IR 05000298/2017010

Revised NRC Problem Identification and Resolution Inspection Report 05000298/2017010

ML19164A172
Person / Time
Site:	Cooper
Issue date:	06/12/2019
From:	Ray Kellar Division of Reactor Safety IV
To:	Dent J Nebraska Public Power District (NPPD)
Kellar R
References
IR 2017010
Download: ML19164A172 (40)

Text

une 12, 2019

SUBJECT:

COOPER NUCLEAR STATION - REVISED NRC PROBLEM IDENTIFICATION AND RESOLUTION INSPECTION REPORT 05000298/2017010

Dear Mr. Dent:

On June 29, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed a problem identification and resolution inspection and a follow-up inspection for multiple Severity Level IV violations at your Cooper Nuclear Station and discussed the results of this inspection with Mr. J. Kalamaja, General Manager Plant Operations and then-acting Vice President and Chief Nuclear Officer, and other members of your staff. The results of this inspection were originally issued in a report, dated August 7, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17219A742). NRC staff subsequently determined that some of the inspection results had been incorrectly characterized. A telephonic discussion of the results of the revised inspection report were discussed with you and other members of your staff on June 12, 2019. The revised report is attached. The inspection teams overall assessment of Cooper Nuclear Stations corrective action program and processes remains unchanged.

The original inspection report documented four findings of very low safety significance (Green),

all of which were described as violations of NRC requirements. The original inspection report also documented one Severity Level IV violation without an associated finding. Upon further evaluation, the NRC has determined that two of the documented findings did not involve violations of regulatory requirements and were of minor safety significance. As a result, they were removed from the inspection report. Additionally, NRC inspectors determined that the Severity Level IV violation should have been documented with an associated Green finding.

The attached revised report now documents three findings of very low safety significance (Green). All of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV. The NRC is treating the three violations of NRC requirements as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the revised violation or the significance, you should provide a response within 30 days of the date of this revised inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Cooper Nuclear Station.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Ray L. Kellar, P.E., Team Leader Inspection Program and Assessment Team Division of Reactor Safety Docket No. 50-298 License No. DPR-46

Enclosure:

Revised Inspection Report 05000298/2017010 w/ Attachment: Supplemental Information

REGION IV==

Docket: 50-298 License: DPR-46 Report: 05000298/2017010 Licensee: Nebraska Public Power District Facility: Cooper Nuclear Station Location: 72676 648A Ave Brownville, NE Dates: June 12 through June 29, 2017 Inspectors: E. Ruesch, J.D., Senior Reactor Inspector (Team Lead)

H. Freeman, Senior Reactor Inspector G. Pick, Senior Reactor Inspector P. Voss, Senior Resident Inspector C. Young, Senior Project Engineer Approved By: Ray L. Kellar, P.E., Team Leader Inspection Program and Assessment Team Division of Reactor Safety Enclosure

SUMMARY

IR 05000298/2017010; 06/12/2017 - 06/29/2017; REVISED COOPER NUCLEAR STATION;

PROBLEM IDENTIFICATION AND RESOLUTION (BIENNIAL)

The inspection activities described in this report were performed between June 12, 2017, and June 29, 2017, by four inspectors from the NRCs Region IV office and the resident inspector at Cooper Nuclear Station. The report documents three findings of very low safety significance (Green). All of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Assessment of Problem Identification and Resolution Based on its inspection sample, the team concluded that the licensee maintained a corrective action program in which individuals generally identified issues at an appropriately low threshold.

However, once entered into the corrective action program, the licensee had some substantial programmatic challenges with evaluating these issues appropriately and timely, commensurate with their safety significance. These challenges were primarily in station managements oversight of the corrective action program, the stations screening processes to determine the significance of issues, and timely implementation of operability determination processes. With the exception of some corrective actions to preclude repetition that lacked sustainability, the licensees corrective actions were generally effective, addressing the causes and extents of condition of problems.

The licensee appropriately evaluated industry operating experience for relevance to the facility and entered applicable items in the corrective action program. The licensee incorporated industry and internal operating experience in its root cause and apparent cause evaluations.

The licensee performed effective and self-critical nuclear oversight audits and self-assessments.

The licensee maintained an effective process to ensure significant findings from these audits and self-assessments were addressed.

The licensee maintained a safety-conscious work environment in which personnel were willing to raise nuclear safety concerns without fear of retaliation.

Cornerstone: Mitigating Systems

Green.

The team identified a Green, non-cited violation of 10 CFR 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to accomplish activities affecting quality in accordance with Corrective Action Program Procedure 0-EN-LI-118, Root Cause Evaluation Process, Revision 18C5. Specifically, between June 7, 2016, and June 29, 2017, contrary to Procedure 0-EN-LI-118, the licensee failed to assign corrective actions to preclude repetition to address the failure of a relay coil that resulted in a loss of the high-pressure coolant injection system, a significant condition adverse to quality. Corrective actions to restore compliance included reevaluation of the corrective actions assigned to the root cause of the condition and the creation of corrective actions to preclude repetition for the condition. The licensee entered this deficiency into the corrective action program as Condition Report CR-CNS-2017-03544.

The licensees failure to accomplish activities affecting quality in accordance with documented instructions, procedures, or drawings of a type appropriate to the circumstances in violation of 10 CFR 50, Appendix B, Criterion V, was a performance deficiency. The performance deficiency was evaluated using Inspection Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, and was associated with the Mitigating Systems cornerstone. The team determined that the performance deficiency was more than minor, and therefore a finding, because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the licensees failure to accomplish activities affecting safety with documented instructions could reasonably result in the condition recurring and creating more safety-significant equipment failures. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding had very low safety significance (Green) because it: was not a design deficiency; did not represent a loss of system and/or function; did not represent an actual loss of function; did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time; and did not result in the loss of a high safety-significant non-technical specification train. The finding had a cross-cutting aspect in the area of problem identification and resolution associated with resolution, because the licensee failed to ensure that the organization took effective corrective actions to address issues in a timely manner commensurate with their safety significance [P.3]. (Section 4OA2.5)

Green.

The team identified a Green non-cited violation of 10 CFR 50.65(a)(1)/(a)(2), for the licensees failure to perform an a(1) evaluation and establish a(1) goals when the No. 2 diesel generator a(2) preventive maintenance demonstration became invalid.

Specifically, on April 28, 2017, the No. 2 diesel generator exceeded its performance criteria when it experienced a second maintenance rule functional failure, but the licensee failed to perform an associated a(1) evaluation. The licensee had failed to appropriately evaluate a February 4, 2017, failure associated with the No. 2 diesel generator jacket water heater failure in the Maintenance Rule Program and, as a result, the site failed to evaluate and monitor the equipment under 10 CFR 50.65(a)(1) as required. Corrective actions taken by the licensee to restore compliance included reevaluation of the February 4, 2017, functional failure and performance of an a(1) evaluation. The issue was entered into the licensees corrective action program as Condition Report CR-CNS-2017-03930.

The licensees failure to monitor the No. 2 diesel generator in accordance with the requirements of 10 CFR 50.65(a)(1), due to incorrectly evaluating one maintenance rule functional failure, in violation of 10 CFR 50.65(a)(1)/(a)(2), was a performance deficiency.

The inspectors screened the performance deficiency using Inspection Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, and determined that the issue was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding had very low safety significance (Green) because it:

was not a design deficiency; did not represent a loss of system and/or function; did not represent an actual loss of function; did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time; and did not result in the loss of a high safety-significant non-technical specification train. The finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluation, because the licensee failed to ensure that the organization thoroughly evaluated the No. 2 diesel generator issues to ensure that resolutions addressed causes and extent of conditions commensurate with their safety significance [P.2]. (Section 4OA2.5)

Other Findings

and Violations

• Severity Level IV. The team identified a Green finding and associated Severity Level IV, non-cited violation of 10 CFR 21.21(a), for the licensees failure to adopt appropriate procedures to evaluate Part 21 deviations. Specifically, Procedure EN-LI-108, 10 CFR 21 Evaluations and Reporting, Revision 5C0, was not appropriate to ensure that adequate Part 21 evaluations could be completed. In particular, the procedure (1) could lead the licensee to incorrectly conclude that a substantial safety hazard could not be created, (2) allowed a limited extent of condition in performing the substantial safety hazard evaluation such that similarly dedicated parts would not be included in the scope, and (3) included incorrect guidance in Attachment 9.3. Corrective actions to restore compliance included revision of Procedure EN-LI-108-01 and re-evaluation of affected deviations under Part 21 requirements. The licensee entered this issue into the corrective action program as Condition Reports CR-CNS-2017-03936 and CR-CNS-2017-04143.

The failure to adopt appropriate procedures to evaluate Part 21 deviations, in violation of 10 CFR 21.21(a), was a performance deficiency. The inspectors screened the performance deficiency using Inspection Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, and determined that the issue was more than minor, and therefore a finding, because it was associated with the Mitigating Systems cornerstone and, if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the licensees failure to have an adequate procedure to evaluate Part 21 implications for defective components and identify substantial safety hazards could reasonably result in the condition recurring and the possibility that the defect might also exist in the redundant basic component which could result in a loss of safety function creating more safety-significant failures. In one case, the Part 21 implications of a failed relay that had been installed in the high-pressure coolant injection system and could have been installed in the low-pressure coolant injection system were not recognized until the team identified the vulnerability. The inspectors assessed the significance of the finding using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012. Using Exhibit 2, Mitigating Systems Screening Questions, the finding was screened as having very low safety significance (Green) because it was not a design deficiency, did not represent a loss of system and/or function, did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, and did not result in the loss of a high safety-significant non-technical specification train.

Traditional enforcement applied to this violation because it was associated with impeding the regulatory process. The team used the NRC Enforcement Policy, dated November 1, 2016, to determine the significance of the violation. The inspectors determined that the violation was similar to Enforcement Policy Severity Level IV Example 6.9.d.13, Failure to implement adequate 10 CFR Part 21 or 10 CFR 50.55(e) processes or procedures that has more than minor safety or security significance, The inspectors also determined the issue was not similar to Enforcement Policy Severity Level III Example 6.9.c.5(a), An inadequate review or failure to review such that, if an appropriate review had been made as required, a 10 CFR Part 21 or 10 CFR 50.55(e) report would have been required. Specifically, the procedure could result in inadequate reportability reviews for Part 21 defects, but for examples reviewed by the team, the licensee had reported the events under the requirements of 10 CFR 50.73, even if the event report in one case did not include all known aspects of the deviation. As a result, the team determined that this issue did not represent a failure to make a required Part 21 report and concluded that the violation should be classified as a Severity Level IV violation. The inspectors did not assign a cross-cutting aspect to the violation because the deficient procedure was made effective on August 18, 2015, and did not represent current performance. (Section 4OA2.5)

REPORT DETAILS

4OA2 Problem Identification and Resolution

The team based the following conclusions on a sample of corrective action documents that were open during the assessment period, which ranged from June 24, 2015, to the end of the on-site portion of this inspection on June 29, 2017.

.1 Assessment of the Corrective Action Program Effectiveness

a. Inspection Scope

The team reviewed approximately 220 Condition Reports (CRs), including associated root cause analyses and apparent cause evaluations, from approximately 16,000 that the licensee had initiated or closed between June 2015 and June 2017. The majority of these (over 15,000) were lower-level condition reports that did not require cause evaluations. The inspection sample focused on higher-significance condition reports for which the licensee evaluated and took actions to address the cause of the condition. In performing its review, the team evaluated whether the licensee had properly identified, characterized, and entered issues into the corrective action program (CAP), and whether the licensee had appropriately evaluated and resolved the issues in accordance with established programs, processes, and procedures. The team also reviewed these programs, processes, and procedures to determine if any issues existed that may impair their effectiveness.

The team reviewed a sample of performance metrics, system health reports, operability determinations, self-assessments, trending reports and metrics, and various other documents related to the licensees corrective action program. The team evaluated the licensees efforts in determining the scope of problems by reviewing selected logs, work orders, self-assessment results, audits, system health reports, action plans, and results from surveillance tests and preventive maintenance tasks. The team reviewed daily CRs and attended the licensees performance improvement review group (PRG), PRG pre-screen, operations focus, and aggregate performance review meetings. The team assessed the licensees reporting threshold and prioritization efforts, to observe the corrective action programs interfaces with the operability assessment and work control processes. The teams review included an evaluation of whether the licensee considered the full extent of cause and extent of condition for problems, as well as a review of how the licensee assessed generic implications and previous occurrences of issues. The team assessed the timeliness and effectiveness of corrective actions, completed or planned, and looked for additional examples of problems similar to those the licensee had previously addressed. The team conducted interviews with plant personnel to identify other processes that may exist where problems may be identified and addressed outside the corrective action program.

The team reviewed corrective action documents that addressed past NRC-identified violations to evaluate whether corrective actions addressed the issues described in the inspection reports. The team reviewed a sample of corrective actions closed to other corrective action documents to ensure that the ultimate corrective actions remained appropriate and timely.

The team considered risk insights from both the NRCs and Cooper Nuclear Stations risk models to focus the sample selection and plant tours on risk-significant systems and components. The team focused a portion of its sample on the primary containment and high-pressure coolant injection (HPCI) system, which the team selected for a 5-year in-depth review. The team conducted walk-downs of this system and other plant areas to assess whether licensee personnel identified problems at a low threshold and entered them into the corrective action program.

b. Assessment During the assessment period, the licensee significantly revised its corrective action program to incorporate two major industry initiatives. Among other enhancements, these revisions incorporated three significant changes to the program. First, the term adverse condition was introduced and defined to clarify when conditions or issues are required to be formally handled through the quality-related corrective action program, or when they can be handled instead through less-rigorous non-quality processes.

Second, apparent cause evaluations (ACEs) were eliminated as a defined product and replaced with adverse condition assessments (ACAs) which are procedurally more flexible. The new ACA process allows station leadership more latitude to determine the appropriate level of resources to dedicate to evaluating and correcting important, but not necessarily critical problems. Third, several management-level corrective action program (CAP) oversight bodies were combined into a single performance improvement review group, which now fulfills all the leadership oversight functions formerly performed by the condition review group and the management performance review board. The team noted that collectively these efficiency enhancements could improve CAP performance by allowing evaluation and corrective action resources to be focused on the most important problems.

1. Effectiveness of Problem Identification The team determined that most conditions that required generation of a condition report by Procedure 0-CNS-LI-102, Corrective Action Process, had been appropriately entered into the corrective action program. During the 24-month inspection period, licensee staff generated and screened over 16,000 condition reports, roughly 600 per non-outage month. All personnel interviewed by the team understood the requirements for condition report initiation and expressed a willingness to enter newly identified issues into the corrective action program at a very low threshold.

The team observed several instances where apparent adverse trends were discussed at performance improvement review group meetings, but any follow-up actions were taken informally, and were often documented in non-CAP processes, if at all. Further, of the 13 conditions being tracked as adverse station trends, five had been identified, at least in part, by the NRC or another external organization.

The team also noted that condition reports were not always initiated timely.

Procedure 0-CNS-LI-102 requires, CR initiation should be completed prior to the end of the work day in which the condition was recognized, and CR initiation should not be excessively delayed while gathering all of the associated information. On several occasions during the inspection, issues identified by the team were not entered into the corrective action program until several days to two weeks later. The licensee entered this issue into the corrective action program as Condition Report CR-CNS-2017-03937. Although these issues (documentation adverse trends and timely initiation of CR) should be corrected, they constitute violations of minor significance that are not subject to enforcement action in accordance with Section 2 of the Enforcement Policy.

Overall, with the exception of organizational and programmatic trends, the team concluded that the licensee generally maintained a low threshold for the formal identification of problems and entry of those problems into the corrective action program for evaluation, though entry was sometimes delayed.

2. Effectiveness of Prioritization and Evaluation of Issues

The team identified multiple concerns with the licensees prioritization and evaluation processes, or its implementation of these processes. These concerns were primarily focused in the areas of the licensees condition report screening process, adverse/non-adverse determinations, immediate operability determination timeliness and documentation quality, and extent of condition reviews performed during cause evaluations. Each of these areas is briefly addressed below.

Condition Report Screening The team noted that the licensees process for initial screening of condition reports for significance differs significantly from standard industry practices. Preliminary significance of condition reports is initially assigned by a single member of the corrective action and assessment (CA&A) group. Significance assigned by CA&A is then reviewed in a pre-screening meeting, which is procedurally required but lacks the formalities associated with most other quality processes, before being screened by management at PRG.

The team noted that the CA&A pre-screen appeared to introduce a confirmation bias in the pre-screen meeting. Further, the pre-screen meeting has no quorum requirement and inconsistent membership. The station has no qualification requirement for participants in the pre-screen meeting, and some key groups are not always represented. Though departments at Cooper Nuclear Station generally have department performance improvement coordinators (DPICs), who act as CAP subject-matter experts for their groups, these DPICs do not represent their departments at the CR pre-screen. Additionally, during the several pre-screen meetings observed by the team, meeting participants did not reference the CR screening procedure or appear to have a copy available.

At the beginning of the on-site inspection period, the team observed that the PRG also lacked formality. Similar to the observation above regarding cognitive trending, this lack of a rigorous process for ensuring PRG decisions were recorded and formally tracked appeared to contribute to some intended actions not being accomplished. Further, the team noted that an observed inconsistent quality of cause evaluations and adverse condition assessments was likely at least partially attributable to this lack of rigor in PRG review.

Adverse/Non-adverse Determinations The team noted that for two categories of adverse conditions, as defined by Procedure 0-CNS-LI-102, the licensee was inconsistent in its classification, sometimes designating them non-adverse. The first category, related to the above-noted lack of rigor in documenting and completing follow-up actions from PRG decisions, was a failure to consistently identify safety-culture-related adverse trends as adverse conditions as required by Procedure 0-CNS-LI-102. When behavior-related adverse trends were identified through discussions at PRG, follow-up actions to confirm or refute a suspected trend, or to address a known trend, were often taken informally or through the use of a non-CAP administrative process.

The second category was failures of quality components or subcomponents of safety-related structures, systems, or components (SSCs) whose failure did not necessarily directly affect the safety function of the SSC. For example, the licensee has experienced multiple failures of rod-full-out lights, which are part of the digital rod position indication system as described in the Updated Safety Analysis Report (USAR). The licensee usually classified failures of these components as non-adverse, contrary to the requirements of Procedure 0-CNS-LI-102 (e.g., Condition Reports CR-CNS-2016-09041 and CR-CNS-2017-03481). A similar incorrect classification was also the subject of a minor violation described in the discussion of an annual problem identification and resolution sample in NRC Inspection Report 2016001 (ADAMS Accession No. ML16119A441). In that case, operators initially did not recognize indications of a leaking scram outlet valve to be a condition requiring CR initiation; and once a CR was eventually written, it was improperly classified as non-adverse.

Although the issue described above should be corrected, it constitutes a violation of minor significance that is not subject to enforcement action in accordance with Section 2 of the Enforcement Policy.

Additionally, over the previous two years, the NRC has issued three non-cited violations (NCVs) related to operators failure to recognize degraded or nonconforming conditionson June 25, 2015, NCV 2015008-03 documented main steam isolation valve (MSIV) limit switch preconditioning; on June 30, 2016, NCV 2016002-01 documented failure of a ball valve in the traversing in-core probe system; and on September 30, 2016, NCV 2016003-02 documented operators defeating systems designed to mitigate internal flooding.

Immediate Operability Determinations The team reviewed a number of condition reports that included or should have included immediate operability determinations to assess the quality, timeliness, and prioritization of these determinations. The team identified a number of recent instances where these immediate operability determinations were not performed within a shift as required by station procedure.

The team reviewed a population of 543 immediate operability determinations associated with degraded or nonconforming conditions identified between January 1, 2017, and June 13, 2017. Of this population, approximately 35 (6.5 percent) took greater than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, meaning they could not have been accomplished within one-shift as required by procedure. A number of others that were accomplished within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> likely also exceeded the one-shift requirement, but the team did not review actual times of documentation as compared to shift-change times to determine an accurate count. The median time from condition report initiation to operability declaration was over 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, with nearly a third (31 percent) taking greater than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Licensee Procedure 0.5.OPS, Operations Review of Condition Reports/Operability Determination, Revisions 56 and 57, define immediate determination as, The Operability Determination performed immediately after confirmation that a Degraded or Non-Conforming Condition exists for a [structure, system, or component] required to be operable by Technical Specifications. It further states, Operability should be determined immediately upon discoverywithout delayusing the best information available. A separate process is provided to gather initial information to support the immediate determination: Prompt Determination is a follow-up and is warranted when additional information is needed to confirm the immediate determination.

The team reviewed several examples where substantial time had elapsed between identification of the degraded or nonconforming condition and the documentation of operability. Two examples of team observations were:

• On February 7, 2017, during emergency diesel generator maintenance, personnel discovered incorrect bolting installed in the injector and documented the condition in Condition Report CR-CNS-2017-00610. The diesel was returned to service at 0817 on February 9, 2017. A final operability declaration was not made by the shift manager until 1843 that evening, over 2 days after discovery and over 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the equipment was returned to service.

• On June 12, 2017, the licensee-initiated Condition Report CR-CNS-2017-03505, documenting receipt of NRC Part 21 report 2017-31-00, which described a potential defect in Curtiss-Wright Grayboot socket contacts. The condition report was generated at 0952 on June 12 with an operability assignment to operations. After four revisions to the immediate determination documentation between 2336 on June 12 and 0311 on June 13 an operability declaration was made by the shift manager at 0320, almost 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> after the condition was formally identified.

The team noted one additional example of an untimely operability evaluation had resulted in a violation of Technical Specification requirements (Cooper Integrated Resident Inspector Report 05000298/2016002) one year earlier. However, the team did not identify any new instances where the licensee made an incorrect operability determination, where the delay exceeded any technical specification allowed outage time for the condition, or any other violations of regulatory requirements.

Extent of Condition Reviews The team noted numerous opportunities for improvement in the licensees implementation of extent of cause and extent of condition analyses as part of its cause evaluation (and now adverse condition analysis) processes. Multiple lower-level examples were discussed with licensee personnel during the inspection; two more significant examples follow.

In June 2016 the NRC implemented Inspection Procedure 92723 at Cooper Nuclear Station in response to three Severity Level IV violations received during calendar year 2015. One of the goals of that inspection was to ensure the licensee had identified the extent of cause and extent of conditions of the three violations impacting the regulatory process. The inspector performing that inspection documented several inadequacies with the licenses extent of condition and cause evaluations. These are documented in NRC Inspection Report 2016002 (ML16211A197). A reinspection performed as part of this problem identification and resolution inspection determined that the revised evaluations were adequate to satisfy the inspection objectives, though some gaps still existed. This is further discussed in Section 4OA5 below.

Following the failure of an Allen-Bradley rotary relay that caused loss of function of the HPCI system, the licensee performed a failure analysis under Condition Report CR-CNS-2016-02281. This analysis determined that the failure had been caused by a faulty solder joint that, because of an inadequate dedication plan, had not been detected by a vendor during component dedication. The licensees extent of condition only examined other relays of the same lot; it did not look for other similar components that may have been dedicated using similarly inadequate dedication criteria. This evaluation is also the subject of NCV 2017010-03, documented in Section 4OA2.5.c of this report.

Other Observations Related to Prioritization and Evaluation of Adverse Conditions On February 4, 2017, the No. 2 emergency diesel generator jacket water heater failed, after having been in service for 39 years with no preventive maintenance or replacement schedule. This failure resulted in the inability to maintain the system above 100 degrees Fahrenheit, as required by system design to support fast-start capability. This was the second functional failure of the diesel generator during the cycle, which exceeded maintenance rule performance criteria, but the licensee failed to perform required monitoring. This issue is further discussed as NCV 2017010-02 in Section 4OA2.5.b of this report.

Finally, the team identified two minor performance deficiencies associated with prioritization and evaluations.

• Following catastrophic failure of the control room emergency filtration system (CREFS) fan bearing in October 2016 which resulted in inoperability of an important safety system, the licensee failed to quarantine the failed parts as required by Procedure 0-CNS-LI-118, Step 6.1.4. This resulted in the inability to perform failure modes and effects analysis as required by Procedure 7.0.1.7, Step 1.1. In its cause evaluation for the bearing failure, performed under Condition Report CR-CNS-2016-07426, the licensee failed to take actions to ensure that parts were quarantined in the future. The team determined this was a violation of Criterion V of 10 CFR 50, Appendix B, which was minor because it was an isolated noncompliance of a procedural requirement used to help determine the root cause of a significant condition adverse to quality and the failure of the fan bearing has not recurred.

However, if a repeat failure were to occur by a similar failure mechanism, potentially indicating that the lack of failure analysis caused actions to preclude repetition to be ineffective, the NRC may reevaluate this performance deficiency.

• Also, in Condition Report CR-CNS-2016-07426, the licensee noted that the CREFS fans were classified as criticality level II (Crit-II) for the purpose of scheduling preventive maintenance. The team noted that this was contrary to the guidance contained in system engineering Desktop Guide 98-03-02, Revision 5, which is used by engineering to determine component criticality, and which indicates that these components should be Crit-I. Further, the desktop guide itself, which is not controlled as a quality procedure, is inconsistent with Procedure 7.0.14, Preventive Maintenance Program, which is quality-related. The team determined that this failure to appropriately classify component criticality as required by procedure was a violation of Criterion V of 10 CFR 50, Appendix B. This violation was minor because the maintenance schedule as implemented met the requirements for Crit-I components.

The violations described above constitute violations of minor significance that are not subject to enforcement action in accordance with Section 2 of the Enforcement Policy.

Overall, the team determined that the licensees process for prioritizing and evaluating issues that had been entered into the corrective action program supported nuclear safety, though some improvements are warranted.

3. Effectiveness of Corrective Actions

In general, the corrective actions identified by the licensee to address adverse conditions were effective. However, the team noted some challenges in the licensees development and implementation of sustainable corrective actions for some significant conditions adverse to quality.

Station procedures require corrective actions to preclude repetition to be developed during a root cause evaluation for all significant conditions adverse to quality. The development and implementation of these corrective actions to preclude repetition is meant to fulfil quality assurance requirements of Criterion XVI of 10 CFR 50, Appendix B. The team noted a number of instances where corrective actions to preclude repetition did not appear adequate to preclude repetition of the subject event:

• Under Condition Report CR-CNS-2016-08744, licensee staff performed a root cause evaluation to determine the causes of a December 7, 2016, misalignment of the control room emergency air filtration system (CREFS).

The corrective actions to preclude repetition developed under this evaluation focused on the actions of an individual control room operator and did not address broader organizational and programmatic causes for the operators inadvertent actions.

• Under Condition Report CR-CNS-2016-07426, licensee staff evaluated the failure of a catastrophic bearing failure of CREFS fan A on October 23, 2016.

The corrective actions to preclude repetition developed in this root cause evaluation was to revise a maintenance plan to ensure proper reassembly following maintenance. However, the revisions lacked the specificity necessary to prevent the same incorrect component reassembly after future maintenance. (Verify fan bearings engaged with shaft). Further, there was no indication that the revised steps were tied to a corrective action to preclude repetition (CAPR), a requirement to prevent future changes.

• On April 25, 2016, the licensee initiated a root cause evaluation under Condition Report CR-CNS-2016-02281 to evaluate two 2016 HPCI failures that were initially presumed to be related. Though the failures were later determined to have different causes, the licensee opted to evaluate both root causes in a single evaluation, with a separate cause determined for each failure. A CAPR was assigned for one of the two root causes, but not for the other. This example is further discussed as FIN 2017010-01 in Section 4OA2.5.a of this report.

Overall, the team concluded that the licensee generally identified and implemented effective corrective actions for the problems evaluated in the corrective action program, though additional focus on root-cause corrective actions to preclude repetition may be warranted. Where procedurally required, the licensee generally assessed the effectiveness of the corrective actions appropriately and made adjustments as necessary.

.2 Assessment of the Use of Operating Experience

a. Inspection Scope

The team examined the licensees program for reviewing industry operating experience, including reviewing the governing procedures. The team reviewed a sample of 10 industry operating experience communications and the associated site evaluations out of the 45 completed in 2017 to assess whether the licensee had appropriately assessed the communications for relevance to the facility. The team also reviewed assigned actions to determine whether they were appropriate.

b. Assessment Overall, the team determined that the licensee appropriately evaluated industry operating experience for its relevance to the facility. Operating experience information was incorporated into plant procedures and processes as appropriate. The licensee was effective in implementing lessons learned through operating experience. They took full advantage of being part of the Entergy fleet, to give a thorough review of the operational experience from a variety of sources. The licensees evaluations conservatively considered operating experience from a wide variety of sources and provided appropriate assessment. Licensee personnel ensured that significant issues were dealt with in a thorough and timely manner. This was also generally true for the Part 21 process that is within the licensees operational experience program. The team further determined that the licensee appropriately reviewed industry operating experience when performing root cause analysis and apparent cause evaluations.

.3 Assessment of Self-Assessments and Audits

a. Inspection Scope

The team reviewed a sample of licensee self-assessments and audits to assess whether the licensee was regularly identifying performance trends and effectively addressing them. The team also reviewed audit reports to assess the effectiveness of assessments in specific areas. The specific self-assessment documents and audits reviewed are listed in Attachment 1.

b. Assessment Overall, the team concluded that the licensee had an effective self-assessment and audit process. The team determined that self-assessments were self-critical and thorough enough to identify deficiencies.

.4 Assessment of Safety-Conscious Work Environment

a. Inspection Scope

The team interviewed 51 licensee personnel45 in five focus groups and six individually(1) to evaluate the willingness of licensee staff to raise nuclear safety issues, either by initiating a condition report or by another method,

(2) to evaluate the perceived effectiveness of the corrective action program at resolving identified problems, and

(3) to evaluate the licensees safety-conscious work environment. The focus group participants included personnel from operations, training, engineering, planning and scheduling, electrical, mechanical, instrumentation, and control. At the teams request, the licensees regulatory affairs staff selected the participants blindly from these work groups, based partially on availability. To supplement these focus group discussions, the team interviewed the employee concerns program manager to assess her perception of the site employees willingness to raise nuclear safety concerns. The team reviewed the employee concerns program case log and select case files.

b. Assessment 1. Willingness to Raise Nuclear Safety Issues All individuals interviewed indicated that they would raise nuclear safety concerns by one or more of the methods available. All felt that their management was receptive to raising nuclear safety concerns and encouraged them to do so. All of the interviewees agreed that if they were not satisfied with the response from their immediate supervisor, they had the ability to write a condition report or to escalate the concern to a higher organizational level. All individuals indicated that they were aware of changes that had been implemented earlier in the year associated with the submittal of condition reports anonymously [anonymous concerns are now screened by the Employee Concerns Program who either addresses the concern or directs it to the appropriate venue]. All individuals felt that this was appropriate because most of the anonymous condition reports had become a forum or submitting personal character attacks that should not be viewed by the general workforce.

2. Employee Concerns Program All interviewees were aware of the employee concerns program. Most explained that they had heard about the program through various means, such as posters, training, presentations, and discussion by supervisors or management at meetings. Most interviewees stated that they would use the employee concerns program if they felt it was necessary.

3. Preventing or Mitigating Perceptions of Retaliation When asked if there have been any instances where individuals experienced retaliation or other negative reaction for raising issues, all individuals interviewed stated that they had neither experienced nor heard of an instance of retaliation, harassment, intimidation, or discrimination at the site. The team determined that processes in place to mitigate these issues were being successfully implemented. Responses from the focus group interviewees indicate that they believe that management has established and promoted a safety-conscious work environment where individuals feel free to raise safety concerns without fear of retaliation. Overall, employees indicated that there has been a steady improvement of the culture on-site.

.5 Findings

a. Failure to Accomplish Activities in Accordance with Documented Procedures for High Pressure Coolant Injection Failure

Introduction.

The team identified a Green, non-cited violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to accomplish activities affecting quality in accordance with Corrective Action Program Procedure 0-EN-LI-118, Root Cause Evaluation Process, Revision 18C5. Specifically, between June 7, 2016, and June 29, 2017, contrary to Procedure 0-EN-LI-118, the licensee failed to assign corrective actions to preclude repetition (CAPRs) to address the failure of a relay coil that resulted in a loss of the high-pressure coolant injection (HPCI)system, a significant condition adverse to quality.

Description.

On April 25, 2016, a licensed operator performing a control room panel walkdown noted that the green light for the HPCI auxiliary lube oil pump (ALOP) was not illuminated. Operations personnel attempted to start the ALOP and it failed to start. Due to the inoperability of the ALOP, the licensee declared the HPCI system inoperable and entered the associated technical specifications (TSs). The licensee reported the event as a loss of safety function under the requirements of 10 CFR 50.72 and 50.73 (Licensee Event Report 2016-001).

The licensee initiated a root cause evaluation (RCE) under Condition Report CR-CNS-2017-02281 to determine the cause of the condition. Investigation revealed that an Allen-Bradley 700DC relay for the ALOP that had been installed during a maintenance window 6 days earlier had failed due to infant mortality. Specifically, the relay coil internal to the relay had failed after approximately 133 hours0.00154 days <br />0.0369 hours <br />2.199074e-4 weeks <br />5.06065e-5 months <br /> of service. The failure was attributed to the overheating of the coil windings, caused by a manufacturing defect. The licensees root cause evaluation found that the commercial grade dedication process used by the Nutherm vendor did not have sufficient checks to identify the infant mortality failure of the relay.

On June 29, 2017, during review of the RCE, the inspectors found that the licensee had not issued any corrective actions to preclude repetition (CAPRs) of the significant condition adverse to quality (SCAQ) associated with the relay failure and the inadequate Nutherm dedication process. Instead, the root cause corrective action (CA) plan stated, in part (with some portions crossed out), The newly revised dedication process used by Nutherm takes care of the issues related to this specific RC1. This is why there is no CAPR. CA-A2 is an "insurance" action. The corrective action this statement referred to directed that, a review of all current dedication pre-installation checks shall be conducted to determine what is necessary to reasonably ensure that infant mortality failures of the HPCI ALOP control relay are minimized. The review shall include the recently revised dedication process, dated May 13, 2016, used by Nutherm and the findings by Exelon in their analysis of the relay failure. The inspectors did not identify any definitions for insurance actions in the licensees corrective action program procedures.

Upon the inspectors review of this corrective action, they discovered that it did not have any completion documentation to demonstrate that the action was, in fact, completed.

Instead, the action was listed directly in the RCE as being completed on May 25, 2016.

The inspectors noted that the action could not have been fully completed at that time, because the final Exelon Labs relay failure analysis report was not received and reviewed by the station until July 29, 2016. In addition, the inspectors reviewed the changes made to the dedication plan for the relay that appeared to be completed in response to this corrective action. The inspectors noted that although the dedication plan was changed to include cycling the relays 30 times, measuring resistance across the relay coils, and testing for dielectric strength of the relays, there appeared to be no actions described in the dedication plan or in the stations procedure to ensure that the changes would remain in place. In addition, during interviews, in explanation for why no CAPR was assigned, engineering personnel expressed a lack of confidence in the ability of these dedication plan changes to prevent recurrence of the relay failure. As a result, the inspectors concluded that there were no actions in place to ensure the corrective actions would preclude repetition of the SCAQ.

The inspectors reviewed the corrective action program (CAP) procedures that were in effect at the time of the inspection. Procedure 0-CNS-LI-118, Cause Evaluation Process, Revision 0, Section 3.5 states in part, At least one CAPR is required for a SCAQ.

The inspectors also reviewed the CAP procedures that were in place at the time of performance of the RCE. Licensee Procedure 0-EN-LI-118, Root Cause Evaluation Process, Revision 18C5, was used during performance of the RCE. Section 5.2.1 of this procedure states, Root cause investigation is the process used to reconstruct an event in order to determine its most basic cause(s) and to formulate corrective actions to preclude repetition. Since events typically occur only after multiple barriers failed or a sequence of inappropriate actions occurred, they can have multiple root causes. Root causes are addressed by Corrective Actions to Preclude Repetition (CAPR). The inspectors noted that for the root cause associated with the failure of the HPCI relay, the cause evaluator did not develop CAPRs as required by the procedure. In addition, 9.10, Effectiveness Review Plan, Step 5 states, this review is required for CAPRs for significant CRs as described in Procedure 0-CNS-LI-102, Corrective Action Process. The inspectors determined that because no CAPR was assigned for the root cause associated with the failure of the HPCI relay, the required effectiveness reviews were not performed.

The inspectors also reviewed Procedure 0-CNS-LI-102, Corrective Action Process, Revision 3, which was in effect at the time the RCE was performed and concluded that it also requires development of CAPRs and Effectiveness Reviews for SCAQ root causes.

Specifically, Step 10.2.2 states in part, the Responsible Manager must

(1) ensure a Root Cause Evaluation is performed for Category "A" CRs and that appropriate CAPRs are issued and

(2) ensure formulation of a proposed CA Plan to correct the condition and to preclude repetition. This procedure also requires that, The Corrective Action Plan includes an action to perform an Effectiveness Review of the CAPRs. The inspectors concluded that the licensees responsible manager had not ensured any appropriate CAPRs were issued for the Category A CR associated with a loss of the HPCI system due to a relay failure. The inspectors also noted that assigning a CAPR would have required performance of an effectiveness review which would have provided programmatic oversight over whether or not the CAPRs were succeeding in preventing recurrence. Section 11.1.4 of this procedure stated, in part, for CAPRs that are credited as being implemented by revising training documents or procedure actions or requirements, the applicable steps in the associated procedure should be annotated or flagged as obligations in accordance with applicable site procedures. The inspectors also noted that the changes made to the dedication process requirements for these relays were not annotated or flagged, to ensure they would remain in place as required by procedure.

During the inspectors review of the RCE associated with this event, they identified several weaknesses and deficiencies associated with the evaluation, in addition to the lack of an assigned CAPR for the relay-related SCAQ. In particular, the inspectors noted that many of the issues they identified during their review of this revision of the RCE had been identified by the inspectors previously and documented in Condition Report CR-CNS-2016-04137. The inspectors noted that the licensee had attempted to address these weaknesses in response to the CR, but these actions had fallen short of their intended goal. The RCE weaknesses that the inspectors identified included:

incorrect information regarding local operation of HPCI contained in the RCE resulted in the conclusion that the event only had medium risk (Condition Report CR-CNS-2017-03570); the extent of cause did not consider whether the cause of the light bulb event had extended to other modifications performed by the site (Condition Report CR-CNS-2017-3917); the extent of cause did not review whether the relay dedication issues associated with the relay failure were specific to the Nutherm vendor or if they were a more generic procurement and dedication issue (Condition Report CR-CNS-2017-03915); the corrective action related to establishing improved relay testing methods had inadequate closure documentation (Condition Report CR-CNS-2017-03920); and the Part 21 reportability evaluation was inadequate (addressed as a separate NCV in this report.) These issues were entered into the licensees corrective action program for further evaluation.

Analysis.

The licensees failure to accomplish activities affecting quality in accordance with documented instructions, procedures, or drawings of a type appropriate to the circumstances in violation of 10 CFR 50, Appendix B, Criterion V, was a performance deficiency. The performance deficiency was evaluated using Inspection Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, and was associated with the Mitigating Systems cornerstone. The team determined that the performance deficiency was more than minor, and therefore a finding, because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the licensees failure to accomplish activities affecting safety with documented instructions could reasonably result in the condition recurring and creating more safety-significant equipment failures. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding had very low safety significance (Green) because it: was not a design deficiency; did not represent a loss of system and/or function; did not represent an actual loss of function; did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time; and did not result in the loss of a high safety-significant non-technical specification train. The finding had a cross-cutting aspect in the area of problem identification and resolution associated with resolution, because the licensee failed to ensure that the organization took effective corrective actions to address issues in a timely manner commensurate with their safety significance [P.3].

Enforcement.

Title 10 CFR 50, Appendix B, Criterion V requires, in part, that activities affecting quality shall be accomplished in accordance with documented instructions, procedures, or drawings of a type appropriate to the circumstances. Licensee Procedure 0-EN-LI-118, Root Cause Evaluation Process, Revision 18C5, an Appendix B quality related procedure, describes CAP requirements for root cause evaluations of significant conditions adverse to quality. Section 5.2.1 of this procedure states, root causes are addressed by Corrective Actions to Preclude Repetition (CAPRs). Contrary to the above, between June 7, 2016, and June 29, 2017, licensee personnel failed to ensure that root causes were addressed by corrective actions to preclude repetition. Specifically, the licensee failed to assign CAPRs to address the root cause of a relay failure that resulted in a loss of the HPCI system, a significant condition adverse to quality. Corrective actions to restore compliance included reevaluation of the corrective actions assigned to the root cause of the condition and the creation of CAPRs for the condition. Because this violation was of very low safety significance (Green) and was entered into the licensees corrective action program as Condition Report CR-CNS-2017-03544, this violation is being treated as a non-cited violation (NCV) in accordance with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000298/2017002-01, Failure to Accomplish Activities in Accordance with Documented Procedures for High Pressure Coolant Injection Failure.

b. Failure to Monitor No. 2 Diesel Generator Under 50.65(a)(1) due to Inadequate Maintenance Rule Evaluation

Introduction.

The team identified a Green, non-cited violation of 10 CFR 50.65(a)(1)/(a)(2), for the licensees failure to perform an a(1) evaluation and establish a(1) goals when the No. 2 diesel generator (DG) a(2) preventive maintenance demonstration became invalid. Specifically, on April 28, 2017, the No. 2 DG exceeded its performance criteria when it experienced a second maintenance rule functional failure (MRFF), but the licensee failed to perform an associated a(1) evaluation. The licensee had failed to appropriately evaluate a February 4, 2017, failure associated with the No. 2 DG jacket water heater failure in the maintenance rule program and, as a result, the site failed to evaluate and monitor the equipment under 10 CFR 50.65(a)(1) as required.

Description.

On June 21 during a review of the licensees Maintenance Rule Program functional failure evaluations and corrective action reports, the inspectors noted that one component failure did not appear to be correctly evaluated in the licensees Maintenance Rule Program as a MRFF. Specifically, the inspectors identified that on February 4, 2017, a failure of the No. 2 diesel generator jacket water heater resulted in the need to take the DG out of service due to the fact that jacket water temperatures were quickly approaching the minimum required operability limit of 100 degrees F (Condition Report CR-2017-00551). Although the condition resulted in the need to declare the DG inoperable, the licensee had determined that this issue was not a MRFF. The inspectors reviewed the event to assess the appropriateness of the licensees evaluation.

At 2038 on February 4, 2017, the licensee received alarms in the control room which indicated that there was a ground on the No. 2 DG motor control center transformer.

The licensee discovered that the jacket water heater had failed, and as a result, the licensee was required to secure power to the heater and jacket water temperature began to lower. Operations personnel initiated actions to monitor the temperature trends to ensure that action was taken prior to the lower temperature limit being exceeded. At the time of discovery, temperatures were indicating 131 degrees F on the inlet to the heater and 136 degrees F on the outlet of the heater. By approximately 0443 on February 5, 2017, temperatures had dropped to 102 degrees F on the inlet to the heater and 118 degrees F on the outlet of the heater. At that time, the licensee declared No. 2 DG inoperable.

When the licensee-initiated repairs on the heater, they learned that the heater elements had overheated and melted open in several locations. The licensee performed a C - Fix level evaluation for the heater failure. This evaluation revealed that the heater had been in place since the beginning of plant life and was installed in 1974. The evaluation also revealed that there was no preventive maintenance (PM) activity in place that would drive replacement of the heater. Instead, the licensee was performing 5-year cleaning and inspection PMs. As a result, the licensee created a PM activity to drive replacement of the heater on a 16-year frequency.

The inspectors reviewed the MRFF determination documentation and discussed the conclusions with systems engineering personnel. The inspectors learned that the licensee had not counted the failure as an MRFF because they had concluded that there was no lower limit on temperature for the jacket water system. The licensee had relied on a letter, dated March 26, 1998, which was received from MPR Associates, Inc., who had taken on vendor responsibilities for the Cooper-Bessemer DGs in operation at the station. Licensee personnel pointed to a statement in this letter that said, No design lower temperature limit for C-B Model KSV Diesel Engine Jacket Water System. As a result, the licensee had determined that this equipment failure did not constitute an MRFF.

The inspectors challenged the licensee on this assessment. In particular, Station Operating Procedure 2.2.20, Standby AC Power System (Diesel Generator),

Revision 95, Section 2.2 (Precautions and Limitations) stated, If jacket water or lube oil temperature is less than or equal to 100 degrees F while DG is in standby, DG shall be declared inoperable. In addition, Section 1.2.4 explained that the procedure contained minimum required temperature limitations for jacket water and lube oil in order to meet the diesel generator fast start requirements. In addition, the inspectors noted that the Maintenance Rule Basis Document for the DG system function included specific provisions for jacket water temperatures. Specifically, the Function Description section stated, The Jacket Water (DGJW) sub-systems consist of a standpipe, connecting pipes, pumps, temperature control valves, coolers, standby heaters, valves, and instrumentation necessary to remove heat from the engine jackets during operations or provide heat during standby conditions to maintain the engine jackets greater than or equal to 100 degrees F for fast-starting capability.

Finally, the inspectors reviewed the MPR letter that the licensee had used as the basis for the decision not to classify the failure as a MRFF. The inspectors discovered that the statement the licensee relied on for their determination that there were no low temperature limits for the DG was applicable only for performing non-timed starts from maintenance conditions. The inspectors noted that the line below it included different guidance with respect to low temperature limits for normal DG fast starts. For fast starts, the low limit for the jacket water was listed as 100 degrees F. In response to inspector questions on the basis for the 100-degree F limit throughout station procedures, the licensee discovered that historical procedure change requests had also referenced the fast start limitations derived from the same MPR letter. As a result, the licensee agreed that there was a lower temperature limit for DG jacket water. The inspectors concluded that the heater failure represented a MRFF because:

• The heating function of the heater was directly described as part of the DG function in the Basis Document and failure of the component represented a functional failure; and

• Due to the equipment failure, the licensee was required to take the DG out of service and declare it inoperable when jacket water temperatures reached the lower temperature limit.

The inspectors reviewed the Maintenance Rule performance criteria for the No. 2 DG.

The inspectors determined that the No. 2 DG was allowed one MRFF in a 24-month cycle. The inspectors noted that the No. 2 DG already had one MRFF counted against it due to a relay failure that resulted in the DG being declared inoperable on April 28, 2017, (Condition Report CR-2017-02533). With the additional failure associated with the jacket water heater, the inspectors concluded that the No. 2 DG had exceeded its performance criteria on April 28, 2017, and invalidated its (a)(2) preventive maintenance demonstration. As a result, the inspectors concluded that the licensee had failed to take the necessary actions required by 10 CFR 50.65(a)(2)/(a)(1).

Analysis.

The licensees failure to monitor the No. 2 DG in accordance with the requirements of 10 CFR 50.65(a)(1) due to incorrectly evaluating one MRFF, in violation of 10 CFR 50.65(a)(1)/(a)(2), was a performance deficiency. The inspectors screened the performance deficiency using Inspection Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, and determined that the issue was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding had very low safety significance (Green)because it: was not a design deficiency; did not represent a loss of system and/or function; did not represent an actual loss of function; did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time; and did not result in the loss of a high safety-significant non-technical specification train. The finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluation, because the licensee failed to ensure that the organization thoroughly evaluated the No. 2 diesel generator issues to ensure that resolutions addressed causes and extent of conditions commensurate with their safety significance [P.2].

Enforcement.

Title 10 CFR 50.65 (a)(1), requires in part, that holders of an operating license shall monitor the performance or condition of SSCs within the scope of the rule as defined by 10 CFR 50.65 (b), against licensee established goals, in a manner sufficient to provide reasonable assurance that such SSCs are capable of fulfilling their intended functions. Title 10 CFR 50.65 (a)(2) states, in part, that monitoring, as specified in 10 CFR 50.65 (a)(1), is not required where it has been demonstrated that the performance or condition of an SSC is being effectively controlled through the performance of appropriate preventive maintenance, such that the SSC remains capable of performing its intended function. Contrary to the above, on April 28, 2017, the licensee failed to demonstrate that the performance or condition of the No. 2 DG was being effectively controlled through the performance of appropriate preventive maintenance, such that the SSC remained capable of performing its intended function and failed to monitor the performance or condition of the SSC against licensee-established a(1) goals. Specifically, the No. 2 DG exceeded its performance criteria when it experienced a second MRFF, but the licensee failed to perform an associated a(1) evaluation because engineering personnel had not correctly evaluated a February 4, 2017, failure associated with the No. 2 DG jacket water heater in the Maintenance Rule Program. As a result, the site failed to evaluate and monitor the equipment under 10 CFR 50.65(a)(1) as required. Corrective actions taken by the licensee to restore compliance included reevaluation of the February 4, 2017, functional failure and performance of an a(1) evaluation. Because the finding was of very low safety significance and has been entered into the licensees corrective action program (Condition Report CR-2017-03930), this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000298/2017010-02, Failure to Monitor No. 2 Diesel Generator under 50.65(a)(1) due to Inadequate Maintenance Rule Evaluation.

c. Failure to adopt appropriate procedures in accordance with 10 CFR Part 21

Introduction.

The team identified a Green finding and associated Severity Level (SL) IV, non-cited violation of 10 CFR 21.21(a), for the licensees failure to adopt appropriate procedures to evaluate Part 21 deviations. Specifically, Procedure EN-LI-108, 10 CFR 21 Evaluations and Reporting, Revision 5C0, was not appropriate to ensure that adequate Part 21 evaluations could be completed. In particular, the procedure

(1) could lead the licensee to incorrectly conclude that a substantial safety hazard could not be created,

(2) allowed a limited extent of condition in performing the substantial safety hazard evaluation such that similarly dedicated parts would not be included in the scope, and

(3) included incorrect guidance in Attachment 9.3. Corrective actions to restore compliance included revision of Procedure EN-LI-108-01 and re-evaluation of affected deviations under Part 21 requirements. The licensee entered this issue into the corrective action program as Condition Reports CR-CNS-2017-03936 and CR-CNS-2017-04143.

Description.

On June 29, 2017, the team reviewed licensee Procedure EN-LI-108, 10 CFR 21 Evaluations and Reporting, Revision 5C0, and determined it was not adequate to ensure that an appropriate Part 21 evaluation could be completed.

Specifically, the inspectors noted that Attachment 9.3 of the procedure allowed the licensee to not perform evaluations of Part 21 requirements when deviations were discovered in installed components. Specifically, Attachment 9.3 states, in part, there are only two conditions under which nuclear power plants perform reportability evaluations per 10 CFR 21. The process described in this procedure applies to these conditions as follows: Failures to comply and received but not installed.

The attachment further states, If the structure, system, component, or part thereof is installed in an operating nuclear power plant, reporting is in accordance with 10 CFR 50.72 and 50.73. The inspectors noted that this allowance left the licensee vulnerable to missing evaluations of defects that reveal themselves in installed equipment but extend to other stock materials. For example, if a safety-related stock component was found to contain a manufacturing flaw or was incorrectly dedicated for safety-related use, the licensee would be driven to evaluate all locations where the component could be installed and determine whether the deviation could create a substantial safety hazard. If the same component were to fail immediately after installation, the inspectors noted that the same type of extent of condition evaluation would not be driven by the procedure to determine if a substantial safety hazard could be created.

The inspectors noted that the Statements of Considerations for 10 CFR 21 state that there are cases where a defect in a basic component of an operating reactor might be reportable under Part 21, but not under 10 CFR 50.72 or 50.73, and that these cases would involve parts on the shelf. This type of defect, if it does not represent a condition reportable under §§ 50.72 or 50.73, might still represent a condition reportable under 10 CFR 21. The inspectors noted that this discussion did not grant an exception to the licensees responsibility to evaluate Part 21 defects that are identified first in installed components and extend to in-stock components.

The inspectors observed that 10 CFR 21.3 defines a defect as:

(1) A deviation in a basic component delivered to a purchaser for use in a facility or an activity subject to the regulations in this part if, on the basis of an evaluation, the deviation could create a substantial safety hazard;

(2) The installation, use, or operation of a basic component containing a defect as defined in this section;

(3) A deviation in a portion of a facility subject to the early site permit, standard design certification, standard design approval, construction permit, combined license or manufacturing licensing requirements of Part 50 or Part 52 of this chapter, provided the deviation could, on the basis of an evaluation, create a substantial safety hazard and the portion of the facility containing the deviation has been offered to the purchaser for acceptance;

(4) A condition or circumstance involving a basic component that could contribute to the exceeding of a safety limit, as defined in the technical specifications of a license for operation issued under Part 50 or Part 52 of this chapter; or

(5) An error, omission or other circumstance in a design certification, or standard design approval that, on the basis of an evaluation, could create a substantial safety hazard.

Title 10 CFR 21.3 further defines a substantial safety hazard as, a loss of safety function to the extent that there is a major reduction in the degree of protection provided to public health and safety for any facility or activity licensed or otherwise approved or regulated by the NRC.

The inspectors paid particular attention to items

(1) and

(2) contained in the definition of a Part 21 defect, which included both

(1) deviations in basic components delivered to a purchaser for use in a facility if, on the basis of an evaluation, the deviation could create a substantial safety hazard; and

(2) the installation, use, or operation of a basic component containing a defect. The inspectors noted that while 10 CFR 50.72 and 50.73 evaluations would likely capture the direct effects of item

(2) for the installed component, those evaluations would fail to identify the in-stock components vulnerable to the same condition described in item

(1) of the definition. The inspectors also noted that since, in this case, the deviation that existed in the installed component most assuredly escaped recognition by licensee receipt inspectors, there could not be confidence that the same deviation in additional models of the same relay would be detected prior to installation. The inspectors noted that NUREG 0302, Reporting of Defects and Noncompliance, discussed this responsibility, stating, In the case of a redundant basic component, a condition, circumstance or deviation which could cause a failure of that component must be evaluated to determine if there may be a loss of safety function for the affected basic component or a major reduction in the degree of protection provided to public health and safety. Therefore, a defect in a basic component, even though a redundant component exists, could be reportable under Part 21. As a result, the inspectors determined that Procedure EN-LI-108, 10 CFR 21 Evaluations and Reporting, Revision 5C0, should have driven an extent of condition review that was inclusive of in-stock components and their respective installation locations prior to allowing the conclusion that the condition could not create a substantial safety hazard, or that no Part 21 reportability evaluation was required.

In addition, Procedure EN-LI-108 included incorrect guidance in Attachment 9.3. In particular, Attachment 9.3 states, assuming that 10 CFR 21 requires an automatic application of a single failure to the redundant component or system would set a threshold for reporting under 10 CFR 21 lower than 10 CFR 50.72 and 10 CFR 50.73.

Such an interpretation would be contrary to the principles in 10 CFR 21 which establish that reporting under Part 21 applies when there is a loss of safety function and when there is a major reduction in the degree of protection provided to the public health and safety. The inspectors noted that these statements were inconsistent with the guidance contained in NUREG 0302 and the requirements of Part 21. Specifically, to address whether defects in redundant components would be reportable under Part 21, NUREG 0302 states, a deviation (i.e., a departure from a procurement document specification) which, based upon an evaluation, causes or could cause the failure of a redundant basic component is a reportable defect under Part 21. The loss of safety function of a basic component is considered a major reduction in the degree of protection provided to the public health and safety. It is possible that the defect might also exist in the redundant basic component which could result in a loss of safety function. The existence of a defective basic component, considering a single failure of its counterpart redundant basic component, could result in a loss of safety function.

The inspectors determined that the information contained in the licensees procedure was conflicting with this regulatory guidance and could result in inappropriate Part 21 evaluation conclusions.

Finally, the inspectors noted that Attachment 9.3 included outdated information from a previous revision of NUREG 1022, Event Report Guidelines 10 CFR 50.72 and 50.73, which discussed reporting of Part 21 defects. The information was removed for the current revision of NUREG 1022 (Revision 3), but it remained in Attachment 9.3 of the procedure.

The inspectors reviewed whether the procedure deficiencies resulted in any inadequate Part 21 evaluations for previous events at the plant. The inspectors identified one case where the licensee failed to identify a Part 21 defect associated with an Allen-Bradley 700DC relay that had failed due to a manufacturing flaw approximately 6 days after installation in the HPCI system. In addition to containing a manufacturing flaw, this component was a commercial relay that had been dedicated by Nutherm for safety-related applications via an inadequate dedication process that failed to identify the components flaw. The installed relay caused an actual loss of safety function of the single train HPCI safety system. However, other relays of the same model, having potentially the same flaw remained in stock in the licensees warehouse. These stock relays could have been installed in HPCI system, both divisions of the safety-related low-pressure coolant injection system, and other locations, such that if relay failure occurred, the loss of function for the respective division of the associated safety-systems would result. Following the inspection, Nutherm determined that 46 relays were shipped to customers that could potentially have the defect, at least 4 of which were in stock at Cooper Nuclear Station at the time of the teams inspection. The inspectors noted that the licensees Part 21 evaluation for this issue stated, this condition is not reportable per 10 CFR 21. The failure of HPCI by itself is not a substantial safety hazard. Alternate depressurization system and low-pressure emergency core cooling system were unaffected by the relay issue and were still available for accident mitigation and decay heat removal.

The inspectors noted that Procedure EN-LI-108 should have driven a substantial safety hazard review that included in its scope, other places where the manufacturing flaw potentially could exist. The licensee had stated that both the relay equipment failure and the inadequate dedication plan for the relay were Part 21 deviations. As a result, the licensee should have assessed whether these deviations - both the relay flaw and the inadequate dedication plan - could exist elsewhere in the plant or in the warehouse inventory. This review would help to identify additional plant vulnerabilities and would allow for a more appropriate assessment of whether a substantial safety hazard could be created.

In addition, the inspectors reviewed 10 CFR Part 21 requirements and NUREG 0302 for this issue. As a result of their review, and in consultation with NRC headquarters staff, the inspectors determined that this deviation could be categorized as having the potential to create substantial safety hazard. Specifically, in the category of a major degradation which could create a substantial safety hazard, NUREG 0302 states, the loss of safety function of a basic component is considered a major reduction in the degree of protection provided to the public health and safety. The inspectors noted that HPCI is a single train system for accident conditions, and as a result, loss of the system created a loss of a safety function. The inspectors noted that the alternate depressurization system referenced in the licensees evaluation did not perform the same safety function. Specifically, alternate depressurization system allows operations personnel to reduce pressure in the reactor in order to initiate another mitigating system.

The alternate depressurization system function does not allow for operators to add high pressure inventory to the vessel; rather, it relies on the availability of the low-pressure injection systems, which serve a separate safety function. In addition, the inspectors noted that the in-stock relays vulnerable to the same flaw could be installed in both divisions of low-pressure coolant injection, and the loss of HPCI and both divisions of low-pressure coolant injection should further be considered as having the potential to create a substantial safety hazard. Specifically, Technical Specification Bases for LCO 3.5.1 Condition H states, when multiple emergency core cooling subsystems are inoperable, as stated in Condition H, the plant is in a condition outside of the accident analyses. As a result of these factors, the inspectors determined that the licensees evaluation was inadequate, and that the licensees procedure should have driven identification of the issue as a defect under Part 21.

While the inspectors concluded that the licensees procedure was inadequate to drive this evaluation in this case, the inspectors noted that the licensee had met the Part 21 reporting requirements for the issue. Specifically, as allowed by 10 CFR 21.2(c), the licensee reported the issue as a loss of safety function for HPCI under 10 CFR 50.72 and 50.73 in lieu of making a Part 21 report. Therefore, they met the reportability requirements, even if the issue was not identified as a Part 21 issue and did not describe all the locations where the relay could exist as required by Part 21.

Analysis.

The failure to adopt appropriate procedures to evaluate Part 21 deviations, in violation of 10 CFR 21.21(a), was a performance deficiency. The inspectors screened the performance deficiency using Inspection Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, and determined that the issue was more than minor, and therefore a finding, because it was associated with the Mitigating Systems cornerstone and, if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the licensees failure to have an adequate procedure to evaluate Part 21 implications for defective components and identify substantial safety hazards could reasonably result in the condition recurring and the possibility that the defect might also exist in the redundant basic component which could result in a loss of safety function creating more safety-significant failures. In one case, the Part 21 implications of a failed relay that had been installed in the HPCI system and could have been installed in the low-pressure coolant injection system were not recognized until the team identified the vulnerability. The inspectors assessed the significance of the finding using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Exhibit 2, Mitigating Systems Screening Questions, the finding was screened as having very low safety significance (Green) because it was not a design deficiency; did not represent a loss of system and/or function; did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time; and did not result in the loss of a high safety-significant non-technical specification train.

Traditional enforcement applied to this violation because it was associated with impeding the regulatory process. The team used the NRC Enforcement Policy, dated November 1, 2016, to determine the significance of the violation. The inspectors determined that the violation was similar to Enforcement Policy Severity Level IV Example 6.9.d.13, Failure to implement adequate 10 CFR Part 21 or 10 CFR 50.55(e)processes or procedures that has more than minor safety or security significance. The inspectors also determined the issue was not similar to Enforcement Policy Severity Level III Example 6.9.c.5(a), An inadequate review or failure to review such that, if an appropriate review had been made as required, a 10 CFR Part 21 or 10 CFR 50.55(e)report would have been required. Specifically, the procedure could result in inadequate reportability reviews for Part 21 defects, but for examples reviewed by the team, the licensee had reported the events under the requirements of 10 CFR 50.73, even if the event report in one case did not include all known aspects of the deviation. As a result, the team determined that this issue did not represent a failure to make a required Part 21 report and concluded that the violation should be classified as a Severity Level IV violation. The inspectors did not assign a cross-cutting aspect to the violation because the deficient procedure was made effective on August 18, 2015, and was not indicative of current performance.

Enforcement.

Title 10 CFR 21.21(a) requires, in part, that entities subject to the regulations in this part shall adopt appropriate procedures to evaluate deviations and failures to comply to identify defects associated with substantial safety hazard as soon as practicable except as provided in paragraph (a)(2) of this section, and in all cases within 60 days of discovery, in order to identify a reportable defect that could create a substantial safety hazard, were it to remain uncorrected. Contrary to the above, between August 18, 2015, and June 29, 2017, the licensee failed to adopt appropriate procedures to evaluate deviations and failures to comply to identify defects associated with substantial safety hazards as soon as practicable, and in all cases within 60 days of discovery, in order to identify a reportable defect that could create a substantial safety hazard, were it to remain uncorrected. Specifically, Procedure EN-LI-108, 10 CFR 21 Evaluations and Reporting, Revision 5C0, was not appropriate to ensure that adequate Part 21 evaluations could be completed. In particular, the procedure

(1) could lead the licensee to incorrectly conclude that a substantial safety hazard could not be created,

(2) allowed a limited extent of condition in performing the substantial safety hazard evaluation such that similarly dedicated parts would not be included in the scope, and

(3) included incorrect guidance in Attachment 9.3. Corrective actions to restore compliance included revision of Procedure EN-LI-108-01 and re-evaluation of affected deviations under Part 21 requirements. Because this violation was of Severity Level IV significance and was entered into the licensees corrective action program as Condition Reports CR-17-3936 and CR-17-4143, this violation is being treated as a non-cited violation (NCV) in accordance with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000298/2017010-03, Failure to adopt appropriate procedures in accordance with 10 CFR Part 21.

4OA5 Other Activities

Follow Up Inspection for Three or More Severity Level IV Traditional Enforcement Violations in the Same Area in a 12-Month Period

a. Inspection Scope

The inspectors performed Inspection Procedure (IP) 92723, Follow Up Inspection for Three of More Severity Level IV Traditional Enforcement Violations in the Same Area in a 12-Month Period, based on the results of the NRCs annual review of station performance as documented in the 2015 assessment letter, dated March 2, 2016 (ADAMS Accession No. ML16061A312). In 2015, the NRC issued the following three Severity Level IV traditional enforcement violations in the area of impeding the regulatory process:

• NCV 05000298/2015004-02, Failure to Update the Updated Safety Analysis Report

• NCV 05000298/2015007-03, Failure to Update the Final Safety Analysis Report (FSAR)

• NCV 05000298/2015003-04, Failure to Make a 10 CFR 50.72(b)(2)(xi)

Notification The inspectors reviewed the licensees cause evaluations and corrective actions associated with these issues in order to determine whether the licensees actions met the IP 92723 inspection objectives to provide assurance that:

(1) the cause(s) of the violations are understood by the licensee,

(2) the extent of condition and extent of cause of the violations are identified, and

(3) licensee corrective actions to the violations are sufficient to address the cause(s).

In June 2016 the inspectors reviewed the licensees actions to address these violations.

In NRC Inspection Report 05000298/2016002 (ADAMS Accession No. ML16211A197),the inspectors documented their conclusion that objective

(2) above was not met, in that the licensee did not fully identify the extent of condition and extent of cause of multiple Severity Level IV traditional enforcement violations. In this inspection (June 2017) the inspectors assessed the licensees actions to address the weaknesses identified in the initial evaluation.

b. Assessment The inspectors determined that the licensees corrective actions were adequate to meet the inspection objectives. The inspectors developed the following observations with regard to the licensees actions to meet objective

(2) regarding identification of extent of condition and extent of cause.

The inspectors noted that the NCVs referenced above included five examples of failures to update the updated safety analysis report (USAR) in accordance with the requirements of 10 CFR 50.71(e). Three of these examples involved new or updated information that was included in license amendments, while two examples involved new information that was introduced in licensee procedure changes. The inspectors determined that the licensees initial extent of condition evaluation included a review of a sample of license amendments to determine whether additional examples of failures to make appropriate corresponding updates to the USAR existed. The inspectors observed that the initial evaluation did not include a sample output of any other change processes by which new or updated information affecting the content of the USAR could be developed, such as licensee procedure changes. The inspectors determined that the licensee supplemented their extent of condition evaluation to include a sample of procedure revisions to determine whether corresponding USAR updates were implemented, if applicable. The licensees evaluation also acknowledged that other change process output (e.g. engineering evaluations, plant modifications, and design changes) could result in the need for a USAR update. The licensees evaluation included a search for past condition reports documenting problems in these areas. The license also performed a review of three USAR sections against other applicable licensing basis documentation to verify accuracy and consistency of USAR content.

The inspectors also observed that, for the identified cause of, failure to apply the proper rigor for regulatory requirements associated with USAR maintenance, the licensees initial extent of cause evaluation did not assess the applicability of the cause for other programs or activities, such as whether proper rigor is being applied for maintaining licensee-controlled licensing basis documents other than the USAR. The inspectors determined that the licensee supplemented their extent of cause evaluation to include a sample of the last 3 years of revisions to licensing basis documents other than the USAR (e.g. Technical Specifications Bases, Technical Requirements Manual) to determine whether the changes were made properly (in accordance with established processes and procedures) and accurately (in accordance with the information that prompted the need for the change).

The inspectors determined that the licensees extent of condition evaluation did not include any independent sample of change process output other than license amendments and procedure changes, and the licensees extent of cause evaluation did not include an effort to identify potential instances where no licensing basis document change occurred when there should have been, based on new or updated information being issued. The licensee entered these observations into the corrective action program as Condition Report CR-CNS-2017-04036.

c. Findings

No findings were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On June 29, 2017, the inspectors presented the inspection results to Mr. J. Kalamaja, General Manager Plant Operations and then-acting Vice President and Chief Nuclear Officer, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

On June 12, 2019, the inspectors presented the revised inspection results to Mr. J. Dent, Vice President-Nuclear and CNO, and other members of the licensee staff. The licensee acknowledged the categorization of the revised issues presented.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Aue, Employee Concerns Program Coordinator

T. Barker, EP&C Manager

T. Chard, Quality Assurance Manager

L. Dewhirst, CA&A Manager

J. Dykstra, EP&C Engineer

J. Ehlers, System Engineering Supervisor

T. Forland, Licensing Engineer

E. Fulton, System Engineer

S. Gocek, Design Engineer

D. Kiekel, Design Engineer

M. Metzger, System Engineer

J. Reimers, System Engineering Manager

J. Shaw, Licensing Manager

R. Shaw, Assistant Operations Manager - Support

D. Van Der Kamp, Licensing Technical Specialist

NRC Personnel

C. Henderson, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

Failure to Accomplish Activities in Accordance with

05000298/2017010-01 NCV Documented Procedures for High-Pressure Coolant Injection Failure (Section 4OA2.5.a)

Failure to Monitor No. 2 Diesel Generator Under 50.65(a)(1)

05000298/2017010-02 NCV Due to Inadequate Maintenance Rule Evaluation (Section 4OA2.5.b)

Failure to Adopt Appropriate Procedures in Accordance with

05000298/2017010-03 NCV CFR Part 21 (Section 4OA2.5.c)