IR 05000245/2011008

AA -106, "lnfrequently Conducted orComplex Evolutions," establishes expectations for the need to stop the test orevolution when unexpected conditions arise or unexpected behavior is experienced.However, as the

BOP [[]]

RO placed turbine first stage pressure feedback in service, henoted an increase in first stage pressure and incorrectly pressed the turbine load setINCREASE pushbutton instead of the

DECREA [[]]

SE pushbutton. When the

BOP [[]]

RO did not get the desired response, he depressed the

INCREA [[]]

SE pushbutton threemore times, followed by two depressions of the

DECREA [[]]

SE pushbutton, rather thanstopping in the face of uncertainty as expected. The actions by the

BOP [[]]

RO resultedin a rapid, unintended reactor power rise.Enclosure

b.IDominion Procedure

AP -300, "Reactivity Management," states the ShiftTechnical Advisor will provide engineering expertise to shift operators, as required,during periods of significant reactivity changes. However, the

STA was peer-checking the turbine manipulations and did not identify that the

BOP [[]]

RO actionswere incorrect. Because the

STA [[was dedicated to supporting the turbine evolutionas the peer checker, he was unable to remain within his assigned role and did notprovide his engineering expertise to the crew regarding the multiple inappropriatereactivity additions by other members of the crew.Dominion Procedure]]

AA -100, "Conduct of Operations," states the UnitSupervisor will provide oversight of plant operations and ensure the plant is operatedsafely in accordance with procedures. Dominion Procedure

AP -300, "ReactivityManagement," states the Unit Supervisor will direct reactivity changes and ensurereactivity manipulations are made in a deliberate, carefully controlled manner.However, the

US was focused on the turbine evolution during the event and did notprovide effective oversight to the crew in responding to the power rise. The

US alsodid not initially identify that the

BOP [[]]

RO should have been depressing theDECREASE rather than the

INCREA [[]]

SE pushbutton. After the

SM directed the

US toresume his oversight role, the

US did not clearly report to the rest of the crew that apower increase was in progress.Dominion Procedure

OP -AA-100, "Conduct of Operations," states the Shift Managerwill maintain a broad perspective of plant operations as the senior managementrepresentative on shift. However, the

SM did not recognize that turbine operationswere causing changes in plant parameters. He observed the closure of the partiallyopen turbine bypass valve and, believing this to be the result of the effects of fissionproduct poison build-in, directed the

OATC [[]]

RO to lower the turbine bypass valvecontroller setpoint to re-open the valve.Dominion Procedure

OP -AP-300, "Reactivity Management," States the ReactorOperator will stop and question unexpected situations involving reactivity, criticality,power level, or core anomalies and will meet the anomalous indication withconservative action. However, the

OATC [[]]

RO , who was adding positive reactivity bydiluting the

RCS at the time, followed the

SM [['s direction without question andadjusted the turbine bypass valve setpoint to reopen the valve, thereby addingadditional positive reactivity to the core. The Millstone Unit 2 control room crew hadpracticed the control valve testing evolution on the simulator two days prior to theevent with the]]

OATC [[]]

RO monitoring the turbine bypass valve position. This trainingapparently led the

OATC [[]]

RO to think his primary responsibility during the event wasturbine bypass valve monitoring and control rather than his other reactivity controlresponsibilities as the Operator at the Controls.Dominion Procedure

SM directed the Reactivity

AP [[-300, "Reactivity Management," States that addingpositive reactivity is never an appropriate way to address unstable plant conditions,and also that it is non-conservative to withdraw control rods in an attempt to restoreprimary coolant temperature during a transient. However, after directing reopening ofthe turbine bypass valve, the]]

SRO to withdraw one bankd.e.f.Enclosure

10of control rods four steps to raise reactor temperature. This action added positivereactivity, thereby further exacerbating the power increase.g. Dominion Procedure

AP -300, "Reactivity Management," states the ReactivitySRO reports to the Unit Supervisor, has no concurrent duties, directly monitors thereactivity change, and will provide peer checks for the reactor operator for allreactivity manipulations. The Reactivity

SRO had been monitoring the rodrepositioning and

RCS dilutions that were performed by the

OATC [[]]

RO as expected.When the

OATC [[]]

RO began monitoring turbine bypass valve position, the ReactivitySRO continued to monitor the ongoing

RCS dilution. The Reactivity

SRO believedthat if he needed to personally manipulate any controls, he would no longer be actingas the Reactivity

SRO. When the

SM directed rod withdrawal, the Reactivity

SRO glanced at a digital readout of

RCS temperature, and, not noticing any change in theparameter, incorrectly concluded the plant was not in a transient and withdrewcontrol rods.h. Dominion Procedure

AA -106, "lnfrequently Conducted or Complex Evolutions,"states the Senior Operations Manager assigned to oversight of the test will ensuretests are conducted in a manner that maximizes the margin of safety of the Unit. AnSRO-licensed and

SM and for specificactions for power operation and transients involving multiple reactivity additions.Specific examples of these failures are provided below:a. At the onset of the event, the]]

RPS [[]]

VHT setpoints were below 96 percent. During theturbine transient, reactor power increased toward the

VHT setpoints. The ReactivitySRO observed the illumination of the

VHT setpoint reset permissive lights (one lightper

RPS [[channel), and incorrectly assumed they were illuminating due to minorpower fluctuations associated with the fission product poison increase and on-goingdilution. Consequently, he increased the margin to the trip setpoint by resetting theVHT setpoints upward four times during the power rise. lf the]]

SRO had not reset the

VHT , the

RPS would have automatically initiated a high power reactor trip due to themagnitude of the power increase from 88 percent to 96 percent. In addition topreventing the automatic trip, the Reactivity

SRO did not understand or question whyreactor power was increasing, and did not inform anyone on the crew of his actionsto reset the VHT setpoints. The inspection team reviewed existingEnclosure

11station procedures, and determined that there was no procedural prohibition forresetting the

VHT setpoint under any conditions.b. During the turbine steam flow increase power transient event (which introducedpositive reactivity to the reactor), the crew also added positive reactivity by 1) an on-going

RCS [[dilution, 2) opening a turbine bypass valve, and 3) withdrawing controlrods. The inspection team identified that station reactivity management proceduresdid not provide adequate guidance regarding multiple, concurrent, positive reactivityadditions during power operations.Analvsis: The performance deficiency was the failure of Millstone personnel to carry outtheir assigned roles and responsibilities and poor reactivity management during mainturbine control valve testing, which contributed to the unanticipated reactor powerincrease. Specifically, the Millstone Unit 2 operations crew failed to implement writtenprocedures that delineated appropriate authorities and responsibilities for safe operationand shutdown and a procedure for controlling reactor reactivity. In addition, the licenseefailed to establish written procedures for the]]

RPS [[]]

VHT [[setpoint reset and for poweroperation and transients involving multiple reactivity additions. Multiple factorscontributed to this deficiency; however, the primary cause was ineffective reinforcementof Dominion standards and expectations. Traditional enforcement does not apply sincethere were no actual safety consequences, impacts on the]]

NRC [['s ability to perform itsregulatory function, or willful aspects to the finding.The finding is more than minor because the finding was associated with the HumanPerformance attribute of the Initiating Events cornerstone and affected the cornerstoneobjective of limiting the likelihood of those events that upset plant stability and challengecritical safety functions during power operations. Additionally, the]]

PD could be viewedas a precursor to a significant event. Because the finding primarily involved humanperformance errors, probabilistic risk assessment tools were not well suited forevaluating its significance. The team determined that the criteria for using IMC 0609,Appendix M, "significance Determination Process Using Qualitative Criteria," were met,and the finding was evaluated using this guidance as described in Attachment 4 to thisreport. Based on the qualitative review of this finding, regional management concludedthe finding was preliminarily of low to moderate safety significance (preliminary White).The completed Appendix M table is attached (Attachment 4). There were no immediatesafety concerns following the transient because the event itself did not result in powerexceeding license limits or fuel damage. Additionally, interim corrective actions weretaken, which included removing the Millstone Unit 2 control room crew involved in thetransient from operational duties pending remediation, and establishment of continuousmanagement presence in the Millstone Unit 2 control room while long term correctiveactions were developed.This finding had a cross-cutting aspect in the Human Performance cross-cutting area,Decision Making component, because Dominion licensed personneldid not demonstrateadequate operational decision-making, especially when faced with uncertain orunexpected plant conditions. This includes formally defining the authority and roles fordecisions affecting nuclear safety, communicating these roles to applicable personnel,and implementing these roles and authorities as designed H.1(a).Enclosure

2Enforcement: The team identified two apparent violations of Technical Specification 6.8,"Procedures," which states, in part, that written procedures shall be established,implemented, and maintained covering the applicable procedures recommended inAppendix "A" of Regulatory Guide (RG) 1.33, February, 1978. Regulatory Guide 1.33,Appendix "A," Paragraph 1, "Administrative Procedures," requires written procedures forauthorities and responsibilities for safe operation and shutdown as well as general plantoperating procedures appropriate for power operation and transients. Regulatory Guide1.33, Appendix A, Paragraph 3, "Procedures for Startup, Operation, and Shutdown ofSafety-Related

PWR [[Systems," requires, in part, written procedures for changing modesof operation, as appropriate, for the reactor control and protection system. RegulatoryGuide 1.33, Appendix A, Paragraph 5, "Procedures Abnormal, Off-normal, or AlarmConditions," requires, in part, written procedures for other expected transients that maybe applicable.The first apparent violation involved the failure of the Millstone Unit 2 control room crewto implement written procedures that delineated appropriate authorities andresponsibilities for safe operation and shutdown and a procedure for controlling reactorreactivity. As noted in the Description section above, on February 12,2011, the sevenoperators in the control room (4]]

SRO s,

2 RO [[s and 1 non-licensed operator)inadequately implemented Dominion procedures for authorities and responsibilities forsafe operation and shutdown during the performance of main turbine controlvalvetesting. The inappropriate actions of the operators directly contributed to anunanticipated 8 percent increase in Millstone Unit 2 reactor power'The second apparent violation involved the licensee's failure to establish writtenprocedures for the]]

RPS [[]]

VHT setpoint reset and for power operation and transientsinvolving multiple reactivity additions. As noted in the Description section above, onFebruary 12,2011, Dominion did not have written procedures regarding operation of theMillstone Unit 2

VHT setpoint reset pushbuttons (a part of the reactor protection system)during steady-state or plant transient conditions. As a result, during the unanticipatedplant transient on February 12,2011, a Millstone Unit

2 SRO reset the

VHT setpoint atotal of four times without adequate guidance from a plant procedure, thereby prohibitingthe automatic trip that would have occurred, had the

VHT [[setpoint not been reset.Additionally, Dominion did not have an adequate written procedure related to reactivitycontrol regarding multiple concurrent positive reactivity additions during at-poweroperations. Specifically, during the unanticipated reactor transient event, three separatepositive reactivity additions occurred (]]

RCS dilution, manual opening of a turbine bypassvalve, and manual withdrawal of control rods), and the existing procedures did notprovide guidance to address this situation.Following review of the event, the licensee documented the condition in the correctiveaction process (CR 413602). lmmediate corrective actions included removal of theMillstone Unit 2 control room crew involved in the transient from operational dutiespending remediation, issuance of a Standing Order regarding VHT setpoint reset, andestablishment of continuous management presence in the Millstone Unit 2 control roomwhile long term corrective actions were developed.Enclosure

2.213Pending determination of final safety significance, this finding with the associatedapparent violations will be tracked as

AV [[05000336/2011008-01, Multiple Examples ofProceduralViolations and Inadequate Procedures Relating to Control Room CrewPerformance During a Plant Transient.Turbine OperationInspection ScopeThe team interviewed the control room personnel that were directly involved with theturbine load increase during the Febr:uary 12,2011, unanticipated reactor transientevent. The team also reviewed narrative logs, sequence of events and alarm printouts,condition reports,]]

PPC [[trend data, procedures implemented by the crew, and proceduresregarding roles and responsibilities of operations personnel.Find inos/Observationslmproper Operation of Turbine Control Valves During Testinqlntroduction: The inspectors identified a self-revealing finding of very low safetysignificance (Green) for improper operation of the Millstone Unit 2 turbine controls duringturbine control valve testing. Specifically, the inspectors identified that Millstone Unit 2control room operators failed to correctly implement surveillance procedure]]

SP [[-2651N,"Main Control Valve Testing." Incorrect operation of the turbine controls contributed toan unplanned reactor power increase from 88 percent to 96 percent'Description: On February 12,2011, the Millstone Unit 2 control room operatorsincorrectly performed step 4.1 .1 3.c of]]

SP [[-2651 N while conducting main turbine controlvalve testing. This step required the operator to use the turbine load selector pushbuttonto maintain turbine first stage pressure within t10 psig of the initial pressure for thecurrent power level, 88 percent. However, in response to an increasing trend in firststage pressure, the control operators improperly selected "INCREASE" on the turbineload set selector pushbutton instead of "DECREASE". This action caused the turbinecontrol valve to further open and compounded the increasing trend in turbine first stagepressure. The control operators pushed the "INCREASE" pushbutton a total of fourtimes before the operators recognized that they should have, instead, pressed the"DECREASE" pushbutton. The operators subsequently took action to stop the powerincrease and stabilize the plant by depressing the "DECREASE" push button twice. Theunexpected turbine load increase resulted in a plant transient, raising reactor power from88 percent to 96 percent before power was stabilized.The]]

STA conducted peer checking for the control operator during the control valvetesting evolution and the

US closely supervised the operation of the turbine controls.Both individuals failed to identify or correct the mis-operation of the turbine load selector.All three operators then failed to communicate the extent of the plant transient to the SMwhich contributed to additional human performance errors, thereby exacerbating theplant transient.a.b.Enclosure

14Analysis: The team determined that the control room operator's failure to correctlyimplement step 4.1 .13.c of

SP [[-2651 N was a performance deficiency. The cause of thisperformance deficiency was reasonably within Dominion's ability to foresee and correctto ensure proper operator response during turbine control valve testing. Traditionalenforcement does not apply since there were no actual safety consequences, impactson the]]

NRC 's ability to perform its regulatory function, or willful aspects to the finding.The finding is more than minor because it was similar to

NRC [[Inspection ManualChapter 0612, Appendix E, "Examples of Minor lssues," Example 4b, in that theincorrect operation of the turbine load selector pushbutton caused a plant transient.The finding was associated with the Human Performance attribute of the InitiatingEvents cornerstone and affected the cornerstone objective of limiting the likelihood ofthose events that upset plant stability and challenge critical safety functions duringpower operations. Specifically, the mis-operation of the turbine load selector upset plantstability by causing a plant transient that raised reactor power from 88 percent to 96percent. The inspectors conducted a Phase 1 screening in accordance with]]

NRC [[]]

IMCA [[ttachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," anddetermined that the finding was of very low safety significance (Green) because it did notcontribute to both the likelihood of a reactor trip and the likelihood that mitigationequipment or functions would not be available.The inspectors determined that this finding had a cross-cutting aspect in the HumanPerformance cross-cutting area, Resources component, because Dominion did notprovide adequate training of personnel and sufficient qualified personnel H.2(b). Thejust-in-time training (]]

JITT ) for turbine control valve testing had not adequately preparedthe control room operators to respond to a change in turbine first stage pressure. lnaddition, the use of the

STA [[for peer checking, although not prohibited by plantadministrative procedures, had been previously identified during recent (May 2010)licensed operator requalification training in plant-specific operating experience as beinga contributing cause for a plant transient during control valve testing on Unit 3 in 20Q7.Nevertheless, the shift allowed the]]

STA [[, who was not licensed, to be the peer checkerfor this evolution in place of a qualified licensed reactor operator.Enforcement: This finding does not involve enforcement action because no regulatoryrequirement violation was identified. Dominion entered this issue into their correctiveaction program (CR415094) and conducted an]]

RCE to determine corrective actions toprevent recurrence. Because this finding does not involve a violation of regulatoryrequirements and has very low safety significance, it is identified as

FIN05000336/2011008-02, lmproper Operation of Turbine Gontrol Valves DuringTesting.Enclosure

3.3.115Orqanizational Responselmmediate ResponseInspection ScopeThe team interviewed personnel, reviewed various procedures and records, andobserved control room operations to assess immediate response of station personnel tothe unanticipated reactor power transient event.FindinqsNo findings of significance were identified.The team noted that Dominion's initial response to the event was not appropriatelythorough and timely, did not highlight the significance of the unplanned power increaseand reactivity control issues, and was narrowly focused. Following postevent plantstabilization, a crew brief was conducted to assure good common understanding oftransient and to determine whether testing should proceed. However, the crew did notidentify the many human performance issues during the event, including control rodwithdrawal,

VHT [[reset, steam dump operation, multiple communication errors, andincorrect transient diagnoses.lnitially, Dominion personnel incorrectly concluded that Unit 2 reactor power increasedby four percent (rather than the actual eight percent) during the transient. This extent ofpower increase was challenged during immediate post-event discussions betweenbominion managers, but the Dominion management team did not correctly identify theextent of the power rise until the following day. Based on an incomplete and inaccurateinitial assessment of the event, Crew D was allowed to complete the test, return powerto 100% and stand an additional shift in the control room the following day beforeDominion management removed them from operating duties. Although all of Crew Dwas off-shift the following week (per normal shift rotation), two of the individuals involvedin the human performance errors were not formally disqualified from watchstanding untilseveral days after the event, after]]

NRC questioned Dominion's basis for not disqualifyingthose individuals. As of two weeks after the event, Dominion had only generated twocondition reports related to the event and these two condition reports did not address allidentified deficiencies related to the event. See the detailed sequence of events(Attachment 3).Millstone Operations department management issued a new standing order related toVHT setpoint reset. However, a number of weeks elapsed before operating procedureswere revised to provide updated approved plant procedures for the VHT setpointoperation.a.b.Enclosure

3.2b.16Post-Event Root Cause Evaluation and Actionslnspection ScopeThe team reviewed Millstone's

RCE [[Report for the unanticipated reactor power transientevent to determine whether the causes of the event and associated human performanceissues were properly identified. Additionally, the team assessed whether interim andplanned long term corrective actions were appropriate to address the cause(s).FindinqsNo findings of significance were identified.The]]

RCE was thorough and appeared to identify all underlying causal factors. Theassociated proposed corrective actions appeared to adequately address the underlyingcausalfactors. Dominion identified the root cause as an ineffective crew performancemanagement program. The identified contributing causes and issues included:. lmproper implementation of standards and fundamental work practices by thecrew;. Operator knowledge weakness related to understanding main turbine operation;. Inadequate guidance for VHT setpoint reset;. Inadequate pre-job briefs;. Inadequate just-in{ime training;. Weaknesses in test procedure guidance for controlling first stage pressure; ando Lack of guidance on control of multiple concurrent reactivity additions.Meetinos. lncludinq ExitExit Meetinq SummarvOn April 14,2011, the team discussed the inspection results with Mr. A. J. Jordan, SiteVice President, and members of his staff. The team confirmed that proprietaryinformation reviewed during the inspection period was returned to Dominion.40A6Enclosure

Dominion PersonnelL. ArmstrongD. BajumpaaB. BartronC. ChapinW. ChesnutS. ClaffeyT. ClearyG. ClosiusK. GroverJ. HamptonA. JordanR. MacManusG. MarshallH. McKenneyJ. RileyR. RileyJ. SemancikC. TanC. ZornOthersD. Galloway1-1SUPPLEMENTAL

INFORM [[]]

ATIONK EY

POINTS [[]]

OF [[]]

CONTAC [[]]

TM [[anager, TrainingNuclear Safety AnalystSupervisor, LicensingAssistant Operations ManagerSupervisor Nuclear Shift Operations Unit 2Reactor EngineerLicensing EngineerLicensing EngineerManager, OperationsSimulator TesterSite Vice PresidentDirector, Nuclear Station Safety & LicensingManager, Outage and PlanningSupervisor Shift Operations SupportLead Instructor - Unit 2 Operator Requalification TrainingSupervisor of Nuclear Shift Operations Unit 3Plant ManagerSimulation EngineerTurbine System EngineerProgram Supervisor, Connecticut Department of EnvironmentalProtection, Bureau of Air Management, Radiation DivisionLIST]]

OF [[]]

ITEMS [[]]

OPENED ,

CLOSED ,

AND [[]]

DISCUS SEDAVMultiple Examples of Procedural Violations andInadequate Procedures Relating to Control RoomCrew Performance During a Plant Transient(Section 2.1)lmproper Operation of Turbine Control ValvesDuring Testing (Section 2.2)LIST

OF [[]]

DOCUME NTS

REVIEW [[]]

ED cR415089 cR415096cR415091 cR415097cR415094

CR 415104Opened05000336/201 1 008-0105000336/2011008-02Condition Reports (

CR)cR413602cR415944cR415087FINAttachment 1

1-2SUPPLEMENTAL

INFORM [[]]

ATIONS tandinq OrderSO-11-04 (Retating to

VHT setpoint reset)Procedures

MP -PROC-OPS-SP 2651N, "Main Control Valve Operability Test," Rev 004-03MP-PROC-OPS-OP 2204, "Load Changes," Rev 023-06MP-PROC-000-AD-AA-102, "Procedure Use and Adherence," Rev

4MP -

PROC -OPS-OP 2304C, "Make Up (Boration and Dilution) Portion of

CVCS ," Rev 023-03

MP -PROC-000-OP-AA-100, "Conduct of Operations," Rev

11MP -

PROC -000-OP-AP-300, "Reactivity Management," Rev 1

1MP -

PROC -000-OP-AA-106, "lnfrequently Conducted or Complex Evolutions," Rev

5MP -

GARDMP -000-OP-AA-1 800, "Operator Fundamentals," Rev 2MiscellaneousControl Room Operations Narrative LogsUnit 2 Sequence of Events Recorder Printout for February 12,2011Unit 2 Alarm History Printout for February 12,2011Root Cause EvaluationRoot Cause Evaluation

RCE 001044, "Unplanned 8% Reactor Power Excursion"

ADAMSA VBOP

ROCFRC [[]]

RCVDRP DRSHEPtMcJITTMTMWNRCOATC

RO oMoc

PARSPD PPCPRApsigRCERCSRELIST

OF [[]]

ACRONY [[MSAgency-wide Documents Access and Management SystemApparent ViolationBalance of Plant Reactor OperatorCode of Federal RegulationsCondition ReportControlValveDivision of Reactor ProjectsDivision of Reactor SafetyHuman Error ProbabilityInspection Manual ChapterJust in Time TrainingMain TurbineMegawattNuclear Regulatory CommissionOperator at the Controls Reactor OperatorOperations Manager on CallPublicly Available RecordsPerformance DeficiencyPlant Process ComputerProbabilistic Risk Assessmentpounds per square inch gaugeRoot Cause EvaluationReactor Coolant SystemReactor EngineerAttachment 1]]

RGRORP [[]]

SSDPSM SROSITSTATSUSVCTVHT1-3SUPPLEMENTAL

INFORM [[]]

ATIONR [[egulatory GuideReactor OperatorReactor Protection SystemSignificance Determination ProcessShift ManagerSenior Reactor OperatorSpecial Inspection TeamShift Technical AdvisorTechnical SpecificationUnit SupervisorVolume ControlTankVariable High Power TripAttachment 1]]

MEMOMN [[]]

DUM [[]]

TO [[:]]

FROM SUBJECT:2-1SPECIAL

INSPEC [[]]

TION [[]]

TEAM [[]]

CHARTE RUNITED

STATES [[]]

NUCLEA R

REGULA [[]]

TORY [[]]

COMMIS [[]]

SIONRE GION I475

ALLEND [[]]

ALE [[]]

ROADKI [[]]

NG [[]]

OF [[]]

PRUSSI A,

PA 19406-1415

SPECIA L

INSPEC [[]]

TION [[]]

TEAM [[]]

CHARTE RFebruary 18,2011Samuel

L. HansellJr., ManagerSpecial Inspection TeamPeter A. Presby, LeaderSpecial lnspection TeamPeter R. Wilson, Acting Director /

RA /Division of Reactor SafetyDarrell

J. Roberts, Director /

RA /Division of Reactor ProjectsSPECIAL

INSPEC [[]]

TION [[]]

TEAM [[]]

POWER [[]]

DURING [[]]

MAIN [[]]

TURBIN E

CONTRO L

VALVET [[]]

ESTING [[]]

ON [[]]

FEBRUA [[RY 12,2011ln accordance with Inspection Manual Chapter (lMC) 0309, "Reactive Inspection Decision Basisfor Reactors," a Special Inspection Team (SlT) is being chartered to evaluate operatorperformance and organizational decision-making during a Millstone Power Station Unit 2 mainturbine control valve test on February 12,2011. The decision to conduct this special inspectionwas based on meeting the deterministic criteria (involved questions or concerns pertaining tolicensee operational performance) specified in Enclosure 1 of]]

IMC [[0309, and in accordance withSection 04.04, "Additional Factors That May Warrant an llT, AlT, or SlT." The risk associatedwith this event was not amenable to probabilistic risk analysis. The absence of a calculableincrease in conditional core damage probability (]]

CCDP) is based upon the inability toreasonably and accurately approximate the human performance reliability attributes associatedwith the operator performance that precipitated the unanticipated reactor power level changes.IMC 0309, Section 04.04 states that, "factors such as openness, public interest, and publicsafety should be appropriately considered by NRC when deciding whether to dispatch an llT,AlT, or SlT.".Attachment 2

2-2SPECIAL

INSPEC [[]]

TION [[]]

TEAM [[]]

CHARTE RThe

SIT will expand on the inspection activities started by the resident inspectors andaugmented by a Division of Reactor Safety (

DRS [[) inspector who was dispatched to the sitesoon after the event. The Team will review the causes of the event, and Dominion'sorganizational and operator response during the event. The Team will perform interyiews, asnecessary, to understand the scope of operator actions performed during the event. The Teamwill also assess whether the]]

SIT should be upgraded to an Augmented lnspection Team inaccordance with

IMC [[]]

0309.T he inspection will be conducted in accordance with the guidance contained in

NRC [[InspectionProcedure 93812, "Special lnspection," and the inspection report will be issued within 45 daysfollowing the final exit meeting for the inspection.The special inspection will commence on February 22,2011. The following personnel havebeen assigned to this effort:Manager:Team Leader:Team Members:Enclosure: Special lnspection Team CharterSamuel]]

L. Hansell, Jr., Branch ChiefOperations Branch,

DRS , Region

IP eter A. Presby, Senior Operations EngineerOperations Branch,

DRS , Region

IB rian C. Haagensen, Millstone Power Station Resident InspectorDivision of Reactor Projects (

DRP ), Region

IB rian J. Fuller, Operations EngineerOperations Branch,

DRS, Region IAttachment 2

2-3SPECIAL

INSPEC [[]]

TION [[]]

TEAM [[]]

CHARTE [[RSpecial Inspection Team CharterMillstone Power StationUnit 2 Operator Performance During Main Turbine ControlValveTesting on February 12,2011Backqround:Based on preliminary information, the following is a description of the event. On Saturday,February 12,2011, Millstone Power Station Unit 2 reduced power to 88 percent for main turbinecontrol valve testing. ln preparation for the test, Dominion procedure]]

SP 2651N, "Main ControlValve Operability Test," provides written instructions for the operators to slowly rotate theturbine first stage pressure feedback potentiometer from the "

OUT " to the "lN" position over aone minute period while maintaining turbine first stage pressure by using the "LOADSELECTOR

INCREA [[]]

SE and

DECREA [[]]

SE ' pushbuttons. As the Balance of Plant (BOP)Reactor Operator (RO) rotated the turbine first stage pressure potentiometer, turbine first stagepressure and reactor power increased. The

BOP [[]]

RO [[incorrectly went to increase instead ofdecrease on the load selector button. When he did not get the desired response, he pressedthe increase button at least two more times. The Shift Technical Advisor, who was acting asboth the peer checker and the Control Room Supervisor directing the evolution, did notapparently detect the incorrect manipulation and did not correct the]]

BOP [[]]

RO. [[The increasedsteam demand lowered reactor coolant average temperature (Tavg) and caused a powerincrease to 96 percent power over 90 seconds. While the transient was occurring, the VariableOver Power Trip (VOPT) reset lights were illuminated. The crew reset the]]

VOPT several timesduring the event.The Shift Manager recognized that a transient was occurring and directed the

BOP [[]]

RO [[to stophis actions. He directed the reactivity Senior Reactor Operator to withdraw control rods foursteps to stabilize Tavg while temperature was decreasing, an action that compounded thepower increase. After Tavg and reactor power were stabilized, the main turbine control valvetest was completed and Unit 2 was returned to 100 percent power.Currently, Millstone Unit 2 is in Mode 1 at normal operating pressure and temperature. Therewas no impact to Unit 3. Dominion is currently investigating the operators' response to thisevent. Additionally, Dominion has suspended the qualifications of the operations crew while theinvestigation continues. The]]

NRC resident inspectors and a

DRS senior operations engineerhave provided follow-up to this event under the Reactor Oversight Process (

ROP ) baselineinspection program.Basis for the Formation of the

SIT The

IMC 0309 review concluded that one of the deterministic criteria was met due to questionsor concerns pertaining to licensee operational performance. This criterion was met based onhuman performance errors that occurred and led to the unanticipated reactor power excursion.The human performance errors included:. Depressing the increase button on the load selector instead of decrease;r Inadequate self and peer checking;o The addition of positive reactivity (control rod withdrawal) while reactor power wasalready increasing, without understanding the nature of the transient;Attachment 2

2-4SPECIAL

INSPEC [[]]

TION [[]]

TEAM [[]]

CHARTE R. Manipulating control rods while in an oversighUsupervisory role; andr Resetting the

VOPT setpoint during a transient, without understanding the nature of thetransient.ln accordance with

IMC [[0309, the event was evaluated for risk significance because onedeterministic criterion was met. However, the risk associated with this event was not amenableto probabilistic risk analysis. The absence of a calculable increase in conditional core damageprobability (CCDP) is based upon the inability to reasonably and accurately approximate thehuman performance reliability attributes associated with the operator performance thatprecipitated the unanticipated reactor power level changes.f]]

MC 0309, Section 04.04 states that, "factors such as openness, public interest, and publicsafety should be appropriately considered by

NRC [[when deciding whether to dispatch an llT,AlT, or SlT." In light of the aforementioned human performance errors, and consistent withSection 4.04, Region I has decided to initiate an SlT.Obiectives of the Special Inspection:The Team will review the causes of the event, and Dominion's organizational and operatorresponse during the event. The Team will perform interviews, as necessary, to understand thescope of operator actions performed during the event.To accomplish these objectives, the team will:1. Develop a complete sequence of events including follow-up actions taken byDominion, and the sequence of communications within Dominion and to the]]

NRC [[subsequent to the event;2. Review and assess crew operator performance and crew decision making, includingtheir adherence to expected roles and responsibilities, including the command andcontrolfunction associated with reactivity manipulations, the use of procedures, logkeeping, and overall communications;3. Evaluate the extent of condition with respect to the other crews;4. Determine the appropriateness and safety significance of resetting the]]

VOPTsetpoint during this event;5. Evaluate the effectiveness of supervisory oversight of Senior Reactor Operators(SROs) in light of the on-duty Shift Manager directing the Reactivity Oversight SROto manipulate control rods while in the oversight role;6. Review and assess the effectiveness of Dominion's response to this event andcorrective actions taken to date. This includes overall organizational response, theroot cause evaluation, and adequacy of immediate, interim and proposed longtermcorrective actions;Attachment 2

2-5SPECIAL

INSPEC [[]]

TION [[]]

TEAM [[]]

CHARTE [[R7. Review the adequacy of operator requalification training as it relates to this event,including the integration of newly licensed operators into the operator requalificationtraining program;L Assess the decision making and actions taken by the operators to determine if thereare any implications related to the site's safety culture;L Evaluate_ Dominion's application of pertinent industry operating experience,including]]

INPO [[]]

SOER [[1Q-2, "Engaged, Thinking Organizations," to assess theeffectiveness of any actions taken in response to the operating experience; and10. Document the inspection findings and conclusions in a Special Inspection Team finalreport within 45 days of inspection completion.Guidance:lnspection Procedure 93812, "Special Inspection", provides additional guidance to be used bythe SlT. Team duties will be as described in Inspection Procedure 93812. The inspectionshould emphasize fact-finding in its review of the circumstances surrounding the event. Safetyconcerns identified that are not directly related to the event should be reported to the Region Ioffice for appropriate action.The team will conduct an entrance meeting and begin the inspection on February 22,2011.While on-site, the Team Leader will provide daily briefings to Region I management, who willcoordinate with the Office of Nuclear Reactor Regulation, to ensure that all other pertinentparties are kept informed. The Team will also coordinate with the Region / State Liaison Officerto implement the Memorandum of Understanding between the]]

NRC [[and the State ofConnecticut to offer observation of the inspection by representatives of the state. A reportdocumenting the results of the inspection will be issued within 45 days following the final exitmeeting for the inspection.Before the end of the first day onsite, the Team Manager shall provide a recommendation to theRegional Administrator as to whether the]]

SIT should continue or be upgraded to an Augmentedlnspection Team response.This Charter may be modified should the team develop significant new information that warrantsreview.Attachment 2

3-1DETAILED

SEQUEN [[]]

CE [[]]

OF [[]]

EVENTS [[February 12,2011 Power Transient EventThe team constructed the sequence of events fromplant process computer (PPC) data (alarm printout,graphs) and plant personnel interviews.a review of Control Room narrative logs,sequence of event printout, plant parameterMILLSTONE]]

MODE 1, 1A0% reactor power.07:50Quarterly main turbine (

EVENT [[]]

TIMELI [[]]

NEC [[lock Time[date](hr:mm:ss)Event TimeDescription2110111Sperations Crew D attends four hour simulator just-in-time trainingsession to prepare for scheduled quarterly main turbine (MT) valve:esting. Partial evolution pre-job brief conducted.211211106:00Operations Crew D assumes the day shift watch. Unit 2 is in]]

MT ) stop valve testing complete.08:33Pre-job briefing for the downpower,

MT controlvalve (

CV ) testing,and up-power. Personnel in attendance for brief, and alsoihroughout the downpower and control valve testing:management to provide oversight for the reactivityevolutionssupervisor)(oATC

RO )

RO )08:593ommence downpower for

MT [[valve testing per reactivity plan.10:15Stabilize plant at 88% power, following 173 gallons boration, control"od insertion from 180 steps to 158 steps and turbine load reduction.rsing load limit.10:35102 gallon dilution to maintain steady Reactor Coolant System]]

RCS ) temperature during build-in of fission product poisons.10:44100 gallon dilution.10:53150 gallon dilution,11:02150 gallon dilution.11:06CATC RO begins 600 gallon dilution.Attachment 3

MILLST [[]]

ONE [[]]

RO shifts turbine load controlfrom Load Limit to Load Set.11:20

EVENT [[]]

TIMELI [[]]

NEG [[lock Time[date]{hr:mm:ss)Event TimeDescription11:193OP]]

OATC [[]]

RO adjusts turbine bypass valve setpoint to open'A turbinebypass valve to 10% open.

BOP [[]]

RO adjusts main turbine load tomaintain

RCS temperature.

US ,

BOP [[]]

RO and

STA discuss andiointly agree on a planned action, to depress the Load SetINCREASE button, if l"tstage pressure increases while placing 1"'stage pressure feedback in service.11:24:42Start letdown diversion to waste to lower

VCT level 89o/o to 79o/o.11:26:15

BOP [[]]

RO , with peer checks from

STA and direct observation by

US ,regins to place 1" stage feedback in service and depresses .

INCREA SE pushbutton multiple times in response to rising 1"'stage pressure.11:26:3203ontrol valves begin opening. Beginning of transient. Conditions:RCS Tcold 542.8"F,

MT [[]]

CV position 38.1% open.

MT first stage)ressure 476 psig.11:26:4412 sec

RCS Tcold is decreasing.11:27:341 min, 2 secA' turbine bypass valve fully closes.11:27:561 min, 24 secReactivity

SRO resets ChannelA Variable High Power Trip (

VHT ).- 11:28:001 min, 28 secSM directs

OATC [[]]

RO to lower turbine bypass valve setting to re-)pen 'A' turbine bypass valve. Tcold approximately 541.5"F.11:28:021 min. 30 sec600 gallon dilution is comPlete.11:28:181 min. 46 sec)ATC

RO adjusts'A'turbine bypass valve setpoint. Valve opens to2% open position for approximately 6 seconds and then reclosesrutomatically.11:28:402 min. 8 secleactivity

SRO resets ChannelA

VHT (2nd time during transient).- 11:28:402 min. 8 seciM directs

US to return to position of oversight, away from the,urbine control panel.11:28:402 min. 8 secl-urbine 1" stage pressure is about 524 psig, up from 476 psig priorro transient.

US recalled later that at this point the Load Set

NCREAS E pushbutton had been depressed 4 times and the Loadiet

DECREA [[]]

SE pushbutton had been depressed 2 times.11:28:442 min, 12 sec?eactivity

SRO withdraws Group 7 Control Element Assemblies.control rods) 4 steps per

SM direction. Tcold approximatelyi38.7'F. Neither

SM nor Reactivity

SRO are aware of turbine loadncrease and temperature transient in progress.11:29:142 min. 42 secfurbine load stabilizes at new setpoint on Load Set. Control valves'each maximum open during transient al70.5o/o open position'11:29:182 min, 46 secleactivity

SRO resets Channel A

VHT (3'd time during transient)'3-2DETAILED

SEQUEN [[]]

CE [[]]

OF [[]]

EVENTS Attachment 3

MILLST [[]]

ONE [[]]

VHT 14h time during transient).leactor power stabilized al -960/o.11:30:56itop letdown diversion to waste.11:31:563OP

EVENT [[]]

TIMELI [[]]

NEC [[lock Time[date](hr:mm:ss)Event TimeDescription11:29:282 min. 56 secfcold reaches minimum during transient at 537.5"F. Minimumrressurizer pressure is 2238 psia.11:29:323 min, O secleactivity]]

SRO resets ChannelA

RO shifts turbine load controlfrom Load Set to Load Limit.11:32:18leactivity

SRO resets Channel A

VHT. 11:35:52Reactivity

SRO resets ChannelA

VHT. -11:37l-urbine load gradually reduced by the operator to restore

RCS [[[cold to program value.-11:50furbine load stabilized at pre-event level.-12:0034 miniM calls his immediate supervisor (Senior Unit 2 Licensedndividual). The]]

SM characterizes the event as a 4o/o increase in'eactor power. After discussion, both agree, okay to complete

MT )V testing.12:18lurbine load control transferred to Load Set.-12:30iM calls immediate supervisor again. During this call, discussion'eveals

SM mistakenly believed the

SM -qualified individualrssigned by operations management to provide oversight for the'eactivity evolutions, who was in the control room, was fulfilling the'oll of Operations Manager on Call (OMOC). The immediate;upervisor directed the

SM to inform the actual

OMOC of the event.12:33Recommenced main turbine control valve stroking satisfactorily.-12:40Ihr, 14 minSM briefs

OMOC on the event (estimated time from

SM 'ecollection).12:55t hr. 29 minfMOC informs Assistant Operations Manager.12:563ompleted main turbine control valve stroking.-13:04t hr. 38 min\ssistant Operations Manager calls Operations Manager.13:063OP

RO returns turbine load controlto Load Limit.-13:252 hrsVlanagement conference call between Plant Manager, OperationsVanager, Assistant Operations Manager,

SM , Operations\rlanagement oversight person on shift. Discussed event aslnderstood at the time (single human performance error associatedrvith turbine load increase button causing a 4o/o power increase).)ecided to have

SM meet with mgmt team following morning to'ully debrief on the occurrence. Rearranged watch bill toaccommodate

SM debrief.DETAILED

SEQUEN [[]]

CE [[]]

OF [[]]

EVENTS Attachment 3

MILLST [[]]

ONE [[]]

OMOC , the other twosenior Unit 2 ops mgmt licensed individuals and a

EVENT [[]]

TIMELI [[]]

NEC [[lock Time[date]{hr:mm:ss)Event TimeDescription-15:153.8 hrs\nother operations management conference call (estimated time/Jetails from Assistant Operations Manager recollection) betweenCps Manager, Assistant Ops Manager,]]

SM not currentlyrn shift. Decided to have the on-shift

SM meet with mgmt teambllowing morning (211312011) to fully debrief on the occurrence.Rearranged the dayshift watch bill to accommodate

SM debrief. A'eactor engineer was assigned during the evening shift to review:vent data for use the following day in reconstruction of the)ccurrence.15:38Srew D commences power increase to return Unit 2 to full power.17:055.5 hrsIhe

OMOC contacts one of the

NRC [[Resident Inspectors andnforms him of a human performance error during valve testingryhich resulted in approximately 4oh power rise, with no reactor trip,ro safety limits exceeded and that Dominion would be investigating'urther tomorrow.17:45Unit 2 returned to 100% reactor power.-18:003rew D relieved by on-coming night shift crew.23:0511.5 hrsReactor engineering email to Operations management team,:ontaining Unit 2 plant process computer data and summarydentifying transient details of 8% power change magnitude (not 4o/oas originally characterized), inappropriate rod withdrawal, andrariable high power trip setpoint resets.2113111-06:00lrew D assumes the dayshift watch from the night shift crew.2113111-15:0027.5 hrsCps Manager and Assistant Operations Manager update the]]

NRCS [[enior Resident Inspector that event was more serious thanrriginally realized, Station management considering pulling the;rew off-shift and a senior operations management licensedndividual observing remainder of dayshift operations until Crew Ds relieved at 18:00.2t13t11-18:00lrew D relieved by on-coming night shift crew.2114111-10:0046.5 hrs)perations Manager informs]]

NRC resident staff that Crew Dlualifications have been suspended. Crew will meet withnanagement to analyze the event to evaluate the exhibitedrerformance issues.3-4DETAILED

SEQUEN [[]]

CE [[]]

OF [[]]

EVENTSAttachment 3

1.2.3.4-1IMC 0609,

APPEND [[]]

TABLE 4.1Qualitative Decision-Making Attributes for

NRC Management ReviewThe

SDP is the preferred path for determining the significance of findings in the ReactorOversight Process.

IMC 0609 Appendix M is provided for use when the existing

SDP guidance is not adequateto provide a reasonable estimate of the significance.

IMC [[0609 Appendix M could be used for this case. Appendix M utilizes a qualitativesignificance determination process focused on the below table where 6 of 8 attributes havesome level of applicability.Decision AttributeApplicabletoDecision?Basis for Input to Decision - Provide qualitativeand/or quantitative information for managementreview and decision making.Finding can be boundedusing qualitative and/orq uantitative information?NoThe at-power safety significance determination process,IMC 0609 Appendix A, quantitative analysismethodology is not adequate to provide reasonableestimates of the finding's significance. That]]

SDP [[doesnot model errors of commission and does not provide amethod of accurately estimating changes to the humanerror probabilities caused by errors of omission. As aresult, no quantitative risk evaluation can be performedfor this finding.Human errors have the potential to increase the humanerror probability (]]

HEP ) for credited operator actions.The probabilistic risk assessment models are highlysensitive to smallvariations in

HEP changes. Theexisting

PRA research does not currently support amethod for varying the performance shaping factors inresponse to defined error forcing contexts. lt is notpossible to calculate a valid single point risk estimate.Human performance is a very large contributor to

PRA [[uncertainty.Defense-in-Depthaffected?YesThe term "defense in depth" is commonly associatedwith the maintenance of the integrity and independenceof the three fission product barriers. The fission productbarriers were not actually compromised by the actionsof the crew during this event. While the Reactivity]]

SROreset the VHT and prevented a reactor trip fromoccurring, a reactor trip was not actually required toprotect the core during this event. The fuel barrier wasnot actually jeopardized by the crew's actions.On the other hand, the crew plays a vital role in theAttachment 4

4-2IMC 0609,

APPEND [[]]

VHT setpoints and withdrew control rods.However, the flux distribution remained bounded by thesafety analysis and

TABLE [[4.1Decision AttributeApplicabletoDecision?Basis for Input to Decision - Provide qualitativeand/or quantitative information for managementreview and decision making.maintenance of defense in depth from the perspectivethat they operate station controls. Human errors havethe potentialto compromise the three fission productbarriers. The commission of multiple unforeseenhuman errors in a short period of time during the turbinevalve testing was clearly related to a loss of situationalawareness and a failure to maintain the roles andresponsibilities assigned under the Dominionad ministrative procedures.Performance Deficiencyeffect on the SafetyMargin maintained?YesPlant safety analyses credit the variable high-power tripsetpoint for some events when determining boundingcases. The Final SafetyAnalysis Report Chapter 14safety analysis considers a similar event (a 10o/o powerincrease from a turbine control valve failing full open at100To power) that actually bounds this event where thecore is protected from fuel damage.Operator response to this event reduced the margin tothe reactor trip setpoint. Operators unintentionallyraised turbine load and then, in response, intentionallyopened a turbine bypass valve, raised the]]

RPS actuation was not actuallyneeded to prevent exceeding the departure fromnucleate boiling or fuel centerline temperature designlimits.Operator action, post-event interviews and lack ofprocedural guidance for

VHT [[reset all indicate likelihoodthat other Unit 2 operators may have similarly resetVHT when a reset permissive light illuminates duringpower transient events where the underlying cause isnot immediately apparent. Under differentcircumstances, there is potential for exceedingacceptable fuel design limits if the]]

VHT were resetduring an event with a higher magnitude steam flowincrease and core peaking factors closer to operatinglimits. However, the potential for the event to progressto a core damage state due to operators incorrectly andcontinually resetting the

VHT is unlikely becauseredundant reactor trips (thermal margin/low pressureAttachment 4

Decision AttributeApplicabletoDecision?Basis for Input to Decision - Provide qualitativeand/or quantitative information for managementreview and decision making.and local power density trips) would limit the powerincrease.The extent theperformance deficiencyaffects other equipment.YesThe failure of the Unit 2 crews to remain within theirassigned roles and responsibilities has the potential toaffect the operation of equipment that requires operatormanual action to function. Other Unit 2 crews displayeda degree of degraded performance in the area ofconduct of operations based on post-eventassessment.Dominion documented a number of post-event issuesrelated to human performance by the other Unit 2operating crews. These issues were observed bylicensee management personnel during the three weekperiod immediately following the power transient eventand demonstrate the pervasiveness of the performancelapses of the Unit 2 control room operators. lmproperprocedure use and improper peer checking were readilyidentified behaviors on multiple Unit 2 crews.lneffective just-in-time training and procedureinadequacies were also factors that degraded all thecrews'ability to operate the plant.Degree of degradation offailed or unavailablecomponent(s).N/APeriod of time (exposuretime) affect on theperformance deficiency.YesWith respect to this specific event, Reactor CoolantSystem cold leg temperature began lowering at11:26:44 on 21121201 1. The first

VHT [[setpoint resetoccurred at 11:27:56. Reactor power stabilized at 96%at 11:29:32. The entire event lasted approximately 3minutes.With respect to the latent issues underlying thisperformance deficiency, the exposure time isindeterminate, but clearly developed over an extendedperiod. The procedural and training performanceweaknesses specified above existed for many years.The Dominion root cause evaluation team determinedthat the causal factors for the event had existed for a]]

IMC 0609,

APPEND [[]]

TAB [[]]

LE 4.1Attachment 4

4-4IMC 0609,

APPEND [[]]

VHT setpoints, and open the turbine bypassvalve were not identified as inappropriate until a reactorengineering review of plant computer data many hoursafter the event.

TABLE [[4.1Decision AttributeApplicabletoDecision?Basis for Input to Decision - Provide qualitativeand/or quantitative information for managementreview and decision making.considerable period of time. However, they did notquantify the exposure time.The likelihood that thelicensee's recoveryactions wouldsuccessfully mitigate theperformance deficiency.YesThe licensee's root cause analysis was thorough andappeared to identify all underlying causalfactors. Theassociated proposed corrective actions appear toadequately address the underlying causal factors.During the recent April 2011 Unit 2 refueling outage,there were no significant configuration control issues,and no]]

NRC [[or self-revealing findings or violations.Resident inspectors have observed improvedprocedure adherence and an improvement in humanperformance since the Special lnspection in February2011.Additional q ualitativecircumstancesassociated with thefinding that regionalmanagement shouldconsider in theevaluation process.YesDuring this event, all control room operators on thecrew failed to either recognize or respond properly tothe unintended power transient. None of the operatorsinitially identified the breakdowns in command andcontrol or the deviations from defined roles andresponsibilities as worthy of note in the immediate post-event brief or in discussions regarding whether it wasappropriate to continue with the turbine testing (otherthan to identify that the event was initiated by theturbine operator's action to press the increase, ratherthan the decrease pushbutton).Dominion was initially slow to recognize the scope andthe significance of the event. Despite involvement ofmultiple layers of licensee management personnelduring and immediately following the event, numerousperformance problems during the event were not fullyrecognized until the next day after the event. Theinadvertent power rise was initially assessed as 4o/o,vice the actual 8% because the operators used neutronflux instead of Q-power as the indicator of powerincrease. Actions taken to withdraw reactor controlrods, reset]]

NRC inspector challenges of licenseemanagement decisions relating to the event precededAttachment 4

4-5IMC 0609,

APPEND [[]]