IR 05000458/2012010

IR 05000458-12-010; 9/17/2012 - 9/21/2012; River Bend Station; Augmented Inspection Team Follow-up; Operability Evaluations, Identification and Resolution of Problems, Other Activities

ML12328A178
Person / Time
Site:	River Bend
Issue date:	11/23/2012
From:	Kennedy K NRC/RGN-IV/DRP
To:	Olson E Entergy Operations
References
IR-12-010
Download: ML12328A178 (37)

Text

UNITE D S TATE S NUC LEAR RE GULATOR Y C OMMI S SI ON ber 23, 2012

SUBJECT:

RIVER BEND STATION - NRC AUGMENTED INSPECTION TEAM FOLLOW-UP INSPECTION REPORT 05000458/2012010

Dear Mr. Olson:

On September 21, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a follow-up inspection of the unresolved items documented in NRC Augmented Inspection Team Report 05000458/2012009. The augmented inspection team reviewed the circumstances surrounding the May 24, 2012, reactor scram with loss of feedwater, circulating water, and nonsafety-related cooling water. The enclosed report documents the inspection results, which were discussed with you and other members of your staff on October 11, 2012.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Four NRC-identified and four self-revealing findings of very low safety significance (Green) were identified during this inspection. Seven of these findings were determined to involve violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCV)

consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the non-cited violations or their significance, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV, the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at River Bend Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC Resident Inspector at River Bend Station. In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Kriss M. Kennedy, Director Division of Reactor Projects Docket No.: 05000458 License No.: NPF-47 Enclosure: Inspection Report 05000458/2012010 w/ Attachment: Supplemental Information cc w/ encl: Electronic Distribution

SUMMARY OF FINDINGS

IR 05000458/2012010; 9/17/2012 - 9/21/2012; River Bend Station; Augmented Inspection Team

Follow-up; Operability Evaluations, Identification and Resolution of Problems, Other Activities.

As documented in NRC Inspection Report 05000458/2012009, an augmented inspection team was dispatched to the site on May 26, 2012, to assess the facts and circumstances surrounding the loss of normal service water and reactor scram event that occurred on May 24, 2012. The team was established in accordance with NRC Management Directive 8.3, NRC Incident Investigation Program, and implemented using Inspection Procedure 93800, Augmented Inspection Team. The team identified eight unresolved items.

This report documents the follow-up inspection of unresolved items from the augmented inspection team report. The follow-up team was comprised of resident and region-based inspectors. Four NRC-identified and four self-revealing findings of very low safety significance (Green) were identified during this inspection. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. The cross-cutting aspect is determined using Inspection Manual Chapter 0310, Components Within the Cross-Cutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 4, dated December 2006.

Cornerstone: Initiating Events

Green.

The inspectors identified a Green non-cited violation of Technical Specification 5.4.1.a for the failure to develop adequate controls for low-power stroking of safety relief valves. In response to this finding, the licensee trained senior reactor operators on the lessons learned from the finding. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2012-03816.

The performance deficiency was more than minor because it was associated with the procedure quality attribute of the initiating events cornerstone and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown operations. In accordance with NRC Inspection Manual Chapter 0609,

Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 1, Section B, this finding screened to very low safety significance because it was a transient initiator that did not result in a reactor trip and loss of mitigation equipment. Because the most significant causal factor of the performance deficiency was that the licensee had made an inappropriate assumption that the abnormal operating procedure was a satisfactory controlling document, this finding has a human performance cross-cutting aspect associated with the decision-making component, in that the licensee failed to use conservative assumptions in decision-making. H.1b] (Section 4OA5.3)

Green.

The inspectors identified a non-cited violation of 10 CFR Part 50,

Appendix B, Criterion XVI, for the licensees failure to identify and correct a condition adverse to quality. Specifically, after a lockout relay mechanically bound in 2011, causing a fire, the licensee failed to identify and correct other susceptible relays. In response, the licensee tested other susceptible relays and replaced those that failed the test. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2012-05894.

This performance deficiency was more than minor because it was associated with the equipment performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 1, Section B, this finding screened to a detailed risk evaluation because it had caused a reactor trip and the loss of mitigation equipment such as loss of main feedwater and normal service water.

The detailed risk evaluation included a quantitative bounding analysis and a qualitative evaluation in accordance with NRC Inspection Manual Chapter 0609,

Appendix M, Significance Determination Process Using Qualitative Criteria, to determine that this finding was of very low safety significance (Green). Because the most significant causal factor of the performance deficiency was that the licensee had failed to recognize the potential risk to the plant when performing the evaluations for the failed lockout relays, this finding has a human performance cross-cutting aspect associated with the work control component in that licensee did not plan and coordinate work activities by incorporating risk insights, consistent with nuclear safety. H.3a] (Section 4OA5.4)

Green.

The inspectors reviewed a self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, for the licensees failure to establish adequate preventative maintenance instructions for lockout relays in accordance with vendor recommendations for electrical testing. In response, the licensee incorporated vendor recommendations into the instructions for testing lockout relays. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2011-02209.

The performance deficiency was more than minor because it was associated with the equipment performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations, in that it resulted in a fire. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 1, Section B, this finding screened to very low safety significance (Green) because it was a transient initiator that did not result in a reactor trip or loss of mitigation equipment.

The finding did not have a cross-cutting aspect because the performance deficiency was not representative of current plant performance (Section 4OA5.5).

Green.

The inspectors reviewed a self-revealing finding for the licensees failure to establish an effective cable reliability program, in that the licensee failed to distinguish between wetted and dry splices. In response, the licensee tested the high-risk-ranked cables, and replaced those that failed the test. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2012-03440.

The performance deficiency was more than minor because it was associated with the equipment performance attribute of the initiating events cornerstone, and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations, in that it resulted in a reactor scram. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609,

Appendix A, The Significance Determination Process for Findings At-Power,

Exhibit 1, Section B, this finding screened to very low safety significance (Green)because it was a transient initiator that did not result in both a reactor trip and loss of mitigation equipment. Because the most significant causal factor of the performance deficiency was that the licensee failed to implement and institutionalize operating experience related to wetted splices, this finding has a problem identification and resolution cross-cutting aspect associated with operating experience in that the licensee did not implement and institutionalize operating experience through changes to station processes and procedures to support plant safety. P.2b] (Section 4OA5.6)

Cornerstone: Mitigating Systems

Green.

The inspectors reviewed a self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to promptly identify and correct a condition adverse to quality.

Specifically, the licensee failed to identify and correct an inadequate design of the reactor core isolation cooling (RCIC) system that resulted in spurious system isolations during main turbine trips. In response, the licensee installed a time delay into the circuit that had tripped the RCIC steam supply before the RCIC received a start signal. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2012-03439.

The performance deficiency was more than minor because it was associated with the design control attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences, in that the repeated spurious isolations adversely affected the RCIC system reliability. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, this finding screened to a detailed risk evaluation which determined that the finding was of very low safety significance (Green). This finding does not have a cross-cutting aspect because the apparent cause of this finding was the licensees decision in 2008 to not add a time delay to the high differential pressure trip, and the NRC does not consider that cause to be representative of current licensee performance. (Section 4OA5.2.a)

Green.

The inspectors identified a non-cited violation of 10 CFR Part 50,

Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to declare the RCIC system inoperable when the system was unreliable for an automatic start following a main turbine trip. The licensee addressed the underlying safety concern by installing a time delay into the circuit that had tripped the RCIC steam supply before RCIC received a start signal. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2012-06015.

The performance deficiency was more than minor because it affected the equipment performance attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter 0609,

Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, this finding screened to a detailed risk evaluation which determined that the finding was of very low safety significance (Green). Because the most significant causal factor of the performance deficiency was that the organization had used the absence of information to determine RCIC operability, this finding has a cross-cutting aspect in the human performance area associated with the decision-making component, because the licensee had failed to demonstrate that the proposed action was safe in order to proceed rather than a requirement to demonstrate that it was unsafe in order to disapprove the action.

H.1b].(Section 4OA5.2.b)

Green.

The inspectors reviewed a self-revealing, non-cited violation of License Condition 2.C.(10) because the licensee failed to prevent conflict of duties for fire brigade members, which affected the timely response to fires. In response, the control room initiated a night order to ensure that when a fire brigade member is called for fitness-for-duty testing, the staff will either designate a relief fire brigade member or arrange a deferral of the fitness-for-duty testing. The licensee plans to address long-term corrective actions through appropriate procedure changes at the fleet level. The licensee entered the finding into the corrective action program as Condition Report CR-RBS-2012-03817.

The performance deficiency was more than minor because it was associated with the protection against external events attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, this finding screened to very low safety significance (Green) because the affected fire brigade member was unavailable for less than two hours. Because the most significant causal factor of the performance deficiency was that the licensee failed to ensure that conflicts between the fitness-for-duty and fire brigade procedures had been properly resolved prior to implementation, this finding has a human performance cross-cutting aspect associated with resources because the licensee did not ensure that procedures were complete and accurate to assure nuclear safety.

H.2c] (Section 4OA5.8)

Cornerstone: Miscellaneous

Green.

The inspectors identified a non-cited violation of 10 CFR Part 50,

Appendix B, Criterion V, for several examples of failures to follow Procedure EN-OM-119, Onsite Safety Review Committee, Revision 8, which indicated that the onsite safety review committee failed to accomplish an independent review of station activities in accordance with the procedure. In response to this finding, the licensee developed a process to document the committee findings and reinforced roles and responsibilities for committee conduct, and committee members reviewed the implementing procedure. The licensee entered this finding into the corrective action program as Condition Report CR-RBS-2012-03739.

The multiple failures to follow the onsite safety review committee implementing procedure were performance deficiencies that were more-than-minor because failure to correct these performance deficiencies could compromise the nuclear safety oversight function of the committee, which could result in inappropriate decision-making on activities important to nuclear safety. In accordance with NRC Inspection Manual Chapter 0609 Appendix M, Significance Determination Process Using Qualitative Criteria, the finding was of very low safety significance because the performance deficiency did not result in any risk-significant issues. Because the most significant causal factor of the performance deficiency was the licensees failure to properly define, communicate and implement the roles for decision-making that affected nuclear safety, this finding has a human performance cross-cutting aspect associated with decision-making because the licensee failed to adequately communicate the authority and roles of the onsite safety review committee to the members. H.1a] (Section 4OA5.7)

Licensee-Identified Violations

None

REPORT DETAILS

Summary of Plant Status

On May 21, 2012, River Bend Station was operating at 100 percent power. At 2:52 p.m., the site experienced an automatic reactor scram due to a main turbine trip caused by low condenser vacuum. The low condenser vacuum condition resulted from a fault in the supply cable to nonsafety-related 4160 Volt bus NNS-SWG2A that powered two of the four circulating water pumps.

On May 22, the licensee powered all circulating water pumps and normal service water pumps from nonsafety-related 4160 Volt bus NNS-SWG2B. On May 23, the licensee commenced reactor startup.

On May 24, the reactor was operating at 33 percent power with one feedwater pump in service.

Shortly after operators started a second feedwater pump, a fault occurred in the pump motor termination box. The fault was not isolated by the motor feeder breaker due to a failed lockout relay. As a result and to clear the fault, the supply breaker for the nonsafety-related 13.8 Kilovolt supply bus NPS-SWG1B tripped. This resulted in the loss of power to all running feedwater, circulating water, and normal service water pumps. Operators initiated a manual reactor scram. The station reached cold shutdown conditions on May 25.

No radiological release was associated with either event.

For a detailed description of the events, refer to NRC Inspection Report 05000458/2012009.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness

1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the operability evaluation in Condition Report CR-RBS-2012-03439 for a RCIC system spurious isolation following a main turbine trip.

The inspectors reviewed the technical adequacy of the evaluation to ensure that technical specification operability was properly justified and the component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the technical specifications and Updated Safety Analysis Report to the licensees evaluation to determine whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Specific documents reviewed during this inspection are listed in the attachment.

These activities constitute completion of one operability evaluation inspection sample as defined in Inspection Procedure 71111.15-05.

b. Findings

A finding associated with the RCIC system spurious isolation operability evaluation is documented in Section 4OA5.2 of this report.

4OA2 Identification and Resolution of Problems

Selected Issue Follow-up Inspection

a. Inspection Scope

The inspectors reviewed Condition Report CR-RBS-2012-03534 for the adequacy of corrective actions for failed lockout relays. The inspectors reviewed documents and interviewed personnel to determine if the licensee completely and accurately identified problems in a timely manner commensurate with their significance, evaluated and dispositioned operability issues, considered the extent of condition, prioritized the problem commensurate with its safety significance, and completed corrective actions in a timely manner commensurate with the safety significance of the issue.

These activities constitute completion of one in-depth problem identification and resolution sample as defined in Inspection Procedure 71152-05.

b. Findings

A finding associated with the corrective actions for lockout relay failures is documented in Section 4OA5.4 of this report.

4OA3 Event Follow-up

The inspectors reviewed licensee event reports and related documents to determine the accuracy of the licensee event reports, appropriateness of corrective actions, violations of requirements, and generic issues.

These activities constitute completion of two event follow-up samples as defined in Inspection Procedure 71153-05.

.1 (Closed) Licensee Event Report 05000458/2012-002-00, Automatic Reactor Scram Due

to Low Main Condenser Vacuum Resulting From Electrical Fault The details of this event are described in NRC Inspection Report 05000458/2012009.

The enforcement aspects are documented in Section 4OA5 of this report. The inspectors did not identify new information in the licensee event report. This licensee event report is closed.

.2 (Closed) Licensee Event Report 05000458/2012-003-00, Reactor Scram Following a

Loss of Main Reactor Feedwater Pump Due to Electrical Fault The details of this event are described in NRC Inspection Report 05000458/2012009.

The enforcement aspects are documented in Section 4OA5 of this report. The inspectors did not identify new information in the licensee event report. This licensee event report is closed.

4OA5 Other Activities

Inspection Procedure 93800, Augmented Inspection Team Unresolved Items For detailed information on the background of each unresolved item, refer to NRC Inspection Report 05000458/2012009.

.1 (Closed) Unresolved Item 05000458/2012009-01, Main Control Room Annunciator

Control and Conduct of Operations The augmented inspection team identified an unresolved item associated with operators simulator and control room performance for the licensees failure to use human performance tools to reduce the probability of making errors during an event.

Specifically, the team identified instances of inadequate three-way communications, silenced alarms prior to identifying the alarming parameter, failure to acknowledge alarms, and failure to make regular control room updates to keep the crew informed of changing conditions.

The inspectors interviewed operations personnel and reviewed the licensees corrective actions, human performance procedures, and the alarm response procedure.

The inspectors identified a performance deficiency for the licensees failure to establish adequate three-way communications and for the licensees failure to make regular control room updates in accordance with Procedure EN-HU-102, Human Performance Tools and Traps, Revision 11. The inspectors determined the performance deficiency to be of minor significance because it was not a precursor to a significant event, did not have the potential to lead to a more significant safety concern, would not cause a performance indicator to exceed a threshold, and did not adversely affect a reactor oversight process cornerstone objective. Specifically, the inspectors did not identify any communication errors that resulted in adverse impacts on the plant.

The inspectors also identified a violation of 10 CFR Part 50, Appendix B, Criterion V, for the licensees failure to follow the requirements of Procedure EN-OP-115-08, Annunciator Response, Revision 12, which requires that shift operators maintain

awareness and understanding of alarm status at all times. Contrary to the procedural requirements, operators were unaware of the cause for a residual heat removal inoperable alarm. The inspectors determined the performance deficiency to be of minor significance because it was not a precursor to a significant event, did not have the potential to lead to a more significant safety concern, would not cause a performance indicator to exceed a threshold, and did not adversely affect a reactor oversight process cornerstone objective. Specifically, the previous operations shift crew took the appropriate actions in response to the annunciator, so there were no adverse impacts on the plant. Because the violation was minor and was documented in the licensees corrective action program as Condition Report CR-RBS-2012-03815, it is not subject to enforcement action in accordance with the NRCs Enforcement Policy. This unresolved item is closed.

.2 (Closed) Unresolved Item 05000458/2012009-02, Past Operability of the Reactor Core

Isolation Cooling System On May 21, 2012, the RCIC system steam supply spuriously isolated following a main turbine trip. The licensee determined that the cause of the spurious isolation was a false high steam flow isolation signal due to a sudden change in steam pressure. The licensee concluded the system was degraded but operable and restarted the plant on May 24, 2012. On May 31, 2012, the licensee added a time delay to the high steam flow signal to prevent future spurious isolations. The augmented inspection team concluded that additional inspection was needed to assess the operability of the RCIC system prior to time delay modification.

During this inspection, the inspectors reviewed the associated operability evaluation in Condition Report CR-RBS-2012-03439. The inspectors reviewed the technical adequacy of the evaluation to ensure that technical specification operability was properly justified and the system remained available such that no unrecognized increase in risk occurred. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

.a Failure to Correct Spurious Isolations of Reactor Core Isolation Cooling System

Introduction.

The inspectors reviewed a Green self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to promptly identify and correct a condition adverse to quality. Specifically, the licensee failed to identify and correct an inadequate design of the RCIC system that resulted in spurious system isolations during main turbine trips.

Description.

On May 21, 2012, following a main turbine trip and reactor scram, the RCIC system steam supply spuriously isolated. The system was unavailable to perform its safety function while isolated. Operators were quickly able to determine that the isolation was unnecessary, reset the isolation, and start the system. The licensee performed a causal evaluation in Condition Report CR-RBS-2012-03439, and determined that the pressure transient from the main turbine trip had caused a false steam line high differential pressure trip. The licensee determined that the potential for a spurious isolation was inherent to the design of the high differential pressure trip because the instantaneous trips did not allow for pressure transients to decay.

The licensee determined that their failure to take adequate corrective actions from a similar event in 2004 was a contributing cause to the 2012 spurious isolation. That is, on October 1, 2004, the RCIC system spuriously isolated following a main turbine trip and reactor scram. In response to that event, the licensee performed a causal evaluation in Condition Report CR-RBS-2004-02906 and determined that either gas or a blockage in the instrument sensing lines combined with the pressure transient caused the false high differential pressure trip. As a corrective action, the licensee modified the system and procedures to prevent gas or blockages in the sensing lines. In addition, the licensee initiated Engineering Request ER-RB-2005-0079-000 to add a time delay to the high differential pressure trip. However, in 2008, the licensee cancelled that Engineering Request because they classified it as an enhancement, they installed a continuous backfill system to address gas in the sensing lines, and the system had not spuriously isolated since 2004.

The inspectors noted that operating experience existed that recommended including a time delay associated with the high differential pressure trip. Specifically, General Electric Design Specification 22A3124BC stated, in part, that the isolation of a steam line break shall be in 3 to 13 seconds. In addition, NRC Information Notice 82-16, HPCI/RCIC High Steam Flow Setpoints, stated, in part, that consideration should be given to including a time delay in the high steam flow instrumentation to decrease the chance of spurious isolation. Therefore, the inspectors concluded that the licensee had reasonable ability to foresee and correct the inadequate design of the RCIC system high differential pressure trip.

The inspectors noted that the RCIC had operated correctly and had not isolated following several main turbine trips that occurred between 2004 and 2012, including one in 2011. The inspectors determined that the intermittent spurious isolations had occurred frequently enough that the system had failed to meet the technical specification operability requirements. Therefore, the inspectors concluded that the RCIC system had been inoperable at least from 2004 to 2012, a period which exceeded the technical specification allowed outage time. Following the 2012 event, the licensee installed time delays to the high differential pressure trip, to prevent spurious isolations from future pressure transients.

Through document reviews, the inspectors determined that the apparent cause of this finding was the licensees decision in 2008 to not add a time delay to the high differential pressure trip.

Analysis.

The licensees failure to promptly identify and correct an inadequate design feature of the RCIC system was a performance deficiency. The performance deficiency was more than minor because it was associated with the design control attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the repeated spurious isolations adversely affected the RCIC system reliability. The inspectors used NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, to determine that the finding did not affect the plant during a shutdown, operator requalification, risk management, 10 CFR 50.54(hh)(2) mitigating strategies, or fire protection, so the inspectors used NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems, Structures, and Components, and Functionality, to

screen the finding to a detailed risk evaluation because it represented a loss of a system.

The senior reactor analyst used the River Bend Station Standardized Plant Analysis Risk model, Revision 8.20, to evaluate the risk of this performance deficiency. Because the turbine-driven pump would only trip if the main turbine tripped before a reactor scram occurred, the analyst used generic industry data to determine that the main turbine trips before a reactor scram is initiated approximately 19 percent of the time. After adjusting the model to account for recovery of the RCIC system following an inadvertent isolation, the analyst evaluated the risk of the pump tripping during turbine trip sequences. The resulting change in core damage frequency was bounded at 1 x 10-7 over a 1-year exposure period. Therefore, the finding was of very low safety significance (Green).

As noted above, the inspectors determined that the apparent cause of this finding was the licensees decision in 2008 to not add a time delay to the high differential pressure trip. Because that cause occurred more than three years ago, the NRC does not consider it to be representative of current licensee performance. Therefore, this finding does not have a cross-cutting aspect.

Enforcement.

10 CFR 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that conditions adverse to quality are promptly identified and corrected. Contrary to the above, between October 4, 2004, and May 21, 2012, the licensee failed to promptly identify and correct a condition adverse to quality. Specifically, the licensee failed to identify and correct an inadequate design of the RCIC system that resulted in spurious system isolations during main turbine trips. To correct the condition, the licensee installed a time delay into the circuit that had tripped the RCIC turbine-driven pump.

Because this violation was of very low safety significance and was entered in the licensees corrective action program as Condition Report CR-RBS-2012-03439, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000458/2012010-01, Failure to Correct Spurious Isolations of Reactor Core Isolation Cooling System.

.b Plant Startup with Reactor Core Isolation Cooling System Inoperable

Introduction.

The inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to follow the operability determination process procedure. Specifically, the licensee failed to declare the RCIC system inoperable when the system was unreliable for an automatic start following a main turbine trip. As a result, the licensee started up the reactor with the RCIC system inoperable, contrary to technical specification requirements.

Description.

As discussed in section 4OA5.a above, on May 21, 2012, following a main turbine trip, the RCIC system experienced a spurious steam isolation before it received a start signal, and the licensee declared the system inoperable. As documented in Condition Report CR-RBS-2012-03439, before the licensee restarted the plant on May 23, 2012, they determined that the RCIC system was operable. They therefore did not develop any corrective action to address the spurious isolation. The inspectors review of the operability evaluation associated with CR-RBS-2012-03439 identified that the licensee had failed to address Technical Specification Surveillance Requirement 3.5.3.5,

which required the licensee, in part, to verify the RCIC system actuates on an actual or simulated automatic initiation signal. Specifically, the licensee failed to identify that with the RCIC system isolated, it was unavailable for an automatic start. Procedure EN-OP-104, Operability Determination Process, Revision 6, Attachment 9.1, Table 1, row 9, stated, in part, that when a system fails to meet the quantitative requirements of surveillances demonstrating compliance with technical specifications, the system must be declared inoperable. Therefore, the inspectors concluded that the licensee failed to declare the system inoperable when it was unreliable for an automatic start.

In the subject operability evaluation, the licensee stated that credit for operator manual action to reset the RCIC system was appropriate. However, the inspectors determined that because automatic initiation was a specific surveillance requirement, the licensee inappropriately credited manual action in place of the automatic action, and done so without a license amendment. In addition, the licensee concluded that the design function of the RCIC system was to respond to a station blackout event. However, the inspectors noted that Technical Specification Bases 3.5.3, Reactor Core Isolation Cooling System, stated, in part, that the RCIC system was designed to operate either automatically or manually following reactor pressure vessel isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of reactor pressure vessel water level. Therefore, because the RCIC system is designed to operate automatically, and because a spurious trip prevented the RCIC system from operating automatically on May 21, 2012, the inspectors concluded that spurious trips rendered the RCIC system inoperable on May 21, 2012. The inspectors also determined that the licensee correctly declared the RCIC system inoperable at the time of the event and that, as documented in Condition Report CR-RBS-2012-03439, following the event. The licensee incorrectly determined that the RCIC system had been operable.

Technical Specification (TS) Limiting Condition for Operation (LCO) 3.5.3, Reactor Core Isolation Cooling System, requires the RCIC system to be operable, and is applicable in Modes 1, 2, and 3, with reactor steam dome pressure greater than 150 pounds per square inch. As described above, when the licensee started the plant on May 23, 2012, RCIC was inoperable. That is, RCIC did not satisfy its associated TS LCOs. TS LCO 3.0.4 requires that TS equipment be operable before changing operational modes.

Because the licensee changed operational modes with the RCIC system inoperable, they therefore violated TS LCO 3.0.4.

After the reactor scram on May 24, 2012, the licensee added time delays to the circuit to prevent spurious isolations. The licensee completed that modification before restarting the plant again.

Through document reviews, the inspectors concluded that the licensee failed to declare the system inoperable prior to restart due to their incomplete view of the systems licensing bases.

Analysis.

On May 23, 2012, the licensees failure to determine that the RCIC system was inoperable was a performance deficiency that resulted in the licensee starting up the plant with the system inoperable. The performance deficiency was more than minor because it affected the equipment performance attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability,

reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee placed the RCIC system in service after learning that it was susceptible to spurious isolations, adversely affecting the reliability of the system. The inspectors used NRC Inspection Manual Chapter 0609, 4, Initial Characterization of Findings, to determine that the finding did not affect the plant during a shutdown, operator requalification, risk management, 10 CFR 50.54(hh)(2) mitigating strategies, or fire protection, so the inspectors used NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems, Structures, and Components, and Functionality, to screen the finding to a detailed risk evaluation because it represented a loss of a system.

The NRC senior reactor analyst used the River Bend Station Standardized Plant Analysis Risk model, Revision 8.20, to evaluate the risk of this performance deficiency.

Because this performance deficiency would cause the RCIC pump to trip only if the main turbine tripped before a reactor scram occurred, the analyst used generic industry data, to determine that the main turbine trips before a reactor scram is initiated approximately 19 percent of the time. After adjusting the model to account for recovery of the RCIC system following an inadvertent isolation, the analyst evaluated the risk of the RCIC pump tripping during turbine-trip sequences. The resulting change in core damage frequency was bounded at 1 x 10-7 over a 1-year exposure period. Therefore, the finding was of very low safety significance (Green).

The inspectors determined that the most significant causal factor of the performance deficiency was that the organization had used incomplete information to determine RCIC operability. Therefore, this finding has a cross-cutting aspect in the human performance area associated with the decision-making component, because the licensee had failed to demonstrate that the proposed action was safe in order to proceed rather than a requirement to demonstrate that it was unsafe in order to disapprove the action H.1b].

Enforcement.

10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be accomplished in accordance with procedures. Procedure EN-OP-104, Operability Determination Process, Revision 6, Attachment 9.1, Table 1, Row 9, states, in part, that when a system fails to meet the quantitative requirements of surveillances demonstrating compliance with technical specifications, the system must be declared inoperable.

Contrary to the above, on May 23, 2012, when a system failed to meet the quantitative requirements of surveillances demonstrating compliance with technical specifications, the system was not declared inoperable. Specifically on May 23, 2012, when the RCIC system failed to meet the quantitative requirements of Technical Specification Surveillance Requirement 3.5.3.5 on May 21, 2012, after the licensee first declared that the RCIC system was inoperable. However, on May 23, 2012, they declared it operable.

As a result, the licensee started up the plant on May 23, 2012, with the RCIC system inoperable, in violation of TS 3.5.3.

After the reactor scram on May 24, 2012, and before they restarted the plant, the licensee added time delays to the circuit to prevent spurious isolations. Because this violation was of very low safety significance and was entered in the licensees corrective action program as Condition Report CR-RBS-2012-06015, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000458/2012010-02, Failure to Declare Reactor Core Isolation Cooling System Inoperable.

.3 (Closed) Unresolved Item 05000458/2012009-03, Implementation of the Procedure for

Infrequently Performed Tests or Evolutions On June 1, 2012, the augmented inspection team observed the licensee cycle leaking safety relief valves in an attempt to seat the valves. The licensee decided to perform the evolution using Procedure EN-OP-116, Infrequently Performed Tests or Evolutions, Revision 9. The procedure provided additional controls and required a pre-plan.

However, the team observed that the licensee did not have an adequate pre-plan, and did not adequately address the additional controls required by the procedure. Therefore, the augmented inspection team concluded that additional inspection was needed to assess the effectiveness of the licensees use of Procedure EN-OP-116.

During this inspection, the inspectors assessed the adequacy of the procedures used by the licensee as well as operators adherence to procedures. The inspectors reviewed the documents generated from the infrequently performed tests or evolutions process, reviewed AOP-0035, Safety Relief Valve Stuck Open, Revision 18, reviewed control room logs, and interviewed operators. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

Introduction.

The inspectors identified a Green non-cited violation of Technical Specification 5.4.1.a for the failure to develop adequate controls for low-power stroking of safety relief valves. Specifically, the licensee failed to develop appropriate guidance as described in Procedure EN-OP-116, Infrequently Performed Tests or Evolutions, Revision 9.

Description.

During the reactor startup on June 1, 2012, the operating crew received a safety relief valve acoustical monitor alarm. The crew determined that two safety relief valves were leaking, and decided to hold reactor pressure steady in order to minimize the leak rate into the suppression pool. The licensee decided to cycle the safety relief valves open then closed in an attempt to seat the valves. Since the cycling of relief valves was an activity not typically performed during startup, the operators decided to perform the evolution using the guidance contained in Procedure EN-OP-116, Infrequently Performed Tests or Evolutions, Revision 9. This procedure provided additional pre-planning and controls for use as an error prevention tool when conducting non-routine evolutions, including performing an engineering review of the pre-plan for technical adequacy and validating the pre-plan through simulator use or plant walkdowns. The licensee prepared and approved a pre-plan for conducting the evolution. However, the inspectors found no evidence that the licensee had performed an engineering review of the pre-plan for technical adequacy or validation of the pre-plan through simulator use or plant walkdowns.

The augmented inspection team noted the following from observing the evolution:

• EN-OP-116 included a pre-job brief checklist which required the licensee to establish a list of potential problems and associated contingencies. In the checklist prepared for this evolution, a handwritten note indicated the only

potential problem was safety relief valve sticks open. For this problem, no associated contingency was listed. However, when the control room crew discussed this evolution, they identified additional concerns including: reactor pressure control with only one bypass valve approximately 20 percent open; reactor level control at low power; reactor power response with power on range 8-10 of the intermediate range monitors; safety relief valve leak rate increasing with increasing reactor pressure; and the length of time the valve should be left open before being shut. Because the licensee did not address these additional concerns in the checklist prepared for this evolution, the inspectors determined that the licensee had not comprehensively addressed potential problems associated with the cycling of safety relief valves.

• For this evolution, the licensee identified that Procedure AOP-0035, Safety Relief Valve Stuck Open, Revision 17, was the controlling document. However, because the licensee had written this procedure for steady state power operation, the bulk of the guidance was not applicable to the low-power conditions associated with the planned evolution. Consequently, over the course of the morning, operators held several discussions on how to set up the initial conditions for the evolution as well as defining the abort and contingency criteria.

Those discussions continued up to the time when the safety relief valve was opened.

The inspectors identified that the licensee had justified the use of AOP-0035 to control the evolution because the licensee had successfully performed low-power safety relief valve stroking in the past using Procedure STP-202-0602, Safety Relief Valve Division 1 Operability Test, Revision 302. To the inspectors, this justification indicated that the licensee had assumed that AOP-0035 was an appropriate controlling document.

However, the inspectors determined that STP-202-0602, which was retired in 2011, included precautions, limitations and prerequisites that the licensee did not include in the checklist prepared for this evolution. Furthermore, procedure EN-OP-116 required the licensee to identify plant system or component initial conditions, and include them in the checklist prepared for this evolution. Because the operating crew concerns discussed above were not addressed by either Procedure AOP-0035 or the checklist prepared for this evolution, the crew held discussions to establish and implement appropriate initial conditions. For example, the procedure did not address reactor power or initial bypass valve position, so the operators withdrew control rods to increase reactor power and isolated various steam drain valves and other house loads. These actions were performed to open the turbine bypass valves further for adequate pressure control when cycling the safety relief valves. Therefore, the inspectors concluded that AOP-0035 was not an appropriate controlling procedure for this evolution.

The inspectors determined the operating crew was effective in looking ahead and considering the different variables that could lead to an undesired transient; however, the crew performed actions without a controlling document developed from Procedure EN-OP-116. The inspectors concluded that, although the procedure was referenced, it did not appear to have been effectively implemented.

Analysis.

The licensees failure to develop and establish an adequate controlling procedure in accordance with Procedure EN-OP-116 for cycling safety relief valves at low reactor power levels was a performance deficiency. That performance deficiency was more than minor because it was associated with the procedure quality attribute of the initiating events cornerstone and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown operations. Specifically, the failure to develop and establish an adequate controlling procedure increased the likelihood that human error would cause a plant transient. The inspectors used NRC Inspection Manual Chapter 0609, 4, Initial Characterization of Findings, to determine that the finding did not affect the plant during a shutdown, operator requalification, risk management, 10 CFR 50.54(hh)(2) mitigating strategies, or fire protection, so the inspectors used NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 1, Section B, Transient Initiators, to determine that the finding has very low safety significance because it was a transient initiator that did not result in a reactor trip or loss of mitigation equipment.

The inspectors determined that the most significant causal factor of the performance deficiency was that the licensee had made an inappropriate assumption that AOP-0035 was a satisfactory controlling document for the proposed evolution. Therefore, this finding has a cross-cutting aspect in the human performance area associated with the decision-making component, because the licensee failed to use conservative assumptions in decision-making H.1b].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Quality Assurance Program Requirements (Operations),

Appendix A, Section 6.t., recommends procedures for malfunctions of pressure control systems. Contrary to the above, before June 1, 2012, written procedures were not established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Specifically, procedures for malfunctions of pressure control systems are recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978, and before the subject date, the licensee failed to establish and implement adequate procedures for malfunctions of pressure control systems at low-power operations. This violation increased the likelihood that human error would cause a plant transient. The licensee documented this violation in Condition Report CR-RBS-2012-03816. Because this violation was of very low safety significance and was documented in the licensees corrective action program, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000458/2012010-03, Failure to Establish an Adequate Controlling Procedure for Stroking Safety Relief Valves at Low Power.

.4 (Closed) Unresolved Item 05000458/2012009-04, Corrective Action Program

Implementation for Prior Lockout Relay Failure in February 2011 The augmented inspection team identified an unresolved item associated with the corrective actions for a lockout relay failure in February 2011, which had resulted in a fire. The inspectors noted that the lockout relay failure on May 24, 2012, that resulted in a loss of main feedwater and normal service water appeared to have the same failure

mode as the lockout relay failure in 2011. Therefore, the augmented inspection team determined that additional inspection was required to assess the effectiveness of the licensees corrective actions from the February 2011 event.

During this inspection, the inspectors performed a review of Condition Report CR-RBS-2012-03534 for the adequacy of corrective actions for failed lockout relays.

The inspectors reviewed documents and interviewed personnel to determine if the licensee had completely and accurately identified problems in a timely manner commensurate with their significance, evaluated and dispositioned operability issues, considered the extent of condition, prioritized the problems commensurate with their safety significance, and completed corrective actions in a timely manner commensurate with the safety significance of the issues. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

Introduction.

The inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, for the licensees failure to identify and correct a condition adverse to quality. Specifically, after a lockout relay mechanically bound in 2011, causing a fire, the licensee failed to identify and correct other susceptible relays. In addition, the inspectors identified that the licensees root cause evaluation for the 2012 event had failed to fully address the extent of condition for safety-related relays. As a result, a mechanically bound lockout relay failed to isolate a fault on a main feedwater pump motor in 2012, causing a complete loss of feedwater and normal service water.

Description.

On February 12, 2011, a fire occurred in the cooling tower C switchgear room. In an apparent cause evaluation for Condition Report CR-RBS-2011-02209, the licensee determined that the fire was, in part, the result of a mechanically bound lockout relay. The relay latching mechanism had bound due to the age of the relay and the lack of electrical relay testing to uncover failures. The licensee changed the preventative maintenance plan for lockout relays, but failed to recognize that other relays installed in the plant were susceptible to similar failures.

On May 24, 2012, a main feedwater pump motor faulted. The associated lockout relay failed to isolate the fault because it was mechanically bound, so the entire bus isolated, resulting in a total loss of main feedwater and normal service water. In the root cause evaluation for Condition Report CR-RBS-2012-03534, the licensee determined that the extent of condition for Condition Report CR-RBS-2011-02209 had not been effectively performed, and that they had not been testing lockout relays in accordance with vendor recommendations. As a corrective action, the licensee tested susceptible lockout relays and implemented electrical testing of the relays as specified by the vendor. They also initiated Condition Report CR-RBS-2012-03979 to address the testing issue. In that condition report, the licensee determined that in their lockout relay preventative maintenance procedures, they had failed to include the vendor recommendation to test the relays at 70 percent voltage, to determine if the relay was operating correctly. The licensee considered that failure to be administrative, and subsequently updated the preventative maintenance plan for the relays. However, the inspectors determined that the licensee had failed to evaluate whether safety-related relays were impacted at that time. As a result, the licensee performed an operability evaluation and determined that the impacted relays were operable, and that additional testing was necessary.

Therefore, the inspectors concluded that the licensee had failed to identify potential problems associated with installed lockout relays in both 2011 and 2012.

Through document reviews and interviews, the inspectors determined that when the licensee performed the evaluation described in Condition Report CR-RBS-2012-03979, they failed to recognize the potential risks associated with the lockout relays.

Analysis.

The licensees failure to promptly identify and correct mechanical binding in lockout relays, which resulted in a loss of main feedwater and normal service water, was a performance deficiency. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the performance deficiency resulted in a complete loss of main feedwater and normal service water. The inspectors used NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, to determine that the finding did not affect the plant during a shutdown, operator requalification, risk management, 10 CFR 50.54(hh)(2) mitigating strategies, or fire protection, so the inspectors used NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 1, Section B, Transient Initiators, to determine that the finding screened to a detailed risk evaluation because it had caused a reactor trip and the loss of mitigation equipment such as loss of main feedwater and normal service water.

The senior reactor analyst determined, in accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Section 4, SDP Appendix Router, that no SDP appendix was capable of evaluating the subject finding and associated degraded condition and that IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria, was an appropriate tool to evaluate the subject performance deficiency.

Therefore, in accordance with Appendix M, Section 4.1, Initial Bounding Analysis, the analyst conducted a quantitative and qualitative bounding analysis, using best available information.

Quantitative Evaluation:

The analyst made the following assumptions:

• for this performance deficiency to affect an operating reactor, the electrical load associated with the relay must fail;

• the frequency of an ac motor fault was no higher than the frequency of motor-driven pump driver failures documented as 1.39 x 10-2 /year by Idaho National Laboratories; Given these assumptions, the analyst used the NRCs River Bend Station Standardized Probabilistic Analysis Risk model, Revision 8.20, with a truncation limit of 1E-11 and hand calculations, to quantify the following:

• the total incremental conditional core damage probability for a failure of Switchgear NPS-SWG1A, Switchgear NPS-SWG1B, and a failure of both busses was 1.5 x 10-7 over a 1-year period;

• the incremental conditional core damage probability associated with the failure of each of the five Division III 86 relays was 4.2 x 10-7 over a 1-year period; and

• the total bounding change in core damage frequency was 8.8 x 10-7 for internal initiators and 9.3 x 10-7 for external initiators.

Qualitative Evaluation:

The analyst noted that the resulting quantitative bounding change to the core damage frequency was 1.8 x 10-6 over the 1-year assessment period. However, this bounding value was considered to be significantly higher than the actual change in risk.

Therefore, the analyst used the following qualitative assumptions to further evaluate the significance of the finding:

• the analyst noted that pump drivers fail for many reasons including: electrical faults, grounds, and open windings plus mechanical deficiencies such as bearing failures. Therefore, while no data set was readily available, the analyst determined that the fault frequency used in the quantitative analysis was significantly higher than expected;

• the analyst noted that the Division III relays had been tested by the licensee (although not sufficiently) indicating that they were more reliable than was assumed in the quantitative assessment; and

• the analyst recognized that under some postulated external events scenarios, the external initiator itself would have caused the loss of front-line systems regardless of the 86-relay performance. The quantification of these conditions would require an indepth analysis of specific initiators and their effects on the River Bend Station that has not been conducted. However, the analyst determined qualitatively that the actual risk would be lower than that determined in the quantitative analysis.

Based on the assumptions listed above, and in accordance with IMC 0609, Appendix M, the analyst determined, by quantitative and qualitative bounding analysis, that the change to the core damage frequency was less than 1 x 10-6/year. NRC management agreed with the determination. Therefore, the subject performance deficiency was of very low safety significance (Green).

The inspectors determined that the most significant causal factor of the performance deficiency was that the licensee had failed to recognize the potential risk to the plant when performing the evaluations for the failed lockout relays. Therefore, this finding has a human performance cross-cutting aspect associated with the work control component because the licensee did not plan and coordinate work activities by incorporating risk insights, consistent with nuclear safety H.3a].

Enforcement.

10 CFR 50, Appendix B, Criterion XVI, states, in part, that measures shall be established to assure that conditions adverse to quality, such as failures and nonconformances, are promptly identified and corrected. Contrary to this, from February 12, 2011, to September 19, 2012, a condition adverse to quality was not promptly identified and corrected. Specifically, during the subject period, the licensee identified but failed to correct mechanical binding in lockout relays, which resulted in a loss of main feedwater and normal service water. Because this violation was of very low safety significance and was documented in the licensees corrective action program as

Condition Report CR-RBS-2012-005894, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy: NCV 05000458/2012010-04, Failure to Implement Effective Corrective Actions for Lockout Relay Failures.

.5 (Closed) Unresolved Item 05000458/2012009-05, Implementation of Vendor and

Industry Recommended Relay Testing and Maintenance The augmented inspection team identified an unresolved item associated with the testing of electrical lockout relays. The licensee was not electrically testing lockout relays before the May 24, 2012, event, contrary to vendor and industry guidance.

Therefore, the team determined that additional inspection was required to assess the lack of recommended maintenance activities on lockout relays.

During this inspection, the inspectors assessed the licensees maintenance activities for lockout relays. The inspectors reviewed lockout relay vendor manuals, licensee procedures, work instructions, maintenance templates, and revisions to the maintenance practices. In addition, the inspectors reviewed the corrective action program documents related to maintenance practices, including the licensees causal analysis for failed lockout relays. The enforcement aspects of this unresolved item are discussed below.

This unresolved item is closed.

Introduction.

The inspectors reviewed a Green self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, for the licensees failure to establish adequate preventative maintenance instructions for lockout relays in accordance with vendor recommendations for electrical testing.

Description.

The licensee performed a root cause evaluation in Condition Report CR-RBS-2012-03534, for the lockout relay failure on May 24, 2012, which identified the cause to be inadequate preventive maintenance scope for the lockout relays resulting in mechanical binding and failure to isolate faulted conditions. The vendor recommended, and operating experience supported, electrically tripping HEA lockout relays to ensure the relay functioned correctly. After the May 24, 2012, event, the licensee added the vendor recommended electrical testing to maintenance procedure MCP-1134, Functional Testing of Auxiliary Relays, Rev. 19.

The inspectors determined that this issue revealed itself on February 12, 2011, when a fire occurred in the cooling tower C switchgear room. The licensees apparent cause evaluation had determined that the fire was partially due to the failure of a lockout relay due to mechanical binding of the relay latching mechanism. The corrective actions for this event were ineffective, which was discussed in Condition Report CR-RBS-2012-03534 and in Section 4OA5.4 of this report.

Through document reviews, the inspectors determined that, prior to the 2011 fire, the licensee had not changed the preventative maintenance for the lockout relays since 2004. Therefore, the finding did not have a cross-cutting aspect because the performance deficiency was not representative of current plant performance.

Analysis.

The licensees failure to establish adequate preventive maintenance instructions for lockout relays in accordance with vendor recommendations, which resulted in a fire, was a performance deficiency. The performance deficiency was more

than minor because it was associated with the equipment performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the performance deficiency resulted in a fire. The inspectors used NRC Inspection Manual Chapter 0609, 4, Initial Characterization of Findings, to determine that the finding did not affect the plant during a shutdown, operator requalification, risk management, 10 CFR 50.54(hh)(2) mitigating strategies, or fire protection, so the inspectors used NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 1, Section B, Transient Initiators, to determine that the finding has very low safety significance because it was a transient initiator that did not result in a reactor trip or loss of mitigation equipment.

The finding did not have a cross-cutting aspect because the performance deficiency was not representative of current plant performance.

Enforcement.

10 CFR 50, Appendix B, Criterion V, states, in part, that instructions, procedures, or drawings that prescribe activities affecting quality shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Contrary to the above, a documented instruction that prescribes an activity affecting quality did not include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Specifically, MCP-1134, Functional Testing of Auxiliary Relays, Rev. 18, prescribed testing of the breaker lockout relays and does not include vendor-recommended testing practices. The licensee corrected the condition by adding the vendor-recommended electrical testing to MCP-1134, Rev. 19. Because the violation was of very low safety significance and was documented in the licensees corrective action program as Condition Report CR-RBS-2011-02209, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy: NCV 05000458/2012010-05, Failure to Test Lockout Relays in Accordance with Vendor Testing Practices.

.6 (Closed) Unresolved Item 05000458/2012009-06, Implementation of the Station Cable

Reliability Program The augmented inspection team identified an unresolved item associated with the licensees process for ensuring that underground non-safety-related power cables, whose failure could affect equipment in the scope of the Maintenance Rule, were maintained as described in Procedure EN-DC-346, Cable Reliability Program, Revision 3. The team determined that the licensee did not have enough information to effectively implement the cable reliability program because the licensee was unaware of the location of wetted splices. Therefore, the team determined that additional inspection was required to assess the cable reliability program.

During this inspection, the inspectors assessed the adequacy and implementation of the licensees cable reliability program. The inspectors reviewed industry guidance, procedures, completed work orders, condition reports, and causal evaluations. In addition, the inspectors reviewed the testing methodology and testing results for cables in underground vaults. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

Introduction.

The inspectors reviewed a Green self-revealing finding for the licensees failure to establish an effective cable reliability program. The inspectors reviewed a self-revealing finding for the licensees failure to establish an effective cable reliability program, in that the licensee failed to distinguish between wetted and dry splices.

Description.

On May 21, 2012, the licensee experienced an automatic scram due to a turbine trip on low condenser vacuum. Breaker NPS-SWG1A ACB07 tripped while feeding two of four circulating water pumps, causing the low condenser vacuum.

Approximately 5 minutes after the scram, a report of a fire in electrical manhole 1A was received.

The licensee inspected electrical manhole 1A and identified an electrical fault in cable 1NPSANJ322. This cable failure caused the loss of circulating water pumps. In addition, cable 1NPSAN304, also in electrical manhole 1A, subsequently failed tan delta testing. The licensee determined that moisture intrusion at a cable splice had been the cause for the failure of both cables.

The inspectors reviewed the licensees corrective actions and associated root cause evaluation for the cable failure, and identified that the cable reliability program had failed to contain sufficient criteria for splices in wetted environments for medium voltage cables. The licensee stated that per procedural guidance, all cables that were in wetted environments and contained a splice were categorized as elevated risk. However, neither EN-DC-346 nor Electric Power Research Institute Guidance 1020805 distinguished between cables that were wetted at the splice and cables that were wetted at non-spliced locations.

However, the inspectors determined that industry standard Electric Power Research Institute Topical Report TR-1020805 does distinguish between a wetted splice and a dry splice. Furthermore, that report suggests that wetted splices are more vulnerable to insulation failure, which could result in phase-to-phase or phase-to-ground shorting. The inspectors also determined that the licensee had failed to consider this vulnerability when they risk-ranked the medium-voltage cables.

Besides the opportunity to rank cables appropriately and prioritize them according to their process, the licensee had additional opportunities to identify and correct the cable failure prior to the event on May 21, 2012. For example, on September 9, 2011, the licensees trend records for water level in electrical manhole 1A indicated that cables were submerged. The inspectors noted that after the licensee had identified that those cables were submerged and implemented some associated corrective actions, those corrective actions did not prevent the failure which resulted in the event on May 21. In another example, the inspectors identified that the licensee did not attempt to test these cables during a forced outage on December 23, 2011.

The inspectors noted that the licensee had ranked the failed cable as high-risk.

However, because the licensee was unaware where wetted cable splices were located, the inspectors determined that the licensees risk-ranking program was flawed. With specific knowledge that the cable had a splice that was wetted in 2011, the licensee had

reasonable ability to foresee and correct the condition of the cable during a forced outage later that year, before it failed.

Through document reviews, the inspectors determined that the licensee had failed to implement and institutionalize operating experience related to wetted splices.

Analysis.

The licensees failure to establish an adequate cable reliability program, which resulted in a cable failure, was a performance deficiency. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the initiating events cornerstone, and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations, in that the performance deficiency resulted in a cable failure which resulted in a reactor trip. The inspectors used NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 1, Section B, Transient Initiators, to determine that the finding has very low safety significance because although the finding did cause a reactor trip, it did not also cause the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition.

The inspectors determined that the most significant causal factor of the performance deficiency was that the licensee had failed to implement and institutionalize operating experience related to wetted splices. Therefore, this finding has a problem identification and resolution cross-cutting aspect associated with operating experience because the licensee did not implement and institutionalize operating experience through changes to station processes and procedures to support plant safety P.2b].

Enforcement.

Enforcement action does not apply because the performance deficiency did not involve a violation of regulatory requirements. This issue was entered into the licensees corrective action program as Condition Report CR-RBS-2012-03440.

Because this finding did not involve a violation of regulatory requirements and was of very low safety significance, it is identified as a finding: FIN 05000458/2012010-06, Failure to Establish An Adequate Cable Reliability Program.

.7 (Closed) Unresolved Item 05000458/2012009-07, Onsite Safety Review Committee

Implementation The augmented inspection team identified an unresolved item associated with the licensees implementation of Procedure EN-OM-119, Onsite Safety Review Committee, Revision 8. The team determined that the poor quality of the information packages provided to the onsite safety review committee for review required the committee to perform or direct the work of the line organization to obtain the information. This appeared to hinder the committees independent review function. Therefore, the team determined that additional inspection was required to assess the implementation of the onsite safety review committee.

During this inspection, the inspectors assessed the quality of the information provided to the committee and its independence. The team reviewed meetings minutes for 2011 and 2012, audio recordings for Meetings 2012-06 and 2012-07, and performed

interviews. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

Introduction.

The inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, for several examples of failures to follow Procedure EN-OM-119, Onsite Safety Review Committee, Rev. 8. Specifically, the onsite safety review committee failed to independently review station activities in accordance with the procedure, because the committee accepted substandard products, and because the members became more involved in the presentation of review topics. Additionally, voting members presented review topics to the committee.

Description.

According to EN-OM-119, Rev.8, the function of the onsite safety review committee is to provide an independent review by site management personnel to assure the plant is operated and maintained in accordance with the operating license and applicable regulations. Items typically reviewed by the committee include plant modifications, procedure changes, license amendment requests, and plant restart issues following a planned or unplanned outage. The augmented inspection team documented several problems regarding poor product quality and inadequate presentation of information to the onsite safety review committee during observations of Meeting 2012-008 on May 31, 2012. The inspectors determined that the poor quality of the information packages provided to the onsite safety review committee for review resulted in the committee performing and directing the work of the line organization to obtain missing information.

EN-OM-119, Rev.8, required the onsite safety review committee to maintain a high standard for quality of the documents presented for review. The procedure requires condition reports to be generated for items that are either technically inaccurate or inadequate, or are of poor quality. However, the inspectors identified several examples where the committee identified poor product quality but did not initiate condition reports to document the deficiencies. The independence of the committee was negatively influenced by the continued, uncorrected acceptance of substandard products, which prompted the committee members to become more involved in the presentation and discussion of review topics.

EN-OM-119, Rev.8, defines an independent review as a review completed by personnel not having direct responsibility for the work function under review regardless of whether they operate as a part of an organizational unit or as individual staff members. By reviewing the audio tapes from Meeting 2012-06, the inspectors determined that a voting member of Onsite Safety Review Committee presented three items to the committee: an operations decision making instruction for the main steam positive leakage control system, cross-tying the normal switchgear busses, and the review of Procedure GOP-0003, Scram Recovery, Revision 22. The inspectors identified that the individual was also the reviewer for the completed GOP-0003 package. The inspectors also identified that the individual did not recuse himself from voting, and that the other committee members did not challenge the potential for loss of independence due to a committee member presenting these topics.

During further review of the audio tapes from Meeting 2012-06, the inspectors found deficiencies in the stations adherence to EN-OM-119, Rev.8, during presentations detailing issues surrounding the spurious isolation of the RCIC system. Specifically, the

committee asked if RCIC had isolated during similar events in the past, and the presenter responded that We havent seen this specific issue before that I know of we did not find were we had a similar situation where you have RCIC isolated in this way in our operating experience searches so far. Through interviews with involved personnel, the inspectors learned that during a break in the meeting, the corrective action program manager had become aware of a 2004 isolation of RCIC, and was concerned that the event had not been addressed in the subject presentations. The committee directed the presenter to change the failure modes analysis to investigate the differences between the 2004 RCIC spurious isolation and 2012 event, but failed to reject the failure modes analysis, as required by EN-OM-119, Rev.8. During the presentation, the committee chairman began presenting the technical issues for the RCIC trip and answering committee members questions regarding the potential of air in the RCIC differential pressure sensing lines. At the end of the meeting, the committee approved plant startup by consensus with a hold at 150 pounds per square inch reactor vessel pressure, pending further evaluation of the RCIC system isolation.

On the following day, the committee held Meeting 2012-07 to resolve the RCIC issue and release the hold on plant startup. During this meeting, a committee member asked, Is the station sure that the station blackout analysis in Chapter 15, Appendix C of the Updated Safety Analysis Report is the only place in our licensing basis that we credit reactor core isolation cooling? The presenter responded, I believe that is correct, but we will check to ensure that this is correct. Contrary to the requirements in EN-OM-119, the committee chairman then called for the committee to vote for approval to remove the hold on plant startup, while requiring that the answer to the question be provided to himself and the operations manager after the meeting. The committee approved by consensus to approve the plant for operations above 150 pounds per square inch reactor vessel pressure. This contributed to the station violating technical specifications due to not considering the surveillance requirement that the RCIC system automatically starts on system demand. (That violation is discussed in section 4OA5.2 of this report)

In response to this issue, the licensee initiated Condition Report CR-RBS-2012-03739, and in that condition report developed a process to document the committee findings and corrective actions which reinforced roles and responsibilities of the committee. In addition, committee members reviewed the implementing procedure. The inspectors therefore considered that the cause of the multiple failures to follow the onsite safety review committee implementing procedure was that the licensee had not emphasized and reinforced the importance of committee independence in decision-making that affected nuclear safety.

Analysis.

The multiple failures to follow the onsite safety review committee implementing procedure were performance deficiencies. The performance deficiencies were more than minor because, if left uncorrected, they could have the potential to lead to a more significant safety concern. Specifically, failure to correct these performance deficiencies could compromise the nuclear safety oversight function of the committee, which could result in inappropriate decision-making on activities important to nuclear safety. The inspectors reviewed the finding using NRC Inspection Manual Chapter 0609 Appendix M, Significance Determination Process Using Qualitative Criteria, because quantitative methods and tools were not available or were not adequate to determine the significance of the finding. Using an Appendix M qualitative bounding analysis, the inspectors recommended and NRC management concurred that the finding was of very

low safety significance because the performance deficiency did not result in any risk-significant issues. The inspectors determined that the most significant causal factor of the performance deficiency was the licensees failure to properly define, communicate and implement the roles for decision-making that affected nuclear safety. Therefore, this finding has a human performance cross-cutting aspect associated with decision-making because the licensee failed to adequately communicate the authority and roles of the onsite safety review committee to the members H.1a].

Enforcement.

10 CFR 50, Appendix B, Criterion V, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Procedure EN-OM-119, Onsite Safety Review Committee, Rev. 8, requires that the onsite safety review committee independently review activities to provide additional assurance that the plant is operated and maintained in accordance with the operating license and applicable regulations that affect nuclear safety. Contrary to the above, from May 22, 2012, to May 31, 2012, the onsite safety review committee did not independently review activities to provide additional assurance that the plant is operated and maintained in accordance with the operating license and applicable regulations that affect nuclear safety.

Specifically, during the subject period, committee members accepted substandard products and became involved in the presentation of review topics. In response to this finding, the licensee developed a process to document the committee findings and reinforced roles and responsibilities for committee conduct, and committee members reviewed the implementing procedure. Because the violation was of very low safety significance and was entered into the corrective action program as Condition Report CR-RBS-2012-03739, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000458/2012010-07, Loss of Onsite Safety Review Committee Independence.

.8 (Closed) Unresolved Item 05000458/2012009-08, Ability to Promptly Staff the Fire

Brigade at All Times During Plant Operation The augmented inspection team identified an unresolved item concerning the licensees ability to promptly staff the full fire brigade in all situations. The team documented several instances of fire brigade members that delayed arrival to a callout due to other duties. Therefore, the team determined that additional inspection was required to assess the ability of the fire brigade to respond to fires in a timely manner.

During this inspection, the inspectors assessed the timeliness of fire brigade response to the callouts. The inspectors reviewed condition reports, procedures, fire reports, and conducted interviews. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

Introduction.

The inspectors reviewed a Green self-revealing, non-cited violation of License Condition 2.C.(10) because the licensee failed to prevent conflict of duties for fire brigade members, which affected the timely response to fires.

Description.

In accordance with National Fire Protection Association 27-1981, Section 3-2.3.2, the licensees fire brigade maintains a prearranged schedule for availability to prevent conflict of duties and to cover absences.

On May 24, 2012, prior to the fire which followed the reactor scram, the fire brigade leader was randomly selected to complete a fitness-for-duty test. While the leader was waiting to take the test, the fire brigade was dispatched to respond to the fire. However, because leaving the fitness-for-duty testing area would be considered a fitness-for-duty failure, the fitness-for-duty personnel prevented the fire brigade leader from responding to the fire. In the meantime, the other four fire brigade members responded to the fire.

One of the fire brigade members, who was also qualified as a fire brigade leader, served as a temporary fire brigade leader and maintained communication with the control room.

Because no additional qualified fire brigade members responded to the fire, the fire brigade was undermanned. The fire brigade leader was released from fitness-for-duty testing and responded to the fire brigade callout within approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

Based on this event and through document reviews, the inspectors identified that the licensees prearranged fire brigade schedule for availability did not prevent conflict of duties, in that on May 24, 2012, a fitness for duty test prevented the fire brigade leader from fulfilling his role on the fire brigade.

Analysis.

The licensees failure to maintain a prearranged schedule for availability for the fire brigade to prevent conflict of duties and cover absences was a performance deficiency. This performance deficiency was more than minor because the finding was associated with the protection against external events attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, a fire brigade member was unavailable to respond to a fire. The inspectors used NRC Inspection Manual Chapter 0609, 4, Initial Characterization of Findings, to determine that the finding did not affect the plant during a shutdown, operator requalification, risk management, 10 CFR 50.54(hh)(2) mitigating strategies, but did affect the performance of the fire brigade. Therefore, using NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, Mitigating Systems, Structures, and Components, and Functionality, the inspectors determined that the finding has very low safety significance because the affected fire brigade member was unavailable for less than two hours.

The inspectors determined that the most significant causal factor of the performance deficiency was that the licensee failed to establish a procedure or process to resolve conflicts between the fitness-for-duty and fire brigade assignments prior to implementation. Therefore, this finding has a human performance cross-cutting aspect associated with resources because the licensee did not ensure that procedures were complete and accurate to assure nuclear safety H.2c].

Enforcement.

Facility Operating License, NPF-47, License Condition 2.C.(10) required, in part, that the licensee shall comply with the requirements of the fire protection program as specified in the fire protection program requirements. The fire protection program Section 9A.3.3.7 required, in part, the licensee to implement the requirements of National Fire Protection Association 27, Private Fire Brigade. National Fire Protection Association 27-1981, Section 3-2.3.2, required, in part, that the fire brigade maintain a prearranged schedule for availability to prevent conflict of duties and to cover absences. Contrary to this, on May 24, 2012, the licensee failed to maintain a

prearranged schedule for availability to prevent conflicts of duty for the fire brigade leader. Specifically, the licensee released the fire brigade leader for fitness-for-duty testing without maintaining adequate fire brigade staffing. The licensee documented this issue in Condition Report CR-RBS-2012-03817. Because this violation was of very low safety significance and was documented in the licensees corrective action program, it is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy: NCV 05000458/2012010-08, Failure to Prevent Conflicts of Duty for Fire Brigade Members.

4OA6 Meetings

Exit Meeting Summary

On October 11, 2012, the inspectors presented the inspection results to Mr. E. Olson, Site Vice President, and other members of the licensees staff. The licensee acknowledged the issues presented. The inspector asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Clark, Manager, Licensing

T. Evans, Manger, Operations

M. Feltner, Manager, Planning and Scheduling, Outages

C. Forpahl, Manager, System Engineering

R. Gadbois, General Manager, Plant Operations

H. Goodman, Director, Engineering

K. Huffstatler, Senior Licensing Specialist

B. Mashburn, Director, Engineering

E. Olson, Site Vice President

J. Roberts, Director, Nuclear Safety Assurance

D. Vines, Manager, Corrective Actions and Assessments

L. Woods, Manager, Quality Assurance

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000458/2012010-01 NCV Failure to Correct Spurious Isolations of Reactor Core Isolation Cooling System (Section 4OA5.2)

05000458/2012010-02 NCV Failure to Declare Reactor Core Isolation Cooling System Inoperable (Section 4OA5.2)

05000458/2012010-03 NCV Failure to Establish an Adequate Controlling Procedure for Stroking Safety Relief Valves at Low Power (Section 4OA5.3)

05000458/2012010-04 NCV Failure to Implement Effective Corrective Actions for Lockout Relay Failures (Section 4OA5.4)

05000458/2012010-05 NCV Failure to Test Lockout Relays in Accordance with Vendor Testing Practices (Section 4OA5.5)

05000458/2012010-06 FIN Failure to Establish An Adequate Cable Reliability Program (Section 4OA5.6)

05000458/2012010-07 NCV Loss of Onsite Safety Review Committee Independence (Section 4OA5.7)

05000458/2012010-08 NCV Failure to Prevent Conflicts of Duty for Fire Brigade Members (Section 4OA5.8)

Closed

Automatic Reactor Scram Due to Low Main Condenser

05000458/2012-002-00 LER Vacuum Resulting From Electrical Fault (Section 4OA3.1)

Reactor Scram Following a Loss of Main Reactor Feedwater

05000458/2012-003-00 LER Pump Due to Electrical Fault (Section 4OA3.2)

Attachment

Closed

Main Control Room Annunciator Control and Conduct of

05000458/2012009-01 URI Operations (Section 4OA5.1)

Past Operability of the Reactor Core Isolation Cooling

05000458/2012009-02 URI System (Section 4OA5.2)

Implementation of the Procedure for Infrequently Performed

05000458/2012009-03 URI Tests or Evolutions (Section 4OA5.3)

Corrective Action Program Implementation for Prior Lockout

05000458/2012009-04 URI Relay Failure in February 2011 (Section 4OA5.4)

Implementation of Vendor and Industry Recommended

05000458/2012009-05 URI Relay Testing and Maintenance (Section 4OA5.5)

Implementation of the Station Cable Reliability Program

05000458/2012009-06 URI (Section 4OA5.6)

Onsite Safety Review Committee Implementation

05000458/2012009-07 URI (Section 4OA5.7)

Ability to Promptly Staff the Fire Brigade at All Times During

05000458/2012009-08 URI Plant Operation (Section 4OA5.8)

Attachment