IR 05000390/2013011

IR 05000390-13-011; 12/09/2013 - 12/20/2013; Watts Bar Nuclear Plant, Unit 1; Supplemental Inspection - Inspection Procedure (IP) 95002, Follow-up Inspection - IP 92702

ML14034A096
Person / Time
Site:	Watts Bar
Issue date:	02/03/2014
From:	Bartley J Reactor Projects Region 2 Branch 6
To:	James Shea Tennessee Valley Authority
References
IR-13-011
Download: ML14034A096 (38)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION ary 3, 2014

SUBJECT:

WATTS BAR NUCLEAR PLANT UNIT 1 - NRC SUPPLEMENTAL INSPECTION REPORT 05000390/2013011

Dear Mr. Shea:

Prior to September 30, 2009, your staff failed to establish an adequate abnormal condition procedure to implement a successful flood mitigation strategy. The procedure was inadequate to mitigate the effects of a probable maximum flood (PMF) event, in that earthen dams located upstream of the facility could potentially overtop and breach. Failure of the earthen dams during a PMF event would have resulted in onsite flooding and subsequent submergence of critical equipment. The condition existed from initial licensing until compensatory measures were put in place to prevent over-topping and failure of the earthen portions of the Ft. Loudon Dam.

On February 15, 2013, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Watts Bar Nuclear Plant Unit 1. Based on the results of this inspection, documented in NRC Inspection Report 05000390/2012009 on March 12, 2013, and the final significance determination documented in NRC Inspection Report 05000390/2013009 on June 4, 2013, the NRC assigned a white finding Action Matrix input to the mitigating systems cornerstone in the first quarter of 2013. The NRC also documented a related Severity Level III violation of 10 CFR 50.72(b)(3)(ii)(B) for failure to report an unanalyzed condition that significantly degraded plant safety.

In addition, prior to July 2012, your staff failed to maintain an adequate abnormal condition procedure to implement a successful flood mitigation strategy. The procedure had not been adequately maintained to ensure that necessary plant systems could have been reconfigured and realigned to mitigate the consequences of a design basis flood event within the allowed time of 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />. As a result, the Watts Bar flood mitigation strategy for certain flooding events, including PMF events, was inadequate. The condition existed from initial licensing until July 2012, when corrective actions were completed to ensure the abnormal condition procedure could be implemented within the allowed timeframe. On February 15, 2013, the NRC completed an inspection at your Watts Bar Nuclear Plant Unit 1. Based on the results of this inspection, documented in NRC Inspection Report 05000390/2012009 on March 12, 2013, and the final significance determination documented in NRC Inspection Report 05000390/2013009 on June 4, 2013, the NRC assigned a yellow finding Action Matrix input to the mitigating systems cornerstone in the first quarter of 2013.

In response to these Action Matrix inputs, the NRC informed you that a supplemental inspection under Inspection Procedure 95002, Supplemental Inspection for One Degraded Cornerstone or any Three White Inputs in a Strategic Performance Area, and Inspection Procedure 92702, Follow-up on Traditional Enforcement Actions, would be required.

On November 8, 2013, you informed the NRC that Watts Bar was ready for the supplemental inspection.

On December 20, 2013, the NRC completed the supplemental inspection and discussed the results of this inspection with Mr. Cleary and other members of your staff. The inspection team documented the results of this inspection in the enclosed inspection report.

The NRC performed this supplemental inspection to determine if: 1) the root and contributing causes for the significant issues were understood; 2) the extent of condition and extent of cause for the identified issues were understood; and 3) your completed or planned corrective actions were sufficient to address and prevent recurrence of the root and contributing causes. The NRC also conducted an independent review of the extent of condition and extent of cause for the white and yellow findings and an assessment of whether any safety culture component caused or significantly contributed to the performance issues.

The NRC determined that your staff performed a comprehensive evaluation of both findings.

Your staffs evaluation of the inadequate abnormal condition procedure identified two root causes. The first root cause was overconfidence in the accuracy of the Simulated Open Channel Hydraulics model and calculation processes which resulted in unrecognized inaccuracies in the PMF calculations. The inaccuracies in the model originated from design input errors. The second root cause was the Tennessee Valley Authority (TVA) Nuclear managements failure to provide effective oversight of changes to the river system and to apply safety-significant conservative decision-making for those changes affecting nuclear site PMF calculations, which demonstrated that nuclear safety during flooding conditions was not the overriding priority. The corrective actions taken and planned to prevent recurrence include, but are not limited to: 1) the development of a Flood Protection Program within the corporate nuclear engineering organization to ensure that nuclear plant critical safety systems are protected from all postulated flooding conditions; 2) the development of various implementing procedures to control the management of the Flood Protection Program; 3) the development of formal Flood Protection Program design standards and guides to control the calculation process; 4) the creation of a formal, documented risk management process for all engineering products; and 5) incorporation of industry best practices with respect to engineering technical rigor into the Conduct of the Engineering Organization procedure. Your staffs evaluation of the failure to maintain an adequate abnormal condition procedure to ensure that the plant would be realigned prior to the onset of PMF conditions at the Watts Bar site identified one root cause. The root cause was that Watts Bar management personnel failed to identify the aggregate impact of issues with the stations ability to implement the flood mode protection plan which resulted in the failure to exercise conservative decision making with respect to those issues. The corrective actions taken and planned to prevent recurrence include, but are not limited to: 1) performing periodic walkdowns of procedures and equipment relied upon to configure the site for a design basis flood event to ensure their accuracy and availability; 2) formally incorporating a Flood Protection Program within the Corporate Nuclear Engineering organization and developing implementing procedures as discussed above; 3) creating a detailed timeline for implementation of the flood mode plan at Watts Bar; and 4) performing a review of other programs and processes that are important to nuclear safety.

For the yellow and white findings; and for the Severity Level III violation, the NRC concluded that the root and contributing causes were understood, and that the extent of condition and extent of cause were identified. In addition, the NRC concluded that the root cause evaluations appropriately considered whether safety culture components caused or significantly contributed to the findings.

The NRC has determined that completed and planned corrective actions were sufficient to address the performance that led to the yellow and white findings. Therefore, the performance issues will not be considered as an Action Matrix input after the end of the fourth quarter of 2013.

NRC inspectors documented one finding of very low safety significance (Green) in this report.

This finding did not involve a violation of NRC requirements.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II; and the NRC resident inspector at Watts Bar Unit 1.

In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely, RA Jonathan H. Bartley, Chief Reactor Projects Branch 6 Division of Reactor Projects Docket No.: 50-390 License No.: NPF-90

Enclosure:

Inspection Report 05000390/2013011 w/ Attachment: Supplementary Information

REGION II==

Docket No.: 50-390 License No.: NPF-90 Report No.: 05000390/2013011 Licensee: Tennessee Valley Authority (TVA)

Facility: Watts Bar Nuclear Plant, Unit 1 Location: Spring City, TN 37381 Dates: December 9, 2013, through December 20, 2013 Inspectors: S. Sandal, Senior Project Engineer, Lead Inspector J. Heisserer, Senior Construction Inspector (Section 4OA5)

R. Monk, Senior Resident Inspector W. Deschaine, Resident Inspector J. Heath, Resident Inspector L. Pressley, Resident Inspector Approved by: Jonathan H. Bartley, Chief Reactor Projects Branch 6 Division of Reactor Projects Enclosure

SUMMARY

Inspection Report (IR) 05000390/2013011; 12/09/2013 - 12/20/2013; Watts Bar Nuclear Plant,

Unit 1; Supplemental Inspection - Inspection Procedure (IP) 95002, Follow-up Inspection - IP 92702 This supplemental inspection was conducted by two regional inspectors, a senior resident inspector, and three resident inspectors. The inspectors identified one finding having very low (green) safety significance. The significance of most findings is identified by their color (Green,

White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, (SDP), dated June 2, 2011. Cross-cutting aspects are determined using IMC 0310,

Components Within the Cross-Cutting Areas, dated October 28, 2011. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

The NRC staff performed this supplemental inspection in accordance with IP 95002,

Supplemental Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area, to assess the licensees evaluations associated with a white inspection finding involving the failure to properly establish an adequate abnormal operating instruction to mitigate the impact of a probable maximum flood that could overtop upstream dams. The NRC staff previously characterized this issue as having low to moderate safety significance (white), as documented in NRC IR 05000390/2013009 (ADAMS Accession No.

ML13155A572). Additionally, this supplemental inspection assessed the licensees evaluations associated with a yellow inspection finding involving the failure to properly maintain an adequate abnormal operating instruction to implement the flood mitigation strategy following notification of a significant flooding event. The NRC staff previously characterized this issue as having substantial safety significance (yellow), as documented in NRC IR 05000390/2013009 (ADAMS Accession No. ML13155A572).

During this supplemental inspection, the inspectors determined that the licensee performed a comprehensive evaluation of both findings. The inspectors determined that the licensee conducted a comprehensive extent of condition and extent of cause review that sufficiently identified relevant areas for both findings. The licensees evaluation of the inadequate abnormal condition instruction identified two root causes. The first root cause was overconfidence in the accuracy of the Simulated Open Channel Hydraulics model and calculation processes which resulted in unrecognized inaccuracies in the probable maximum flood (PMF) calculations. The second root cause was TVA Nuclear managements failure to provide effective oversight of changes to the river system and to apply safety-significant conservative decision-making for those changes affecting nuclear site PMF calculations, which demonstrated that nuclear safety during flooding conditions was not the overriding priority. The inspectors determined the licensees corrective actions were thorough and should prevent recurrence. Corrective actions included the development of a Flood Protection Program within the corporate nuclear engineering organization, the development of various implementing procedures to control the management of the Flood Protection Program, and the development of formal Flood Protection Program design standards and guides to control the calculation process.

The licensees evaluation identified a primary root cause for the failure to maintain an adequate abnormal operating instruction to implement the flood mitigation strategy following notification of a significant flooding event. The root cause was that Watts Bar management personnel had failed to identify the aggregate impact of issues with the stations ability to implement the flood mode protection plan. This resulted in the failure to exercise conservative decision making with respect to those issues. The inspectors determined the licensees corrective actions were thorough and should prevent recurrence. Corrective actions included performing periodic walkdown assessments of implementing maintenance instructions used to reconfigure systems to mitigate the consequences of a design basis flood event, and development of a Flood Protection Program, as described in the paragraph above.

Given the licensees acceptable performance in addressing the issues that led to the yellow and white findings, these performance issues will only be considered in assessing plant performance for a total of four quarters in accordance with the guidance in IMC 0305, Operating Reactor Assessment Program.

The NRC staff also performed IP 92702, Follow-up on Traditional Enforcement Actions Including Violations, Deviations, Confirmatory Action Letters, Confirmatory Orders, and Alternative Dispute Resolution Confirmatory Orders, to assess the licensees evaluations associated with a failure to report within eight hours an unanalyzed condition that significantly degraded plant safety related to an increase in the postulated probable maximum flood level.

The NRC staff previously characterized this issue as a Severity Level III violation, as documented in NRC IR 05000390/2013009 (ADAMS Accession No. ML13155A572).

Findings:

Green.

The NRC identified a finding for the licensees failure to incorporate fleet inspection monitoring requirements for permanent flood mode structures into the Watts Bar external flood protection program procedure. Specifically, Watts Bar procedure 0-TI-444, External Flood Protection Program, Revision 0, failed to detail the procedures and processes used to track, trend, and maintain key program data related to periodic inspections for permanent flood mode structures. The licensee generated Problem Evaluation Reports (PERs) 824744 and 823305 to address this issue and other observations regarding the Watts Bar flood monitoring plan.

The performance deficiency was more than minor because if left uncorrected it would lead to a more significant safety concern. Specifically, the absence of a site-level monitoring plan in 0-TI-444 to track periodic inspection results of permanent flood mode structures would degrade the licensees ability to detect and correct declining external flood hazard barrier conditions or performance to ensure Watts Bar remained capable of withstanding a probable maximum flood elevation as intended by the external flood protection program. The inspectors concluded the finding was associated with the mitigating systems cornerstone and determined the finding was of very low safety significance (green) because the finding had not resulted in an actual physical degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event. The inspectors concluded the cause of the finding was related to the complete, accurate, and up-to-date procedures cross-cutting aspect in the Resources component of the Human Performance area. Specifically, the licensees implementation of the fleet external flood protection program had not ensured that site procedures and other resources were available to provide complete, accurate, and up-to-date documentation and procedures regarding the treatment of passive flood barriers H.2(c). (Section 4OA4.02.03.f)

REPORT DETAILS

4OA3 Event Follow-up

.01 (Closed) Licensee Event Report (LER) 05000390/2013-001-00, Latent Design Input

Inconsistencies Adversely Affect Probable Maximum Flood Analysis

a. Inspection Scope

On July 28, 2009, TVA identified latent design input inconsistencies in hydrological computer modeling that adversely affected existing PMF analyses. The cumulative effects of these inconsistencies and updated changes predicted potential dam overtopping at Fort Loudon, Cherokee, Watts Bar, and Tellico dams during an assumed PMF event. The potential overtopping and failure of the four dams would result in an increase in PMF levels that exceed the original design and licensing basis elevations at the Watts Bar site. This condition represented an unanalyzed condition. On February 6, 2013, TVA notified the NRC that due to the potential to overtop and fail earthen embankments at the four dams, Watts Bar was in an unanalyzed condition that could have resulted in an increased PMF level. The licensee documented the issue in PER 682212 and performed a root cause evaluation.

The root causes of this event were determined to be an organizational behavior which allowed the latent input inconsistencies to go undetected and management failure to provide oversight of the impact of river system changes on the calculated value of the PMF. The licensees immediate and interim corrective actions included the development of temporary procedures to control flood protection calculations and a review of vendor calculations of current PMF values to determine they were in compliance with current standards. Permanent corrective actions include development of a corporate and site-specific Flood Protection program to ensure design requirements associated with hydrology and external flood protection are continuously met, and to ensure critical nuclear safety.

The inspectors reviewed the LER, the licensees root cause evaluation, and corrective action documents to verify the accuracy of the LER and that corrective actions were identified and implemented to address the issue. This LER is closed.

b. Findings

See Inspection Report 05000390/2012009 (ADAMS Accession No. ML13071A298) and Inspection Report 05000390/2013009 (ADAMS Accession No. ML13155A572) for regulatory issues associated with this LER.

4OA4 Supplemental Inspection

.01 Inspection Scope

The NRC staff performed this supplemental inspection in accordance with IP 95002 to assess the licensees evaluation of one yellow finding and one white finding, which affected the mitigating systems cornerstone in the reactor safety strategic performance area. The inspection objectives were to:

provide assurance that the root and contributing causes of risk-significant performance issues were understood, independently assess and provide assurance that the extent of condition and the extent of cause of risk-significant performance issues were identified, independently determine if safety culture components caused or significantly contributed to the risk significant performance issues, and provide assurance that the licensees corrective actions for risk-significant performance issues were sufficient to address the root and contributing causes and to prevent recurrence.

The licensee entered the Degraded Cornerstone Column of the NRCs Action Matrix in the first quarter of 2013 as a result of one inspection finding of substantial safety significance (yellow) and one finding of low to moderate safety significance (white). The yellow finding was associated with the failure to maintain an adequate abnormal operating instruction (AOI) to implement the Watts Bar flood mitigation strategy prior to the onset of PMF conditions onsite. The PMF is the flood that may be expected from the most severe combination of critical meteorological and hydrologic conditions that are reasonably possible in a particular drainage area. Specifically, AOI-7.01, Maximum Probable Flood, Revision 21, had not been maintained to ensure implementation within 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> following a notification of a significant flooding event. As a result, the licensees flood mitigation strategy for certain design basis flooding events, including PMF events, was inadequate. The finding was initially described in NRC IR 05000390/2012009 (ADAMS Accession No. ML13071A298).

The white finding was associated with the failure to establish an adequate AOI to mitigate the effects of a PMF onsite. Specifically, AOI-7.01 was inadequate to mitigate the effects of a PMF event, in that, prior to September 30, 2009, earthen dams located upstream of the facility could potentially overtop, causing a subsequent breach. Failure of the earthen dams during a PMF event would have resulted in onsite flooding and subsequent submergence of critical equipment, including emergency diesel generators, resulting in an ineffective flood mitigation strategy. As part of the corrective actions, the licensee installed HESCO barriers on the Fort Loudon, Tellico, Watts Bar, and Cherokee dams to raise the effective height of the earthen embankments. The finding was initially described in NRC IR 05000390/2012009 (ADAMS Accession No. ML13071A298).

These findings were characterized as having substantial safety significance (Yellow) and low to moderate safety significance (White) respectively in NRC IR 05000390/2013009 (ADAMS Accession No. ML13155A572).

The licensee staff informed the NRC staff on November 8, 2013, that they were ready for the supplemental inspection. In preparation for the inspection, the licensee performed a root cause analysis (RCA) for each violation and an additional RCA to analyze the violations at both Sequoyah and Watts Bar collectively from a corporate standpoint.

The inspectors reviewed the licensees RCAs in addition to other evaluations conducted in support and as a result of the RCAs. The inspectors reviewed corrective actions that were taken or planned to address the identified causes. The inspectors also held discussions with licensee personnel to ensure that the root and contributing causes and the contribution of safety culture components were understood and corrective actions taken or planned were appropriate to address the causes and prevent recurrence. The inspectors also independently assessed the extent of condition and extent of cause of the identified issues. In addition, the inspectors performed an assessment of whether any safety culture components caused or significantly contributed to the issues.

.02 Evaluation of the Inspection Requirements

02.01 Problem Identification a. IP 95002 requires that the inspection staff determine that the evaluation documented who identified the issue (i.e., licensee-identified, self-revealing, or NRC-identified) and under what conditions the issue was identified.

i. Technical Specification (T.S.) 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The NRC identified the licensee would not have been able to perform timely implementation of AOI-7.01, Maximum Probable Flood, consistent with Technical Requirements Manual (TRM) 3.7.2 as required by T.S. 5.7.1. The NRC identified this issue during demonstrations conducted in response to the Fukushima event from August to September 2012. The inspectors verified that the licensee recognized that this issue was NRC-identified and was appropriately documented within the RCA. The root cause recognized the failure to self-identify the issue and exercise conservative decision making when questioning assumptions related to AOI-7.01.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

On July 28, 2009, the licensee identified the potential to overtop Ft. Loudoun Dam and fail its earthen embankment during evaluations performed in response to an NRC Notice of Violation (NOV) of Bellefonte Units 3 and 4 Combined Operating License Application (COLA). Similar conditions were subsequently identified at Cherokee, Tellico, and Watts Bar Dams. The overtopping and failure of the specified earthen embankments could have resulted in an increase in the PMF level at the Watts Bar, Sequoyah, and Browns Ferry Nuclear Plants. The result was that existing flood mitigation processes and procedures were inadequate to protect critical safety systems from the additional flood elevation. Watts Bar PER 740702 was initiated to document the white finding that involved the failure to properly establish an adequate abnormal operating procedure to mitigate the impact of a PMF. The abnormal operating procedures and processes were not adequate because they were established for lower PMFs. Deficiencies in the modeling of PMF, primarily associated with design inputs, resulted in the potential for overtopping of the earthen embankments at the Cherokee, Fort Loudoun, Tellico, and Watts Bar dams. The inspectors verified that this information was documented in the licensees RCA. The inspectors verified that the licensee recognized that this issue was NRC-identified and was appropriately documented within the RCA.

b. IP 95002 requires that the inspection staff determine that the evaluation documented how long the issue existed and prior opportunities for identification.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensees RCA documented that the ability to implement the flood mitigation strategy within the required time had never been verified and the condition had presumably existed since initial plant startup. The licensee determined that previous opportunities for identification had occurred. Pre-operational testing, Quality Assurance reviews, self-assessments and previous NRC inspections had identified issues with implementation of the flood mitigation strategy. The inspectors determined the licensee had adequately documented how long the issue existed and prior missed opportunities for identification.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The licensees RCA documented that the failure to properly establish an adequate abnormal operating procedure to mitigate the impact of a PMF had existed since initial design, construction, and licensing of the plant. The hydrology software and model used to license the TVA nuclear stations was originally developed in the 1960s to late 1970s.

The licensee determined that prior opportunities for identification of the error existed over the years, but due to overconfidence in the accuracy of the Simulated Open Channel Hydraulics (SOCH) model and calculation processes, the unrecognized inaccuracies in the nuclear site PMF calculations were not identified until July 28, 2009.

The inspectors determined that the licensees evaluation was adequate with respect to identifying how long the issue existed and prior opportunities for identification.

c. IP 95002 requires that the inspection staff determine that the evaluation documented the plant-specific risk consequences, as applicable, and compliance concerns associated with the issues both individually and collectively.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The inspectors reviewed the licensees risk evaluation as documented in the Safety Consequences section of the RCA for PER 687079. The NRC determined this issue was a yellow finding as documented in IR 05000390/2013009 (ADAMS Accession No.

ML13155A572). In the NRCs evaluation, Significance Determination Process Phase 3 Analysis, WBN-1202.2, the increase in core damage frequency from this event was determined to be greater than or equal to 3.6E-5. The licensees evaluation acknowledged that the failure to implement the flood mitigation strategy would result in loss of safety functions which provided the basis for the yellow finding. The licensee determined that, given the performance issues with implementing the mitigation strategy, a conclusive statement could not be made that any of the actions required by the strategy would have been completed when required. The licensee recognized the consequences of failure to implement the strategy would result in the loss of heat removal capability and inability to provide makeup to the reactor coolant system. The inspectors concluded that the licensee had appropriately documented and recognized both the individual and collective risk consequences and compliance concerns associated with the issue.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The inspectors reviewed the licensees risk evaluation as documented in the Safety Consequences section of the RCA for PER 682212. The licensee determined the annual exceedance probability of the design basis flooding event to be less than 1E-6 for Watts Bar. In the NRCs evaluation, Significance Determination Process Phase 3 Analysis, WBN-1203.4, a precise quantitative estimate of the increase in core damage frequency from this event could not be estimated, but a range of values was determined starting from a lower bound of 8.68E-6. In addition, the RCA for PER 682212 documented the consequences of the issue given the premise that a probable maximum flood had occurred prior to identification of this previously unanalyzed condition. The licensee determined that the event would have made maintenance of core cooling impossible at Watts Bar with the prevailing procedural guidance. The inspectors concluded that the licensee appropriately documented the risk consequences and compliance concerns associated with the issue both individually and collectively.

d. Findings

No findings were identified.

02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation a. IP 95002 requires that the inspection staff determines that the problem was evaluated using a systematic methodology to identify the root and contributing causes.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensee used the following systematic methods to complete the RCA for PER 687079:

Data gathering through interviews and document review Sequence of events timeline construction Events and causal factor charting Hazard barrier-target analysis Management Oversight and Risk Tree (MORT) analysis The inspectors determined that the licensee performed a thorough evaluation of the issue using systematic methodology to identify the root and contributing causes.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The licensee used the following systematic methods to complete the RCA for PER 682212:

Data gathering through interviews and document review Events and causal factor analysis Barrier analysis Change analysis Organizational and programmatic factors evaluation MORT analysis Safety culture evaluation The inspectors determined that the licensee evaluated the issue using a systematic methodology to identify root and contributing causes.

b. IP 95002 requires that the inspection staff determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensees RCA for PER 687079 included an extensive sequence of events and multiple analysis methods in order to evaluate data and draw conclusions. The licensees RCA determined the direct cause of the issue was a failure to maintain as required by procedures; the number of personnel required, and the staging of tools, equipment, and materials for full implementation of flood mode operation in the time required by the TRM. The licensees RCA determined the root cause of the issue was:

Root Cause 1 (RC-1): A failure of station management to exercise conservative decision making to identify the aggregate impact of issues affecting the ability to implement the flood protection plan resulting in the failure to exercise conservative decision making with respect to those issues.

The licensee determined that the contributing causes included:

Contributing Cause 1 (CC-1): The use of unsubstantiated assumptions caused an inability to implement the flood mode operation response to Stage 2 as required by the TRM.

Contributing Cause 2 (CC-2): Failure to thoroughly evaluate through problem identification and resolution resulted in missed opportunities to improve and optimize implementation of flood mode operations.

Contributing Cause 3 (CC-3): Failure to properly train and maintain proficiency on flood mode procedures resulted in unfamiliarity with the actions required for optimization of flood mode operations.

Contributing Cause 4 (CC-4): Over confidence in the stations capabilities to implement flood mode procedures resulted in low priorities placed on any concerns identified with implementation of flood mode operations.

Based upon the extensive work performed for this RCA, the inspectors concluded that the analysis was conducted to a level of detail commensurate with the significance of the problem.

ii. T.S. 5.7.1, White Finding, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The licensees RCA for PER 682212 included an extensive timeline of events and an event and causal factor tree. The licensees RCA documented two root causes:

Root Cause 1 (RC-1): Overconfidence in the accuracy of the SOCH model and calculation processes resulted in unrecognized inaccuracies in the nuclear site PMF calculations. These inaccuracies originated from design input errors present in the SOCH model.

Root Cause 2 (RC-2): TVA Nuclear managements failure to provide effective oversight of changes to the river system and to apply safety-significant conservative decision-making for those changes affecting nuclear site PMF calculations demonstrated that nuclear safety during flooding conditions was not the overriding priority.

The licensee determined that the contributing causes included:

Contributing Cause 1 (CC-1): Formal process controls have not been established that ensure the Flood Protection Program protects critical safety systems for the nuclear sites.

Contributing Cause 2 (CC-2): TVA demonstrated less than adequate shared understanding of the applicable regulatory requirements under which the nuclear sites, as integral components of the river system, must operate.

Contributing Cause 3 (CC-3): TVA incorrectly assumed that the corrective actions identified in the root cause and apparent cause evaluations for the Bellefonte COLA shortfalls were completed as written.

Based on the extensive work performed for this RCA, the inspectors concluded that the analysis was conducted to a level of detail commensurate with the significance of the problem.

c. IP 95002 requires that the inspection staff determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience (OE).

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensees RCA for PER 687079 included an evaluation of previous similar events.

The licensee researched and reviewed both external and internal OE and concluded that external OE would not have prevented this issue. However, the licensee did conclude that internal OE had provided earlier opportunities for follow-up and could have either prevented or identified this issue. The licensee initiated PER 703321 to enter this issue into the corrective action program. Based on the licensees detailed evaluation and conclusions, the inspectors determined that the licensees RCA included a consideration of prior occurrences of the issue and knowledge of OE.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The licensees RCA for PER 682212 included an evaluation of internal and external OE.

During validation of the hydrology model in response to the Bellefonte NOV, and after TVA realized that there were errors in the SOCH model inputs, PER 201568 was written on September 11, 2009, and an RCA was performed. In addition, on April 29, 2010, an Apparent Cause Evaluation (ACE) documented in PER 227488 was performed and included a comprehensive review of operating experience relative to the maintenance of quality software.

The root cause identified in PER 201586 was the failure to establish a PMF procedure or process which could be used to train River Operations personnel on how to perform, revise, and maintain accurate PMF calculations. Because there was no procedure or process, there was also no requirement to consider the effects of changes in the TVA River System on PMF calculations. The root cause of this event was organizational and programmatic deficiencies caused by organizational breakdowns and inadequate communication within and between River Operations and Nuclear Power Group (NPG).

Contributing causes included inadequate information, inadequate training, unfamiliarity with information availability, misjudgment, wrong assumptions, human errors, and inadequate self-verification processes. The ACE from PER 227488 concluded that this was a recurring event and proposed a single point of contact to ensure that all software used for hydrology met regulatory requirements. TVA-IGA-09.002, TVA Intergroup Agreement (IGA) Nuclear Power Group and River Operations & Renewables, Revision 1, establishes the Manager-NPG Corporate Civil/Mechanical Engineering as responsible for ensuring that all affected organizations comply with the requirements of the Nuclear Quality Assurance Plan.

The licensees RCA concluded that lessons learned from OE identified in RCA PER 201568 and ACE PER 227488 may have resulted in identifying the shortfalls in the hydrologic model SOCH sooner, but would not have prevented this event. Based on the licensees detailed evaluation and conclusions, the inspectors determined that the licensees RCA included a consideration of prior occurrences of the issue (none) and knowledge of OE.

d. IP 95002 requires that the inspection staff determine that the root cause evaluation addresses the extent of condition and the extent of cause of the problem.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensees evaluation of extent of condition assessed the potential for the following condition to exist at Watts Bar:

the potential for requirements (time-related or other) in procedures (abnormal or other) that have not been demonstrated The licensees review considered the population of those procedures that, if not performed, would result in violations of design basis, regulatory requirements, or would result in impact to the health and safety of the public. Those procedures included:

Abnormal Operating Instructions Emergency Operating Instructions Technical Specifications Technical Requirements Offsite Dose Calculation Manual Fire Protection Report / Appendix R Radiological Emergency Plan Procedures Security Response Procedures Additionally, the licensees evaluation of extent of cause assessed the potential for adverse impact to other plant processes, equipment, or human performance. The licensee determined the extent of cause for this issue to be:

the potential to not identify and resolve the aggregate impact of issues important to nuclear safety throughout the Nuclear Power Group The licensees review considered a population of programs throughout NPG to ensure that those programs had well-defined procedures and processes governing their performance and that the programs had established owners.

The inspectors concluded that the licensees RCA addressed the extent of condition and extent of cause through the reviews conducted and the designated corrective actions.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The licensees RCA identified two conditions as part of the review for extent of condition.

Condition 1 was the potential to overtop and fail earthen embankments at the Cherokee, Fort Loudoun, Tellico, and Watts Bar Dams. This was viewed as a physical condition.

Condition 2 was for an indeterminate period, the processes and procedures for calculating, quantifying, and mitigating flood events, up to and including a 100 percent PMF event, have been less than adequate to protect specific plant equipment at Watts Bar. This was viewed as a programmatic condition. The extents of these two conditions are addressed below:

The Extent of Condition 1 was the potential for the failed embankments at the Cherokee, Fort Loudoun, Tellico, Watts Bar, Chickamauga, Nickajack, and Guntersville Dams to have resulted in affecting equipment at Browns Ferry prior to the completion of the compensatory actions described above.

The Extent of Condition 2 was the potential that programmatic weaknesses in the control of PMF calculations and for the configuration of the river system could impact other NPG processes.

The licensee conducted an extent-of-cause review for each identified root and contributing cause. In the evaluation of the extent of the root causes, the licensee concluded that the causes have the potential to result in additional deficiencies and to impact performance in other areas. Below is a summary of the extent of cause for the two root causes identified in the RCA:

The Extent of Cause for Root Cause 1 was the potential for overconfidence in processes of other engineering programs inside and outside of TVA that are important to nuclear safety but not subject to rigorous oversight controls which could have inaccuracies in them.

The Extent of Cause for Root Cause 2 was the potential that existing TVA processes for the consideration of risk in decision-making may not adequately establish nuclear safety as the overriding priority.

The inspectors concluded that the licensees RCA addressed the extent of condition and extent of cause through the reviews conducted and the designated corrective actions.

e. Findings

No findings were identified.

02.03 Corrective Actions a. IP 95002 requires that the inspection staff determine that appropriate corrective actions are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The inspectors reviewed the corrective actions for each root and contributing cause as previously discussed in paragraph 02.02.b.i. Based upon the root cause, the licensee implemented the following corrective actions to prevent recurrence (CAPRs):

Created a detailed timeline and sequence based upon actual walkdowns to be used for reference in accurately implementing AOI-7.01, Maximum Probable Flood.

Revised 0-PI-OPS-19.0, Periodic Assessment of Operations Procedures Related to Natural Disasters, which assesses the procedural guidance of operations procedures. This assessment includes a review and walkdown of five implementing maintenance procedures to verify tools, equipment, permits, and clearances are appropriate and pre-staged for use.

Revised Standard Program and Process (SPP) document NPG-SPP-09.0.6, (originally NEDP-20), Conduct of Engineering Programs, to include a Flood Protection Program within the Corporate Nuclear Engineering organization with the primary function to ensure that critical plant safety systems are protected from flooding conditions.

Develop formal Flood Protection Program implementing procedures to control the following:

o Define the Flood Protection Program policy, to ensure that the nuclear plant critical safety systems are protected from all postulated flooding conditions o Appoint Single-point ownership o Define Roles & Responsibilities o Identify the regulatory requirements o Establish Governance & Oversight expectations for:

River Operations system changes impacting nuclear plant flood protection Dam modifications impacting nuclear plant flood protection Flood warning methodology and procedures Flood calculations Vendor oversight requirements Plant AOP integration with critical hydrology inputs o Periodic benchmarking and self-assessment of the Flood Protection Program o Benchmarking and maintenance of the calculation methodology o Establish training and qualification requirements in accordance with processes o Institute a Flood Protection Change Control Board process o Implement a Program Health Report for Flood Protection Revise NPG-SPP-01.4, Governance, Oversight, Execution and Support Program, to perform a biennial assessment on programs and processes that are important to nuclear safety.

In addition to corrective actions associated with the root cause, the licensee implemented multiple corrective actions to address the contributing causes. The majority of these corrective actions associated with the contributing causes overlapped or coincided with the corrective actions from the CAPRs, or in some cases, other RCAs.

The inspectors reviewed the following significant corrective actions:

Created a detailed listing of tools and equipment required for implementing each Maintenance Instruction (MI-17 Series) for flood preparation and establish routine inspection and inventory requirements.

Provided clear guidance in AOI-7.01 to aid in organization response, which included clear direction to Outage Control Center staff, manpower requirements and references to critical path activities.

Develop, perform, or revise flood mode training as necessary across various departments.

Additionally, the resident inspectors observed a detailed plant exercise of AOI-7.01, Maximum Probable Flood. This included staffing of the Central Emergency Control Center in Chattanooga, the Technical Support Center, a mock control room, and the Operations Support Center. Using appropriate time compression, the licensee demonstrated to a plausible degree that changes incorporated into AOI-7.01 were adequate to accomplish the complex activities to place the plant into the flood mode configuration to protect the reactor core during a design basis PMF within the required 27 hour3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> time line.

The inspectors concluded that the proposed and implemented corrective actions were appropriate and addressed each root and contributing cause.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The inspectors found that a systematic methodology, and evaluation level of detail, identified appropriate corrective actions for the root and contributing causes as previously discussed in paragraph 02.02.b.ii. In addition, the reviews for extent of condition and extent of cause resulted in additional corrective actions being developed, or additional analysis to determine if appropriate corrective actions existed. Below are the corrective actions the licensee developed to prevent reoccurrence:

CAPR 682212-003 addressed RC-1 and CC-1 by revising the Conduct of the Engineering Organization procedure (currently NPG-SPP-09.06), to include a Flood Protection Program within the Corporate Nuclear Engineering Organization with the primary function to ensure that the nuclear plant critical safety systems are protected from all postulated flooding conditions.

CAPR 682212-004 addressed RC-1, CC-1, and CC-2 by developing formal Flood Protection Program Management Implementing Procedures to:

Define the Flood Protection Program policy, To ensure that the nuclear plant critical safety systems are protected from all postulated flooding conditions.

Appoint Single-point ownership Define Roles & Responsibilities Identify the nuclear regulatory requirements Establish Governance & Oversight expectations for:

o River Operations river system changes impacting nuclear plant flood protection o Dam modifications impacting nuclear plant flood protection o Flood warning methodology and procedures o Flood calculations o Vendor oversight requirements o Plant AOP integration with critical hydrology inputs Periodic benchmarking and self-assessment of the Flood Protection Program Benchmarking and maintenance of the calculation methodology Establish training and qualification requirements in accordance with the SAT process Institute a Flood Protection Change Control Board process Implement a Program Health Report for Flood Protection CAPR 682212-005 addressed RC-1, CC-1, and CC-2 by developing formal Flood Protection Program Design Standard(s) or Design Guide(s) in accordance with NEDP-6, to control the flood protection calculation process.

CAPR 682212-010 addressed RC-1, RC-2, and CC-1 by creating a formal documented risk management process for all engineering products, informed by INPO 12-008, Excellence in Integrated Risk Management, which includes flood-related issues to evaluate:

River system operation changes Nuclear plant design changes Design input changes Procedure changes impacting flood protection Environmental/NEPA Project Management CA 682212-013 addressed CC-1, CC-2, and CC-3 by revising the TVA Nuclear corrective action program process/procedure to include review on Non-Nuclear Level A and B PERs for potential impact to Nuclear. Impacts that should be considered include:

nuclear safety, radiological safety, industrial safety, regulatory interest, operability, and reportability.

The inspectors concluded that the proposed and implemented corrective actions were appropriate and addressed each root and contributing cause.

b. IP 95002 requires that the inspection staff determine that the corrective actions have been prioritized with consideration of risk significance and regulatory compliance.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensees immediate corrective actions were to incorporate the lessons learned from the reasonable simulation of AOI-7.01, Maximum Probable Flood, and MI-17 series maintenance instructions for flood preparation procedures in order to restore compliance with the requirements of the TRM. The licensee restored full compliance on November 15, 2012, when flood-related maintenance instructions and AOI-7.01 were revised to incorporate lessons learned from the August through September 2012 reasonable simulations of AOI-7-01.

Other follow-up corrective actions identified in the RCA and sampled for inspection were related to the licensees ability to ensure that the corrective actions remain effective and to self-assess the capability to effectively implement the flood mode protection strategy.

Inspectors noted that the CAPRs were complete and associated corrective actions were assigned proper due dates commensurate with their safety significance. The inspectors reviewed the licensees plans for accomplishing these activities and noted that the licensee prioritized corrective actions with consideration of risk significance and regulatory compliance.

.ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The licensees immediate corrective actions were to install a compensatory measure, HESCO barriers, to prevent the earthen embankments of the dams upriver from the nuclear sites from overtopping. The inspectors walked these HESCO barriers down to verify that they were adequate. The inspectors observed the storage locations and quantities of spare HESCO barriers and filler material, and reviewed the associated procedures. In December 2012, the resident inspectors observed the licensees conduct of exercises to set up the HESCO barriers and fill them with filler material to demonstrate that timeline estimates were adequate. This exercise was performed to demonstrate the timeline estimates for filling gaps in the existing HESCO barriers were adequate.

Based upon the corrective actions listed in the previous section (02.03.a.2), as well as the other corrective actions identified in the RCA and sampled for inspection, the inspectors determined that the licensee prioritized corrective actions with consideration of risk significance and regulatory compliance.

The inspectors reviewed the licensees plans for accomplishing the corrective actions and noted that the risk significance was being appropriately considered.

c. IP 95002 requires that the inspection staff determine that a schedule has been established for implementing and completing the corrective actions.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The inspectors reviewed the corrective actions associated with RCA 687079. The inspectors determined that the licensee had established and followed a reasonable schedule for implementing and completing the corrective actions. All CAPRs and significant corrective actions associated with RCA 687079 were considered complete at the time of the inspection.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The inspectors determined that the licensee established a schedule for implementing and completing corrective actions. All corrective actions to RCA PER 682212, which included six CAPRs, were wither completed or scheduled at the time of the inspection.

The inspectors identified a performance deficiency associated with the implementation of the external flood protection program procedure at Watts Bar. During a review of corrective actions to prevent reoccurrence, CAPR 682212-004 required TVA NPG to develop a formal Flood Protection Program to ensure that all flood-related requirements and operating conditions were maintained within the specified design, licensing, and regulatory requirements for each TVA nuclear site. The licensee completed this corrective action by issuing corporate procedure NPG-SPP-09.22 External Flood Protection Program, Revision 0.

The inspectors reviewed procedure 0-TI-444 External Flood Protection Program, Revision 0, which implemented the Watts Bar site-specific requirements for the external flood protection program in accordance with corporate procedure NPG-SPP-09.22.

Procedure 0-TI-444 detailed the procedures and processes used to monitor, maintain, and update external flood protection as required for the Watts Bar site. The inspectors determined that the licensee failed to incorporate inspection criteria and monitoring requirements for permanent flood protection structures into the site-specific external flood protection program procedure 0-TI-444, as specified by NPG-SPP-09.22. This issue is further discussed in section 02.03.f of this report.

d. IP 95002 requires that the inspection staff determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The inspectors reviewed multiple quantitative and qualitative measures that the licensee established for determining the effectiveness of the CAPRs for the root and contributing causes. The inspectors verified the licensee had developed a corrective action plan that included the performance of self-assessments to evaluate the effectiveness of the corrective actions. The self-assessment attributes included success criteria and reasonable timeliness goals which were clearly listed in the RCA for each corrective action. The inspectors concluded that reasonable quantitative and qualitative measures of success had been developed for determining the effectiveness of the corrective actions to prevent recurrence.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

As documented in the licensees RCA, quantitative and qualitative measures were established for determining the effectiveness of the corrective actions. The licensee also plans to perform a self-assessment for each corrective action. The assessment method attributes, success criteria, and timeliness are clearly listed in the RCA for each corrective action.

The inspectors determined that quantitative and qualitative measures of success had been developed for determining the effectiveness of the corrective actions to prevent recurrence.

e. IP 95002 requires that the inspection staff determine that the corrective actions planned or taken adequately address a Notice of Violation (NOV) that was the basis for the supplemental inspection.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The NRC issued an NOV to the licensee on June 4, 2013. The licensee provided the NRC a written response to the NOV on July 3, 2013. The licensees response described: 1) corrective steps which have been taken and the results achieved; 2) corrective steps which will be taken; 3) the date when full compliance will be achieved; and 4) the reasons for the violation. During this inspection, the inspectors confirmed that the licensees RCA and planned and taken corrective actions addressed the NOV. The licensee restored full compliance on November 15, 2012, when flood-related Maintenance Instructions and AOI-7.01 were revised to incorporate lessons learned from the August through September 2012 reasonable simulations of AOI-7-01.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The NRC issued an NOV to the licensee on June 4, 2013. The licensee provided the NRC a written response to the NOV on July 3, 2013. The licensees response described: 1) corrective steps which have been taken and the results achieved; 2) corrective steps which will be taken; 3) the date when full compliance will be achieved; and 4) the reasons for the violation. During this inspection, the inspectors confirmed that the licensees RCA and planned and taken corrective actions addressed the NOV. The licensee completed actions to ensure the adequacy of the Watts Bar abnormal condition procedure for flood mitigation on December 30, 2009, by completing installation of the HESCO barriers which raised the effective height of the earthen embankments and completing the post-HESCO PMF calculation for Watts Bar. The inspectors also noted that the licensee had submitted a license amendment request to the NRC regarding changes to the Watts Bar flood mitigation strategy.

f. Findings

Introduction:

An NRC-identified a green finding was identified for the licensees failure to incorporate fleet inspection monitoring requirements for permanent flood mode structures into the Watts Bar external flood protection program procedure. Specifically, Watts Bar procedure 0-TI-444, External Flood Protection Program, failed to detail the procedures and processes used to track, trend, and maintain key program data related to periodic inspections for permanent flood mode structures.

Description:

Standard Program and Process (SPP) document NPG-SPP-09.22, External Flood Protection Program, was the upper-tier corporate document that established fleet-wide external flood protection program requirements. NPG-SPP-09.22, in part, required each TVA NPG site to develop and maintain an external flood protection monitoring plan to track key program data which included:

Periodic inspection results for flood mode equipment, Periodic inspections results for permanent flood mode structures, Periodic flood mode simulation/demonstration results, and Hydrologic and External Flood-related corrective action program issues and needed improvements.

Procedure 0-TI-444 was the site level external flood protection monitoring plan for Watts Bar which implemented site-specific requirements for the external flood protection program in accordance with NPG-SPP-09.22.

The inspectors reviewed procedure 0-TI-444 and determined that the procedure did not incorporate key program elements related to flood protection into the site-specific monitoring plan in accordance with procedure NPG-SPP-09.22. Specifically, the inspectors identified that the licensees monitoring plan did not detail the inspection monitoring requirements for permanent flood mode structures. The inspectors noted that 0-TI-444 applied to external flood hazard barriers which included passive protection features to mitigate leakage of water with minimum cumulative seepage to ensure plant flood mode equipment remained operable during a design basis flood. External flood hazard barriers included the essential raw cooling water structure, electrical, mechanical, and instrumentation and control penetration seals, doors, and plugs. However, Watts Bar procedure 0-TI-444 did not define the periodic inspection monitoring requirements for external flood hazard barriers as they applied to the permanent flood mode structures within the site-level external flood protection program.

The licensee generated PERs 824744 and 823305 to address this issue and other observations regarding the Watts Bar flood monitoring plan. The licensees proposed corrective actions included revising procedure 0-TI-444 to align with the required program elements of NPG-SPP-09.22 by specifying within the flood protection plan how procedures and processes used for external flood protection are monitored, and clarifying program owner requirements for monitoring activities that implement the flood protection program.

Analysis:

The inspectors determined that the licensees failure to implement a site-level monitoring plan to track periodic inspection results for permanent flood mode structures was a performance deficiency. The performance deficiency was more than minor because if left uncorrected it would lead to a more significant safety concern.

Specifically, the absence of a site-level monitoring plan in 0-TI-444 to track periodic inspection results of permanent flood mode structures would degrade the licensees ability to detect and correct declining external flood hazard barrier conditions or performance to ensure Watts Bar remained capable of withstanding a probable maximum flood elevation as intended by the external flood protection program described in NPG-SPP-09.22.

Using Table 2 of IMC 0609.04, Significance Determination Process (SDP) Initial Characterization of Findings dated June 19, 2012; the inspectors concluded the finding was associated with the mitigating systems cornerstone. The inspectors evaluated the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, dated June 19, 2012. The inspectors determined the finding was of very low safety significance (green) because the finding had not resulted in an actual physical degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event. The inspectors concluded the cause of the finding was related to the complete, accurate, and up-to-date procedures cross-cutting aspect in the Resources component of the Human Performance area. Specifically, the licensees implementation of the fleet external flood protection program had not ensured that site procedures and other resources were available to provide complete, accurate, and up-to-date documentation and procedures regarding the treatment of passive flood barriers H.2(c).

Enforcement:

This finding does not involve enforcement action because no violation of a regulatory requirement was identified. Because this finding did not involve a violation and was of very low safety significance, it is identified as Finding (FIN)05000390/2013011-01, Failure to Implement Monitoring Plan for Permanent Flood Mode Structures.

02.04 Independent Assessment of Extent of Condition and Extent of Cause

a. Inspection Scope

IP 95002 requires that the inspection staff perform a focused inspection to independently assess the validity of the licensees conclusions regarding the extent of condition and extent of cause of the issues. The objective of this requirement is to independently sample performance, as necessary, within the key attributes of the cornerstone that are related to the subject performance issues to ensure that the licensees evaluation regarding the extent of condition and extent of cause is sufficiently comprehensive.

i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The inspectors conducted independent extent of condition and extent of cause reviews of the issues associated with the yellow finding and associated licensee root cause evaluation reports. Licensee root cause report for PER 687079 revealed that Watts Bar management had failed to aggregate the impact of issues related to the stations ability to implement the flood mode protection plan. This resulted in the licensees failure to exercise conservative decision making with respect to those issues. Additionally, the licensee had not questioned the assumptions for flood mode protection plan success or the need to validate AOI-7.01, Maximum Probable Flood. The review focused on the primary root causes and contributing causes that involved more specific aspects of the broader root causes.

The inspectors assessed whether the licensees extent of condition and extent of cause evaluations sufficiently identified and bounded other potential existing conditions that could adversely affect other plant systems, structures, and components (SSCs), plant processes, or human performance. The inspectors assessed whether the licensees evaluations were intrusive enough to determine if similar issues existed in other licensee programs. The inspectors independent review focused on other manual operator actions outside of the control room that are necessary to reconfigure plant systems to mitigate the consequences of events. The inspectors reviewed manual operator actions to align nitrogen to the steam generator power-operated relief valves in the event of a fire and manual operator actions necessary to realign emergency direct current loads during a station blackout event. Additionally, the inspectors reviewed the licensees implementing procedures for periodic validation of time critical manual operator actions as well as the licensees corrective action plans associated with the documentation of those validations.

In conducting this independent review, the inspectors interviewed station management and engineering personnel, reviewed program and process documentation, and reviewed existing station program monitoring and improving efforts, including a review of corrective action documents and implementing procedures. The inspectors also performed walkdowns in the plant to verify that the operator actions were reasonable for the plant configuration and operating conditions. Based on the root and contributing causes identified by the licensee, the inspectors focused on the following key attributes of the mitigating system cornerstone to determine if the licensee adequately considered the attributes in their causal analysis:

Design control Configuration control Equipment performance Procedure quality ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The inspectors conducted independent extent of condition and extent of cause reviews of the issues associated with the white finding and associated licensee root cause evaluation reports. Licensee root cause report for PER 682212 revealed TVA over-confidence in their flood model analysis, a lack of formal TVA process controls for flood protection, a lack of understanding of regulatory reporting requirements, and inadequate corrective action closure practices within TVA. The review focused on the primary root causes and contributing causes that involved more specific aspects of the broader root causes.

The inspectors assessed whether the licensees extent of condition and extent of cause evaluations sufficiently identified and bounded other potential existing conditions that could adversely affect other plant SSCs, plant processes, or human performance. The inspectors assessed whether the licensees evaluations were intrusive enough to determine if similar issues existed in other licensee programs. The inspectors focused their review on other external event initiators including design features associated with tornado high wind protection for the emergency core cooling system, emergency diesel generators, and safety-related cooling water systems. Additionally, the inspectors performed a review of the licensees evaluation of upstream gravity dam stability at the higher PMF levels as well as planned modifications to those structures.

In conducting this independent review, the inspectors interviewed station management and engineering personnel, reviewed program and process documentation, and reviewed existing station program monitoring and improvement efforts, including a review of corrective action documents and implementing procedures. The inspectors also performed walkdowns in the plant to verify that equipment configuration in the plant was consistent with the design and equipment performance basis. Based on the root and contributing causes identified by the licensee, the inspectors focused on the following key attributes of the mitigating system cornerstone to determine if the licensee adequately considered the attributes in their causal analysis:

Design control Configuration control Equipment performance Procedure quality b. Assessment i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The inspectors determined that the licensee conducted a comprehensive extent of condition and extent of cause review that sufficiently identified relevant areas for the yellow finding associated with PER 687079. The inspectors did not identify any substantive extent of condition and extent of cause issues that the licensee was not aware of and had not already identified with corrective action plans in place.

The inspectors found the corrective actions taken or planned by the licensee were adequate in addressing the causes of the licensees failure to maintain the capability of implementing the flood mode protection plan at Watts Bar within 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> (yellow finding) and should help address any additional issues similar to the shortfalls identified in the root cause analysis report. The inspectors verified that the licensees extent of condition and extent of cause reviews were not limited only to those operator actions associated with Abnormal Operating Instructions, but were sufficiently broad enough in scope to include other operator actions specified by Emergency Operating Instructions, Technical Specifications, and the Technical Requirements Manual. The inspectors confirmed that the licensee had considered the need to have a well-defined and established process for identifying and validating the capability of performing time critical operator actions that extended beyond flooding events. The inspectors determined that the licensee had a program for identifying and validating time critical operator actions.

Additionally, the inspectors noted that the licensee had corrective action plans in place to document the basis for those operator actions as well as the completion of validations that provide assurance that the actions can be completed within the required timeframes. The inspectors independent review of selected operator actions used for realigning plant systems in response to a fire or station blackout event did not identify similar shortcomings to the issues that resulted in the yellow finding.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

The inspectors determined that the licensee conducted a comprehensive extent of condition and extent of cause review that sufficiently identified relevant areas for the white finding associated with PER 682212. The inspectors did not identify any substantive extent of condition and extent of cause issues that the licensee was not aware of and had not already identified with corrective action plans in place.

The inspectors found the corrective actions taken or planned by the licensee were adequate in addressing the causes of the licensees failure to implement an adequate abnormal operating instruction to mitigate the consequences of a PMF event at Watts Bar (white finding) and should help address any additional issues similar to the shortfalls identified in the root cause analysis report. The inspectors verified that the licensees extent of condition and extent of cause reviews were not limited only to the impact that this condition had at the Watts Bar site, but that the licensees review was sufficiently broad enough in scope to include the potential impact this condition could have at other licensee facilities. The inspectors noted that the licensee had a corrective action plan in place to evaluate the potential impact of this condition at the Browns Ferry site. The inspectors confirmed that the licensee had considered the need to have a well-defined and established process for rigorous oversight and review of engineering products supplied to the licensee by outside organizations and that the licensees evaluation extended beyond those products provided by River Operations. The inspectors performed a review of the licensees evaluation of upstream gravity dam stability at the higher PMF elevations as well as planned future modifications to those structures. The inspectors confirmed that the licensees evaluation was sufficiently broad enough in scope to include other programs and processes important to nuclear safety that are both internal and external to the nuclear organization and that the licensees review was not limited solely to River Operations. Additionally, the inspectors reviewed design features at Watts Bar that mitigate the consequences of a site tornado event. The inspectors independent review of those design features did not identify similar shortcomings to the issues that resulted in the white finding.

c. Findings

No findings were identified.

02.05 Safety Culture Consideration

a. Inspection Scope

IP 95002 requires that the inspection staff perform a focused inspection to independently determine that the root cause evaluation appropriately considered whether any safety culture component caused or significantly contributed to any risk significant performance issue.

The inspection staff reviewed corrective actions documents and procedures and conducted interviews with licensee personnel to determine if the licensee properly considered whether any safety culture component caused or contributed to the issues.

b. Assessment i. T.S. 5.7.1, Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Yellow)

The licensee performed a safety culture evaluation as part of the RCA. In order to appropriately assess the causes for safety culture, the safety culture attributes were utilized during analysis and reviews. When causes and contributors for the failure to implement the flood mitigation strategy were identified they were reviewed for applicability to specific safety culture aspects to ensure corrective actions were appropriately planned to address them. The licensee identified the following key safety culture aspects in their RCA:

that licensee decisions demonstrate that nuclear safety is an overriding priority the licensee ensures that personnel, equipment, procedures, and other resources are available and adequate to assure nuclear safety the licensee ensures that issues potentially impacting nuclear safety are promptly identified, fully evaluated, and that actions are taken to address safety issues in a timely manner, commensurate with their significance the licensee conducts self and independent assessments of their activities and practices, as appropriate, to assess performance and identify areas for improvement the licensee ensures that a learning environment exists The inspectors independently reviewed the licensees actions and concluded that the licensee had appropriately considered safety culture contributions to the issue. For each of the identified safety culture aspects, the inspectors confirmed that the licensee had established corrective actions to address the issues.

Inspectors also performed interviews with licensee personnel. Specific questions were utilized to gauge the condition of the safety conscious work environment (SCWE) to determine if licensee staff were reluctant to raise safety concerns or if retaliation existed for raising safety concerns. The inspectors did not identify concerns related to SCWE.

ii. T.S. 5.7.1, Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (White)

As part of the root cause evaluation for the issue, the licensee evaluated the identified root and contributing causes against the safety culture components that could have contributed to the issues. The licensees root cause evaluation included a discussion of the 13 safety culture components described in Regulatory Issue Summary 2006-013, Information on the Changes Made to the Reactor Oversight Process to More Fully Address Safety Culture, dated July 31, 2006, (ADAMS Accession No. ML061880341)as they applied to the white finding affecting the mitigating systems cornerstone. The licensee identified several key safety culture areas in their RCA. They included:

failure to address risk during decisions that were made affecting the PMF calculations for the nuclear sites, and oversight of River Operations and NPG working together on river level and dam changes that affected the nuclear sites The inspectors independently confirmed that a number of other safety culture components that contributed to the issue were also identified in the RCA. These additional safety culture components included weaknesses in the corrective action program and self-assessments. For each of the identified prevalent and contributing safety culture components, the inspectors confirmed that the licensee established corrective actions to address the issues. During the course of interviews with licensee personnel, the inspectors asked interviewees questions related to SCWE to determine if licensee staff were reluctant to raise safety concerns or if retaliation existed for raising safety concerns. The inspectors did not identify concerns related to SCWE.

c. Findings

No findings were identified.

02.06 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues For both findings, the licensee requested credit for self-identification of an old design issue during the Regulatory Conference conducted on April 22, 2013, as noted in the public meeting summary (ADAMS Accession No. ML13115A020). The NRC evaluated these issues against the IMC 0305 criteria for treatment of an old design issue in IR 05000390/2013009 (ADAMS Accession No. ML13155A572) and determined that the findings would not be treated as old design issues.

4OA5 Other Activities

.01 Follow-up on Traditional Enforcement Actions Including Violations, Deviations,

Confirmatory Action Letters, Confirmatory Orders, and Alternative Dispute Resolution Confirmatory Orders (92702)

a. Inspection Scope

In accordance with IP 92702, the inspectors conducted a follow-up inspection of enforcement action EA-13-018, which was a Severity Level III violation of 10 CFR 50.72(b)(3)(ii)(B), for the licensees failure to report within eight hours an unanalyzed condition that significantly degraded plant safety related to an increase in the postulated PMF level.

This issue was documented as an NOV in inspection report 05000390/2013009 (ADAMS Accession No. ML13155A572). The inspectors reviewed TVAs response dated July 3, 2013, (ADAMS Accession No. ML13192A033) to determine whether the stated corrective and preventative actions were timely and appropriate. The inspectors evaluated whether the response described the conduct of a root cause analysis and implementation of appropriate changes in training and procedures. The inspectors assessed whether generic implications were addressed and whether the licensee programs and practices have been enhanced to prevent recurrence.

The inspectors reviewed PER 682202 and the associated RCA to determine whether:

1) TVA management assigned responsibility for implementing corrective actions, including changes in procedures and practices; 2) corrective actions have been fully implemented; 3) the RCA was adequate to address the deficiency and prevent recurrence; and 4) the generic implications identified were adequate.

TVAs response to the NOV included a discussion of the root causes for the failure to report the unanalyzed condition related to PMF. The reasons for the violation described in the response included a cultural bias within the corporate NPG towards not reporting events and conditions when the consequences were uncertain and not analyzed, procedural inadequacies, and a weak understanding of unanalyzed conditions and the relationship to reportability. The corrective actions described in the response include making a notification to the NRC on February 6, 2013 (Emergency Notification Report 48723), the development of a structured oversight program to assess reportability decisions, and procedural and training revisions.

The inspectors reviewed the licensees changes to various implementing procedures to verify the inclusion of appropriate guidance from NUREG-1022, Event Reporting Guidelines: 10 CFR 50.72 and 50.73, dated January 2013, and other sources. The inspectors also reviewed updates to training plans to verify that the appropriate emphasis on reportability was incorporated. The inspectors observed a portion of a training session that used the violation as a case study. The inspectors interviewed individuals from TVA corporate and Watts Bar licensing and operations personnel to understand how corrective actions taken address the cultural bias toward not reporting events and conditions if the consequences were uncertain.

b. Findings

No findings were identified.

The inspectors concluded that the corrective actions implemented by TVA were adequate. In addition, the inspectors concluded that the root causes of the violation were identified, that generic implications have been addressed, and that the licensees programs and practices have been appropriately enhanced to prevent recurrence.

4OA6 Exit Meeting

On December 20, 2013, the inspectors presented the inspection results to Mr. Timothy Cleary, Watts Bar Site Vice President, and other members of the licensees staff, who acknowledged the finding. The inspectors verified no proprietary information was reviewed or documented in the report.

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

T. Cleary, Vice President, Watts Bar

K. Dutton, 95002 Project Manager, TVA Corporate

D. Gronek, Plant Manager, Watts Bar

J. ODell, Watts Bar Licensing

A. Robinson, Senior Manager Engineering Programs, TVA Corporate

P. Selman, Program Manager, Nuclear Design Engineering, TVA Corporate

W. Sprinkle, Operations, Watts Bar

R. Stroud, Watts Bar Licensing Manager

D. Viscusie, Watts Bar 95002 Site Lead

NRC Personnel

B. Monk, Senior Resident Inspector

LIST OF REPORT ITEMS

Open and

Closed

05000390/2013011-01 FIN Failure to Implement Monitoring Plan for Permanent Flood Mode Structures (Section 4OA4.02.03.f)

Closed

05000390/2012009-01 VIO Inadequate Abnormal Condition Procedure for Flood Mitigation Strategy Prior to Installation of HESCO Barriers (Section 4OA4)

05000390/2012009-02 VIO Failure to Report Unanalyzed Condition Related to External Flooding (Section 4OA5)

05000390/2012009-03 VIO Failure to Maintain an Adequate Abnormal Condition Procedure to Implement the Flood Mitigation Strategy (Section 4OA4)

05000390/2013-001-00 LER Latent Design Input Inconsistencies Adversely Affect Probable Maximum Flood Analysis (Section 4OA3)