IR 05000325/2010013

IR 05000325-10-013; on 09/27/2010 - 12/27/2010; Carolina Power and Light Company; H.B. Robinson Steam Electric Plant, Unit 2; Other Activities

ML103620095
Person / Time
Site:	Brunswick, Robinson
Issue date:	12/27/2010
From:	Wert L Division Reactor Projects II
To:	Duncan R Carolina Power & Light Co
References
EA-10-257 IR-10-013
Download: ML103620095 (35)

Text

UNITED STATES December 27, 2010

SUBJECT:

H. B. ROBINSON STEAM ELECTRIC PLANT - NRC INSPECTION REPORT 05000261/2010013 AND PRELIMINARY WHITE FINDINGS

Dear Mr. Duncan:

On December 27, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed an in-office inspection of two unresolved items (URI) and two Apparent Violations (AV) associated with the H. B. Robinson Steam Electric Plant. The two URIs that were identified in NRC Inspection Report Number 05000261/2010009 (ADAMS Accession Number ML101830101), dated July 2, 2010, involved monitoring of plant parameters and alarms, and utilization of operators during events requiring use of concurrent procedures. These issues were unresolved pending additional review to determine if your actions resulted in untimely identification and investigation of abnormal plant parameters, unexpected main control room alarms and whether the crews monitoring of plant parameters and alarms and use of associated procedures met specified operator performance standards. The two AVs documented in NRC Inspection Report Number 05000261/2010004 (ML103160382), dated November 12, 2010, involved failure to establish an adequate emergency operating procedure, and failure to correctly implement a systems approach to training for the Licensed Operator Requalification Program, were identified as To Be Determined until the safety characterization was completed. The enclosed inspection report documents the inspection results and preliminary significance determinations, which were discussed on December 27, 2010, with Mr. B. McCabe of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the NRCs rules and regulations and with the conditions of your license. Based on the results of this inspection, three findings were identified, two of which were associated with preliminarily low to moderate safety significance.

The first finding which is identified as a problem associated with the failure to implement requirements and standards of the fleet conduct of operations procedure, involves an apparent violation and four related violations for failure to meet Technical Specification (TS) 5.4.1, CP&L 2 Procedures, which have been determined to be preliminarily White, that is a finding of low to moderate safety significance. Specifically, failure to adequately implement requirements of OPS-NGCC-1000, Fleet Conduct of Operations, on multiple instances contributed to an uncontrolled cooldown of the Reactor Coolant System and subsequent safety injection, operator errors that increased the likelihood of Reactor Coolant Pump seal failure, and the initiation of a preventable plant fire that resulted in an Alert emergency classification being declared.

Furthermore, the four related violations of TS 5.4.1, Procedures mentioned above were for failure to follow procedures: APP-003-E3, VCT Hi/Lo Level; EPP-4, Reactor Trip Response, APP-009-B6, Aux Transfer Fault Trip; and Emergency Operating Procedure, Path 1. In accordance with Enforcement Manual, Section 2.13.8, the NRC has evaluated these issues and determined they will be dispositioned as a group of related programmatic violations associated with a problem in your implementation of the requirements and standards of OPS-NGGC-1000, Fleet Conduct of Operations.

The second finding which is identified as a problem associated with the implementation of the Commission approved requalification program developed using a systems approach to training, involves an apparent violation and an associated finding of significance which have been determined to be preliminarily White, that is a finding of low to moderate safety significance, for the failure to properly implement elements of a Commission approved program developed using a systems approach to training. Specifically, the violation of 10 CFR 55.59(c)4 involves the failure to adequately design and implement training based on learning objectives in that lesson material failed to identify the basis of a procedural action involving reactor coolant pump seal cooling in procedure Path-1, as required by the definition of systems approach to training, Element 3 in 10 CFR 55.4. The associated finding involves the failure to meet Training Program Procedure TTP-200, Licensed Operator/Shift Technical Advisor Continuing Training Program, which is part of the systems approach to training, by not identifying, documenting, and evaluating operator weaknesses exhibited during evaluated scenarios. This is being characterized as a finding (FIN) for not meeting a self-imposed standard (TTP-200) and it did not involve a violation of a regulatory requirement. In accordance with Enforcement Manual, Section 2.13.8, the NRC evaluated these issues and determined they will be dispositioned as a group of related programmatic violations associated with a problem in implementation of your Commission approved requalification program developed using a systems approach to training.

Although these findings have potential safety significance, they do not present an immediate safety concern, because you have implemented corrective actions that include, but are not limited to, enhancement of licensed operator training material, re-training and evaluation of all control room operators, procedure enhancements, crew reconstitution to enhance performance, and personnel and management changes. Additionally, the NRC has performed inspections to verify that important operational safety aspects have been addressed.

Each finding was assessed based on the best available information, including influential assumptions, using the applicable Significance Determination Process (SDP). The final resolution of these findings will convey the increment in the importance to safety by assigning the corresponding color, i.e., White, a finding with low to moderate safety significance that may require additional NRC inspections. The SDP analyses are included in the report as Enclosure 2 and 3. CP&L 3 In accordance with NRC Inspection Manual Chapter 0609, Significance Determination Process, we intend to complete our risk evaluations using the best available information and issue our final determination of safety significance within 90 days of this letter. The SDP encourages an open dialogue between the staff and the licensee; however, the dialogue should not impact the timeliness of the staffs final determination. Before the NRC makes its enforcement decision, we are providing you an opportunity to either (1) present to the NRC your perspectives on the facts and assumptions used by the NRC to arrive at these findings and its significance at a Regulatory Conference or (2) submit your position on these findings to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference to make the conference more efficient and effective. If a conference is held, it will be open for public observation. The NRC will also issue a press release to announce the conference. If you decide to submit only a written response, such a submittal should be sent to the NRC within 30 days of the receipt of this letter. If your response contains security-related information please ensure it is marked appropriately. If your response does not contain security-related information, it will be made available for public inspection in the NRC Public Document Room or from the NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. If you decline to either request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination; in that, by not doing either you fail to meet the appeal requirements stated in the Prerequisites and Limitations Sections of Attachment 2 of IMC 0609.

In recognition of the relationship of these two apparent violations, we encourage you to request a joint Regulatory Conference to discuss the above matters, or as an alternative, you may include your response to these issues and corrective actions in a single written response.

Please contact Randall Musser at (404) 997-4603 within 10 days of the date of this letter to notify the NRC of your intended response. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. You will be advised by a separate correspondence of the results of our deliberations on this matter.

Since the NRC has not made a final determination as to the significance of these violations, no Notice of Violation is being issued at this time. Please be advised that the number and characterization of the apparent violations described in Enclosure 1 may change as a result of further NRC review.

In addition to the above findings, this report also documents the final significance for an apparent violation documented in NRC Report Number 05000261/2010004. Specifically, the significance of AV 05000261/2010004-04, Failure to Establish an Adequate PATH-1 Emergency Operating Procedure was determined to be of very low safety significance (Green). This finding was determined to involve violations of NRC requirements. However, because of the very low safety significance and because it has been entered into your corrective action program, the NRC is treating this finding as a non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy. If you contest this non-cited violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with CP&L 4 copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the H.B. Robinson facility.

Additionally, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at the H. B. Robinson facility.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). Adams is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/W. Jones RA for/

Leonard D. Wert, Jr., Director Division of Reactor Projects Docket No. 50-261 License No. DPR-23

Enclosures:

1. Inspection Report 05000261/2010013 w/Attachment: Supplemental Information 2. Significance Determination, SRA Analysis Number ROB1014 w/Attachments: (Official Use Only - Security Related Information withheld)

3. Significance Determination, SRA Analysis Number ROB1013 w/Attachments: (Official Use Only - Security Related Information withheld)

REGION II==

Docket No.: 50-261 License No.: DPR-23 Report No.: 05000325/2010013 Licensee: Progress Energy - Carolina Power and Light (CP&L)

Facility: H. B. Robinson Steam Electric Plant, Unit 2 Location: Hartsville, SC Dates: September 27 - December 27, 2010 Inspectors: W. Rogers, Senior Reactor Analyst C. Kontz, Senior Project Engineer M. Bates, Senior Operations Examiner G. Laska, Senior Operations Examiner Approved by: Leonard D. Wert, Jr., Director Division of Reactor Projects Enclosure 1

SUMMARY OF FINDINGS

IR 05000261/2010013, September 27- December 27, 2010; Carolina Power and Light

Company; H.B. Robinson Steam Electric Plant, Unit 2; Other Activities.

The report transmits the results and NRCs preliminary assessment of an in-office inspection of two unresolved items (URI) and two Apparent Violations (AV). The inspectors identified two AVs with potentially low to moderate safety significance (White), and one Non-cited Violation (NCV) of very low safety significance (Green). The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609,

Significance Determination Process (SDP). The cross cutting aspects were determined using IMC 0310, Components within the Cross Cutting Areas. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.

Cornerstone: Initiating Events

• (Green) The inspectors identified a green NCV of Technical Specifications (TS) 5.4.1,

Procedures, for the licensees failure to establish and maintain an adequate emergency procedure that ensured reactor coolant pump (RCP) seal cooling was maintained following a reactor trip. The licensee has entered this into the corrective action program (CAP) as nuclear condition report (NCR) 423147. As a corrective action the licensee revised the Path1 procedure for verifying adequate seal cooling to the RCPs.

The failure to establish and maintain an emergency procedure that would ensure adequate reactor coolant pump seal cooling, preventing seal degradation and a possible seal LOCA was a performance deficiency. The finding is more than minor because it is associated with the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations, specifically a loss of seal cooling to prevent the initiation of a RCP seal loss of coolant accident (LOCA). A Phase analysis was performed utilizing the NRCs Robinson Standardized Plant Analysis Risk (SPAR) model and developed an event tree to specifically evaluate the performance deficiencys conditions. The result of the Phase 3 analysis was a core damage frequency increase of <1E-6/year a finding of very low safety significance. The cause of this finding had a cross-cutting aspect of Documentation, Procedures, and Component Labeling, in the Resources component of the cross-cutting area of Human Performance, in that the licensee failed to ensure procedures for emergency operations were adequate to assure nuclear safety. (H.2(c)) (Section 4OA5.02)1 3

Cornerstone: Mitigating Systems

• (TBD) The inspectors identified a problem associated with the failure to implement requirements and standards of the fleet conduct of operations procedure, which involves an AV and four related violations for failure to meet Technical Specification (TS) 5.4.1,

Procedures. Specifically, the licensees failure to adequately implement operational oversight functions including: command and control, supervision, and independent assessment which contributed to an uncontrolled cooldown of the Reactor Coolant System (RCS) and subsequent safety injection, actions that increased the likelihood of Reactor Coolant Pump (RCP) seal failure, and the initiation of a preventable plant fire that resulted in an Alert emergency classification being declared. Furthermore, the four related violations of TS 5.4.1, Procedures mentioned above were identified for failure to follow procedures: APP-003-E3, VCT Hi/Lo Level; EPP-4, Reactor Trip Response,

APP-009-B6, Aux Transfer Fault Trip; and Emergency Operating Procedure, Path 1.

As corrective actions, the licensee enhanced the licensed operator training material, re-trained and evaluated all control room operators, performed procedure enhancements, crew reconstitution to enhance performance, and personnel and management changes.

This finding was entered into the licensees CAP as NCRs 390095 and 423246.

Failure to adequately implement the requirements contained in OPS-NGGC-1000, Fleet Conduct of Operations, was a performance deficiency. The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone in that it affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to adequately implement requirements contained in OPS-NGGC-1000, Fleet Conduct of Operations, contributed to a complete loss of charging system flow, an increase in the likelihood of RCP seal failure and initiation of a fire on March 28, 2010. A Phase 3 SDP analysis using the NRCs Robinson SPAR model and input from the licensees full scope model resulted in this finding being characterized as preliminarily White, a finding of low to moderate safety significance.

The cause of this finding had a cross-cutting aspect of supervisory and management oversight of work activities such that nuclear safety is supported, in the Work Practices component of the Human Performance cross-cutting area, because plant supervisors failed to enforce proper communications methods at the job site and failed to properly supervise workers executing procedure steps. (H.4(c)) (Section 4OA5.01)

• (TBD) The inspectors identified a problem associated with the implementation of the Commission approved requalification program developed using a system approach to training, which involves an apparent violation and an associated finding. Specifically, the AV of 10 CFR 55.59(c)4 involves the failure to adequately design and implement training based on learning objectives in that lesson material failed to identify the basis of a procedural action involving reactor coolant pump seal cooling in procedure Path-1, as required by the definition of systems approach to training, Element 3 in 10 CFR 55.4.

The associated finding involves the failure to meet Training Program Procedure TTP-200, Licensed Operator/Shift Technical Advisor Continuing Training Program, which is part of the systems approach to training, by not identifying, documenting, and evaluating 1 4 operator weaknesses exhibited during evaluated scenarios. As corrective actions, the licensee trained all licensed operators on PATH-1-005 objective requirements and increased the rigor of their remediation program. The finding was entered into the licensees CAP as NCR-423232, NCR-423238, and NCR-423239.

The licensees failure to properly implement elements of a Commission approved requalification program was a performance deficiency. The finding was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone in that it affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to implement training requirements for Path-1 contributed to operators failure to identify and implement actions to mitigate a loss of seal cooling to the reactor coolant pumps during the events of March 28, 2010. A Phase 3 SDP analysis using the NRCs Robinson SPAR model and input from the licensees full scope model resulted in this finding being characterized as preliminarily White, a finding of low to moderate safety significance. The cause of this finding was directly related to the cross cutting aspect of Personnel Training and Qualifications in the Resources component of the Human Performance area, in that the licensee failed to ensure the adequacy of the training provided to operators to assure nuclear safety.

(H.2(b)) (Section 4OA5.03)1

REPORT DETAILS

4OA5 Other

.01 (Closed) URI 05000261/2010009-01, Monitoring of Plant Parameters and Alarms

(Closed) URI 05000261/2010009-03, Utilization of Operators During Events Requiring Use of Concurrent Procedures

a. Inspection Scope

On March 28, 2010, an event occurred at the H. B. Robinson Steam Electric Plant. The event is described in detail in Augmented Inspection Report 05000261/2010009. The event included two separate fires, an uncontrolled cooldown of the reactor coolant system, a safety injection, and a loss of adequate reactor coolant pump seal cooling.

During the week of September 20-24, 2010, the inspectors interviewed members of the control room staff on duty during the March 28, 2010, event. The inspectors reviewed facts gathered during the Augmented Inspection. The inspectors also reviewed plant data and licensee procedures to ensure compliance with applicable operator requirements.

b. Findings

Problem Associated with the Failure to Implement Requirements and Standards of the Fleet Conduct of Operations Procedure During the inspection, multiple issues associated with procedure implementation were identified by the inspectors. In accordance with Enforcement Manual, Section 2.13.8, the NRC evaluated these issues and determined they will be dispositioned as a group of related programmatic violations associated with a problem in your implementation of the requirements and standards of OPS-NGGC-1000, Fleet Conduct of Operations.

Issues associated with the problem 1. Apparent Violation for Failure to Implement Requirements of Fleet Conduct of Operations Procedure

Introduction:

The inspectors identified an apparent violation of Technical Specifications (TS) 5.4.1, Procedures, for the licensees failure to adequately implement the requirements contained in OPS-NGGC-1000, Fleet Conduct of Operations.

Specifically, the licensees failure to adequately implement operational oversight functions including: command and control, supervision, and independent assessment which contributed to an uncontrolled cooldown of the Reactor Coolant System (RCS) Enclosure 1 6 and subsequent safety injection, increased the likelihood of Reactor Coolant Pump (RCP)seal failure, and the initiation of a preventable plant fire that resulted in an Alert emergency classification being declared.

Description:

During the events of March 28, 2010, multiple examples of the licensees failure to implement the operational oversight requirements and standards of OPS-NGGC-1000, Fleet Conduct of Operations, were identified by the inspectors.

OPS-NGGC-1000, Fleet Conduct of Operations, contains the following requirements and standards for control room oversight:

• The Manager-Operations was required to (Section 4.1):

o Ensure compliance with operating instructions and procedures

• The Shift Manager (SM) was required to (Section 4.3):

o Ensure the command and control protocols/functions were maintained in the control room.

o Not become so involved with a single operation to an extent that the ability to oversee the safety of the plant was lost.

o Ensure plant operations were conducted in accordance with the requirements of the plant operating license, Technical Specifications, and plant procedures.

o Maintain a broad perspective of operational conditions affecting plant safety.

o Maintain an overview of plant conditions during the initial phases of any emergency, including oversight of the actions being taken by the CRS and operating crew in resolving the casualty.

o Perform event classification only after being satisfied that the operating crew followed the proper course of action to stabilize the plant in a safe condition during emergency operations.

• The Control Room Supervisor (CRS) was required to (Section 4.4):

o Supervise, direct and oversee all unit activities during the shift.

o Maintain a broad perspective of operational conditions affecting the safety of the plant at all times when on control room duty. During plant transients or an emergency, the SMs involvement should not become such that any single operation would distract from required overall operation of the control room.

o Directly supervise control room watchstanders in the manipulation of reactor and plant controls.

o Ensure that the plant was rigorously monitored and operating activities were conducted in accordance with applicable procedures.

o Promote and monitor teamwork and conservative decision making competencies such as recognizing and avoiding activities that unnecessarily reduce nuclear safety margins. Conservative decisions are considered when coordinating all activities.

o Communicate with subordinates, peers, and superiors to ensure accurate information provided, in a timely manner, about the plant status and conditions and events important to safety. Enclosure 1 7 o Monitoring plant instrumentation and making sound, logical decisions involving the safe, efficient and dependable operation of power plant equipment.

• The Shift Technical Advisor was required to (Section 4.5):

o Provide a primary function of independent assessment of plant and crew response, and provide engineering based technical information and recommendations to assist the crew in safe operation of the plant.

o Acts as an advisor to the SM and CRS by assessing plant conditions and response during normal and off-normal plant operating conditions and make recommendations on mitigating actions to ensure the protection of the reactor core.

o Provide the following crew support during event procedures:

Prioritize focus and support on activities that ensure reactor core protection and accident mitigation strategies.

Provide the operating crew with real time evaluation of plant status, direction, and recommended actions.

Report to the operating crew any abnormalities or plant parameters that may represent a challenge to the critical safety functions or that could result in a degradation of the safety level and assist in formulating a plan for appropriate corrective action.

Assess the effectiveness of mitigating actions.

Provide an independent backup diagnosis of the event.

Provide plant status and system performance projections based on plant trends.

• The Reactor Operator was required to (Section 4.6):

o Place primary focus on reactor control, while another operator places primary focus on the balance of plant during transients, significant evolutions, or abnormal conditions.

o Believe and respond conservatively to instrument indications, and use multiple indications to verify them to be incorrect in order to ensure public, plant and personnel safety.

o Monitor and manipulate the control board.

o Announce the receipt and clearing of annunciators and reference response procedures.

o Monitor operation of the reactor and associated controls for proper response and expected behavior when standing in the Operator at the Controls (OATC) position.

o Uses diverse and redundant indications for verification of plant or equipment status.

o Alert for changing critical parameters, alarms, and trends when standing in the OATC position. The OATC is expected to use computers to provide maximum trending and monitoring.

The following examples were identified by the NRC inspectors that were not in accordance with the requirements and standards of OPS-NGGC-1000: Enclosure 1 8 Example 1 When Bus E-2 momentarily lost power, FCV-626, the component cooling water (CCW)return valve from the RCP thermal barrier heat exchanger, closed and isolated CCW flow to all the RCP thermal barrier heat exchangers. Following a failure of the automatic realignment of charging pump suction supply from the volume control tank (VCT) to the refueling water storage tank (RWST), the control room staff did not manually transfer charging pump suction supply from the VCT to the RWST until after the charging pumps had lost an adequate suction supply as exhibited by fluctuating charging header pressure.

During a period of approximately seven or eight minutes, the RCP seal injection flow was inadequate, coincident with a loss of CCW flow to the thermal barrier heat exchanger.

CCW flow was restored to the thermal barrier heat exchanger but the operators failed to identify that adequate seal injection was not present when CCW flow was restored, increasing the potential for failure of the thermal barrier heat exchanger as well as increased the potential for thermally shocking the RCP seals.

Multiple OPS-NGGC-1000 requirements were not met, which contributed to the loss of adequate RCP seal cooling. Effective monitoring of the control boards should have led to earlier diagnosis of FCV-626 being failed closed and earlier diagnosis that the charging pump suction supply had not automatically transferred to the RWST (Section 4.6).

Adequate command and control on behalf of the CRS should have ensured that these parameters were known by the crew and that the appropriate procedures were used to mitigate the failures (Section 4.4). Adequate oversight by the SM and STA should have assisted the crew with the diagnosis of the failures and subsequent guidance should have circumvented the loss of adequate RCP seal cooling. (Sections 4.3 and 4.5)

Example 2 Following a reactor trip, EPP-4, Reactor Trip Response, provides direction to the operators to control RCS temperature and stop dumping steam if RCS temperature is less than 547 oF. When the crew entered EPP-4, RCS temperature was 537 oF, for approximately four minutes the crew did not take actions to arrest the cooldown. The failure to mitigate the RCS temperature decrease as provided by EPP-4 resulted in an automatic safety injection on low pressurizer pressure.

Multiple OPS-NGGC-1000 requirements were not met, allowing plant conditions to degrade until an automatic safety injection occurred. The operators failed to recognize an excess steam demand event was in progress and take corrective actions to mitigate the event even though clear guidance existed within the emergency operating procedures to close MSIVs if RCS temperature was decreasing (Sections 4.3, 4.4, 4.5 and 4.6). ROs failed to monitor RCS temperature and the CRS failed to provide the direction to the RO to ensure that he was adequately monitoring RCS temperature (Section 4.6). The STA and SM failed to provide oversight which included maintaining an overview of plant conditions and provide the CRS and RO with guidance if actions needed to be taken (Sections 4.3 and 4.5). Enclosure 1 9 Example 3 Following the electrical transient event, operators did not address annunciator APP-009-B6, AUX TRANSF FAULT TRIP, prior to performing Step 8.26 of GP-004, Post Trip Stabilization. Attempting to reset the 86P relay with an auxiliary transformer fault present caused a second electrical transient and resulted in a fault at breaker 52/24 creating an arc that damaged the surrounding equipment. The event resulted in alarms in the control room that indicating grounds on both safety-related 125 volt DC battery buses. An Alert emergency declaration was declared for a fire in a Table H-1 area affecting the A and B DC buses criteria as required by HA2.1 of the licensees emergency action level (EAL)matrix.

OPS-NGGC-1000 requirements also were not met with respect to command and control by the CRS, and oversight by the SM and STA. Operations Management actions were not effective in ensuring that all applicable procedures were adequately performed.

Conservative decision making was not implemented when the generator lockout relay was reset. Resetting the generator lockout relay was not needed to stabilize the plant and the emergency operating procedure (EOP) network of procedures was no longer being used.

Sufficient time existed for management to ensure that proper damage assessments were performed prior to taking any actions that could potentially place the plant in a less safe condition.

Example 4 Emergency Operating Procedure, Path 1, states, RESTART BATTERY CHARGERS WITHIN 30 MIN OF POWER LOSS USING OP-601. Performing this step accurately and in a timely manner ensures that the rated one hour duty cycle for the batteries is not exceeded; thereby ensuring that safety related DC loads remain energized. The control room staff did not direct the performance of OP-601, DC Supply System, in a timely manner. The B battery charger remained de-energized for 38 minutes. It was determined that an auxiliary operator (AO), was available to perform OP-601 earlier in the event, but the CRS was not aware of the AOs availability.

OPS-NGGC-1000 requirements were not met in the areas of command and control by the CRS because he was not aware that a resource was available to perform the task within the 30 minute time requirement (Section 4.4). OPS-NGGC-1000 requirements were also not met by the SM and STA by not adequately performing their oversight role (Sections 4.3 and 4.5). The SM and STA, by maintaining the broad perspective as required by procedure, had an opportunity to provide guidance to the CRS that an available resource existed.

2. Violation for Failure to Implement APP-003-E3

Introduction.

The inspectors identified a violation of Technical Specifications (TS) 5.4.1, Procedures, for the licensees failure to adequately implement the requirements contained in APP-003-E3, VCT HI/LO LEVEL. Enclosure 1 10

Description.

At 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br /> on March 28, 2010, VCT level lowered to the point (12.4 inches)where an automatic swap of the suction source from the VCT to the RWST should have occurred. The automatic realignment did not occur. APP-003-E3, VCT HI/LO LEVEL, Revision 39, Step 5, states, If VCT level reaches 12.4 inches, then verify LCV-115B, EMERG MU TO CHG SUCT, opens and LCV-115C, VCT OUTLET, closes. Performing this step ensures that the charging pumps maintain a suction source, aligning their suction supply from the VCT to the RWST, prior to the VCT completely draining. At 1946 hours0.0225 days <br />0.541 hours <br />0.00322 weeks <br />7.40453e-4 months <br />, the operators diagnosed that the charging pump suction had not automatically realigned to the RWST and had lost an adequate suction supply as exhibited by fluctuating charging header pressure. Operators then secured the operating charging pump to prevent damage, realigned the suction supply to the RWST, and then restarted the charging pump at 1953 hours0.0226 days <br />0.543 hours <br />0.00323 weeks <br />7.431165e-4 months <br />.

During a period of seven or eight minutes, the RCP seal injection flow was inadequate, coincident with no CCW flow to the thermal barrier heat exchanger. CCW was re-initiated to the RCP seals at approximately 1931 hours0.0223 days <br />0.536 hours <br />0.00319 weeks <br />7.347455e-4 months <br />, which was six minutes prior to the loss of charging flow and 39 minutes after FCV-626 had failed closed. However, due to an alternate RCS injection valve failing open, adequate seal injection had been lost even though charging flow had not been lost. Inadequate seal injection flow was indicated by a negative pressure differential across the B RCP labyrinth seal and a rapidly increasing seal leakoff temperature that exceeded 190 oF. CCW flow was restored to the thermal barrier heat exchanger and RCP seal leakoff temperatures began to decrease just prior to exceeding the procedural limits for RCP seal leakoff temperature.

The combination of not having CCW flow to the thermal barrier heat exchanger and not having adequate seal injection flow would likely have led to a failure of the RCP seals if cooling had not been restored. Furthermore, restoring CCW flow without adequate seal injection increased the likelihood for failure of the thermal barrier heat exchanger as well as increased the potential for thermally shocking the RCP seals.

3. Violation for Failure to Implement EPP-4

Introduction.

The inspectors identified a violation of Technical Specifications (TS) 5.4.1, Procedures, for the licensees failure to adequately implement the requirements contained in EPP-4, Reactor Trip Response.

Description.

At 1856 hours0.0215 days <br />0.516 hours <br />0.00307 weeks <br />7.06208e-4 months <br /> on March 28, 2010, following a reactor trip, the crew entered EPP-4, Reactor Trip Response, with RCS temperature at 537 oF. Approximately four minutes later, the RCS temperature decrease resulted in an automatic safety injection on low pressurizer pressure.

EPP-4, Reactor Trip Response, Step 8, provides direction to the operators to control RCS temperature and stop dumping steam if RCS temperature is less than 547 oF. Except for resetting Safety Parameters Display Status (SPDS) and initiating Critical Safety Functions Status Trees (CSFST) monitoring, stop dumping steam is the first control board action to be performed after entry into EPP-4. The crew did not stop dumping steam in accordance with Enclosure 1 11 EPP-4, Step 8. RCS temperature was 537 oF at the time that EPP-4 was entered. The crew did not close the main steam isolation valves (MSIV) or direct actions to locally close moisture separator reheater (MSR) drain valves. At 1855, the crew completed briefing for transition to EPP-4. At 1856, EPP-4 was entered with RCS temperature at 537 oF. At 1900:41, an automatic safety injection occurred, which required the crew to transition back to Path 1. The crews failure to secure the cooldown as directed by EPP-4 contributed to the safety injection occurring.

4. Violation for Failure to Implement APP-009-B6

Introduction.

The inspectors identified a violation of Technical Specifications (TS) 5.4.1, Procedures, for the licensees failure to adequately implement the requirements contained in APP-009-B6, AUX TRANSF FAULT TRIP.

Description.

Following the initial electrical transient event on March 28, 2010, APP-009-B6, AUX TRANSF FAULT TRIP, annunciated due to an internal electrical fault in auxiliary transformers (Fault Pressure), which then caused generator lockout relay 86P to actuate.

Operators performed Step 8.26 of GP-004, Post Trip Stabilization, which attempted resetting the 86P relay. Attempting to reset the 86P with an internal electrical fault in auxiliary transformers caused a second electrical transient and resulted in a fault at breaker 52/24, creating an arc that damaged the surrounding equipment. The event resulted in alarms in the control room that indicated grounds on both safety-related 125 volt dc battery buses, which required an Alert emergency declaration.

OPS-NGGC-1000, Section 9.4, stated that annunciators sealed in as a result of an event or transient are required to be reviewed unless directed by the CRS or SM. APP-009-B6, AUX TRANSF FAULT TRIP, annunciated due to the transient and was not reviewed prior to performing GP-004 Step 8.26. APP-009-B6 required the Load Dispatcher to be contacted to repair the condition causing the fault on the auxiliary transformer. GP-004, Post Trip Stabilization, Step 8.26, directs operators to reset the generator lockout relays assuming that the any conditions causing the relay actuation were cleared.

5. Violation for Failure to Implement Emergency Operating Procedure Path-1

Introduction.

The inspectors identified a violation of Technical Specifications (TS) 5.4.1, Procedures, for the licensees failure to adequately implement the requirements contained in Path 1.

Description.

Emergency Operating Procedure, Path 1, states, RESTART BATTERY CHARGERS WITHIN 30 MIN OF POWER LOSS USING OP-601. Performing this step accurately and in a timely manner ensures that the rated one hour duty cycle of the batteries is not exceeded; thereby ensuring that safety related DC loads remain energized.

Following entry into Path 1, the control room staff did not direct the performance of OP-601 in a timely manner. The B battery charger remained de-energized for 38 minutes. On March 28, 2010, at 1852, the B battery charger de-energized as a result of emergency bus Enclosure 1 12 E-2 being de-energized (E-2 supplies MCC-6, which supplies B battery charger). At 1930 hours0.0223 days <br />0.536 hours <br />0.00319 weeks <br />7.34365e-4 months <br /> the B battery charger was restarted in accordance with Section 8.4.3, Restart of Battery Charger B Following Trip, of OP-601, DC Supply System. Through interviews, it was determined that an auxiliary operator (AO), was available to perform OP-601 earlier in the event, but the CRS was not aware of the AOs availability. Also through interviews it was identified that the CRS was aware of the 30 minute time requirement, but because the CRS did not know that there was an available resource to restart the battery charger, the CRS made the decision to restart the battery charger later as a resource became available.

Analysis of the Problem:

Failure to adequately implement the requirements contained in OPS-NGGC-1000, Fleet Conduct of Operations, was a performance deficiency. The finding was initially evaluated to be more than minor because it was associated with the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to adequately implement requirements contained in OPS-NGGC-1000, Fleet Conduct of Operations, contributed to a complete loss of charging system flow, an increase in the likelihood of RCP seal failure and initiation of a fire on March 28, 2010. Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," the inspectors determined the finding required a Phase 2 analysis because the finding could result in RCS leakage exceeding TS limits. The Phase 2 analysis determined that this finding was Potentially Greater than Green; therefore, a Phase 3 analysis was required by a regional Senior Reactor Analyst (SRA) due to an increase in the likelihood of a RCP seal LOCA.

A Phase 3 SDP analysis was performed by a regional SRA using NRCs Robinson SPAR model, guidance from NRC IMC 0609 Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, Appendix F, Fire Protection Significance Determination Process, NUREG/CR 6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, including Supplement 1, and input from the licensees full scope model to produce a best estimate risk assessment. The influential assumptions in the analysis were the experience level of command & control portions of operating crews and ergonomics of the Main Control Room. The exposure period was assumed to be one year.

External event risk contribution was considered for all credible initiators. The dominant sequences were loss of offsite power (LOOP) sequences, followed by failures of the operators to provide an alternate suction source for Auxiliary Feedwater, and failure to properly initiate High Pressure Recirculation. Additional dominant sequences were steam generator tube rupture (SGTR) with a hardware failure to isolate the faulted steam generator (SG) followed by an operator failure to cool down and depressurize the RCS or failure to initiate shutdown cooling after depressurizing the RCS. No other large early release frequency (LERF) sequence was observed in the external events review.

Therefore, the internal events review is considered the total LERF contribution. The resultant core damage frequency risk increase due to the performance deficiency was > 1E-6/year and <1E-5/year. The finding was characterized as preliminarily White, a finding of low to moderate safety significance. The Phase 3 analysis is included as Enclosure 3. Enclosure 1 13 Furthermore, the Phase 3 analysis revealed that an RCP seal LOCA was not among the dominant accident sequences. The original Phase 2 results were only associated with this one accident sequence. The Phase 2 worksheets do not appropriately capture the breadth of the performance deficiency. The Phase 3 analysis identified the dominant accident sequences as licensed operators failing to properly respond to postulated SGTR or a LOOP.

In accordance with IMC 0609 Attachment 4, Exhibit 1, Step 1.1.3, if a finding affects multiple reactor cornerstones (initiating events, mitigating systems, and barrier integrity), the finding should be assigned to the cornerstone that best reflects the dominant risk of the finding. As a result, it was deemed more appropriate to characterize the performance deficiency in the Mitigating Systems Cornerstone because it affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences.

The inspection team concluded that these issues do not present an immediate safety concern because corrective actions have been implemented. These corrective actions include, but are not limited to, enhancement of licensed operator training material, re-training and evaluation of all control room operators, procedure enhancements, crew reconstitution to enhance performance, and personnel and management changes.

Significance of the overall problem will be assigned that of the finding with the highest final significance. As the Phase 3 analysis showed, the finding was characterized as preliminarily White. However, the final significance of this finding has not been determined and will be designated as To Be Determined (TBD). The cause of this finding had a cross-cutting aspect of supervisory and management oversight of work activities such that nuclear safety is supported, in the Work Practices component of the Human Performance cross-cutting area, because plant supervisors failed to ensure an adequate pre-job brief, failed to enforce proper communications methods at the job site, and failed to properly supervise workers executing procedure steps. (H.4(c)).

Enforcement of the Problem:

Technical Specification 5.4.1, Procedures, requires in part that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide (RG) 1.33, Rev. 2, Quality Assurance Program Requirements, Appendix A. RG 1.33, Appendix A.

• Item 1.b, Authorities and Responsibilities for Safe Operation and Shutdown, is implemented by OPS-NGGC-1000, Fleet Conduct of Operations.

OPS-NGGC-1000 contains responsibility requirements for the Shift Manager (SM),

Control Room Supervisor (CRS), Shift Technical Advisor (STA), and Reactor Operator (RO) to provide monitoring and oversight for plant operations. Specifically: Enclosure 1 14 Section 4.3.4, General Duties the Shift Managers are responsible for:

f. Ensure the command and control protocols/functions were maintained in the control room.

g. Not become so involved with a single operation to an extent that the ability to oversee the safety of the plant was lost.

p. Ensure plant operations were conducted in accordance with the requirements of the plant operating license, Technical Specifications, and plant procedures.

s. Maintain a broad perspective of operational conditions affecting plant safety.

u. Maintain an overview of plant conditions during the initial phases of any emergency, including oversight of the actions being taken by the CRS and operating crew in resolving the casualty Section 4.4, Control Room Supervisor:

3. Maintain a broad perspective of operational conditions affecting the safety of the

plant at all times when on control room duty. During plant transients or an emergency, the SMs involvement should not become such that any single operation would distract from required overall operation of the control room.

10. Directly supervise control room watchstanders in the manipulation of reactor and plant controls.

12. Ensure that the plant was rigorously monitored and operating activities were conducted in accordance with applicable procedures.

30. Monitoring plant instrumentation and making sound, logical decisions involving the safe, efficient and dependable operation of power plant equipment.

Section 4.5, Shift Technical Advisor:

1. Provide a primary function of independent assessment of plant and crew response,

and provide engineering based technical information and recommendations to assist the crew in safe operation of the plant.

2. Acts as an advisor to the SM and CRS by assessing plant conditions and response

during normal and off-normal plant operating conditions and make recommendations on mitigating actions to ensure the protection of the reactor core.

13. Provide the following crew support during event procedures:

a. Prioritize focus and support on activities that ensure reactor core protection and accident mitigation strategies.

b. Provide the operating crew with real time evaluation of plant status, direction, and recommended actions.

c. Report to the operating crew any abnormalities or plant parameters that may represent a challenge to the critical safety functions or that could result in a degradation of the safety level and assist in formulating a plan for appropriate corrective action.

f. Assess the effectiveness of mitigating actions.

g. Provide an independent backup diagnosis of the event. Enclosure 1 15 Section 4.6, Reactor Operator:

2.b Believe and respond conservatively to instrument indications, and use multiple indications to verify them to be incorrect in order to ensure public, plant and personnel safety.

4.a Monitor and manipulate the control board.

1.1.a Monitor operation of the reactor and associated controls for proper response and expected behavior when standing in the Operator at the Controls (OATC)position.

1.1.g Remain Alert for changing critical parameters, alarms, and trends when standing in the OATC position.

• APP-003-E3, VCT HI/LO LEVEL is a recommended procedure per RG 1.33, Appendix A, item 5, Procedures for Abnormal, Offnormal, or Alarm Conditions. Step 5 of APP-003-E3, states, If VCT level reaches 12.4 inches, then verify LCV-115B, EMERG MU TO CHG SUCT, opens and LCV-115C, VCT OUTLET, closes.

• EPP-4, Reactor Trip Response is a recommended procedure per RG 1.33, Appendix A, item 6.u, Reactor Trip. Step 8 of EPP-4, provides direction to the operators to control RCS temperature and stop dumping steam if RCS temperature is less than 547 oF.

• APP-009-B6, AUX TRANSF FAULT TRIP is a recommended procedure per RG 1.33, Appendix A, item 5, Procedures for Abnormal, Offnormal, or Alarm Conditions.

APP-009-B6 requires the Load Dispatcher to be contacted to repair the condition causing the fault on the auxiliary transformer.

• Emergency Operating Procedure, Path 1, is a recommended procedure per RG 1.33, Appendix A, item 6. Procedures for Combating Emergencies and Other Significant Events. Emergency Operating Procedure, Path 1, states, RESTART BATTERY CHARGERS WITHIN 30 MIN OF POWER LOSS USING OP-601.

Contrary to the above, on March 28, 2010, the licensee/operators failed to adequately implement:

• The monitoring and oversight responsibility requirements of OPS-NGGC-1000 for the SM, CRS, STA, and RO when:

o Operators failed to effectively monitor the control boards, delaying diagnosis of an FCV-626 closure and a failure of an automatic transfer of charging pump suction to the RWST resulting in a loss of charging pump suction supply.

o Operators were ineffective during the monitoring of the control boards and failed to recognize an excess steam demand and take corrective actions to prevent a safety Enclosure 1 16 injection. Additionally, the CRS was required to provide direction to the operators to ensure they were adequately monitoring RCS temperature.

o Operators failed to address annunciator APP-009-B6 prior to performing Step 8.26 of GP-004, which included resetting the 86P relay with an auxiliary transformer fault present. This caused a fast transfer of 4 kV bus 4 from the unit auxiliary transformer to the startup transformer and caused a fault at breaker 52/24. The associated arc damaged surrounding equipment. Subsequently, alarms in the control room indicated grounds on both safety-related 125 volt DC battery buses, which required an Alert emergency declaration.

o The control room staff failed to direct the performance of OP-601 in a timely manner resulting in the B battery charger remaining de-energized for 38 minutes.

• The required actions of APP-003-E3, VCT HI/LO LEVEL, Revision 39, Step 5; If VCT level reaches 12.4 inches, then verify LCV-115B, EMERG MU TO CHG SUCT, opens and LCV-115C, VCT OUTLET, closes, when VCT level decreased below 12.4 inches.

• The required actions of EPP-4, step 8.b, Stop Dumping Steam, when RCS temperature was below 547oF. This failure resulted in an automatic safety injection on low pressurizer pressure.

• The required actions of APP-009-B6, AUX TRANSF FAULT TRIP. The failure to not clear the conditions causing the fault on the auxiliary transformer resulted in a second electrical transient and associated arc that damaged the surrounding equipment.

• The required actions of, Emergency Operating Procedure, Path 1, which states, RESTART BATTERY CHARGERS WITHIN 30 MIN OF POWER LOSS USING OP-601. The crew re-energize the B battery charger 38 minutes after power was lost to the battery charger.

In accordance with Enforcement Manual, Section 2.13.8, this group of related programmatic violations is identified as Apparent Violation (AV)0500261/2010013-01, Failure to Comply with Conduct of Operations Procedure. This issue has been entered into the licensee's corrective action program as NCRs 390095 and 423246.

URI 05000261/2010009-01, Monitoring of Plant Parameters and Alarms, and URI 05000261/2010009-03, Utilization of Operators During Events Requiring Use of Concurrent Procedures, are closed. Enclosure 1 17

.02 (Green)0500261/2010004-04, Failure to Establish an Adequate PATH-1 Emergency

Operating Procedure

a. Inspection Scope

The inspectors completed an in-office review of AV 0500261/2010004-04, Failure to Establish an Adequate PATH-1 Emergency Operating Procedure which was documented in Inspection Report number 05000261/2010004. The significance of this AV was designated as To Be Determined until the safety characterization was completed. An SDP Phase 3 analysis has been finalized and the results are documented below.

b. Findings

Introduction:

The NRC has identified a green non-cited violation (NCV) of Technical Specifications (TS) 5.4.1.a, Procedures for the licensees failure to establish and maintain an adequate emergency procedure that ensured reactor coolant pump (RCP) seal cooling was adequately maintained following a reactor trip and/or safety injection.

Description:

The licensees Path-1 emergency operating procedure, is a flow path compilation of Westinghouse Owners Group (WOG) procedures E-0, Reactor Trip or Safety Injection, and E-1, Loss of Reactor or Secondary Coolant. The first two columns of the flow path generally align with E-0, and the last two columns generally align with E-1.

The WOG Background Document, Low Pressure, revision 2 step 19 states: Check RCP Seal Cooling. The purpose for this step is to maintain seal cooling to the RCPs. Path-1 directs operators to secure RCPs if seal cooling is not maintained. In the Path-1 procedure, operators are directed to check the RCP Thermal Barrier Cooling Water Hi or Lo flow annunciator illuminated. If the annunciator is illuminated, thermal barrier cooling is considered not available and the operator is directed to verify that a charging pump is running. If a charging pump is running, Path-1 directs the operator to proceed to the next step without securing RCPs. If a charging pump is not running, Path-1 directs operators to secure RCPs.

During the March 28, 2010, event, FCV-626 thermal barrier heat exchanger outlet isolation flow control valve, had failed closed due to a temporary loss of power that resulted in thermal barrier cooling being lost for approximately 39 minutes. An incorrectly installed modification resulted in the failure of an auto-swap feature that was supposed to automatically transfer the charging pump suction from the Volume Control Tank (VCT) to the RWST on low level in the VCT. Also, operators failed to recognize that the lowering VCT level, in conjunction with valve CVC-310A, Charging Flow to Loop 1, opening on a loss of instrument air, resulted in no longer providing adequate RCP seal injection coincident with the loss of thermal barrier cooling. Review of the event indicated that seal leakoff temperatures on all three reactor coolant pumps began to increase toward RCS temperatures, which was indicative of inadequate seal cooling. Enclosure 1 18 Operators who were on duty during the event incorrectly performed the verification of RCP seal injection prior to opening FCV-626. Operators did not verify that adequate seal injection existed by review of diverse indications. The operators indicated during interviews that they verified a charging pump was running prior to re-opening FCV-626. The operators indicated that thermally shocking the RCP seals was not a concern with a charging pump running. At the time that FCV-626 was re-opened, CCW had not been flowing to the thermal barrier heat exchanger for 39 minutes and seal injection had been inadequate for 10 to 15 minutes coincident with no thermal barrier cooling. Inspectors considered this information when performing the review of the licensees procedures that were used during the event. The operator performance aspects are further discussed in section 4OA5.01 of this report.

Inspectors identified that Path-1 only required the operators to verify that a charging pump was running for making the determination that adequate seal injection existed. Inspectors also identified that the Path-1 background document supported the incorrect assumption that a charging pump running was satisfactory indication that adequate seal injection flow existed.

Analysis:

The failure to establish and maintain an emergency procedure that would ensure adequate reactor coolant pump seal cooling, prevent seal degradation and a possible seal LOCA was a performance deficiency. The finding was more-than minor because it is associated with the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations, specifically a loss of seal cooling to prevent the initiation of an RCP seal loss of coolant accident (LOCA). Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings,"

the inspectors determined the finding required a Phase 2 analysis because the finding could result in RCS leakage exceeding Technical Specification limits. The Phase 2 analysis determined that this finding was potentially greater than green; therefore, a Phase 3 analysis is required by a regional senior reactor analyst due to an increase in the likelihood of an RCP seal LOCA.

A Phase 3 analysis was performed assuming a one year exposure period and utilized the NRCs Robinson SPAR model and an event tree was developed to specifically evaluate the performance deficiencys conditions. The dominant sequence was a loss of offsite power which caused an isolation of the RCP thermal barrier cooling without initial operator recovery, followed by a safety injection which affected charging seal injection and subsequent restoration of seal cooling causing seal failure due to thermal shock leading to a seal LOCA and failure of high pressure recirculation. The risk was mitigated by the low likelihood of establishing the conditions necessary to create the loss of seal injection and RCP seal thermal shock conditions. The result of the Phase 3 analysis was a core damage frequency increase of <1E-6/year, a finding of very low safety significance. The cause of this finding had a cross-cutting aspect of Documentation, Procedures, and Component Labeling, in the Resources component of the cross-cutting area of Human Performance, in that the licensee failed to ensure procedures for emergency operations were adequate to assure nuclear safety. (H.2(c)) Enclosure 1 19

Enforcement:

Technical Specification 5.4.1, Procedures, requires in part that procedures shall be established, implemented, and maintained covering the activities in Regulatory Guide (RG) 1.33, Rev. 2, Quality Assurance Program Requirements. Item 6 of RG 1.33, Appendix A, states, in part, that typical safety-related activities such as combating emergencies and other significant events including reactor trip, shall be covered by written procedures. The licensees PATH-1 procedure is the implementing procedure for operator response to a reactor trip.

Contrary to the above, prior to March 28, 2010, the licensee did not adequately establish and maintain procedures to ensure that seal cooling was adequately maintained to the RCPs following a reactor trip. Specifically, the licensees PATH-1 procedure and associated Background Document incorrectly informed operators that verification of an operating charging pump was adequate to determine that RCP seal injection existed. Not maintaining adequate seal cooling to the RCPs affects the likelihood of a RCP seal-LOCA caused by thermally shocking RCP seals and seal failure.

Because this finding was of very low safety significance (Green), and was entered into the licensees CAP as NCR 423147, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and is identified as NCV 0500261/2010004-04, Failure to Establish an Adequate PATH-1 Emergency Operating Procedure.

.03 (Discussed) AV 0500261/2010004-05, Failure to Correctly Implement a Systems Approach

to Training for the Licensed Operator Requalification Program

a. Inspection Scope

During the week of September 20-24, 2010, NRC inspectors performed focused inspection activities in accordance with Inspection Procedure 71111.11, Licensed Operator Requalification Program, and 41500, Training and Qualification Effectiveness as follow-up on unresolved items stemming from plant events from March 28, 2010. The inspectors reviewed training records from 2007 through 2010 associated with the operating crew on watch the evening of March 28, 2010.

b. Findings

Problem Associated with the Implementation of the Commission Approved Requalification Program Developed Using a Systems Approach to Training During the inspection, one finding and one apparent violation associated with the implementation of the licensed operator requalification training program were identified by the inspectors. In accordance with Enforcement Manual, Section 2.13.8, the NRC evaluated these issues and determined they will be dispositioned as a group of related programmatic violations associated with a problem in implementation of the licensees Commission approved requalification program developed using a systems approach to training (SAT). Enclosure 1 20 Issues associated with the Problem

1. Finding for Inadequate Implementation of Remedial Training

Introduction:

The inspectors identified a Finding for the licensees failure to adequately implement elements of a Commission approved requalification program developed using a systems approach to training (SAT). Specifically, the licensee inadequately implemented remediation per TRN-NGGC-0002, Performance Review and Remedial Training, for individuals whose performance was not meeting approved standards.

Description:

The inspectors reviewed licensee training procedures, lesson plans, and operator evaluation documentation to determine if the licensee was meeting the requirements of 10 CFR 55.59, Requalification, as well as their own procedure requirements pertaining to Licensed Operator Continuing Training (LOCT). Training Program Procedure TPP-200, Licensed Operator/Shift Technical Advisor Continuing Training Program required the licensee to develop, maintain, and implement their LOCT program using the SAT process, as well as meet the requirements of 10 CFR 55.59. TRN-NGGC-0002, Performance Review and Remedial Training, provides guidance for remediation of individuals whose performance is not meeting approved standards.

The inspectors identified one example where the licensees retraining, i.e., remediation, for operators who demonstrated weaknesses during their annual operating test on February 13, 2007, failed to prevent the same weaknesses from occurring during the plant event on March 28, 2010. During an annual operating test on February 13, 2007, the operating crew was expected to recognize that a complete loss of Reactor Coolant Pump (RCP) seal cooling had occurred when charging and Component Cooling Water (CCW) flow were lost to all RCPs. The licensees crew evaluation documentation states that the crew did not recognize, for a period of 21 minutes, that RCP seal cooling had been lost. The licensee did not prescribe remediation activities and also did not complete a Remedial Action Plan to address this weakness because the crew had passed the overall scenario. TRN-NGGC-0002, Performance Review and Remedial Training, Section 9.1.1, states that during initial and/or continuing training activities or other job performance deficiencies, an individual performance review may be completed using Attachment 1 (Remedial Action Plan), or a similar form, to document performance that does not meet expectations. Consequently, one of the operators who had demonstrated weaknesses during the February 2007 operating test scenario, who was also the balance of plant operator during the actual plant event on March 28, 2010, demonstrated the same weakness (along with the entire crew) to diagnose the loss of adequate RCP seal cooling.

In addition, the inspectors identified multiple issues related to the quality of implementation of remedial training. The inspectors identified instances where the training program was not identifying and documenting operator weaknesses to allow the underlying causes of operator errors to be remediated. The licensees training documentation contains instances where operator errors were identified; however, the underlying reasons for the errors were not documented. Documentation of follow-up questions was largely absent from the completed evaluation forms. Enclosure 1 21 Specific examples of remediation quality issues were noted in the following evaluated simulator scenarios:

• On December 8, 2009, licensed operators incorrectly diagnosed a feedwater transient that required a manual reactor trip. Operators subsequently failed to ensure a complete phase B isolation, among other errors. Remediation documentation was essentially the same for each operator on the crew and did not indicate specific individual weaknesses.

The remediation documentation did not discuss the individual operator weaknesses that resulted in the operational errors.

• On May 9, 2010, a Shift Manager made an incorrect emergency classification. The individuals evaluation documentation only stated that an emergency classification was made incorrectly. The report does not indicate why the classification was incorrect, or what operator weaknesses were associated with the incorrect classification. The individual was required to take two practice classification Job Performance Measures (JPMs) followed by a re-examination simulator scenario. The individual subsequently failed to correctly classify the event during the re-examination.

• On May 9, 2010, the balance of plant Reactor Operator had evaluated weaknesses of not responding to Annunciator Panel Procedures (APPs), not recognizing that the turbine would not runback when in manual, not controlling charging to prevent letdown alarms, and not using the governor valve fast action push button during Path-1 immediate operator actions. The remediation plan included a brief and review of the failed scenario, two scenarios containing immediate action drills, followed by a re-evaluation. The documentation does not contain information that addresses the operator weaknesses associated with all of the documented operator errors.

• On May 26, 2010, a Shift Manager made an incorrect emergency classification. Similar to the May 9, 2010, misclassification, the individuals evaluation documentation only states that an emergency classification was made incorrectly. The report does not indicate why the classification was incorrect, or what operator weaknesses were associated with the incorrect classification. The individuals remediation documentation states that he was required to perform three practice classification JPMs and then pass another simulator scenario. The evaluation and remediation documentation does not discuss the probable causes for the incorrect classification. There is no method to determine whether the operator weakness was identified, corrected, and accurately re-evaluated.

2. Apparent Violation for Inadequate Training on Objectives

Introduction:

The inspectors identified an AV of 10 CFR 55.59(c), Requalification program requirements, for the licensees failure to implement elements of a Commission approved requalification program developed using a systems approach to training (SAT). Specifically, the licensee failed to implement learning objective Path-1-005, for operators to explain the basis of steps, cautions, and notes of the Path-1 emergency operating procedure. Enclosure 1 22

Description:

The inspectors reviewed licensee training procedures, lesson plans, and operator evaluation documentation to determine if the licensee was meeting the requirements of 10 CFR 55.59, Requalification, as well as their own procedure requirements pertaining to Licensed Operator Continuing Training (LOCT). Training Program Procedure TPP-200, Licensed Operator/Shift Technical Advisor Continuing Training Program required the licensee to develop, maintain, and implement their LOCT program using the SAT process, as well as meet the requirements of 10 CFR 55.59.

During the review of training material, the inspectors identified that the Path-1 training material was not developed to train on all of the procedure steps within Path-1. The lesson material was developed to train primarily on immediate action steps, rules for procedure implementation, procedure transitions, and some relevant operating experience. The lesson plan did not contain supporting training information for subsequent action steps to ensure that operators not only knew the wording of the steps, but also that they understood the intent and basis behind those subsequent action steps. Path-1 training enabling objective, PATH-1-005, required operators to explain the basis of steps, cautions, and notes of Path-1. This enabling objective applied to the entire licensed operator population, as well as the Shift Technical Advisor (STA) position. Design and implementation of training based on learning objectives is a required element of a SAT as defined in Element (3), Training design and implementation based on learning objectives.

Inadequate training on emergency operating procedures contributed to operators inadequately implementing Path-1 procedure steps during the events of March 28, 2010.

The training on Path-1 procedure steps, as well as the basis and intent of those steps, is especially important at Robinson because the Path-1 procedure, although primarily written in accordance with Westinghouse Owners Group (WOG) guidance, does not contain the level of detail required to ensure performance meets the intent of the procedure steps.

Proper implementation of their Path-1 EOP requires the operator to retain and apply much of the knowledge from memory, as opposed to performing specific details prescribed within a procedure, details that also ensure compliance with the intent of the procedure.

Analysis of the Problem The licensees failure to properly implement elements of a Commission approved requalification program was a performance deficiency. The finding was determined to be more than minor because it was associated with the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The failure to implement training requirements for Path-1 and perform adequate retraining of operators that demonstrated areas of weakness during operating tests contributed to operators failure to identify and implement actions to mitigate a loss of seal cooling to the reactor coolant pumps during the events of March 28, 2010. Enclosure 1 23 Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," the inspectors determined the finding required a Phase 2 analysis because the finding could result in RCS leakage exceeding Technical Specification limits. The Phase 2 analysis determined that this finding was Potentially Greater than Green; therefore, a Phase 3 analysis was required by a regional senior reactor analyst due to an increase in the likelihood of an RCP seal LOCA.

A Phase 3 SDP analysis was performed by a regional SRA using NRCs Robinson SPAR model, guidance from NRC IMC 0609 Appendix A, Appendix F, NUREG/CR 6850 and Supplement 1, and input from the licensees full scope model to produce a best estimate risk assessment. The influential assumption in the analysis was that the training degradation only involved main control room (MCR) actions and did not include safe shutdown due to fires. Although exposure period exceeds one year, one year is the maximum duration under the ROP. External event risk contribution was considered for all credible initiators. The dominant sequences were LOOP sequences, followed by failures of the operators to provide an alternate suction source for Auxiliary Feedwater, and failure to successfully initiate feed and bleed. Additional dominant sequences were SGTR with a hardware failure to isolate the faulted SG followed by an operator failure to cool down and depressurize the RCS or failure to initiate shutdown cooling after depressurizing the RCS.

No containment non-bypass sequence was identified in the external events review.

Therefore, the containment bypass sequences are considered the total LERF contribution.

The resultant core damage frequency risk increase due to the performance deficiency was

> 1E-6/year and <1E-5/year. The finding was characterized as preliminarily White, a finding of low to moderate safety significance. The Phase 3 analysis is included as Enclosure 2.

Furthermore, the Phase 3 analysis revealed that an RCP seal LOCA was not among the dominant accident sequences. The original Phase 2 results were only associated with this one accident sequence. The Phase 2 worksheets do not appropriately capture the breadth of the performance deficiency. The Phase 3 identified the dominant accident sequences as licensed operators failing to properly respond to postulated SGTR or a LOOP. Therefore, in accordance with IMC 0609 Attachment 4, Exhibit 1, Step 1.1.3, if a finding affects multiple reactor cornerstones (initiating events, mitigating systems, and barrier integrity), the finding should be assigned to the cornerstone that best reflects the dominant risk of the finding. As a result, it was deemed more appropriate to characterize the performance deficiency in the Mitigating Systems Cornerstone because it affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences.

The team determined that these issues do not present an immediate safety concern because the licensee has implemented corrective actions to train all licensed operators on PATH-1-005 objective requirements and increased the rigor of their remediation program.

Significance of the overall problem will be assigned that of the finding with the highest final significance. As the Phase 3 analysis showed, the finding was characterized as preliminarily White. However, the final significance of this finding has not been determined and will be designated as To Be Determined (TBD). The licensee has entered these issues into their corrective action program as NCR-423232, NCR-423238, and NCR- Enclosure 1 24 423239. This problem was directly related to the cross-cutting aspect of Training of Personnel of the Resources component in the cross-cutting area of Human Performance.

Specifically, the licensee did not comply with the requirements to implement a SAT process for their LOCT program. (H.2(b))

Enforcement of the Problem The inspectors determined that the finding of inadequate implementation of remedial training did not involve a violation of NRC requirements and therefore is not subject to enforcement action.

The finding associated with the SAT did involve a violation of an NRC requirement.

Specifically, 10 CFR 55.59(c), Requalification program requirements, states that a facility licensee shall have a requalification program reviewed and approved by the Commission and shall, upon request consistent with the Commission's inspection program needs, submit to the Commission a copy of its comprehensive requalification written examinations or annual operating tests. The requalification program must meet the requirements of paragraphs (c)

(1) through

(7) of this section. In lieu of paragraphs (c) (2), (3), and

(4) of this section, the Commission may approve a program developed by using a systems approach to training.

10 CFR 55.4 defines a systems approach to training as a training program that includes the following five elements:

(1) Systematic analysis of the jobs to be performed;

(2) Learning objectives derived from the analysis which describe desired performance after training;

(3) Training design and implementation based on the learning objectives;

(4) Evaluation of trainee mastery of the objectives during training;

(5) Evaluation and revision of the training based on the performance of trained personnel in the job setting.

As described in FSAR section 13.2.1, Accredited Training Programs, H.B. Robinson continuing training program (requalification program) for licensed personnel was developed in accordance with the systems approach to training and is accredited by the National Academy for Nuclear Training.

Contrary to the above, prior to March 28, 2010, the licensee failed to adequately implement a requalification program using a systems approach to training. Specifically, the licensee derived learning objectives from task analysis for emergency operating procedure PATH-1, which identified the objective (Path-1-005) that operators explain the basis of steps, cautions, and notes of the Path-1 procedure. However, licensee training was not adequately designed and implemented based on the learning objectives (Element 3 of the systems approach to training), in that lesson material failed to identify the basis of a procedural action involving reactor coolant pump (RCP) seal cooling in procedure Path-1.

As a result, following a reactor trip on March 28, 2010, licensed operators and other main control room staff failed to recognize the loss of adequate RCP seal cooling, and inappropriately re-established seal cooling via thermal barrier heat exchanger flow, thereby increasing the risk of an RCP seal failure. Enclosure 1 25 This apparent violation is identified as AV 0500261/2010004-05, Failure to Correctly Implement a Systems Approach to Training for the Licensed Operator Requalification Program. This issue has been entered into the licensee's corrective action system as NCR-423232, NCR-423238, and NCR-423239.

4OA6 Meetings, Including Exit

On December 27, 2010, the NRC presented the inspection results to Mr. B. McCabe.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

C. Castell, Licensing Supervisor

J. Cole, Manager - Shift Operations

D. Corlett, Licensing

W. Gurganious, Director - Training

S. Howard, Operations Manager

J. Pierce, Fleet Area Manager - Operations Training

E. Roberts, Superintendent Operations Training

K. Smith, Training Manager

D. Sunthankar, Simulator Support Lead

NRC Personnel

R. Musser, Chief, Reactor Projects Branch 4

LIST OF REPORT ITEMS

Opened

05000261/2010013-01 AV Failure to Comply with Conduct of Operations Procedure (Section 4OA5.01)

Closed

05000261/2010009-01 URI Monitoring of Plant Parameters and Alarms. (Section 4OA5.01)

05000261/2010009-03 URI Utilization of Operators During Events Requiring Use of Concurrent Procedures (Section 4OA5.01)

05000261/2010004-04 NCV Failure to Establish an Adequate PATH-1 Emergency Operating Procedure (Section 4OA5.02)

Discussed

05000261/2010004-05 AV Failure to Correctly Implement a Systems Approach to Training for the Licensed Operator Requalification Program (Section 4OA5.03) Attachment