesel Generator Jacket Water Cooler Heat Exchanger

Introduction.

A noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," was identified for failure to meet the prerequisites of a NRC Generic Letter 89-13 program thermal performance test. Specifically, the licensee performed a cleaning of the Division II Standby Diesel Generator jacket water cooler heat exchanger just prior to the February 2006 thermal performance test. Cleaning of the jacket water cooler heat exchanger prior to the thermal performance testing was not in accordance with the licensee's thermal performance test program.

Description.

In June 2005, licensee personnel tested the Division III Standby Diesel Generator jacket water cooler 'A' heat exchanger. The team noted that the fouling factor was greater than design and that the calculated heat removal capacity was 100.8 percent of design capacity. At the same time, the 'B' heat exchanger was tested. It also showed greater than design fouling with only an 83.5 percent calculated heat removal capacity. Licensee personnel performed an operability analysis to determine the status of the Division III Standby Diesel Generator. The licensee personnel concluded that the component was "operable but degraded." On that basis, licensee management deferred cleaning until December 2005. As a result of the fouling removed from the Division III jacket water heat exchangers in December 2005, licensee management scheduled cleaning and inspection of the other standby diesel generator jacket water cooler heat exchangers. Due to the significant improvement in the thermal performance of the Division III jacket water cooler heat exchangers, at the end of 2005, the licensee performed cleaning of the Division II Standby Diesel Generator jacket water cooler heat exchangers. The licensee did not recognize that the Division II Standby Diesel Generator jacket water cooler heat exchanger five year thermal performance test was scheduled to be performed at the beginning of 2006. The NRC Generic Letter 89-13 program specifically states that cleaning of heat exchangers covered by this program is prohibited prior to performing an as-found thermal performance test. Thus, cleaning the jacket water cooler prior to the thermal performance testing was not in accordance with the licensee's thermal performance test program. During the February 2006 test of the Division II Standby Diesel Generator jacket water cooler heat exchangers, data taken during the test had been skewed as a result of cleaning the heat exchanger just prior to performing the thermal performance test. A retest was to be performed in May 2006, to obtain useable test data. A review of this issue by the inspection team determined that a retest was never performed and that performance of test procedure (17-S-03-29) was closed out by making the assessment that this test was not used to make operability determinations for the as-found condition of the heat exchanger. The licensee's program plan for compliance with NRC Generic Letter 89-13 requirements was then formally revised in May 2006, to allow "maintenance (cleaning)" in lieu of thermal performance testing for these water-to-water heat exchangers. The condition report associated with the failed test makes no mention of changing the program from thermal performance testing to performing heat exchanger maintenance (cleaning) nor does it provide any justification for performing the cleaning of the heat exchanger prior to the February 2006 thermal performance test. Failure to redo the test was a violation of written procedures. The team determined that results of monthly surveillance testing of the standby diesel generators was not an adequate substitute for a full thermal performance test and should not have been used as a reason for not completing the test. A data sheet in test procedure 17-S-03-29 specifically requires that an operability assessment be made on a failed or incomplete surveillance, based on the analysis of test results. After the team brought this to the licensee's attention, a conservative assessment of the pre-cleaned thermal performance capability of the Division II Standby Diesel Generator jacket water cooler heat exchanger was performed by the licensee using an assumed fouling factor based on the worst case previously observed fouling rate of the Division III Standby Diesel Generator jacket water cooler heat exchanger 'A.' For that rate of fouling the analysis determined that the margin on design heat removal capability at the time that the test was performed in February 2006 would have been two percent. Since cleaning would not have been required based on these results, the licensee further projected that fouling rate to today's time frame and found that the design basis heat removal capability could not be met without increasing allowable jacket water temperature by two degrees (from 175 oF to 177 oF). The licensee determined that a two degree rise in jacket water temperature "was not unacceptable."

Analysis.

The team determined this finding to be greater than minor because if left uncorrected it could have lead to a more significant issue, namely a heat exchanger that would be unable to fulfill its safety related function within prescribed temperature limits. This finding is also more than minor because it affected the mitigating system cornerstone attribute of equipment performance of ensuring the availability, reliability, and capability of safety systems. Specifically, the failure to control activities that would affect the results of the thermal performance test is a condition adverse to quality with respect to ensuring that the Division II Standby Diesel Generator jacket water cooler would be capable of performing its design function. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding is determined to have very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. The inspectors reviewed the finding for cross-cutting aspects and none were identified.

Enforcement.

10 CFR Part 50, Appendix B, Criterion XI, "Test Control," states, in part, that test procedures shall include provisions for assuring that all prerequisites for the given test have been met. Contrary to the above, the thermal performance test for the Division II Standby Diesel Generator jacket water cooler conducted in February 2006, did not meet the prerequisite condition that cleaning not be performed prior to the test. Also, the licensee failed to follow their procedure for not retesting the Division II Standby Diesel Generator jacket water cooler after the test was not completed in February 2006, and also for not performing an operability assessment. Because the finding is of very low safety significance (Green) and has been entered into the licensee's corrective action program as Condition Report CR-GGN-2009-00904, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2009006-01, "Preconditioning of Division II Standby Diesel Generator Jacket Water Cooler Heat Exchanger."

.2.9 Division II Standby Diesel Generator Fuel Oil Storage - 1P75B001B:

a. Inspection Scope

The team reviewed safety function, modifications, calculations and analysis assumptions, surveillance data, environmental qualification, system health notebook, and procedures. Specifically, the team verified that the Division II Standby Diesel Generator would have sufficient fuel to perform its safety function, including the use of ultra-low sulfur fuel oil and assumptions that the system would function adequately under conditions representative of worst-case accident conditions. This included consideration of the potential for damage to vent and exhaust lines due to external missiles and the effects of ultra-low sulfur fuel oil on gasket materials.

b. Findings

No findings of significance were identified.

.2.10 Standby Service Water 'B' Pump - 1P41C001B:

a. Inspection Scope

The team reviewed the licensee's system description documents, drawings, maintenance work orders, any condition reports in the last three years related to the Standby Service Water system, and vender manual related to pumps and valves in the system.

b. Findings

Non-conservative Bias in Instrumentation Used for Standby Service Water Leak Detection

Introduction.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for failure to establish adequate measures for the selection and review of equipment and processes suitable of the application.

Specifically, the licensee failed to properly design for pulsation effects on flow rate instrumentation used for Standby Service Water system leak detection, installed to meet a 10 CFR Part 50, Appendix A, General Design Criterion 13, commitment to monitor trends in the ultimate heat sink basin inventory with the system in service.

Description.

To meet 10 CFR Part 50, Appendix A, General Design Criterion 13, "Instrumentation and Control," requirements for preservation of ultimate heat sink inventory, the Standby Service Water systems are equipped with instrumentation for monitoring potential leakage. During system operation, this is accomplished by comparing flow rate readings on the supply and return headers and alarming in the control room if the supply is greater than the return by more than 1250 gpm. At the request of the inspection team, current Data Acquisition System readings for both flow rates were downloaded for comparison. The Train 'B' supply header flow rate was found to be reading approximately 1500 gpm lower than the return flow rate, resulting in a commensurate non-conservative alarm circuit bias. In other words, for an actual leakage rate of up to 2750 gpm, no alarm would be sounded. The licensee then took readings for Train 'A' Standby Service Water system, and determined that an even greater disparity of 2100 gpm existed between supply and return flow rate readings for that train. The original Bechtel data sheet called for an alarm set point of 900 gpm, but after initial plant start-up, this was changed to 1250 gpm with a 60 second time delay to eliminate nuisance alarms. No design basis information could be found for either set point, but it was noted that both values were significantly higher than the leakage rate measurement capability (approximately 0.5 gpm) during system inactivity periods that utilizes system fill tank level readings rather than system flow rates.

The system is operated on average 140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br /> per month, not including plant shutdowns when it is used almost continuously. This represents a relatively large amount of time just prior to a postulated accident event during which monitoring capability is significantly diminished in comparison with original design intent. Should an actual event occur with an undetected leak having started during postulated system operation just prior to the event, the original design (i.e., 900 gpm alarm point) would have given operators an estimated 45 hour5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> window of opportunity to take compensatory actions before the ultimate heat sink basin inventory margin would be lost. In comparison, a 1250 gpm alarm flow rate setpoint coupled with a 2100 gpm instrument bias would reduce this window of opportunity to approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Analysis.

This finding is more than minor because it affected the mitigating system cornerstone attribute of equipment performance of ensuring the availability, reliability, and capability of safety systems. Also, using Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, Section 1-3,"Screen for More than Minor - ROP," question 2, the finding is more that minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the failure to adequately account for design concerns of pulsation effects on the Standby Service Water system leak detection instrumentation is a condition adverse to quality with respect to ensuring that the Standby Service Water system would be capable of performing its design function without requiring make-up to the ultimate heat sink basin for a minimum of 30 days following a postulated accident. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding is determined to have very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. The inspectors reviewed the finding for cross-cutting aspects and none were identified.

Enforcement.

10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires in part, that measures shall be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. Contrary to the above, the licensee failed to establish adequate measures and design criteria for the pulsation dampening features of the flow instrumentation used for leakage detection in the Standby Service Water system to insure adequate protection of ultimate heat sink inventory margin. Because the finding is of very low safety significance (Green) and has been entered into the licensee's corrective action program as Condition Report CR-GGN-2009-1054, this violation is being treated as an NCV violation consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2009006-02, "Non-conservative Bias in Instrumentation Used for Standby Service Water Leak Detection."

.2.11 Residual Heat Removal Heat Exchanger Bypass Valve - 1E12F048B:

a. Inspection Scope

The team reviewed the Updated Final Safety Analysis Report, system design criteria, selected drawings, operating procedures, maintenance records and corrective action documents, along with thrust, degraded voltage, and differential pressure calculations, to verify the capability of the valve to perform its function during design basis events. The team reviewed NRC Generic Letter 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance," calculations and requests for resolution to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis, as well as vendor recommendations.

b. Findings

Motor-Operated Valve Calculations Used Non-conservative Inputs and Methodologies

Introduction.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," because the licensee used non-conservative inputs or methodologies in calculating terminal voltages to safety-related motor-operated valve motors that would be required to operate for mitigation of design bases events. Specifically, the licensee's electrical calculations used non-conservative 50 percent locked-rotor currents and neglected thermal overload resistance, to determine the terminal voltages to safety-related motor-operated valves which would predict higher terminal voltages than would actually exist. The calculated terminal voltages were direct design inputs into the applicable mechanical motor-operated valve thrust and torque calculations. The licensee has entered this issue into their corrective action program as CR-GGN-2009-00985.

Description.

The licensee's design calculations determine the motor terminal voltage and minimum actuator output torque for each safety-related motor-operated valve in their NRC Generic Letter 89-10 program. The calculated motor-operated valve terminal voltages are direct design inputs into the applicable mechanical motor-operated valve thrust and torque calculations. The licensee non-conservatively used the combination of a reduced motor-operated valve locked rotor current of 50 percent of the rated current, and neglected thermal overload resistance to calculate the minimum terminal voltage and minimum actuator output torque for the safety-related motor-operated valves that are required to change state during a design basis event. The use of 50 percent of the rated locked rotor current and neglect of thermal overload resistance for the starting motor-operated valves would predict a significantly higher terminal voltage and actuator output torque than would actually exist.

The licensee's approach was contrary to NRC Generic Letter 89-10, Supplement 1, Question 36, which states that the voltage reduction due to cable impedance should be calculated using the expected in-rush or locked rotor currents of the motor-operated valve. NRC Generic Letter 89-10, Supplement 6, also states that that the licensee must justify the use of any current value less than nominal locked rotor current. NRC Information Notice 92-17, dated February 26, 1992, stated that some licensees had not justified the current used to calculate cable losses and losses caused by the resistance to thermal overload devices in the circuits.

Analysis.

The team determined that failure to adequately evaluate the minimum terminal voltage and actuator output torque for safety-related motor-operated valves was a performance deficiency. The team concluded that the finding was greater than minor in accordance with Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B because it affected the mitigating system attribute of design control of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Also, using, Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more that minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was of very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. This finding has a cross cutting aspect in the area of Problem Identification and Resolution, in that self assessments are of sufficient depth, are comprehensive, are appropriately objective, and are self critical.

The licensee had conducted a Component Design Bases Assessment, LO-GLO-2008-00044 in August 2008, and failed to adequately assess an identical finding identified at River Bend Station during their 2008 Component Design Basis Inspection. The licensee had determined that this issue was not applicable at Grand Gulf Nuclear Station P.3(a).

Enforcement.

10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that design control measures provide for verifying or checking the adequacy of design and design changes are required to be subjected to design control measures commensurate with those applied to the original design. Contrary to the above, the licensee did not adequately evaluate the minimum terminal voltage and actuator output torque for safety-related motor-operated valves. Because this violation, was of very low safety significance (Green), and was entered into the licensee's corrective action program as Condition Report CR-GGN-2009-00985, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 5000416/2009006-03, "Motor-Operated Valve Calculations Used Non-conservative Inputs and Methodologies."

.2.12 Reactor Core Isolation Cooling Steam Supply Valve - 1E51F045:

a. Inspection Scope

The team reviewed the Updated Final Safety Analysis Report, design basis documents, selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the motor-operated valve to perform its intended function during design basis events. The team reviewed NRC Generic Letter 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance," calculations and requests for resolution to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations. The team reviewed the design and testing of the control interlocks and setpoints associated with the valve. The team reviewed electrical calculations to verify the appropriate voltage values were included in the valve calculations. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis.

b. Findings

No findings of significance were identified.

.2.13 125 Vdc High Pressure Core Spray Division III Battery:

a. Inspection Scope

During a plant walk down the team noticed that battery rack seismic clamps were improperly installed. The team reviewed seismic qualification documents, completed battery surveillance test procedures, and drawings to assess the scope of this issue. The team reviewed vendor manuals, maintenance procedures, and completed work instructions to determine if replacement work was performed in accordance with the vendor recommendations for seismic restraints. The team reviewed corrective action documents to determine previous installation issues and adverse trends. The team performed a visual inspection of this battery, the distribution panels, and their environs to assess material condition and the presence of hazards.

b. Findings

Inadequate Corrective Actions for Replacement of Safety-Related Batteries

Introduction.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," for failure to correct a condition adverse to quality related to the seismic qualification of the Division III High Pressure Core Spray safety-related battery. Specifically, the licensee received a Notice of Violation by the NRC in 1997 for failure to identify loose brackets and spaces between cells after installation of a Division II safety-related battery. Corrective actions from the battery condition report that was written required changes to drawings, vendor manuals, work instructions, and calculations for heat load combustibles to preclude any gaps between battery cells for all three battery divisions.

In 2002, the Division III battery was replaced.

During a plant walk down by the NRC on February 17, 2009, a 3/8-inch gap between the end bracket and the end cell of the Division III battery was found. The licensee has subsequently written Condition Report CR-GGN-2009-00830 for this issue and has correctly installed the end bracket on the battery rack, restoring the seismic qualification to the battery.

Description.

The licensee replaced the Division II safety-related 125 Vdc battery in 1997. Subsequent to completing the battery replacement work, an NRC inspector found a one inch gap between one end cell and its associated restraining bracket as well as spaces between individual cells. The NRC inspector wrote a violation for these issues and the licensee generated a condition report CR-GGN-1997-00928 to address these issues. Because the battery rack and battery cells were not in their required seismically tested configuration per the seismic qualification document for this battery, QP-10, Revision 2, an operability determination was required to be written. The licensee performed an evaluation and called the vendor for verification with the conclusion that the battery would be operable for the end gap of one inch. The condition report specifically stated in bold and underlined letters that the drawings, vendor manuals, and procedures would be modified to state that "NO GAPS" were allowed in future battery maintenance and replacement activities. This included specific direction to incorporate these changes into the documents for the smaller Division III battery. In 2002, the Division III safety-related battery was replaced. On February 17, 2009, during a plant walk down, the team found a 3/8-inch gap between the end bracket and the battery for the Division III battery. Also, the team discovered that the licensee had not implemented all of the corrective actions identified in CR-GGN-1997-00928. The licensee has issued Condition Report CR-GGN-2009-00830 and has restored seismic qualifications for this battery by tightening the loose bracket.

Analysis.

The team determined that the failure to adequately correct the drawings, vendor manuals, and work instructions to prevent gaps between the seismic brackets and the battery cells for the Division III battery was a performance deficiency because it was a significant condition adverse to quality which was not corrected as required by 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions." Furthermore, the team determined that it was reasonably within the licensee's ability to identify this issue when installed in 2002 and subsequently during the past six years during daily rounds and during scheduled technical specification surveillances. This finding is more than minor because it affected the mitigating system attribute for protection against external factors that ensures the availability, reliability, and capability of systems that respond to initiating events. Furthermore, it is also more than minor because if the performance deficiency (failure to correct drawings and work instructions) were left uncorrected it would have the potential to lead to a more significant safety concern. The battery rack was not returned to its seismically tested configuration after battery replacement until the inspection team found the issue during this inspection. The previous battery violation in 1997 was on the larger Division II battery with a larger rack than the Division III battery, and the seismic qualification document for the Division II battery (QP10) is slightly different than the seismic qualification document for the Division III battery (QP10.5). Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding did not result in a loss of operability or functionality based on the bounding statement made telephonically with the battery vendor for the one inch gap between the battery end cell and the battery end brackets from the previous operability evaluation performed in 1997 for the Division II battery and its similarities to the Division III battery configuration. The issue was of very low safety significance (Green), because the previous operability determination bounded the condition of the battery and rack and it did not result in the actual loss of safety function. The finding was reviewed for cross-cutting aspects and none were identified.

Enforcement.

10 of CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that the licensee establish measures to ensure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances are promptly identified and corrected. Contrary to the above, from 2002 to February 2009, a condition adverse to quality was not corrected by the licensee. Specifically, in 2002, after replacing the Division III safety-related battery, the licensee failed to reconstruct the seismically qualified Division III safety related battery rack to its designed configuration. Further, the licensee had failed to implement all of the corrective actions recommended from CR-GGN-1997-00928, which had been issued in response to a Notice of Violation, and subsequently, the Division III battery replacement in 2002 replicated the mistakes from the previous battery replacement in 1997. Because the issue was determined to be of very low safety significance (Green), and was entered into the licensee's corrective action program as Condition Report CR-GGN-2009-00830, this violation is being treated as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2009006-04, "Inadequate Corrective Actions for Replacement of Safety-Related Batteries."

.2.14 125 Vdc Division I and II Safety-Related Batteries:

a. Inspection Scope

The team reviewed the 125 Vdc Division I and II safety-related battery service test methodologies to verify that the most limiting conditions of the battery were tested during the service test, including Station Black-Out and Loss of Offsite Power with a Loss of Coolant Accident (LOOP/LOCA). The team reviewed completed battery surveillance test procedures, initial battery sizing calculations, and vendor manuals to assess the scope of this issue. The team performed a visual inspection of this battery, the distribution panels, and their environs to assess material condition and the presence of hazards. Based on the review, the team determined that the most-limiting event for battery endpoint voltage and cell sizing was the LOOP/LOCA profile. For service test considerations, the licensee did not perform a modified performance test. However, in accordance with the Updated Final Safety Analysis Report, the licensee added 20 amps of current to the discharge rate for the calculation of margin in order to ensure that the battery would be able to fulfill its design function. The team verified this aspect as part of the Station Black-Out testing requirements and NRC expectations regarding tests for the batteries based on their most limiting conditions.

b. Findings

No findings of significance were identified.

.3.1 Inadequate Testing Programs for the Standby Diesel Generators, and Class 1E Molded-Case Circuit Breakers

The team identified a finding of very low significance (Green) involving a noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," with two examples. Specifically, the team identified that the licensee failed to develop and implement adequate testing programs for the voltage and frequency response of the standby diesel generators, and for the Class 1E molded-case circuit breakers.

Example 1: Inspection of NRC Information Notice 2007-36, Emergency Diesel Generator Voltage Regulator Issues:

a. Inspection Scope

The team reviewed NRC Information Notice 2007-36, which documented the concern of standby diesel generators to provide emergency alternating current power in response to loss of offsite power events. The standby diesel generators are required to be operable as specified in plant technical specifications. The voltage regulator systems of the standby diesel generators have experienced approximately fifty malfunctions at various plants during the last ten years. The problems are of various types and are not limited to a typical single component or model of the voltage regulator. In general, the performance of a voltage regulator is very sensitive to any minor defects in any component of the voltage regulation system.

b. Findings

Inadequate Testing Program for the Standby Diesel Generators:

Introduction.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for failure to incorporate the requirements and acceptance limits contained in applicable design documents into the standby diesel generator test procedures.

Description.

Updated Final Safety Analysis Report Section 3.1 identified that the licensee was committed to NRC Regulatory Guide 1.9, "Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Power Systems at Nuclear Power Plants," Revision 3. Updated Final Safety Analysis Report, Section 8.3, page 8.3-35a, states, "The decrease in frequency and voltage has been verified to be 95 and 80 percent of nominal, respectively. Recovery of voltage and frequency to within 10 percent of nominal and within 2 percent of the pre-sequence value, respectively, has been verified to be accomplished within 60 percent of the sequencing interval of 5 seconds." Regulatory Guide 1.9, Revision 3, Section C.1.4 states in part, "The diesel generator unit design should be designed such that at no time during the loading sequence should the frequency decrease to less than 95 percent of nominal nor the voltage decrease to less than 75 percent of nominal. Frequency should be restored to within 2 percent of nominal and voltage should be restored to within 10 percent of nominal within 60 percent of each load-sequence time interval." Section 2.3.2.3 also states in part, "Overall standby diesel generator unit design capability should be demonstrated at every refueling outage." During the review of Surveillance Procedure 06-OP-1P75-R-0004, performed every 18 months, the team determined the licensee failed to incorporate adequate acceptance limits identified in Regulatory Guidance 1.9 into their test procedure. The team determined that 06-OP-1P75-R-0004 only verified that the steady state voltage and frequency of the emergency busses was maintained at greater than 3,740 Vac and less than 4,576 Vac and greater than 58.8 Hertz and less than 61.2 Hertz, respectively, during the test. Based on review of the data collected during performance of 06-OP-1P75-R-0004, the team could not verify that the response of the standby diesel generator exciter/voltage regulator and governor control system was capable of accelerating the loads and remaining within the design requirements. The licensee could not provide objective evidence that the information identified in Regulatory Guide 1.9, Revision 3, as stated in Updated Final Safety Analysis Report, Section 8.3, page 8.3-35a, had been verified (i.e. such that at no time during the loading sequence should the frequency decrease to less than 95 percent of nominal nor the voltage decrease to less than 75 percent of nominal). The sudden large increases in current drawn from the diesel generator resulting from the sequencing of large induction motors can result in substantial voltage reductions. The lower voltage could prevent a motor from starting, i.e., accelerating its load to rated speed in the required time, or cause a running motor to coast down or stall. Other loads might be lost if their contactors drop out. Recovery from the transient caused by starting large motors or from the loss of a large load could cause diesel engine over-speed which, if excessive, might result in a trip of the standby diesel generator engine. These same consequences can also result from the cumulative effect of a sequence of more moderate transients if the system is not permitted to recover sufficiently between successive steps in a loading sequence. Although the design requirements of the standby diesel generator may have been verified by the vendor or by the licensee during pre-operational testing, any changes/adjustments (tuning), including component drift and degradation to the governor control system or exciter/voltage regulator system may have adversely affected the response of the standby diesel generator to load changes if not verified by testing and documenting periodically. The licensee has entered this issue in their corrective action program as Condition Report CR-GGN-2009-00984.

Analysis.

The team determined that failure to verify that the voltage and frequency response of the standby diesel generator during design basis load sequencing as identified in the information contained in Regulator Guide 1.9 and the Updated Final Safety Analysis Report was a performance deficiency. The team further determined that the issue was within the licensee's ability to foresee and correct the error because the licensee had performed 06-OP-1P75-R-0004 each refueling outage and could have recognized the deficiency. The team concluded that the finding was greater than minor in accordance with Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, because it affected the mitigating systems cornerstone attribute of design control for ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Also, using Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more that minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was of very low safety significance (Green) because it was a design deficiency that did not result in actual loss of safety function. This finding has a cross cutting aspect in the area of Problem Identification and Resolution, in that self assessments are of sufficient depth, are comprehensive, are appropriately objective, and are self critical. The licensee had conducted a Component Design Bases Assessment, LO-GLO-2008-00044 in August 2008, and failed to adequately assess an identical finding identified at River Bend Station during their 2008 Component Design Basis Inspection. The licensee had determined that this issue was not applicable at Grand Gulf Nuclear Station P.3(a).

Enforcement.

10 CFR Part 50, Appendix B, Criterion XI, "Test Control," requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptable limits contained in applicable design documents.

Contrary to the above, the licensee failed to require verification that the voltage and frequency response of the standby diesel generator during performance of Surveillance Test Procedure 06-OP-1P75-R-0004 had met the acceptable limits contained in applicable design documents. Because this violation was of very low safety significance (Green) and was entered into the corrective action program as Condition Report CR-GGN-2009-01057, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2009006-05, Two Examples of a Failure to Meet 10 CFR Part 50, Appendix B, Criterion XI, "Test Control." This was the first of two examples.

Example 2: Inspection of NRC Information Notice 2007-34, Operating Experience Regarding Electrical Circuit Breakers:

a. Inspection Scope

The team reviewed NRC Information Notice 2007-34, which documented the concern of electrical circuit breakers being operable to satisfy many technical specification requirements, which includes technical specifications related to electrical power. For a system to be considered operable, it must have all necessary attendant instrumentation, controls, and normal or emergency electrical power. Circuit breakers are relied upon to provide electrical power to equipment credited in accident analysis. Because licensees often use circuit breakers of the same type and manufacturer in redundant trains of several safety systems, certain breaker problems raise the possibility of a common mode failure.

b. Findings

Inadequate Testing Program for Class 1E Molded-Case Circuit Breaker

Introduction.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for failure to implement a molded-case circuit breaker preventive maintenance and testing program current with industry and NRC operating experience thus ensuring that the installed safety related and important-to-safety molded-case circuit breakers did not degrade and would perform satisfactorily in service. The licensee has entered this into their corrective action program as Condition Report CR-GGN-2009-01024.

Description.

The team identified that the Class 1E molded-case circuit breakers are not under any periodic preventive maintenance and testing program with the exception of the molded-case circuit breakers associated with containment penetration circuits. The team noted that considerable industry experience was available regarding molded-case circuit breaker problems, including NRC Information Notice 93-64, "Periodic Testing and Preventive Maintenance of Molded Case Circuit Breakers," which identified generic concerns with aging of molded-case circuit breakers. In particular, NRC Information Notice 93-64 stated that detecting or assessing degradation could only be accomplished through appropriate periodic testing and monitoring. Certain standard molded-case circuit breaker tests (such as individual pole resistance, 300-percent thermal overload, and instantaneous magnetic trip tests) performed periodically were found effective. NRC NUREG/CR-5762, 1992, "Comprehensive Aging Assessment of Circuits Breakers and Relays," states that failure of circuit breakers can lead to loss of mitigating capability and inadvertent actuations. Circuit breakers which fail to isolate faults can cause significant damage to associated equipment, increase the chance of fires, and lead to the loss of multiple systems.

IEEE Standard 308-1980, section 7.4.1, states that testing shall be performed at schedule intervals to: 1) Detect within practical limits the deterioration of the equipment toward an unacceptable condition, and 2) Demonstrate that standby equipment & other components that are not exercised during normal operation of the station are operable. IEEE 308 is endorsed by NRC Regulatory Guide 1.32. Updated Final Safety Analysis Report, section 3.1, documents that the licensee is committed to the standards and guides mentioned above. ANSI/IEEE 242-1986, section 15.3, states that circuit breakers must be electrically tripped to assure proper operation. Experience has indicated that if breakers are allowed to remain in service for an extended period of time without an electrical operation, the internal mechanism and joints may become stiff so that the circuit breaker operates improperly when subjected to abnormal current. Other industry standards, such as NEMA AB-4, "Guidelines for Inspection and Preventive Maintenance of Molded-Case Circuit Breakers," additionally provide the recommended industry good practices to ensure molded-case circuit breaker reliability. Contrary to the industry operating experience and guidance on establishing an effective preventive maintenance and testing program for molded-case circuit breakers, molded-case circuit breaker vendor recommendations, and the licensee Preventative Maintenance Basis Template for molded-case circuit breakers, the licensee failed to incorporate this guidance and its associated recommendations into maintenance practices and work orders except for those associated with containment penetration circuits.

Analysis:

The team determined that the licensee's failure to ensure that safety related and important-to-safety molded-case circuit breaker periodic test and preventive maintenance program remained current with industry and NRC operating experience was a performance deficiency. The team further determined that the issue was within the licensee's ability to foresee and correct, and that it could have been prevented because the NRC had provided generic communications about breaker testing, specifically, NRC Information Notice 93-64 and other industry guidance. This finding is more than minor because it affected the mitigating systems cornerstone attribute of equipment performance for ensuring the availability, reliability, and capability of systems that respond to initiating events. Also, using Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix B, Section 1-3, "Screen for More than Minor - ROP," question 2, the finding is more that minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was of very low safety significance (Green), because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. This finding has a cross cutting aspect in the area of Problem Identification and Resolution, in that self assessments are of sufficient depth, are comprehensive, are appropriately objective, and are self critical.

The licensee had conducted a Component Design Bases Assessment, LO-GLO-2008-00044 in August 2008, and failed to adequately assess an identical finding identified at River Bend Station during their 2008 Component Design Bases Inspection. The licensee had determined that this issue was not applicable at Grand Gulf Nuclear Station P.3(a).

Enforcement:

The 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," states, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to the above, the licensee failed to assure that installed safety-related and important-to-safety molded-case circuit breakers are in a periodic testing and preventive maintenance program to ensure that the molded-case circuit breakers would not degrade and would perform satisfactorily in service. Because this violation was not willful, was of very low safety significance (Green), and was entered into the licensee's corrective action program as Condition Report CR-GGN-2009-01024, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2009006-05, Two Examples of a Failure to Meet 10 CFR Part 50, Appendix B, Criterion XI, "Test Control." This was the second of two examples.

.3.2 Inspection of NRC Information Notice 2006-26, Failure Of Magnesium Rotors In MOV Actuators:

a. Inspection Scope

The team reviewed NRC Information Notice 2006-26, which documented recent failures of motor-operated valve (MOV) actuators as a result of galvanic corrosion, general corrosion, and/or thermally induced stress. These failures highlight the particular vulnerabilities of motor actuators with magnesium rotors, particularly when the motor is located in a high humidity and/or high temperature environment. These motor-operated valve failures illustrate the necessity of adequate inspection and/or preventive maintenance on actuators manufactured with magnesium rotors. The team reviewed current inspection work orders instructions, and actual inspection documentation for inspections performed.

b. Findings

No findings of significance were identified.

.3.3 Inspection of NRC Information Notice 2007-27, Recurring Events Involving EDG Operability:

a. Inspection Scope

The team reviewed licensee response to this information notice under their Operating Experience Program. The team reviewed the Operating Experience process and self-assessments. The team evaluated the licensee response to each of the four specific issues listed in NRC Information Notice 2007-27, which dealt with industry problems associated with standby diesel generators, including an assessment as to whether the issues were examined narrowly or broadly. The team also reviewed condition reports to determine whether the licensee responses have been effective in avoiding the problems discussed in the information notice.

b. Findings

No findings of significance were identified.

.3.4 Inspection of NRC Generic Letter 2007-01, Inaccessible or Underground Power Cable Failures that Disable Accident Mitigation Systems or Cause Plant Transients:

a. Inspection Scope

The team reviewed the generic letter, which documented failures of safety-related cables and their associated systems at several sites due to long-term exposure to moisture. In NRC Generic Letter 2007-01 the NRC requested the status of all cable failures for those cables that were inaccessible or underground as well as a description of inspection, testing, and monitoring programs for these cables. The team reviewed the licensee's response to this generic letter, which reported one cable failure in 2003 for a fire pump. The team also reviewed the related Information Notice 2002-12, which documents several cable failures at several plants due to water intrusion. The team reviewed drawings, cable design and testing specifications, work instructions for sump pumps, and megger test data. The team inspected five electrical vaults via manhole cover removal by licensee staff and found three of the five vaults to be completely full of water.

b. Findings

Inadequate Design Control for Standby Service Water Pump Cables and Electrical Vaults

Introduction.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," because the licensee failed to adequately demonstrate operability for the 4160 Vac Standby Service Water Pump kerite cables through adequate testing and analysis in a continuously submerged environment. Furthermore, the continuously submerged environment for these cables exists because each of the two vaults that contain these cables (MH-20 and MH-21) has a design flaw in that several other vaults gravity drain to them and the design of these vaults did not include a sump pump or other means for water to be removed or drained from them.

Since NRC Information Notice 2002-12 and Generic Letter 2007-01 were issued, the licensee failed to implement a thorough preventive maintenance program for all of the safety-related cables contained in these vaults. The Standby Service Water Pump cables are meggered on a biennial basis and are currently operable based on this test.

The licensee has subsequently written Condition Report CR-GGN-2009-01028 to address this issue.

Description.

The team received a work instruction template #10942 (for work performed in December of 2008) provided by the resident inspector that documented five vaults (or manholes) out of fifteen whose sump pumps and/or level switches were inoperable, including MH-08, MH-14, MHS-01, MHS-17, and MH-05. The team inspected five vaults for water and found water in three of the five. Specifically, the team inspected vaults MH-01, MH-02, MHS-01, and MHS-17 from this list for water and found water in MHS-01 and MHS-17. The team also inspected vault MH-20 because it contained 4160 Vac safety-related cables for Standby Service Water pumps and because it did not have a sump pump in it and found it to be completely full of water. The team verified that the design of vault MH-21 was similar to vault MH-20 regarding the design deficiency. The licensee informed the team that vault MH-21 was identical to vault MH-20 except that it contains the Division II cables while vault MH-20 contains the Division I cables for Standby Service Water pumps. The licensee later reported to the team that vault MH-21 had 18 inches of water in it.

The team noted in the licensee's response to NRC Generic Letter 2007-01, they did not have any preventive maintenance tasks in place to specifically test underground cables but indicated that some underground cables were periodically tested as part of other electrical equipment testing, such as meggering. The licensee also communicated that preventive maintenance tasks were in place to periodically test manholes with installed dewatering equipment and that condition reporting would be used to determine the cause and extent of conditions where deemed necessary, and would be the mechanism for determining the need to increase cable monitoring. The team noted that five sump pumps for electrical vaults had been out of service for at least four years, and several of these vaults contained safety-related and security-related equipment. The work requests had been written to repair the sump pumps but the work had never been done.

During interviews with plant staff engineers, the team determined that the licensee had incorrectly interpreted the original cable specifications. The licensee thought that the cable specifications, which included one test where the cables were submerged for five minutes, were designed to be completely submerged in water for the 40 year life of the plant with no concern of cable degradation. Upon further review of the cable specifications, consultation with the NRC Office of Nuclear Reactor Regulation, and discussion with the licensee, the team determined that these kerite cables were not designed to be continuously submerged and could fail over time based on current operating experience examples mentioned in NRC Generic Letter 2007-01 and NRC Information Notice 2002-12. Lastly, the team verified that the latest megger tests for the Standby Service Water pump cables (May of 2008) were acceptable for demonstrating operability for 2008.

The licensee has pumped the vaults dry and is preparing an evaluation plan that included the loads whose cables were in these various flooded vaults. The team also questioned the licensee on the need for an immediate operability assessment for the Standby Service Water pump cables and any other affected loads.

Analysis.

The team determined that the failure to adequately demonstrate operability for the 4160 Vac Standby Service Water Pump cables through adequate testing and analysis in a continuously submerged environment and failure to identify design issues for vaults MH-20 and MH-21 (both divisions) were both considered performance deficiencies. This finding is more than minor because it affected the mitigating system cornerstone attribute of design control for ensuring the availability, reliability, and capability of safety systems, and closely parallels Inspection Manual Chapter 0612, Appendix E, Example 3.j, because there was reasonable doubt on the continued operability of the Standby Service Water system. Using the Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to be of very low safety significance (Green), because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not affect external event mitigation. The inspectors determined that the finding has a crosscutting aspect in the area of Problem Identification and Resolution in that the licensee failed to implement Operating Experience directly communicated with a Generic Letter through changes to station processes, procedures, and equipment P.2(b).

Enforcement.

10 CFR Part 50, Appendix B, Criterion III, "Design Control," states, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee failed to implement applicable design bases for the Standby Service Water System Pump 4160 Vac cables. Specifically, the licensee incorrectly interpreted the cable design specifications to include continuously submerged environments and also failed to consider that the two vaults containing these cables have design deficiencies in that water that drains into these vaults has no pathway or motive force to be removed. Because this finding is of very low safety significance (Green), and was entered into the licensee's corrective action program as Condition Report CR-GGN-2009-01028, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2009006-06, "Inadequate Design Control for Standby Service Water Pump Cables and Electrical Vaults."

.4 Results of Reviews for Operator Actions:

The team selected risk-significant components and operator actions for review using information contained in the licensee's probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6.

a. Inspection Scope

For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant. Inspection Procedure 71111.21 requires a review of three to five relatively high-risk operator actions. The sample selection for this inspection was five operator actions.

The selected operator actions were:

• Reactor Core Isolation Cooling recovery from Station Black Out isolation for Main Steam Tunnel High Temperature Isolation (JPM)

• Loss of Offsite Power with 1 Standby Diesel Generator (SDG) out of service and the last SDG does not auto-close on the emergency bus with the potential for Station Black-Out

• Reactor Core Isolation Cooling fails to auto-start, manual start required (Scenario)

• Vent Containment during Hi-Hi Pressure conditions during Loss of Coolant Accident (LOCA) with several injection systems unavailable (JPM)

• Emergency Depressurize during LOCA conditions (Scenario)

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The team reviewed a sample of problems that the licensee had identified previously and entered into the corrective action program. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions. In addition, condition reports written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action system. The specific documents that were sampled and reviewed by the team are listed in the attachment.

b. Findings

. An issue identified during this inspection was directly attributable to improper resolution of identified problems. Specifically, in 2002, after replacing the Division III safety related batteries, the licensee failed to reconstruct the seismically qualified Division III safety related battery rack to its designed configuration. Further, the licensee had failed to implement all of the corrective actions recommended from Condition Report CR-GGN-1997-00928, which had been issued in response to a Notice of Violation, and subsequently, the Division III battery replacement in 2002 replicated the mistakes from the previous battery replacement in 1997. This issue is discussed in Section 1R21.2.13 of this report. Also, the licensee did not take advantage of their established assessment programs. The licensee performed a Component Design Bases Assessment, LO-GLO-2008-00044, in August 2008, and reviewed the results of the River Bend Station Component Design Bases Inspection which took place in May and June 2008. There were numerous violations identified during the River Bend Station Inspection. The licensee's assessment of the violations identified at the River Bend Station was that the violations were not applicable to Grand Gulf Nuclear Station. There are two non-cited violations identified in this report, one of which has two examples, in which the licensee had opportunities to address, prior to this inspection. Sections 1R21.2.11, and 3.1, deal with identical violations that were identified at River Bend Station.

4OA6 Meetings, Including Exit

On February 27, 2009, the team leader presented the preliminary inspection results to Mr. Douet, Site Vice President, Grand Gulf Nuclear Station, and other members of the licensee's staff.

On April 2, 2009, the inspection team leader conducted a telephonic final exit meeting with Mr. Browning, General Manager, Plant Operations, and other members of the licensee's staff. The licensee acknowledged the findings during each meeting. While some proprietary information was reviewed during this inspection, no proprietary information was included in this report.

4OA7 Licensee Identified Violations

None. Attachments: 1 - Supplemental Information ATTACHMENT