IR 05000315/2008502
| ML081000358 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 04/07/2008 |
| From: | Khadijah West Division of Reactor Safety III |
| To: | Rencheck M Indiana Michigan Power Co |
| References | |
| IR-08-502 | |
| Download: ML081000358 (30) | |
Text
ril 7, 2008
SUBJECT:
D. C. COOK NUCLEAR POWER PLANT, UNITS 1 AND 2; NRC INSPECTION PROCEDURE (IP) 95002 SUPPLEMENTAL INSPECTION REPORT 05000315/2008502; 05000316/2008502
Dear Mr. Rencheck:
From February 4 to February 22, 2008, the U.S. Nuclear Regulatory Commission (NRC)
completed an Emergency Preparedness supplemental inspection in accordance with Inspection Procedure 95002 at your D. C. Cook Nuclear Plant. The enclosed inspection report documents the inspection results, which were discussed on February 22, 2008, with you and other members of your staff. On January 14, 2008, Mr. R. Crane of your staff informed the NRC that the site was prepared for the inspection.
The supplemental inspection examined your root cause evaluation, extent of condition, and extent of cause determinations, and corrective actions associated with a Yellow Alert and Notification System (ANS) performance indicator in the Emergency Preparedness cornerstone.
The Yellow performance indicator placed D.C. Cook Units 1 and 2 into the Degraded Cornerstone Column of the NRCs Action Matrix for the second and third quarters of 2007.
Based on the results of this inspection, the NRC determined that you had adequately addressed the performance issues associated with the Yellow performance indicator. Your root cause report identified that a lack of ownership and accountability for the ANS was the primary cause for the Yellow ANS performance indicator. Based on your increased ownership of the ANS as evidenced by your actions to incorporate the operation, maintenance, and testing of the ANS in the D. C. Cook work management and configuration control processes; as well as other actions you have undertaken, the NRC determined that no additional inspection activities are required.
Based on the results of this inspection, one Severity Level IV Non-Cited Violation (NCV) and one finding of very low safety significance (Green) were identified. Because of the very low safety significance and because the issue was entered into your corrective action program, the NRC is treating the violation as an NCV in accordance with Section VI.A.1 of the NRC's Enforcement Policy. If you contest the subject or severity of an NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S.
Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission -
Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector's Office at the D.C. Cook Nuclear Power Plant.
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)
component of NRC's Agencywide Documents Access and Management System (ADAMS),
accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Steven West, Director Division of Reactor Safety Docket Nos. 50-315; 50-316 License Nos. DPR-58; DPR-74 cc w/encl: M. Peifer, Site Vice President J. Gebbie, Plant Manager G. White, Michigan Public Service Commission Michigan Department of Environmental Quality -
Waste and Hazardous Materials Division Emergency Management Division MI Department of State Police T. Strong, Chief, State Liaison Officer, State of Michigan In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)
component of NRC's Agencywide Documents Access and Management System (ADAMS),
accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Steven West, Director Division of Reactor Safety Docket Nos. 50-315; 50-316 License Nos. DPR-58; DPR-74 cc w/encl: M. Peifer, Site Vice President J. Gebbie, Plant Manager G. White, Michigan Public Service Commission Michigan Department of Environmental Quality -
Waste and Hazardous Materials Division Emergency Management Division MI Department of State Police T. Strong, Chief, State Liaison Officer, State of Michigan DOCUMENT NAME:G:\DRS\Work in Progress\Cook95002ReportRev2.doc Publicly Available Non-Publicly Available Sensitive Non-Sensitive To receive a copy of this document, indicate in the concurrence box "C" = Copy without attach/encl "E" = Copy with attach/encl "N" = No copy OFFICE RIII RIII RIII RIII NAME JEllegood:jb CLipa EDuncan SWest DATE 04/03/08 04/03/08 04/07/08 04/07/08 OFFICIAL RECORD COPY
Letter to Michael Rencheck from Steven West dated April 7, 2008 SUBJECT: D. C. COOK NUCLEAR POWER PLANT, UNITS 1 AND 2; nrc INSPECTION PROCEDURE (IP) 95002 SUPPLEMENTAL INSPECTION REPORT 05000315/2008502; 05000316/2008502 DISTRIBUTION:
TEB RidsNrrDirsIrib MAS KGO JKH3 BJK1 CAA1 LSL C. Pederson, DRP DRPIII DRSIII PLB1 TXN ROPreports@nrc.gov
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
Docket Nos: 50-315; 50-316 License Nos: DPR-58; DPR-74 Report Nos. 05000315/2008502; 05000316/2008502 Licensee: Indiana Michigan Power Company Facility: D. C. Cook Nuclear Power Plant, Units 1 and 2 Location: Bridgman, MI 49106 Dates: February 4 to February 22, 2008 Inspectors: J. Ellegood, Palisades Senior Resident Inspector R. Jickling, Senior Emergency Preparedness Analyst S. LaVie, Senior Emergency Preparedness Specialist Approved by: Eric Duncan, Chief Plant Support Branch Division of Reactor Safety
SUMMARY OF FINDINGS
IR 05000315/2008502; 05000316/2008502; 02/4-22/08; D.C. Cook Nuclear Power Plant,
Units 1 and 2; IP 95002 Supplemental Inspection Report.
This report covers a 2-week supplemental inspection by two regional inspectors and one senior Emergency Preparedness (EP) specialist from the Office of Nuclear Security and Incident Response. This inspection identified one finding of very low safety significance (Green) as well as a Severity Level IV Non-Cited Violation (NCV) of NRC requirements. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.
The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.
A. Inspector-Identified and Self Revealed Findings
Cornerstone: Emergency Preparedness (EP)
Severity Level IV. The inspectors identified an NCV of 10 CFR 50.9, Completeness and Accuracy of Information, when licensee personnel failed to properly report data associated with the Alert and Notification System (ANS) performance indicator (PI) for the second quarter of 2004 and subsequently failed to inform the NRC of the incorrect information after it was identified during a root cause evaluation for a similar event in 2007.
The inspectors determined the finding was more than minor in accordance with IMC 0612 and the Enforcement Manual. Specifically, had the licensee properly submitted the ANS data, the PI would have been categorized as White for the second quarter of 2004; therefore the data was inaccurate in a material respect. As part of the licensees immediate corrective actions, this issue was entered into the corrective action program. In addition, the inspectors determined that the finding had a cross-cutting aspect in the area of Human Performance since the licensee failed to evaluate and report the erroneous data due to non-conservative decision-making (H.1(b)).
(Section 02.06)
- Green.
The inspectors identified that between 1984 and 2007, the licensee made significant changes to the ANS without obtaining required Federal Emergency Management Agency (FEMA) approval for the changes as required by 44 CFR 350,
Review and Approval of State and Local Radiological Emergency Plans and Preparedness.
The inspectors concluded that the finding was more than minor because the finding was associated with the Procedure Quality attribute of the Emergency Preparedness cornerstone and adversely impacted the cornerstone objective of ensuring the licensee was capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency since the licensee failed to obtain FEMA approval of significant changes to the ANS. The inspectors determined that the finding affected a Risk Significant Planning Standard (RSPS) since the finding was associated with the FEMA-approved ANS Design Report and supporting FEMA approval letter.
However, because the finding did not result in the loss or significant degradation of the
ANS, the finding was of very low safety significance (Green). As part of their immediate corrective actions, the licensee obtained FEMA approval for a Final ANS Design Report that addressed all of the modifications that had been made to the ANS. Due to the age of the performance deficiency, the inspectors concluded that no cross-cutting aspect was associated with the finding. No violation of NRC requirements occurred.
(Section 02.06)
Licensee-Identified Violations
None.
REPORT DETAILS
INSPECTION SCOPE
01.01 Scope The NRC performed this supplemental inspection to assess the licensees evaluation and corrective actions associated with a degraded Alert and Notification System (ANS)performance indicator (PI) in the Emergency Preparedness (EP) cornerstone. Alert and Notification System performance degraded such that the PI was Yellow for the second and third quarters of 2007. The inspectors performed the inspection in accordance with Inspection Procedure (IP) 95002.
This supplemental inspection reviewed the licensees root cause report and supporting documentation to determine if the licensee adequately evaluated the problem, determined its cause, and developed appropriate corrective actions. In addition, the inspectors independently assessed the extent of condition and the extent of cause of the problem.
01.02 Background Alert and Notification System Description The D.C. Cook ANS consisted of 70 sirens located throughout the Emergency Planning Zone (EPZ) with the primary activation center (PAC) equipment located in the Berrien County Sheriffs Department (BCSD) dispatch center in St. Joseph, Michigan. A second activation center was located in the American Electric Power (AEP) Field Service Facility in Meadowbrook, Michigan. Since this facility was not operated by a local authority on a continuous basis, this facility was not considered a secondary activation center. The encoders in the system provided instructions to the transmitters pertaining to the information to transmit. One transmitter provided information to radios at designated news media outlets regarding the reason for the siren activation. A second transmitter transmitted a signal to activate the sirens themselves. After receiving the transmitter signal, each siren was designed to activate and send a signal back to the activation center with information on siren performance. A visual display, referred to as a map board, provided indication of siren activation and a computer printout provided additional individual siren performance information. In the event the map board and/or printout did not indicate activation, individual sirens could be inspected locally to determine if the siren actuated. Attachment 2 depicts a simple block diagram of the ANS both as it existed prior to the May 7, 2007, testing failure and as it was in the process of being modified to during this inspection. Three types of tests; poll, silent, and activation, were used to test the ANS. In a poll test, a signal was transmitted to the sirens that requested siren status information. This polling provided a test of the activation system and the siren communications without sounding the sirens themselves. In a silent test, a signal was transmitted to activate the sirens at a frequency above the threshold of human hearing. This test exercised the siren activation system and the significant components in each siren. In an audible test, the siren activation system and each sirens components were fully exercised at a frequency in the audible range of human hearing.
Organizationally, the licensee delegated the testing and maintenance of the ANS to American Electric Power Field Services Group (AEP IT), a non-nuclear division of AEP, and allowed testing and maintenance to be performed outside of the licensees work management processes. The AEP IT technician obtained, reviewed, and forwarded testing data to the D.C. Cook EP organization. Within the EP organization, one employee was designated as the point of contact for the ANS and received and reviewed submitted reports and reported ANS performance in the ANS PI. The BCSD operated and tested the ANS from the PAC at the BCSD Dispatch Center. In the event of ANS issues, the BCSD contacted AEP IT for maintenance support.
Alert and Notification System Failure Description On May 5, 2007, the ANS system at D.C. Cook failed to actuate during routine monthly testing of the sirens. The BCSD dispatcher, in consultation with an AEP IT technician, made several attempts to actuate the sirens and after 22 minutes caused the sirens to sound. Troubleshooting did not identify any failed components. On June 1, 2007 the licensee replaced a potentiometer that failed following a lightning strike. On August 6, 2007 the system failed a post-maintenance test following a failure during a polling test. The licensee restored the ANS to service after replacing the transmitter tone shelf board. Although no further problems were encountered, the licensee replaced the transmitter on August 14, 2007. At the time of these failures, the licensee had partially completed a significant upgrade effort to the ANS. At the time of the inspection, a majority of the ANS activation components had been replaced, as well as most of the sirens.
02.
EVALUATION OF INSPECTION REQUIREMENTS 02.01 Problem Identification a.
Determine that the evaluation identifies who (i.e., licensee, self-revealing, or NRC), and under what conditions the issue was identified.
The issue was identified by the licensee on May 5, 2007, during the monthly siren test.
When the BCSD dispatcher attempted to sound the ANS sirens, none of the sirens sounded. The following is a timeline of the attempts to activate the siren:
- 1255 - AEP IT technician contacted BCSD dispatcher to request the monthly siren activation test be conducted.
- 1300 - Monthly test initiated by BCSD dispatcher; map board did not indicate that sirens had activated; news media transmission was satisfactory.
- 1301 - AEP IT technician requested BCSD dispatcher perform system reset.
- 1304 - Key switch placed in test; system reset satisfactory.
- 1307 - Primary encoder replaced with backup encoder.
- 1308 - Second attempt with backup encoder failed; de-energized then re-energized encoder; failed attempt to activate sirens.
- 1321 - AEP IT technician traveled to AEP Field Service Facility and contacted BCSD dispatcher; BCSD dispatcher successful in activating siren system.
- 1322 - Test completed; polling from AEP Field Service Facility required several attempts to get complete polling of sirens
- 1335 - AEP IT technician requested personnel to check equipment.
- 1530 - AEP IT inspection did not identify any equipment problems.
During the evaluation of the test results, the licensee believed that because the sirens ultimately sounded without conducting any maintenance, the test could be considered a success. Nonetheless, the licensee submitted second quarter 2007 PI data that indicated all of the sirens failed the May test pending resolution through the Reactor Oversight Process (ROP) Frequently Asked Question (FAQ) process. Subsequent discussions between the industry, Nuclear Energy Institute (NEI), and NRC representatives on the FAQ working group reached a conclusion that the test should be considered a failure and the FAQ process was not needed to resolve the question.
Inclusion of the test as a failure resulted in a Yellow ANS PI for the second and third quarters of 2007.
The inspectors concluded that the evaluation identified who and under what conditions the issue was identified.
b. Determine that the evaluation documents how long the issue existed, and prior opportunities for identification.
The licensee recognized that the underlying cause existed from the inception of the ANS and that the condition existed for several years. In the root cause report, the licensee noted that ANS changes were made between 1984 and 1998 to improve siren coverage and reliability. The report also acknowledged that multiple attempts to poll the system were needed in 2003. In addition, obsolescence issues in 2004 led to the development and approval of an upgrade project to replace the majority of the components in the ANS. Between 2004 and the failure in 2007, the licensee acquired materials and began replacement of the sirens associated with the ANS. Although the replacement transmitter and encoders that caused the 2007 failure were available for installation, the project plan did not specify the replacement of these components until after the May 2007 failure. In addition, the licensees root cause evaluation (RCE) identified instances in 2003 and 2004 when similar failures occurred.
The inspectors reviewed the historical data from January 2000 through January 2008 and identified three additional examples where the transmitter and/or encoder failed on an initial activation attempt. Based on these examples, the inspectors concluded that intermittent problems existed from at least 2000.
The licensee also reviewed the organizational issues that allowed the ANS reliability to degrade. The licensee concluded that maintenance of the system had been inappropriately delegated to AEP IT. Although D.C. Cook and AEP IT had a common owner (AEP), AEP IT and D.C. Cook were functionally separate entities. In addition, the licensee identified in the RCE that the ANS did not fall under the infrastructure of their programs. As a result, while the licensee funded ANS repairs and modifications, equipment issues were not entered into the corrective action program nor were maintenance activities performed using procedures that applied to other work at D.C.
Cook. In 2005, the licensees Performance Assurance department identified that condition reports (CRs) were not being generated to identify ANS issues. Although the EP organization began generating CRs after this issue was identified, the threshold was much higher than for other plant systems and the ANS continued to effectively remain outside the licensees work management and configuration control processes.
Despite the ANS being outside of normal licensee processes, the RCE identified multiple prior opportunities to identify ANS problems. The licensee identified the following specific missed opportunities for prior identification:
- Implementation of the ROP PIs provided an opportunity to review the testing commitments in the FEMA-approved Final ANS Design Report, which required semi-monthly growl or silent testing that was not being performed. Had the ANS PI implementation effort been more thorough, these tests would have been performed, enabling earlier detection of ANS problems;
- In July of 2003 and 2004, the intermittent failure of silent polling and monthly siren testing provided an opportunity to recognize ANS problems;
- Emergency Preparedness Recovery and Excellence Plans in 2004, 2005, 2006, and 2007 did not identify ANS problems;
- Licensee Information Technology (IT) personnel repeatedly recommended replacement of the BCSD transmitter, but the EP staff did not recognize that a D.C. Cook process did not exist to ensure the replacement occurred;
- During preparation for an NRC EP baseline inspection in March 2006; and
- Failure to document ANS problems in the corrective action program.
In addition to the prior identification opportunities discussed above, the inspectors identified the following opportunities to identify ANS problems and the lack of licensee ownership of the ANS:
- AERP 4.02, Action and Responsibilities of Telecommunications Personnel, contained responsibilities for the ANS (referred to as the Early Warning System or EWS) that assigned responsibility to AEP IT. This procedure was superseded by RMT-2080-JPIC-001, Activation of Operation of the JPIC [Joint Public Information Center]. The new procedure did not discuss the responsibility for ANS maintenance. The revision was an opportunity to recognize the inappropriate assignment of ANS responsibility. However, the change not only failed to identify the issue, but degraded the situation further by removing all discussion of ANS maintenance responsibility;
- In 2005, the licensee identified aging and reliability issues with the same model transmitters used in certain licensee Security and Operations equipment;
- A 2004 presentation to the Plant Health Committee of an ANS improvement request did not prompt licensee management to question the lack of CRs for the system and site ownership of the ANS;
- A 1998 submittal to FEMA concerning siren system upgrades did not result in the recognition that the ANS was being operated, tested, and maintained by non-licensee personnel;
- Multiple Performance Assurance, Quality Assurance, and EP self-assessments failed to refer to regulatory source documents such as the FEMA-approved Final ANS Design Report to determine whether ANS testing was appropriate;
- Performance Assurance (PA) Audit 05-07 included ANS in the scope, with an attribute to verify testing at prescribed frequencies and assess the PI for ANS reliability. The audit did not identify the ANS issues in monthly reports that were used to develop PI submittals. In addition, the Performance Assurance audit report did not identify failures to comply with the FEMA-approved Final ANS Design Report; and
- An action request to include the ANS in the licensees configuration change procedure was rejected by the licensees engineering organization.
Overall, the inspectors concluded that the licensee adequately evaluated the duration of the condition and cause. However, the inspectors concluded the licensee overlooked some of the missed opportunities to identify the condition. These missed opportunities provide additional insight on plant processes that could be addressed.
c. Determine that the evaluation documents the plant specific risk consequences (as applicable) and compliance concerns associated with the issue both individually and collectively.
The licensees RCE evaluated the safety significance of the siren failures. The licensees RCE report stated that there were no nuclear, radiological, or safety impacts related to the Yellow ANS PI. The report clarified this conclusion by noting that the ANS provided the function of alerting the public of an emergency and the potential existed for a delay in public sheltering or evacuation. In addition, the report concluded that the event represented a potential impact on public confidence. Discussions with licensee personnel demonstrated that plant personnel recognized the important role of ANS in emergency planning.
In the RCE, the licensee did not thoroughly address compliance concerns with the ANS system. Although the RCE briefly discussed several regulatory aspects in various sections of the report, the licensees processes did not require a thorough evaluation of the regulatory impacts. The inspectors determined the following compliance concerns existed with the ANS:
- Title 44 CFR 350.14 required FEMA approval for significant changes to the State Emergency Plan, which included the ANS. Although the licensee recognized some level of non-compliance until 1999, the licensee did not recognize that not all changes were approved in 1999 or that additional changes had occurred after 1999.
This issue was the subject of a finding of very low safety significance (Green)that is discussed in Section 02.06 of this report.
- Title 10 CFR 50.47(b)(5) required that, Procedures have been established for notification and the means to provide early notification and clear instruction to the populace within the plume exposure pathway Emergency Planning Zone have been established. The ANS provided this function, but the licensee did not identify this requirement in the RCE.
- Title 44 CFR 350 invoked NUREG-0654/FEMA-1 for the review of Emergency Plans. The RCE did not discuss this requirement.
- The licensee did not evaluate the PI impact for all previous ANS failures. AR 00814077 was generated on May 29, 2007, to evaluate the PI impact of the 2004 failure. The AR concluded that no evaluation was required.
The inspectors concluded the licensee adequately understood the safety significance of the ANS failures, but did not identify all the compliance concerns associated with the ANS.
02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation a.
Determine that the problem was evaluated using systematic methods to identify the root cause and contributing causes.
The licensee used the following systematic methods to conduct the RCE:
- Data gathering through interviews and document review;
- Timeline construction;
- Event and Causal Factors Chart Analysis;
- Barrier Analysis; and
- Why Staircase
Analysis.
Although a reasonable set of tools were used, the inspectors noted some issues with the implementation of the Event and Causal Factors Chart Analysis, Barrier Analysis, and Why Staircase methodologies. Examples included:
- The Why Staircase analysis included a block that stated the safety significance was not recognized. The inspectors determined that the licensee recognized the safety significance of ANS, but did not recognize the degraded state of the ANS.
- The Barrier Analysis concluded that the self-assessment barrier was effective.
The inspectors determined that had the self-assessment barrier been effective, the licensee would have identified the lack of ANS ownership prior to the degradation of the ANS and the Yellow PI.
- The Event and Causal Factor Chart did not include all important events, such as issues with sirens freezing and test failures.
Despite the issues the inspectors identified, the inspectors concluded that the licensee adequately identified the root and contributing causes of the ANS failure.
b. Determine that the root cause was conducted to a level of detail commensurate with the significance of the problem.
The licensee identified the root cause as the failure to use formal processes to oversee, track, and trend the design, performance, and maintenance of the ANS as the result of latent organizational and programmatic failures with respect to accountability and ownership.
In addition, the licensee identified the following contributing causes:
- Failure to recognize and implement the approved testing protocol specified in the FEMA Final ANS Design Report,
- Failure to analyze the risk associated with ANS failures, and
- Failure to properly implement the corrective action program to document ANS testing failures and ANS post-maintenance test failures.
Based upon the extensive work performed to address the root cause and the inspectors review of the information supporting the RCE, the inspectors concluded that the licensee identified the root cause and conducted the RCE with a sufficient level of detail.
c. Determine that the RCE included a consideration of prior occurrences of the problem and knowledge of prior operating experience.
The RCE report included a discussion of the results of a review of previous operating experience. The licensee determined that of nine Operating Experience (OE) reports that were reviewed, two were directly relevant to the licensees programmatic organizational deficiencies. Based upon this review, the licensee identified a number of weaknesses in the oversight and responsibility for the ANS. Some of these weaknesses included:
- Licensee management had developed a complacent attitude toward ANS performance;
- The Emergency Preparedness group had not always taken appropriate, aggressive action to address ANS performance issues;
- Site leadership did not ensure that a root cause or apparent cause was performed;
- The Quality Programs department had not adequately reviewed the EP processes to ensure that significant issues were investigated and corrected;
- There was no systematic design change processes in place; and
- Site leadership did not recognize the value of site processes in ensuring a high level of siren reliability.
The inspectors concluded that the RCE included a consideration of prior occurrences of the problem and knowledge of prior operating experience.
d. Determine that the RCE addresses the extent of condition and the extent of cause of the problem.
The licensee performed an extent of condition review that concluded other equipment was not degraded. At the end of the inspection, the licensee was in the final phase of an ANS upgrade project that replaced the majority of the ANS components. Additional details regarding this effort are discussed in Section 02.04 of this report.
In addition, the licensee performed an extent of cause review that identified the following areas in which site ownership needed to be strengthened:
- Communication Equipment - Corrective action was required to formalize existing interface agreements acceptance criteria for emergency response organization facility communication equipment checks.
- Emergency Response Organization Paging System - Corrective action was required to formalize the existing testing process.
- Facility Equipment - Corrective action was required to formalize the existing process for checks of emergency facility equipment.
For the above areas, the licensee assigned corrective action due dates and determined that the current equipment status did not challenge implementation of the Emergency Plan. The inspectors concluded that the RCE addressed the areas of extent of condition and extent of cause.
One issue associated with a previous ANS reporting error is discussed in Section 02.06 of this report.
02.03 Corrective Actions a.
Determine that the appropriate corrective actions are specified for each root/contributing cause or that there is an evaluation that no actions are necessary.
The inspectors reviewed the corrective actions associated with the ANS siren failure from both the equipment and organizational perspective. The inspectors reviewed the In-Depth Apparent Cause Evaluation (IDACE) AR00813287 that was initiated following the May 2007 ANS failure. Initially, the licensee performed troubleshooting on the ANS but did not identify any failed ANS components. On May 26, 2007, a lightning strike caused a failure of the receiver and abnormal operation of the encoding equipment.
During the troubleshooting activities, the technician identified erratic operation of a potentiometer on a board in the transmitter. The technician wiped the potentiometer multiple times and verified that the potentiometer functioned normally. The technician subsequently replaced the potentiometer to provide increased confidence in the reliability of the ANS. A subsequent ANS failure occurred on August 6, 2007, following maintenance polling of the sirens. During troubleshooting, the technician identified a faulty board in the transmitter and replaced the faulty board. On August 14, 2007, the licensee replaced the transmitter with a new transmitter procured as part of the ANS upgrade project. The inspectors noted that as part of the project, significant portions of the ANS had been replaced. Based on the equipment upgrades, which included the replacement of backup encoders and transmitters, the inspectors concluded that the licensee appropriately addressed the material condition aspects of the failures.
Taken individually, the inspectors concluded that the licensees immediate and short-term corrective actions to resolve the direct cause of the intermittent failures were appropriate and timely. However, coupled with the availability of new equipment already procured as part of the ANS upgrade project and the obsolescence of the equipment, the inspectors concluded that the August 6, 2007, post-maintenance failure could have been precluded by earlier replacement of the transmitter. The inspectors attributed the delay to the licensees root cause that the licensee had failed to exercise accountability and ownership of the ANS.
The RCE concluded that as a result of latent organizational and programmatic failures with regard to accountability and ownership of the ANS, formal processes were not used to oversee, track, and trend the design, performance, and maintenance of the ANS. To address this finding, the licensee assumed ownership of the ANS from AEP IT and placed the ANS under the licensees work processes and configuration controls. To this end, the licensee established positions within the D.C. Cook organization that included a program owner and a technical owner for the ANS and other emergency preparedness equipment. Additional actions taken or planned by the licensee included:
- Development of configuration control documents;
- Assignment of equipment designators;
- Generation of work orders for recurring ANS testing and maintenance;
- Generation of licensee procedures to address oversight, tracking, and trending of the design, performance, surveillance, and maintenance of the ANS; and
- Development of new interface agreements between D.C. Cook, BCSD and AEP IT.
The RCE identified three contributing causes. The first contributing cause identified that licensee personnel failed to recognize and implement the ANS testing requirements specified in the FEMA-approved Final ANS Design Report. To address this issue, the licensee evaluated and revised the ANS testing requirements. Licensee personnel received FEMA approval for these changes in December 2007 and appropriate procedure changes were subsequently completed. The second contributing cause identified the failure to perform a single point vulnerability analysis to assess the risk of such failures on ANS reliability. The licensee completed a single point vulnerability analysis in February 2008. The licensee planned to use the analysis results to develop and implement actions to eliminate single point vulnerabilities in the ANS. In addition, the licensee planned to create a redundant activation system for the BCSD Dispatch Center by June 2008. The third contributing cause identified the failure to use the corrective action program to document test failures and routine maintenance tests. The licensee currently uses the corrective action program to document equipment issues and planned to strengthen ANS test and maintenance procedures by defining the threshold for initiating CRs in various procedures. In addition to the actions that directly addressed causal factors, the licensee also identified additional corrective actions to address other weaknesses identified during their review.
The inspectors determined that the actions implemented and planned were well-developed and appropriate to resolve the root cause and contributory causes and appeared to be sufficient to preclude recurrence. Incorporation of the ANS into the licensees work processes and configuration controls should improve the reliability of the ANS, and increased the management oversight of ANS performance. Therefore, the inspectors concluded reasonable assurance existed that the licensee could maintain an adequate ANS and prevent recurrence of significant problems.
b. Determine that the corrective actions have been prioritized with the consideration of the risk significance and regulatory compliance.
As stated above, the licensee took appropriate immediate and short-term actions to demonstrate the capability to alert the public in the event of a radiological emergency at D.C. Cook. The licensee initiated an In-Depth Apparent Cause Evaluation within 2 days of the observed test failure and performed troubleshooting activities that ultimately resulted in a replacement of the activation transmitter. However, the inspectors noted that the licensee did not immediately initiate an evaluation to determine if programmatic or organizational issues existed that affected ANS reliability. After the licensee recognized that the ROP FAQ working group would conclude the test should be considered a failure, the licensee initiated a RCE. The licensee approved the RCE on November 1, 2007, and established corrective action due dates ranging from December 17, 2007, through June 11, 2008. The inspectors concluded that the licensee prioritized corrective actions in a manner commensurate with their significance.
c. Determine that a schedule has been established for implementing and completing the corrective actions.
The licensee took appropriate immediate and short-term actions to demonstrate the capability to alert the public in the event of a radiological emergency at D.C. Cook.
These actions were complete at the conclusion of the inspection. The inspectors questioned the apparent delay in replacing the transmitter until several months after the failed test. Licensee personnel explained that the cause of the intermittent failures was not immediately known and that early replacement of the transmitter could have prevented identification of the actual cause. Initially, the licensee considered radio interference to be the cause and could not identify any failed components. Subsequent failures and additional troubleshooting ruled out interference as a cause and identified the transmitter as a cause, after which it was replaced. While the inspectors concluded the explanation was reasonable, the inspectors noted that had the ANS been included in the licensees infrastructure, reliability data could have identified degradation of the transmitter much sooner and could have resulted in a more timely replacement.
Corrective action assignments were made with scheduled completion dates ranging from December 17, 2007, through June 11, 2008, with a majority due in January or February 2008. The inspectors identified that the corrective actions most closely associated with establishing accountability and ownership were complete at the time of the inspection.
The inspectors concluded that a schedule had been established for implementing and completing the corrective actions.
d.
Determine that the quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.
The licensee developed an effectiveness review plan that required a self-assessment focused on the ANS program by the Emergency Planning Organization with external industry involvement. This plan established several critical attributes that were required to be assessed and identified four measures for success:
- (1) zero self-assessment findings related to the ANS;
- (3) a successful activation transmission signal from the primary location 100 percent per month; and
- (4) a successful siren activation rate of 97 percent per month. The plan also required an interim report in June of 2008 and a final report in December of 2008.
Although the inspectors concluded that the effectiveness review plan provided a reasonable strategy to monitor the material health of the ANS, the inspectors noted that it did not monitor the root cause of inadequate ownership of the ANS system. The licensee planned to develop additional effectiveness review criteria to monitor the management and oversight elements of the root cause.
The inspectors concluded that measures of success have been developed or were planned for determining the effectiveness of the corrective actions to prevent recurrence.
02.04 Independent Assessment of Extent of Condition and Extent of Cause Perform focused inspections to independently assess the validity of the licensees conclusions regarding the extent of condition and extent of cause of the issues. The objective is to independently sample performance, as necessary, to provide assurance that the licensees evaluation regarding extent of condition and extent of cause is sufficiently comprehensive.
The inspectors determined that the licensee conducted a comprehensive extent of condition and extent of cause review that sufficiently identified all relevant areas. As a result, the inspectors focused on the level of detail and adequacy to which the extent of condition and extent of cause effort was performed. Based on this review, two issues were identified.
During the extent of cause review, the inspectors identified modification process vulnerabilities in the EP and Security areas. In both areas, the screening process required detailed knowledge of the Emergency Plan and Security Plan, respectively.
The inspectors identified that modification reviewers may not have the requisite knowledge of these plans to adequately conduct the screenings. The licensee entered this issue into their corrective action program.
As part of the extent of condition review, the inspectors reviewed data packages from January 2000 through January 2008 that were prepared by AEP IT to document test results. During the review, the inspectors identified that between 1/2 hour and 2 days prior to the monthly activation test, the AEP IT technician pre-tested equipment in the PAC to verify that it would properly operate during the subsequent activation test. The inspectors noted that the use of the PAC equipment rarely occurred other than during the monthly activation test or the pre-test. In addition, the inspectors noted that every monthly test included a pre-test. The pre-test included polling of the sirens from the PAC as well as visual inspections of the PAC equipment. By polling the sirens from the PAC, the pre-test exercised the encoders, transmitters, and portions of the siren and afforded the licensee an opportunity to correct equipment malfunctions prior to obtaining the reliability data that would be provided to the NRC. The inspectors reviewed NEI 99-02, Regulatory Assessment Performance Indicator Guidance, Revision 5, to determine if PI reporting guidance discussed the acceptability of this practice. The guidance in NEI 99-02 permitted the licensee to consider as a successful opportunity any test performed in accordance with the FEMA-approved Final ANS Design Report. NEI 99-02 did not establish the ANS testing criteria, the testing frequency, or the testing method. The FEMA-approved Final ANS Design Report in effect until December of 2007 did not include pre-testing; however, the Final ANS Design Report approved by FEMA in December 2007 explicitly allowed the PAC activation equipment to be tested prior to the monthly audible siren test. Discussions with Region III management, the Office of Nuclear Security and Incident Response (NSIR), and the Office of Nuclear Reactor Regulation (NRR) concluded that an insufficient regulatory basis existed to prohibit this practice. However, the licensee agreed to revise their testing protocol and planned to revise the FEMA-approved Final ANS Design Report to eliminate pre-testing.
The inspectors determined through discussions with members of the licensee staff and review of the RCE that the licensee had not identified the pre-testing and the possible effects of the pre-testing on the reported ANS PI. Although some members of the licensees staff were aware of the test, they did not recognize the potential impact on the ANS PIs. The inspectors concluded that the failure of the licensee to identify the pre-testing represented a weakness in the licensees extent of condition efforts. The inspectors concluded that this testing had the potential to mask equipment reliability issues.
02.05 Safety Culture Perform a focused inspection to independently determine that the RCE appropriately considered whether any safety culture component caused or significantly contributed to any risk significant performance issue. If a weakness in any safety culture component did cause or significantly contributed to such an issue, and the licensees evaluation did not recognize that cause or contribution, refer to IMC 0305.
The inspectors reviewed condition reports and procedures, and conducted interviews with licensee personnel to determine if the licensee properly considered whether any safety culture component caused or contributed to ANS issues. The RCE report included a discussion of the 13 safety culture aspects described in Regulatory Information Summary (RIS) 2006-013, Information on the Changes Made to the Reactor Oversight Process to More Fully Address Safety Culture, as they applied to the Yellow ANS PI. The RCE report identified safety culture weaknesses in the areas of corrective action program and accountability. The inspectors identified that a number of other safety culture components potentially contributed to the ANS issues that were identified in the RCE. These additional safety culture components included resources, work control, work practices, operating experience, and organizational change management.
The inspectors discussed this issue with licensee personnel who stated that their safety culture evaluation focused on organizational issues rather than plant processes related to the operation, maintenance, and testing of the ANS. However, the inspectors determined that although not specifically discussed in the licensees RCE report, the corrective actions that had been developed to address the Yellow ANS PI also addressed the safety culture issues that contributed to ANS failures.
During the course of interviews with site personnel, the inspectors asked interviewees questions related to Safety Conscious Work Environment (SCWE) to determine if licensee staff were reluctant to raise safety concerns or if retaliation existed for raising safety concerns. The inspectors did not identify any concerns related to SCWE.
02.06 Findings a.
Introduction:
A Non-Cited Severity Level IV Violation of 10 CFR 50.9, Completeness and Accuracy of Information, was identified when licensee personnel failed to properly report the ANS PI results for the second quarter of 2004 and subsequently failed to inform the NRC of the incorrect information when it was identified.
Discussion: On May 1, 2004, the licensee performed a monthly test of the ANS system.
On the first attempt to activate the ANS sirens, none of the sirens sounded. On a second attempt, the sirens activated. Even though the sirens failed on the first attempt, the licensee considered the test successful and reported in PI data that 70 sirens activated. During a review of a similar occurrence in May 2007, the NRC determined that results similar to this would be considered a failure. Using siren performance data from the monthly siren tests, the inspectors calculated ANS reliability as 90.7 percent for the second quarter of 2004, which would have resulted in a White performance indicator.
Although the licensee was aware of the 2004 data, the licensee failed to evaluate the impact on the second quarter 2004 ANS PI and therefore failed to correct the erroneous information provided to the NRC.
Analysis:
The inspectors reviewed the issue in accordance with Inspection Manual Chapter (IMC) 0612 and the Enforcement Manual. The inspectors determined that the issue represented a performance deficiency since the licensee failed to meet the requirements of 10 CFR 50.9. In addition, the inspectors concluded that the finding had the potential to impact the NRCs regulatory function because the inaccurate information resulted in inaccurately reporting the ANS PI as Green for the second quarter of 2004.
Section D.3 to Supplement VII of the Enforcement Policy included, as an example of a Severity Level IV violation, the submission of inaccurate or incomplete performance indicator information that would have otherwise caused a PI to change from Green to White. Therefore, the inspectors concluded that the issue represented a Severity Level IV violation. As part of the licensees immediate corrective actions, this issue was entered into the corrective action program as AR 08043039. In addition, the inspectors determined that the finding included a cross-cutting aspect in the area of Human Performance since the licensee failed to adequately evaluate or report the erroneous data due to non-conservative decision-making (H.1(b)). Since the failure to correct the problem occurred in 2007, the inspectors considered it to be reflective of current licensee performance.
Enforcement:
Title 10 CFR 50.9, Completeness and Accuracy of Information, requires, in part, that information provided to the NRC be complete and accurate in all material respects. Contrary to these requirements, the licensee failed to provide complete and accurate information to the NRC regarding the ANS PI for the second quarter of 2004.
Once aware of the information, the licensee failed to evaluate the impact of the test failure on PI data and notify the NRC of the incorrect data. Since the incorrect data, if properly evaluated and reported, would have changed the reported PI from Green to White, the inspectors concluded the information was inaccurate in a material respect.
The failure to provide complete and accurate information to the NRC is being treated as a Severity Level IV NCV consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000315/2008502-01; 05000316/2008502-01: Failure to Properly Report ANS PI Data). This issue was entered into the licensees corrective action program as AR 08043039.
b.
Introduction:
A finding of very low safety significance (Green) was identified when between 1984 and 2007, the licensee made significant changes to the ANS without obtaining FEMA approval for the changes as required by 44 CFR 350, Review and Approval of State and Local Radiological Emergency Plans and Preparedness.
Discussion: In 1984, the licensee obtained FEMA approval of the ANS Design Report.
In 1998, the licensee submitted a revision to the ANS Design Report to FEMA that modified the number and location of some sirens. FEMA approved those changes, modifying the ANS Design Report in 1999. In the RCE report, the licensee determined that the 1999 ANS Design Report provided FEMA approval for the as-built configuration of the ANS in 1998. The inspectors reviewed the FEMA approval documentation and the 1998 submittal. Based on the review, the inspectors noted that the scope of the ANS Design Review did not encompass all the ANS changes made between 1984 and 1998; some of which were significant. In addition, the licensee made changes to the ANS after 1998 without evaluating if the changes required FEMA approval. Examples of these changes included:
- the addition of heaters to the siren motor areas in 1988 and 1994;
- the removal of speakers from Siren 953;
- the retrofit of Siren 953 with horns;
- the addition of encoders/transmitters to the ANS; and
- the use of solar powered sirens (with battery) due to the lack of alternating current power.
Based on the nature of the changes and following discussions with the FEMA staff, the inspectors concluded that the changes should have been evaluated to determine if FEMA approval was required prior to implementing the changes.
Analysis:
The inspectors evaluated the issue in accordance with IMC 0612 and determined that the issue was a performance deficiency because the licensee failed to comply with 44 CFR 350, Review and Approval of State and Local Radiological Emergency Plans and Preparedness, regarding the approval of significant changes to the ANS. Specifically, significant changes to the D.C. Cook ANS required FEMA approval and the licensee failed to determine if the subject changes were significant changes and failed to obtain pre-approval for significant ANS changes. The inspectors concluded that the finding was more than minor because the finding was associated with the Procedure Quality attribute of the Emergency Preparedness cornerstone and adversely impacted the cornerstone objective of ensuring the licensee was capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency since the licensee failed to obtain FEMA approval of significant changes to the ANS. As part of their immediate corrective actions, the licensee submitted and obtained approval for a revised Final ANS Design Report that addressed all of the modifications to the ANS. In accordance with IMC 0609, Appendix B, Emergency Preparedness Significance Determination Process, the inspectors determined that the finding affected the Risk Significant Planning Standard (RSPS) for compliance with the FEMA-approved ANS Design Report and supporting FEMA approval letter. However, because the finding did not result in the loss or significant degradation of the ANS, the finding was of very low safety significance (Green). For the reasons discussed above, and because of the age of the performance deficiency, the inspectors concluded that this finding is not reflective of current performance and, therefore, there is no cross-cutting aspect associated with the finding.
Enforcement:
No violation of NRC requirements occurred. The inspectors concluded that the performance deficiency represented a finding (FIN 05000315/2008502-02; 05000316/2008502-02, Failure to Obtain FEMA Approval for ANS Changes). The issue was entered into the licensees corrective action program as AR 00818547.
03. MANAGEMENT MEETINGS
Exit Meeting Summary
The inspectors presented the inspection results to Mr. Rencheck and other licensee personnel on February 22, 2008. The inspector confirmed that any proprietary information examined during the inspection was appropriately handled.
Regulatory Performance Meeting On February 22, 2008, as part of the exit meeting associated with the IP 95002 inspection, the NRC met with the licensee to discuss their performance in accordance with Section 06.05.a.1 of IMC 0305. During this meeting, the NRC and licensee discussed the issues related to the Yellow ANS PI that resulted in D.C. Cook being placed in the Degraded Cornerstone Column of the NRCs Action Matrix. This discussion included the causes, corrective actions, extent of condition, extent of cause, and other planned licensee actions.
ATTACHMENT 1:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee
- M. Renchek, Senior Vice President/Chief Nuclear Officer
- M. Peifer, D.C. Cook Site Vice President
- C. Hutchinson, Emergency Preparedness Manager
- D. Frie, Emergency Planning Specialist
- C. Graffenius, Emergency Planning Coordinator
- J. Petro, Regulatory Affairs Manager
- J. Smith, Emergency Planning Coordinator
- D. Strzelecki, American Electric Power Senior Telecommunications Engineer
- D. Walton, Emergency Planning Coordinator
- R. Crane, Regulatory Affairs
Attachment 1