ML12006A072

Plant Trip During D-11-2 Maintenance Root Cause

ML12006A072
Person / Time
Site:	Palisades
Issue date:	10/17/2011
From:	Entergy Nuclear Operations
To:	NRC/RGN-III
References
EA-11-243, D-11-2 CR-PLP-2011-4822
Download: ML12006A072 (93)

Text

Entergy Nuclear Operations Palisades Plant Root Cause Evaluation Report Plant Trip During Panel ED-11-2 Maintenance CR-PLP-2011-4822: 09-25-11 REPORT DATE: 10-17-11 Rev 2. 12-27-11 POSITION NAME/DEPT. DATE Al Baerren RCE Evaluator (Maintenance )

10/17/11 Stacie Fontenot Independent Reviewer (Waterford) 10/20/11 Responsible Manager Chuck Sherman 12/27/11 (Radiation Protection)

CARB Chairperson Dave Hamilton 12/27/11 (GMPO)

Page 1 of 93

Entergy Nuclear Operations Palisades Plant Revision Changes Evaluator 0 Initial version approved by PLP A. Baerren CARB 1 1. Incorporation of Fleet Comments P. Deniston

2. Incorporation of IPEC O&P J. Kuemin review

3. Update to RC1

4. Change RC2 to a contributing Cause

5. Update Corrective Action Plan

6. Replace Attachment 1 timeline with timeline developed under PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev 0, Attachment 1

7. Added Why Staircase in Attachment 9.

2 Incorporation of 12/27/2011 CARB P. Deniston Comments J. Kuemin Page 2 of 93

Problem Statement On September 25, 2011, at 1506, while performing maintenance activities on DC electric distribution panel D-11-2, a short circuit condition occurred resulting in reactor trip.

Event Narrative The following narrative describes the sequence of events leading up to the short circuit and the subsequent reactor trip on Sunday 09/25/11. This information is based on available documentation from the event, interviews with plant personnel involved in the event and statements made during the Level 1 Human Performance Error Review (HPER) conducted following the event. Specific details are included in Attachment 1 - Event Time Line.

PREVIOUS MAINTENANCE ON PANEL ED-11-2 Prior to the 2010 refueling outage 1R21, routine preventive maintenance performed per work order WO52025543-01 identified that the green status indication lights for the containment escape air lock MZ-50 were not working.

Although CR-PLP-2010-3580 and work request WR210717 were issued at the time, this condition was not addressed until the troubleshooting activities scheduled for Thursday 09/22/11 under WO248834-01. This was because the repair of the lights was prioritized for completion during the next system window per EN-WM-100, Work Management System.

During refueling outage 1R21, ten of the eighteen breakers were replaced with new breakers and the remaining eight breakers were removed for periodic testing. The removal and installation of the DC breakers was completed per WO212303, Breaker Testing for ED-11-2 which included work instructions and attachments from Maintenance Procedure EPS-E-10, DC Breaker Inspection and Testing. The setting sheet for breaker 52-123, which later failed, was completed and included in the work order package. Upon the completion of D-11-2 breaker replacement the panel was returned to service per WO212303-04, step 5.1, by verifying that all loads of ED-11-2 have been restored.

Discovery of cross-threaded bus connectors and a bus connector air gap during troubleshooting under WO291194 on 09/25/11 suggested that the breaker replacement workmanship during 1R21 could have been substandard. An examination of the two removed connectors that was done for this root cause evaluation found that the threads had been partially stripped, either by repeated use or by over-torquing the bolts in the relatively softer metal of the connectors.

There was no evidence of damage on the tops of the connectors, such as scoring or gouging, to show that workers had found difficulty replacing the bus connector bolts which should have caused them to stop work and ask for help.

Page 3 of 93

The bolts used to attach each breaker to its bus connectors are stainless steel and less than one inch long.

Electricians present during the examination that was done for this evaluation, who were not involved in the work on the panel or with the current event situation, stated that the thread damage could have occurred during 1R21 or possibly earlier and that it would not have been recognized unless the threads had stripped free because the bolts need to positioned through a two inch deep recess. The bolts are normally taped to a long screwdriver to feed each through to its location.

As completed during 1R21, WO212303, and EPS-E-10, which was included with it, included no instructions other than steps to remove and then restore each breaker along with a caution to control breaker bolt nuts. Work order instructions did not specify a bus connector bolt torque value similar to Maintenance Procedure EPS-E-12, DC Breaker Replacement (12 inch-pounds). In addition, the instructions did not include detailed directions for breaker removal or for the method and sequence of reassembly. Although the procedure included a step for Maintenance management approval for work on energized circuits, this step was not completed because, as verified in eSOMS and work order records, the panel was tagged out with incoming fuses removed.

Based on this information, the cross-threading occurred during 1R21 and workers at that time failed to recognize the damage because of the lack of visibility and the lack of detailed instructions for breaker removal and installation in EPS-E-10.

INITIAL TROUBLESHOOTING AND REPAIR Following completion of forced outage associated with primary coolant system leaks, power ascension was in progress and work week managers were coordinating efforts to determine what work could be performed for the remainder of the week. During this coordination meeting it was determined that mechanical work associated with Containment Escape Hatch MZ-50 would be scheduled for early Monday 09/26/11. In support of the scheduled work, electrical maintenance needed to troubleshoot the green indicating lights for the Containment Escape Hatch door that were reported as inoperative.

WO248834 was issued to troubleshoot the indicating lights for MZ-50 and workers were briefed and sent to the field where they found that local interlock circuitry, indicating light bulbs, and limit switches were all functioning properly.

Troubleshooting on 09/22/11 determined there was no load side voltage on breaker 72-123 indicating the need for replacement.

WO291123 was generated to replace breaker 72-123 with additional work order tasks generated to test and install a replacement and the Right Train was Page 4 of 93

declared the protected train. The new work order plan was clear that breaker replacement involved work on the energized ED-11-2 bus. The Plant impact statement, approved on 09/22/11 by an on-duty SRO, recognized a potential risk in the loss of ED-11-2 and recommended a contingency review of ONP 2.3, Loss of DC Power which provides instructions for operators in the event of loss of DC power. Though the SRO recognized a potential risk, the EOOS risk assessment model was not run for the loss of the ED 11-2 bus. (EOOS shows loss or removal from service of ED-11-2 results in an Orange (High) nuclear safety risk factor of 5.8 requiring GMPO approval for entry.)

Testing was completed near the end of day shift on 09/23/11. The new breaker 72-123 was then replaced under the same work order beginning at approximately 1500 on 09/23/11. It was recognized that replacement of the breaker would allow completion of scheduled preventive maintenance on MZ-50. Although EOOS showed that removal of this breaker (risk factor 1.03) had no significant impact on nuclear safety, no evidence was found that the qualitative risk assessment also called for in EN-WM-104, On-Line Risk Assessment had been performed and documented. This assessment should have considered a broader range of affects including work on an alternate Friday when craft and management oversight resources were limited, the potential for loss of ED-11-2 noted above and the personnel safety issues involved with working on an energized bus. (EOOS shows loss or removal from service of ED-11-2 results in an Orange (High) nuclear safety risk factor of 5.8 requiring GMPO approval for entry.)

During restoration following completion of WO291123, at approximately 1635, Operations reported losing instrument air indication, a generator over-excitation alarm with the generator stable and a flickering voltage regulator auto-adjustor indicator. These conditions were documented under CR-PLP-2011-4801.

Operations entered Off Normal Procedure 7.1, Loss of Instrument Air and Electrical Maintenance resources were aligned through dayshift on Saturday and an initial EN-MA-125, Maintenance Troubleshooting, troubleshooting plan was drafted, assigned Risk Level 2 and approved by EFIN, electrical maintenance and the shift manager. Risk Level 2 was justified based on procedure guidance -

the breakers being checked remained in service but troubleshooting involved only voltage checks, connection tightening and breaker operating. However, with the causes unknown, this additional troubleshooting was performed under WO291123 beginning on the night shift of 09/23/11.

Troubleshooting revealed no voltage on load side of 72-119 (Main Control Room Panel EC-13). In addition, a slight misalignment in the mounting of breakers 72-119, 72-121 (Excitation Control Panel E01), and 72-123 (Emergency Air Lock MZ-50) was identified. Efforts also identified a small air gap between the positive bus connector and its line side positive connection on breaker 72-119 which had resulted in minor arcing and a slightly elevated temperature (~2 degrees F) as determined by thermography of the panel with all breakers installed.

Page 5 of 93

Troubleshooting was complete by the end of the night shift on the morning of 09/24/11.

Based on the troubleshooting results, an OCC alignment meeting was held at 0800 on 09/24/11 with the system engineering manager, the operations shift manager, the maintenance manager, the assistant operations manager, the outage manager, the training manager, the engineering programs manager and the MP&C manager. Following a discussion of Plant status and recognition of the equipment out of service, there was a discussion about potential Plant risk including loss of ED-11-2, entry into an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> LCO and the potential for tripping the Plant.

In addition, it was recognized that a temporary modification would be required to power the generator voltage regulator to allow removal of suspect DC breakers in ED-11-2 for examination to ensure that bus connections were properly aligned, flush mounted, and making secure electrical contact. This would include the three suspect breakers as well as breaker 72-120 to ensure access to the breaker bus connector bolts. The temporary modification would power breaker 72-121 loads from an alternate source fed from the same bus through breaker 72-127. Although the full scope of planned work was discussed, as well as the potential risk Plant risk, no qualitative risk assessment was documented.

By the end of day shift on 09/24/11, replacement breakers were procured and tested for 72-119 and 72-121 in the event they were found defective. An EOOS risk assessment was performed by Operations considering the breakers to be removed. It did not include a review of the potential loss of ED-11-2 and no qualitative risk assessment review was documented which included the breakers, the temporary modification and the panel along with the industrial safety and resource factors involved with working during an off-Friday weekend. (A post-event EOOS evaluation shows loss or removal from service of ED-11-2 itself results in an Orange nuclear safety risk factor of 5.8 requiring GMPO approval to go forward.)

TEMPORARY MODIFICATION The temporary modification was approved for installation at 0345 on 09/25/11 as EC31973 and translated into work instructions which were included in WO291209. It was identified that work hour rules would require the Electrical supervisor to leave at 0600 on the morning of 09/25/11 with no suitable replacement eligible to report until 0800. Because of the scope of work, it was not considered feasible to cover that gap with inexperienced or cross discipline supervision. However, after further discussion, it was determined that the brief would proceed to capture any learning to prepare the next shift.

Page 6 of 93

The temporary modification brief was started beginning at 0515 on 09/25/11 with duty station manager, electrical superintendent, NRC resident, engineering and work crew present. During the brief the electrical superintendent noted that workers appeared tired and recognized that no supervisor would be present between 0600 and 0800. Based on this information and complexity and risk associated with the task, the electrical superintendent decided to delay the work until the 09/25/11 day shift with the superintendent providing face-to-face turnovers with the day shift Maintenance Superintendent and the Electrical Supervisor.

For development of the breaker removal and inspection work order task instructions, the electrical superintendent and the responsible engineer reviewed with the electrical planner the scope of repair work after the temporary modification was installed. Input included engineering ideas for inspection of the breakers and panel as well as details on work sequencing and warnings.

A prejob brief was conducted with the day shift Electrical maintenance work crew upon arrival of the dayshift supervisor at 0800. Discussion included the critical steps identified for installing the temporary modification as well as additional details on the sequence of work in panel ED-11-2. Two critical steps were clearly outlined in the work order task instructions, both related to the industrial safety aspects of work on 125 VDC during installation of the temporary power. The Plant impact statement identified the potential for the loss of the turbine. During the HPER, crew members indicated that discussions also included avoiding worst case possible events by insulating the bus connectors and sequencing the breaker removal per the instructions in the temporary modification. These details had been discussed during the brief conducted on the previous shift.

The brief used the EN-HU-102, Human Performance Tools medium risk prejob brief checklist that had been prepared for that work by the previous Electrical maintenance crew. However, based on the Prejob Brief Decision Flowchart (EN-HU-102, Attachment 9.1), a Detailed Checklist would have been appropriate because the potential turbine impact and work on energized equipment.

Although both checklists include the same areas, the detailed checklist provides more detailed coverage of roles and responsibilities, human performance tools and potential risk that would have been appropriate for the planned work.

The temporary modification was successfully installed under WO291209 and EC31973. This activity was completed at approximately 1100 on 09/25/11.

BREAKER REMOVAL AND REPLACEMENT Following the installation of EC31973, preparations began for the removal, inspection and restoration of panel ED-11-2 breakers 72-119, 72-120, 72-121, and 72-123. This work was performed under WO291123 for 72-123, WO291194 for 72-119 and 72-120 and WO291210 for 72-121. These work orders indicated Page 7 of 93

they were based on Maintenance Procedure EPS-E-10, DC Breaker Removal and Inspection. This procedure, which had not been revised since 2007, included outdated Nuclear Management Corporation and Plant procedure references. In addition, no critical steps were identified even though the procedure stated there was potential for worker injury and specifically, that shorting ED-11-2 bus bars could result in Plant trip. Also, instructions to insulate energized bus bars and to control breaker bolt nuts were contained in procedure Notes, and not in procedure steps. Finally, instructions for restoration of removed breakers were limited to reinstall breakers in proper position. At the HPER, crew members stated that they had attempted to obtain detailed panel drawings and had not been able to locate them. The need for this information was supported by the later discovery of cross-threaded bus connector bolts which indicated that the method and sequence of reassembly required more detailed instructions or drawings.

Based on the scope of work to be performed, the EN-HU-102 Prejob Brief Decision Flowchart again indicated a Detailed Brief, at a minimum, should have been performed and documented. However, no qualitative risk assessment had been performed earlier or after the 0800 OCC meeting the previous day. The electrical maintenance crew conducted a prejob brief, although, in this case, no prejob brief checklist was used and the guidance provided by EN-MA-101, Conduct of Maintenance and EN-HU-102 was not consulted. CR-PLP-2011-4981 was issued to document this condition.

This prejob brief, which was conducted at 1300 on 09/25/11, was attended by the duty station manager and the shift manager, as well as the NRC resident.

Because this work would be performed with panel ED-11-2 still energized, the crew discussed the need for care in the use of Personal Protective Equipment and electrical insulation to prevent personal injury and to make sure the non-captive breaker attachment nuts were positively controlled. No critical steps were assigned. It was determined that insulating plastic sheets would be used to cover the energized bus and connectors. The acting Maintenance Manager, who attended the brief and who was made aware after the fact by the supervisor that no formal prejob brief checklist had been used, gained assurance from the supervisor that necessary points had been covered.

Following the prejob brief, work began on removal of breaker 72-120 under WO291194. As it was removed, a small air gap was noted between the positive bus connector and the line side positive connection on breaker 72-119. An initial attempt was made to tighten this connection and close the air gap. However, the termination screw was found to be cross-threaded which prevented it from being tightened further. All breakers were then removed under their respective work orders.

BUS CONNECTOR REPAIRS Page 8 of 93

Following the removal of all four breakers, evidence of cross-threading damage was also found on the bus connector for 72-120. With concurrence from engineering, maintenance management and electrical maintenance supervision, the crew reached a decision to remove the bus connectors for both breakers 72-119 and 72-120 from the energized bus and to return them to the maintenance shop where the damaged threads could be repaired by retapping.

The work could then be performed away from the energized bus and free from the risk of small metal particles falling into the bus or into other breakers. The following picture shows the two bus connectors that were to be removed:

During the HPER, crew members stated this did not constitute an increase in work order scope or a change in its intent because of the general words about chasing threads and replacing fasteners. Removal of the connectors from the energized bus was considered both within the skills of experienced workers and prudent because it eliminated the potential for loose foreign material from tapping the threads in place. However, those work order instructions emphasized CLEAN and TIGHTEN and did not specifically include the term REMOVE.

The bus connectors were removed starting from the 72-119 connectors at the top. One worker would hold a flashlight while another, using an insulating glove Page 9 of 93

in one hand to control the position of the connector and to provide insulation, loosened the screw that held it to the bus with the other hand. Although use of insulating material placed over the connectors had been discussed at the prejob brief, crew members decided on their own that insulating gloves would provide better control. The electrical maintenance supervisor, who was not consulted, was close enough to be in a position to observe and question the approach that was taken.

As the connectors were being removed, the worker holding the connector was startled, by an apparent flash or spark, into an involuntary motion that caused him to release the connector. Fortunately, the involuntary motion was such that no electrical shock occurred. The end of the connector, which had by now been loosened at its bus end, was able to swing down and contact the bus connector below it resulting in a short circuit between the positive and negative bus sections. The following picture was taken shortly after the short circuit occurred:

In this situation, both the decision to remove damaged bus connectors from the panel and the decision to use insulating gloves rather than insulating material between the connectors were changes in work scope that should have resulted in a work stop to re-brief.

PLANT EQUIPMENT RESPONSE Page 10 of 93

As a result of this occurrence, the reactor tripped following a loss of power to ED-11-2. The 125 VDC diagram below can be used to visualize the sequence of equipment events leading up to the Plant trip. Items boxed in red factored into the trip.

Upon completing the short circuit, three events occurred in a short time frame (the actual sequence cannot be determined).

Breaker 72-37 (Inverter No.1 ED-06 Power Supply Breaker) opened. This was due to internal capacitors on the line side of ED-06 (Inverter No. 1).

These capacitors discharged, feeding the fault in ED-11-2 (125 VDC Panel). The discharge resulted in an outrush of current that caused breaker 72-37 to trip open.

Page 11 of 93

ED-15 (Battery Charger No. 1) supplied fault current and tripped its output breaker 72-15.

Breaker 72-01 (Isolation Breaker To DC Battery No. 1 ED-1) opened due to internal protective features.

Due to the above protective functions, the connected busses, ED-10R (125 VDC Bus) and ED-10L (125 VDC Bus) were isolated and dead at zero volts DC.

With ED-10R (125 VDC Bus) at zero volts DC, there is no power input to ED-06 (Inverter No. 1) and therefore no 120 VAC output from ED-06. As ED-10L (125 VDC Bus) is at zero volts DC, there is no power input to ED-08 (Inverter No. 3) and therefore no 120 VAC output from ED-08.

Y-10 (Preferred AC Bus EY-10 No. 1 Inverter) receives power from Inverter #1 (Inverter No. 1 ED-06 ) and given no output from Inverter #1, the Y-10 bus drops to zero VAC. Y-30 (Preferred AC EY-30 Bus No. 3 Inverter) receives power from Inverter #3 (Inverter No. 1 ED-08) and given no output from Inverter #3, Y-30 bus drops to zero VAC.

In the cases of the Y-10 and Y-30 busses, output from the Inverters did not automatically transfer to the alternate source due to the design of the system.

On all four Station Inverters ED-06, ED-07, ED-08 and ED-09; the alternate source is not normally powered due to system configuration. Power to the alternate source of a Station Inverter comes from Instrument AC at the Y-01 panel and connection to a particular Inverter is controlled via a Kirk Key interlock.

Thus, it is not possible to power more than one inverter at a time from the Instrument AC bus.

RPS Channel A (RPS Channel A RPS-AW8 Power Assembly) is a drawer which contains +/-15 Vdc power supplies, one for each RPS Trip Unit as well as the 28 Vdc Matrix power supplies. RPS Channel A receives power from Y-10 (Preferred AC Bus EY-10 No. 1 Inverter). As Y-10 output is at zero VACS, there is no input power to the RPS power supplies in RPS Channel A.

RPS Channel C (RPS Channel C RPS-CW8 Power Assembly) is a drawer which contains +/-15 Vdc power supplies, one for each RPS Trip Unit as well as the 28 Vdc Matrix power supplies. RPS Channel C receives power from Y-30 (Preferred AC Bus EY-30 No. 3 Inverter). As Y-30 output is at zero VACS, there is no input power to the RPS power supplies in RPS Channel C.

Given the loss of power to two of the four RPS Logic Channels (Channel A and Channel C), a Reactor Trip signal occurred, all four RPS Clutch Power Supplies deenergized, and control rods dropped into the core. Plant systems functioned to shut down the reactor safely and the Right Train of the 125 VDC system Page 12 of 93

remained operable. A similar Plant response would have occurred if breaker 72-02 had tripped causing a loss of power to RPS Logic Channels B and D.

Revision 1 of the Operability Evaluation for CR-PLP-2011-4835 and CR-PLP-2011-4965 showed that, based on as found testing, the instantaneous trip setting for breaker 72-01 was 3400A against an expected instantaneous trip of FUZ/

D11-2 of 8000A. Its setting was at its minimum value. This provided an explanation for the failure of FUZ/ D11-2 to actuate prior to breaker 72-01 trip.

As found testing of breaker 72-02 found it at its maximum setting of 5600A.

Based on discussions with system engineering, if breaker 72-01 had stayed closed, FUZ/D-11-2 would have been expected to isolate the fault. CR-PLP-2011-4835 CA-07 has been assigned to analyze the adequacy of breaker 72-01/

panel fuse coordination.

CORPORATE EVENT RESPONSE TEAM (CERT)

Following the reactor trip, a corporate event response team (CERT) was dispatched to Palisades to independently review the causes and contributors to the event with a special focus on the organizational and programmatic aspects.

A CERT report summarized the teams findings.

Portions of the CERT report executive summary that answer why the processes were not followed are provided below. Supporting details as well as other event related conclusions are included CERT report.

Overall, the CERT found that senior leaders have not been sufficiently engaged and intrusive to identify and correct significant behavior and performance gaps at all levels of the organization. Even on those occasions when issues are identified, leaders have not exhibited a bias for action to close those gaps. As a result, plant personnel have a culture of informality that pervades many aspects of the sites performance, including risk assessment, work control, and procedure adherence. This informality was demonstrated in several processes over the course of the events that led up to, and after, the reactor trip. Examples include failure to document a pre-job brief (pre-trip) and the Shift Manager acting outside of their assigned role (post-trip). Managers and supervisors do not have a clear picture of excellence with regard to their roles and responsibilities, and have not been consistently challenged to strictly adhere to fleet or station processes and procedures.

The following findings are considered to be the most significant:

Intrusiveness and Engagement - Senior leaders were not sufficiently intrusive into plant activities, did not understand the work scope and potential plant impact, and, therefore, did not ensure an appropriate organizational response. For example, following the initial transient on the D-11-2 bus resulting in loss of instrument air compressors, leaders did not assemble appropriate managers to Page 13 of 93

review the scope and risk of the planned activities, challenge the proposed course of action, and arrange adequate oversight for the work activities.

Risk Recognition and Management - Senior leaders have not established a culture in which station personnel are sufficiently sensitive to risk recognition and management. Both individual and organizational behaviors exhibited during the events leading to the reactor trip underscore this insensitivity. Managers, supervisors, and workers consistently indicated that work on energized DC circuits was not a big deal and stated that such work is performed frequently.

Personnel involved in development of the plan to address the issues in D-11-2 made the decision to perform the work on a live bus and were comfortable relying on fuses to protect against cascading faults. Additionally, workers made a decision that it was not necessary to insulate the live bus bar extensions because it was only 125 VDC and because, if anything happened, the fuse would blow. Engineers and operators agreed to temporarily power the generator automatic voltage regulator from the same panel that contained the fault they were trying to correct even though they were not sure of the nature or extent of the fault.

Commitment to Process Implementation - Senior leaders have not adequately reinforced a commitment to implementation of fleet and station processes and procedures, and are not effectively leveraging those tools to establish the framework required to ensure safe and reliable plant operations. The team identified several fleet and station processes that have not been properly implemented at Palisades. These include:

Leadership and Alignment (L&A) Meetings Leadership Effectiveness Logbook MELT identification Critical evolution process (EN-FAP-WM-102)

Focused crew assessment Online Risk Assessment (EN-WM-104)

Weaknesses in the implementation of these, and other, processes contributed to the event and leave the station vulnerable to future events and\or plant transients.

Nuclear Safety Culture Monitoring Panel Subsequent to the Reactor Trip on 9/25/11, The Nuclear Safety Culture Monitoring Panel convened on 11/3/11. As a result of the discussion surrounding the 9/25/11 Reactor Trip and the subsequent analysis conducted by the RCE team, the NSCMP members unanimously recommended that a 3rd party Nuclear Safety Culture Assessment take place at Palisades. The independent evaluation was determined to be necessary based on feedback from previous assessments indicating employee perceptions that no action would be taken based on self-assessment and that fleet procedures and policies are part of the problem.

Page 14 of 93

Root Cause Analysis METHODOLOGY Following the initial interviews of workers involved during the Human Performance Error Review process and a review of relevant procedures, an Event Timeline (Attachment 1) was developed. Attachment 1 was based on the timeline provided to the Corporate Event Response Team during the week following the event. The evaluation team employed a Failure Mode Analysis (Attachment 2) to identify significant factors that lead to the trip which is also shown graphically in Attachment 3 - Failure Mode Chart. A Barrier Analysis (Attachment 4) and a Change Analysis (Attachment 5) were used to identify and classify the actual causes. A "Why Staircase" was developed for Revision 1 of this report in order to help clarify the decision sequence leading up to the Reactor Trip. The "Why Staircase" is presented in Attachment 9. The analysis process identified the following causes:

Root Cause 1 Senior leaders have not established a sufficiently sensitive culture of risk recognition and management, which resulted in the plants managers, supervisors and workers not recognizing, accounting for, or preparing for the industrial safety risk and plant operational nuclear risk, involved with the panel ED-11-2 breaker inspection and replacement maintenance.

Supporting Information:

During the evaluation and during HPER1 interviews conducted immediately following the event, numerous examples demonstrated that managers, supervisors and workers do not adhere to risk control processes. Interviews and review by the CERT following the event brought evidence of senior leadership involvement in the root cause. The site culture has been acceptance of behaviors that resulted in failure to take any of the steps which could have prevented the event during the 09/25/11 breaker removal and inspection work on panel ED-11-2:

Senior leaders have not been sufficiently engaged and intrusive to identify and correct significant behavior and performance gaps at all levels of the organization. As a result, plant personnel have a culture of informality that pervades many aspects of the sites performance, including risk assessment, work control, and procedure adherence. This informality was demonstrated in several processes over the course of the events that led up to, and that followed, the reactor trip. Managers and supervisors do not have a clear picture of excellence with regard to their roles and Page 15 of 93

responsibilities, and have not been consistently challenged to strictly adhere to fleet or station processes and procedures.

The Maintenance crew accepted their work order plan even though they had raised questions about the availability of panel drawings which could not be found and although the Operations plant impact review indicated there was a risk for Plant trip.

Breaker replacement work orders were not flagged as compliance work orders although Attachment 9.5 to EN-WM-105, Planning includes risk of transient and reliance on skill of the craft as compliance work order criteria.

The Maintenance crew assigned no critical steps although work involved maintenance on high critical equipment for which spurious control room signals had been received. This was regardless of the fact that a temporary modification was installed to provide that power from breaker 72-127 in panel ED-11-2.

The EOOS risk assessments that was performed by plant Operations staff, was based on breaker removal, did not include loss of ED-11-2, and no qualitative assessments were documented to capture the more subjective concerns of weekend work or work on energized equipment.

Although there were clear notations that breaker removal could affect ED-11-2, this work was not identified as a high risk activity requiring GMPO approval as described by EN-WM-104. Opportunities for this to happen occurred when breaker 72-123 was replaced Friday night, during the 0800 OCC meeting on Saturday morning, prior to temporary modification Sunday morning and before breaker replacement on Sunday morning.

So that a planned surveillance on the containment escape hatch could be completed the following week, the original breaker replacement work was performed on an alternate Friday off with fewer resources on site. When difficulties were encountered, additional work was required over the weekend when resources were limited.

No formal documented prejob brief was performed for the breaker replacement work using the checklists identified by EN-HU-102 even though the work involved safety related equipment that required troubleshooting and work would be performed on energized equipment.

Although EN-IS-123 was consulted to identify PPE requirements, neither EN-MA-101 nor EN-HU-102 was consulted for prejob brief guidance.

After cross-threaded breaker connectors were discovered, the decision to remove them from the panel was made by the crew although the work order plan did not include the term REMOVE. The Lead Electrician Page 16 of 93

confirmed that no additional OE had been considered with respect to the bus stab removal. OE had been covered at the morning brief, but did not include OE relevant to the disassembly of portions of the bus.

Workers were initially briefed on a plan to use insulating plastic sheets to prevent injury and short circuits. The plan was changed to the use of insulating gloves without stopping to rebrief.

Regardless of supervisor and manager training based on SOER 10-2, none of those present at the prejob brief, including the Duty Station Manager and the Shift Manager, or at the work site, identified or corrected lapses in the conduct of the prejob brief, the lack of critical steps or the failure to stop and rebrief when the job plan changed.

Management personnel, including the Electrical Superintendent and the Duty Station Manager, exceeded established work hours potentially reducing their effectiveness for oversight and direction.

(CR-PLP-2011-5095)

Beginning with the initial plans to replace breaker 72-123 on an off Friday, senior site leadership were not sufficiently intrusive into work on panel ED-11-2, did not sufficiently challenge planned courses of action and did not provide adequate oversight.

There were indications that the acting senior leadership team was reluctant to take decisive, timely action to address problems.

May 2011 mid-cycle assessment identified, in AFI OR.2-1, that weakness in alignment of the management team by senior leaders has resulted in failure to sustain a culture of continuous improvement.

Contributing Cause 1 Breaker and fuse coordination for the 125 VDC system left train was insufficient to prevent a reactor trip under the short circuit conditions experienced during ED-11-2 maintenance on 09/25/11.

Supporting Information:

Breaker 72-01, Isolation Breaker To DC Battery ED-1, is a shunt breaker that is used in conjunction with a trip switch to isolate the balance of the left channel DC circuit from panel ED-11A for a fire in the cable spreading room. The shunt breaker will actuate if it sees a fault current. It will also operate if it receives a remote signal to operate. Plant documentation has recognized that the breaker operates from a remote signal. This remote signal comes from the trip switch.

Page 17 of 93

Plant documentation has not recognized that, because of its configuration, breaker 72-01 will also actuate magnetically.

Breaker 72-01, and its right train counterpart 72-02, Isolation breaker to DC Battery ED-2, were installed in 1981 under FC-407-14C. The design specification included with the modification called for breakers equipped with a shunt trip and auxiliary switch to prevent battery drain from ground faults in the DC system due to fires in the cable spreading room. The design specification did not call for a breaker with magnetic trip or auto-trip feature. While this was in agreement with FSAR 8.3.5.2 which describes the two breakers as non-automatic and not intended to interrupt fault currents, it did not specifically state that the auto trip feature should not be provided which would have been more correct and which would have prevented the mistake in ordering the breakers.

The modification package also included procurement and receipt inspection documents. When breakers 72-01 and 72-02 were ordered from the supplier, Gould-ITE under PO 5248 (dated 12-28-79), the items specified were Class 1E/

Seismic Class 1 circuit breakers similar to Gould-ITE Catalog KM3B-800 which were to be shipped with KM2RD shunt trips and KM0LO auxiliary switches. It was not recognized at the time that the breakers ordered this way included the auto-trip feature.

Because no bill of lading or certificates of compliance were received when the two shunt trip breakers arrived, receipt inspectors performed a detailed physical inspection on 10/21/80. Disassembly of one breaker determined that, based on the supplier catalog, the KM3T800 trip assembly and the KM3F800 frame were, as ordered, a type KM3B800 breaker. Current Maintenance personnel explained that although workers experienced with circuit breakers would have recognized by the adjustable settings that the breakers received included an automatic trip feature, the receipt inspectors would not have realized that unneeded features had been provided.

Given the loss of power to two of the four RPS Logic Channels (Channel A and Channel C), a Reactor Trip signal occurred, all four RPS Clutch Power Supplies deenergized, and control rods dropped into the core. Plant systems functioned to shut down the reactor safely and the Right Train of the 125 VDC system remained operable.

This condition was resolved temporarily after the event by changing the magnetic trip setting of breaker 72-01 (and breaker 72-02) to its maximum value -

approximately 5600 amperes. This was accomplished via a temporary modification under EC32028 which will remain in force until a permanent method of resolving the design discrepancy is implemented.

Page 18 of 93

Contributing Cause 2 Work orders used for removal and inspection of breakers 72-119, 72-120, 72-121 and 72-123 did not include details appropriate for maintenance on energized, high critical electrical equipment with the Plant on line.

Supporting Information:

The work order plans used in this case were based on Maintenance Procedure EPS-E-10 which was identified as having the weaknesses listed below. Work on this equipment during 1R21 was performed using this procedure directly which the evidence suggests were the cause of the deficiencies being repaired:

No critical steps were identified even though the procedure stated there was potential for worker injury and Plant trip Instructions to insulate energized bus bars and to control breaker mounting bolt nuts were contained in Notes.

The discovery of cross-threaded bus connectors indicates the method and sequence of reassembly require more detailed instructions and/ or drawings to prevent damage in the future (refer to pgs 2 & 3 above)

An examination of the two removed connectors found that the threads had been partially stripped by over-torquing the bolts in the relatively softer metal of the connectors.

The method for insulating and removing damaged bus connectors for repair was left up to the discretion of the work crew.

The conditions surrounding work in these panels, such as the close proximity of the opposite phase bus connectors and the non-captive breaker bolt nuts, coupled with the fact that the work in the panels is not performed regularly, increased the chance of error and prompted an unsuccessful attempt by the crew to find detailed drawings.

Work order plans were based on EPS-E-10 which had not been revised since 2007. This document contained outdated references to NMC and Plant documents and, as a model for work being performed, included no critical steps.

Although it had been in use since 2007, the outdated status of EPS-E-10 had not been recognized by workers and identified for update. No DRNs were found to be active.

Page 19 of 93

In this situation, the quality of the work instructions was affected by the use of an outdated procedure for emergent work. For the future, this should be corrected by the use of approved procedures for all work on these busses. Corrective action is assigned to update EPS-E-10.

Contributing Cause 3 Oversight by managers and supervisors did not result in identification and correction of the human performance errors and weaknesses in the work involving the inspection and replacement of breakers in the ED-11-2 panel.

Supporting Information:

Although management observers and maintenance supervisors were present at both the breaker replacement prejob brief and during the work itself, the following conditions, which existed or took place, could have been identified but were not corrected:

No critical steps were identified during planning and the prejob brief even though there were Plant operational and industrial safety considerations The prejob brief was not conducted as a high risk or IPTE brief per EN-HU-102 (Human Performance tools) and the procedure was not used as a reference.

The prejob brief was not documented on any of the checklists provided in EN-HU-102. Following the brief, the decision not to use the checklist was made known to and discussed with the acting Maintenance manager who was present for the brief.

The supervisor did not challenge the decision to change the insulation method to be used during breaker removal.

Managers and supervisors present did not challenge the decision to remove bus connectors from the panel for repair without re-brief or work plan revision Contributing Cause 4 Managers, supervisors and workers did not consistently follow approved procedures for job preparation, job execution and risk management.

Page 20 of 93

Supporting Information:

The Maintenance crew accepted their work order plan even though they had raised questions about the availability of panel drawings which could not be found and although the Operations plant impact review conflicted with work plan precautions which indicated there was a risk for plant trip.

Workers continued in the face of uncertainty contra to EN-MA-101.

No critical steps were identified during planning and the prejob brief even though there were plant operational and industrial safety considerations per EN-HU-105.

The prejob brief was not documented on any of the checklists provided in EN-HU-102 and was not conducted as a high risk or IPTE brief per EN-HU-102 (Human Performance tools). The procedure was not used as a reference.

Work order plans to repair breaker bus connectors on the bus were changed and briefed plans to use insulating plastic sheets were changed to use insulating gloves. These changes were made without proper controls per EN-MA-101.

Assessments of plant risk were limited to EOOS calculations of nuclear safety risk for removal of breakers. No qualitative assessments of risk as described in EN-WM-104 were performed to consider the more subjective aspects of schedule, personnel safety or the effects on other equipment.

Management personnel, including the Electrical Superintendent and the Duty Station Manager, exceeded EN-OM-123 established work hours potentially reducing their effectiveness for oversight and direction.

Organizational and Programmatic Weakness Evaluation An evaluation for organizational and programmatic weaknesses was performed to understand the relationship between the identified causes and to identify any Latent Organization Weaknesses (LOW) that influenced this condition. The root and contributing causes were screened against the five categories of O&P issues defined in EN-LI-118, Root Cause Evaluation Process, Attachment 9.5.

ORGANIZATION TO ORGANIZATION INTERFACE WEAKNESSES No weaknesses identified Page 21 of 93

ORGANIZATION TO PROGRAM INTERFACE WEAKNESSES OP2A - Lack of Commitment to Program Implementation: Examples of procedure noncompliance involved managers, supervisors and workers and included changes to established work plans.

(Supports Root Cause 1/ Contributing Cause 4; CA27)

OP2B - Inadequate Program Monitoring or Management Skills: Based on overall results of the evaluation including internal plant operating experience.

This condition, which is described in the Safety Culture Evaluation (decision-making work control, and work practices), involves leadership performance and organizational effectiveness, and is considered to be a Latent Organizational Weakness. (Root Cause 1; CA49, 50, & 51)

OP2D - Lack of Program Implementing Authority : Managers, supervisors and workers in all parts of the plant organization did not employ established risk management processes or prepare for the industrial safety and plant operational risk involved with the panel ED-11-2 breaker maintenance. (Root Cause 1; CA28, 30, & 32)

PROGRAM TO PROGRAM INTERFACE WEAKNESSES No weaknesses identified PROGRAMMATIC DEFICIENCIES OP4A - Insufficient Procedure Details: Work orders used for removal and inspection of breakers 72-119, 72-120, 72-121 and 72-123 did not include details appropriate for maintenance on energized, high critical electrical equipment with the plant on line and they were based on a procedure that was out of date.

(Contributing Cause 2; CA33, 34, 35)

OP4M - Inadequate Design Change Documentation: Breaker and fuse coordination for the left train 125 VDC system did not prevent the 09/25/11 reactor trip (Contributing Cause 1; CR-PLP-2011-4835, CA07)

ORGANIZATIONAL DEFICIENCIES OP5A - Inadequate Function or Structure: The Maintenance crew accepted their work order plan even though they had raised questions about the availability of panel drawings which could not be found. There were no changes to the plan because of this and no critical steps were assigned. (Supports Root Cause 1; CA30, 31, 33, & 34)

Page 22 of 93

OP5AD- Inadequate Evaluation of Risk and Consequences: At four different points, opportunities to perform qualitative risk assessments were not performed (Supports Root Cause 1; CA30)

OP5AD- Inadequate Evaluation of Risk and Consequences: Workers initial plans to repair bus connectors on the bus and to use insulating plastic sheets were revised without rebrief (Supports Root Cause 1; CA-27)

OP5AE- Insufficient Awareness of Impact on Safety and Reliability:

Regardless of supervisor and manager training based on SOER 10-2, none of those present at the prejob brief or at the work site, identified or corrected lapses in the conduct of the prejob brief, the lack of critical steps or the failure to stop and reconsider when the job plan changed. (Root Cause 1; CA27, 30, 31, & 32)

OP5C - Inadequate Work Prioritization Process: No formal documented prejob brief was performed for the breaker replacement work using the checklists identified by EN-HU-102 even though the work involved safety related equipment that required troubleshooting and work on energized equipment. Although EN-IS-123 was consulted to identify PPE requirements, neither EN-MA-101 nor EN-HU-102 was used by the crew. (Root Cause 1 and Contributing Cause 4; CA-25)

OP5C - Inadequate Work Prioritization Process: Management personnel, including the Electrical Superintendent and the Duty Station Manager, exceeded established work hours potentially reducing their effectiveness for oversight and direction. (Root Cause 1; CA26)

OP5D - Inadequate Communication within the Organization: Although it had been used more than once, including 1R21, workers had not questioned the 2007 revision status of Maintenance Procedure EPS-E-10 and no outstanding DRNs were found. (Contributing Cause 2; CA33, 34, 35, 36, & 37)

OP5Q - Lack of Supervisory Monitoring: Oversight by managers and supervisors did not result in identification and correction of the errors and weakness that lead to this event. (Contributing Cause 3; CA49, & 50 )

OP5T - Inappropriate Schedule Emphasis: The original breaker replacement work was performed over a weekend, when limited resources were available, so that a scheduled surveillance on the containment escape hatch could be completed as scheduled the following week. (Root Cause 1; CA28, & 30)

Summary A collective review of the Organizational and Programmatic Weaknesses did not identify any additional gaps that need to be evaluated under this root cause evaluation. Organizational Deficiencies were the primary drivers identified during this review and substantiate the root cause as determined in this evaluation.

Page 23 of 93

Safety Culture Evaluation The Safety Culture Evaluation reviewed the Root and Contributing Causes against the thirteen Safety Culture impact areas described in EN-LI-118 .6. The purpose of this review was determine whether the identified causes reflected in a negative way on the sensitivity and priority of plant personnel with respect to nuclear safety. After reviewing each cause statement against the descriptive information in Tables 1 and 2 of EN-LI-118 Attachment 9.6, there was evidence of gaps in the fleet expected nuclear safety culture as follows:

Decision-Making:

1. Following the departure of the last site vice president in November 2010, the GMPO was elevated to the position of acting site vice president. The NSA director was made the acting GMPO, and the licensing manager was made the acting NSA director. There are indications that this team was reluctant to take decisive, timely action to address problems. The May 2011 mid-cycle assessment identified, in AFI OR.2-1, that weakness in alignment of the management team by senior leaders has resulted in failure to sustain a culture of continuous improvement.

2. Senior leaders do not consistently exhibit a bias for action when addressing organizational issues. For example, senior leaders had seen indications of weakness in managers support of the duty team during the forced outage earlier in the month, but they did not take action to ensure that the necessary levels of support were provided over the weekend of the event. Entergy does not have a formalized process for duty team activation, therefore activation is not rigorous and was not effectively implemented. During interviews, it was determined that the site duty manager remained on site for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before being relieved.

3. The site vice president and directors did not understand the scope and risk of the maintenance activities that were being conducted on the D-11-2 bus. When questioned, both the site vice president and the GMPO stated that they did not believe that it was necessary for them to be made aware when planned work was occurring in an energized DC bus. The site vice president did, however, state that he should be informed of any unplanned work in energized DC buses and that the GMPO should be aware of both planned and unplanned work in DC buses.

4. Personnel involved in the decision to perform the work believed that the worst consequence of a problem during the job was a loss of the D-11-2 bus and exhibited relative ease accepting the potential for the extensive consequences of Page 24 of 93

such an event. Additionally, the individuals involved were comfortable relying on a fuse to prevent cascading of a fault.

5. Decision-making reflects a lack of understanding of proper risk assessment and management. For example, the decision to remove the bus bar extensions (the activity that caused the trip) was made in the field by the work crew and the site duty manager without written direction and without the knowledge of operations personnel. Also, the decision not to insulate the bus bar extensions was made by the electricians without consultation with others even though during their prejob discussion of the work they had informally talked about installing the insulation. Both the shift manager and the electrical supervisor assumed that the insulation would be used, but because of the informality of the discussion and the vagueness of the work order guidance (installation of insulation was in a note rather than as a step), the crew felt that they did not need to insulate.

Resources:

1. Work was suspended on the "Alpha" shift on 9/24/11 due to worker fatigue.

There was a two hour overlap between the "Alpha" shift Electrical Supervisor leaving the site and the "Bravo" shift Electrical Supervisor coming on shift. This necessitated a face-to-face turn over with the Electrical Superintendent who was himself in violation of fatigue rule standards.

Work Control:

1. The plant impact statements for the work orders used over the weekend stated that the work carried low risk. This was not challenged by operations personnel. The EOOS risk process was not used consistently to evaluate the impact of work. For example, EOOS risk profile was evaluated for troubleshooting of the D-11-2, but not for later work involving removal of several breakers. An EOOS risk profile was not obtained for loss of this panel. As such, the potential risk of this activity was never fully assessed.

2. The electrical supervisor allowed work to proceed with a work order that did not meet fleet standards.

Work Practices:

1. The supervisor and crew rationalized that a thorough discussion was an acceptable substitute for a formal prejob briefing. The station duty manager and the shift manager participated in the discussion but did not recognize or correct this gap.

2. Several members of the management team stated that the work on the bus was being performed by master electricians who should not need a lot of oversight.

3. In several cases, personnel proceeded in the face of uncertainty rather than stop and obtain definitive resolution. For example, no prints documenting the layout of the bus work behind the breakers were available and the electricians Page 25 of 93

who were performing the work were not familiar with the panel design and layout; however, no requirements to stop and re-evaluate after the first breaker was removed were included in the work order nor were other electricians who had experience in the bus consulted.

The station has failed to make substantive improvements in plant operation in response to SOER 10-2. In this situation, weaknesses in supervisor oversight and risk recognition were significant factors. None of those present at the prejob brief or at the work site identified or corrected lapses in the conduct of the prejob brief, the lack of critical steps or the failure to stop and reconsider when the job plan changed. In addition, as noted by the Extent of Cause examples, plant personnel have continued to allow long-standing performance and organizational problems to exist.

As discussed in the Organization and Programmatic Weakness Evaluation section of this report, long-standing performance and organizational problems are considered to be a Latent Organization Weakness which is the Extent of Cause for Root Cause 1. Corrective actions have been assigned to address this condition. Safety Culture Evaluation Tables 1 and 2 are Attachment 6 to this evaluation report.

Generic Implications - Extent of Condition/Extent of Cause EXTENT OF CONDITION Root Cause 1 The information obtained during the evaluation and the examples used to support this cause found that all organizations involved did not follow risk management processes. Site leadership at all levels was not sufficiently intrusive into work on panel ED-11-2, did not sufficiently challenge planned courses of action and did not provide adequate oversight.

The use of the qualitative risk assessments as described in EN-WM-104 would have provided more accurate insights into the plant risks of the work being performed. Based on discussion with Maintenance and PS&O personnel, the use of this approach was rolled out in August 2011 with limited attempts to coordinate the change or make sure there was an understanding of how to use it.

Choices made for prejob brief level reflected a Maintenance knowledge gap in the use of the Prejob Brief Decision Flowchart, EN-HU-102 Attachment 9.1.

Although supervisors and above have been part of continuing training in SOER 10-2, Thinking and Engaged Workforce, these efforts have not resulted in close attention to the details of the work being performed and the conditions surrounding it.

Page 26 of 93

This incident identified weaknesses in human performance management defenses such as critical steps and the use of quality prejob briefs identified in EN-HU-105. Work being performed in the ED-11-2 panel met virtually all of the guidelines for an IPTE brief as described in EN-OP-116 Attachment 9.2 including work not covered by existing procedures, infrequently performed work and work on critical DC power equipment.

Contributing Cause 1 The conditions identified for breaker 72-01, which include a deviation from its FSAR description, also apply to breaker 72-02. These conditions are addressed through breaker modification and PM corrective actions related to Contributing Cause 1.

CR-PLP-2011-4958 documented a failure to close reliably condition for breaker 72-02. This condition should also be suspected to affect breaker 72-01 because although the trip function of these two breakers is tested periodically, the cause of the failures to close is unknown. The CR-PLP-2011-4958 operability review states that the breaker would trip free when trying to close the breaker. Several attempts were required to close the breaker, however the breaker was successfully closed and remains closed. This satisfies the purpose of the breaker. Station battery ED-01 remains operable and right train DC power distribution subsystems remain operable. Therefore, no Degraded or Non-conforming condition exists per EN-OP-104, Revision 5, Attachment 1, Table 9.1. These conditions will also be addressed through corrective actions related to Contributing Cause 1.

In addition, the Inverter 1 and Charger 1 breaker trips could suggest that there is need for revised breaker or fuse coordination effort. Although the Operability Determination for CR-PLP-2011-4835 indicated that loss of one DC train was acceptable from a plant shutdown and nuclear safety standpoint, in this case, the loss of one train resulted in a reactor trip. Corrective actions to address Contributing Cause 1 may affect and need to address coordination issues involving other components for both breakers 72-01 and 72-02. Actions are assigned under CR-PLP-2011-4835.

Contributing Cause 2 Because the work order plans used for the breaker removal and inspection were based on Maintenance Procedure EPS-E-10, the weaknesses identified for the work plans should also be corrected in the procedure. Corrective actions are assigned to revise that procedure for all DC panel work.

A review of Maintenance Emergency Power System procedures found that, even though these procedures have been in use, six of the twelve current procedures Page 27 of 93

have not been revised since 2007 when the plant was part of NMC. With respect to this situation, the more current DC breaker procedure EPS-E-12 includes requirements for breaker bolt torquing and the use the EN-IS-125 electrical safety checklist. Corrective actions have been assigned to review and revise these procedures.

Currently, more than 400 change requests exist for the Permanent Maintenance procedures. Based on the number of severely outdated EPS system procedures, the status of Maintenance procedures for other systems could also be at risk.

This has been affected by the willingness of Maintenance workers, as in this case, to continue to use inadequate work instructions. Corrective actions are assigned to identify and correct these procedures and to establish a method for regular update review.

With respect to the quality of plant procedures in general, corrective actions from the root cause evaluation of CR-PLP-2011-1522 will address the extent of procedure quality and change backlog issues.

Contributing Cause 3 EN-HU-102 contains thirty pages of manager and supervisor human performance tools that, if properly applied, could possible have prevented this incident. However, the likelihood of successfully deploying thirty pages of checklist items for a prejob brief or work observation would be limited unless some form of advance planning to decide which elements were applicable.

The root cause evaluation of CR-PLP-2011-4522, Cross-Cutting Issue in Management Oversight has been completed to address the history of plant weakness, as seen by the NRC, in this area. The corrective action plan includes three actions which include reinforcement of expectations and performance-based training designed to prevent recurrence. These actions address the concerns identified by this evaluation. No additional actions are recommended.

Contributing Cause 4 Most recently, the plant assigned CR-PLP-2011-2397 to evaluate a potential emerging trend in NRC violations with a cross cutting aspect in procedure compliance (H4b). Corrective actions from the evaluation focused heavily on placekeeping. Because of the current event, action is assigned to reevaluate this decision.

EXTENT OF CAUSE Root Cause 1 Page 28 of 93

Conditions identified during the evaluation of this event indicated that managers, supervisors and workers had not embraced established methods for risk identification and management. Beyond this concern, recent plant operating experience shows a pattern which suggests that senior management has not established a culture sensitive to risk recognition and management and has not concentrated their attention on ensuring that standards and procedures are being followed in all aspects of plant operation:

A review of the plant Licensing Cross-Cutting Issues Analysis and Trending summary for the current quarter found eight condition reports listed in the Management Oversight (H4C) category since the beginning of 2011. This issue is currently the subject of root cause evaluation under CR-PLP-2011-4522 which determined that supervisors and managers were too closely focused on work practice rather than oversight. This category was identified through the Safety Culture Evaluation for this report.

The Licensing summary also lists six recent condition reports in the Procedural Compliance (H4B) category. The HT apparent cause evaluation of CR-PLP-2011-2397 determined that the failure to use and adhere to procedures is caused by failure to adequately utilize Human Performance Tools of EN-HU-102 - Human Performance Tools. This category was also identified through the Safety Culture Evaluation and supports contributing Cause 4.

The root cause evaluation of CR-PLP-2011-0903 determined that inadequate oversight which was a contributing cause of weaknesses and delays in the execution of the Maintenance Initial Training Program.

The root cause evaluation of CR-PLP-2011-2443 resulted because of long-standing failures on the part of Maintenance and Engineering personnel to ensure workers were meeting procedure requirements for control of nonconforming parts per EN-LI-102.

The HT apparent cause evaluation of CR-PLP-2011-1108 found that plant personnel at all levels did not work together to plan and carry out an efficient diesel generator outage and that this was made worse by weak Maintenance oversight and poor decision making on the part of responsible managers.

The plant INPO Mid-cycle assessment found that the site leadership team and other managers were not providing the necessary leadership to sustain continuous improvement. The HT apparent cause evaluation of CR-PLP-2011-2831 found a focus on department rather than station goals resulting in, among other things, a lack of progress in resolving issues identified during the 2010 WANO assessment.

Page 29 of 93

CONDITION REPORTS CLOSED TO THIS EVALUATION The following condition reports were closed to this evaluation. Where noted below, corrective actions have been identified under CR-PLP-2011-4822 to address the conditions identified by them:

CR-PLP-2011-4779 (09/22/11)

Documented defective breaker 72-123 during 09/22/11 troubleshooting under WO248834. This breaker was replaced under WO291123 prior to the discovery of breaker connection problems in 125 VDC panel ED-11-2. It was later replaced under WO291123 following the reactor trip on 09/25/11. No additional actions are required.

CR-PLP-2011-4801 (09/23/11)

Documented control room alarms and loss of Instrument Air following the initial replacement of breaker 72-123. The 09/25/11 reactor trip occurred during repairs to correct these problems which were finally resolved following the reactor trip under WO291123 and others.

When this condition report was closed to CR-PLP-2011-4822, corrective actions for a Maintenance Rule evaluation and an Equipment Failure Evaluation were transferred. These are included in the corrective action plan for CR-PLP-2011-4822 as CA-04 and CA-03, respectively.

CR-PLP-2011-4981 (09/30/11)

Documents the failure to use a prejob brief form per EN-HU-102 and EN-MA-101 prior to the start of breaker replacement work on 09/25/11. This issue supports Root Cause 1 and Contributing Causes 3 and 4 of this evaluation and is discussed in the Narrative. Corrective actions will be assigned from this evaluation.

Previous Occurrence Evaluation INTERNAL OPERATING EXPERIENCE Plant Condition Reports Using a 15-year PCRS search for DC system breaker and fuse issues, the following condition reports were considered relevant to this evaluation.

Additional more recent searches for INPO, AFI and Risk identified additional Page 30 of 93

examples which supported the issues identified by root cause 1 and the latent Organizational Weakness:

CPAL-97-1493 (10/17/97)

Panel EC-15 deenergized during maintenance on CRDM-38 contactors resulting in loss of manual control for all control rods. Root cause evaluation corrective actions included increasing administrative controls over emergent work, establishing and reinforcing fundamental standards for procedure use and adherence, prejob preparation and briefs, control of work scope, and incident response.

CR-PLP-2006-5388 (11/13/06)

Negative trend in actual risk profile higher than predicted. Common cause evaluation found no trend.

CR-PLP-2008-2890 (02/24/08)

Common cause evaluation identified trend in maintenance work continued with active safety risk precursors was due to newness and quantity of Entergy safety procedures. Actions were taken to improve procedure visibility during transition period.

CR-PLP-2009-0917 (03/04/09)

NRC cross-cutting issue in human performance - design, procedures and labeling . Root cause evaluation lead to development of a procedures improvement team and changes in handling of DRNs.

CR-PLP-2009-3730 (07/29/09)

NRC cross-cutting trend in Work Planning (H3a). Apparent cause evaluation identified and assigned actions to improve familiarity with change management processes.

CR-PLP-2010-3434 (08/16/10)

Non-cited violation for failure to assess and manage risk in maintenance activities. Apparent cause evaluation found and assigned action to correct weaknesses in administrative procedures for operations risk assessment.

CR-PLP-2010-6035 (11/09/10)

NRC green finding in Human Performance - Resources due to examples of procedure compliance involving procedure use and adherence. Common cause Page 31 of 93

analysis found reasons were that procedure users, writers and reviewers were not recognizing and correcting procedure problems. Actions focused on training of procedure writers and reviewers.

CR-PLP-2011-0903 (02/24/11)

Its root cause evaluation determined that inadequate oversight which was a contributing cause of significant and continuing problems with the Maintenance Initial Training Program.

CR-PLP-2011-1108 (03/07/11)

Weak Maintenance oversight, poor decision making on the part of responsible managers and the failure of plant personnel at all levels to work together resulted in an inefficient diesel generator outage.

CR-PLP-2011-2443 (05/12/11)

QA identified condition. Evaluation identified failures on the part of Maintenance and Engineering personnel to ensure workers were meeting procedure requirements for control of nonconforming parts per EN-LI-102.

CR-PLP-2011-2397(05/12/11)

The evaluation determined that the failure to use and adhere to procedures is caused by failure to adequately utilize Human Performance Tools of EN-HU-102

- Human Performance Tools.

CR-PLP-2011-2831(06/08/11)

The HT apparent cause evaluation of CR-PLP-2011-2831 found a focus on department rather than station goals resulting in, among other things, a lack of progress in resolving issues identified during the 2010 WANO assessment.

CR-PLP-2011-4522 (09/12/11)

Plant trend issue in NRC cross-cutting issues in management Oversight category H4C. Significance A.

Summary The most relevant information was found in the recent plant condition reports related to the INPO AFIs and the 2011 root cause evaluations. These provided the basis for extent of cause relative to root cause 1 and the details used in the event narrative. Condition reports relative to plant operation actions and Page 32 of 93

equipment failures following the trip were considered beyond the scope of this evaluation.

Entergy Fleet Condition Reports Using a 5-year PCRS search, as well as references in condition reports identified by that search, the following Entergy Fleet condition reports were considered relevant to this evaluation.

CR-ANO-1-2010-01830 (4/16/2010)

While performing EFIC Channel "A" monthly test under WO-52039429, meter lead slipped and made contact with one of the 120 vac input terminals. This caused EFIC channel "A" to trip CR-ANO-C-2008-01053 (05/04/2008)

ANO experienced a loss of 500 KV Pleasant Hill line as a result of maintenance on Ring Bus breaker B5148 which caused as short to current transformers feeding protection circuitry and tripped B5122 on timed overcurrent.

CR-CNS-2008-05397 (07/11/2008)

The electrician re-terming the two leads which both needed cut back and stripped due to water damage assumed that the leads were de-energized due to the live-dead-live check that was performed the prior morning. The electrician grabbed both leads completing the circuit and received the shock.

CR-GGN-2010-01404 (03/03/2010)

Loss of 480 VAC power due to inadvertent phase to ground short. Feeder breaker 52-14106 tripped which deenergized MCC 14B12.

CR-PNP-2011-2475 (05/10/11)

Reactor SCRAM on HI-HI-Flux resulted from lack of strict enforcement of procedure use and adherence for reactivity management. Root cause actions included development of a management oversight qualification program.

Summary Recent Fleet examples show that inadvertent short circuits can result in industrial safety threats as well as losses of major equipment in a variety of systems.

Although not directly referenced, the need for improvements in oversight quality were reflected in actions assigned from the recent CR-PLP-2011-4522 root cause evaluation. These include actions to improve supervisor observation Page 33 of 93

training and to increase the level of oversight of supervisor observations during on-line and outage periods.

EXTERNAL OPERATING EXPERIENCE As a part of the evaluation, searches of the INPO website and the Entergy Operating Experience Database were performed for applicable events. No time limit was used for these searches which used the keywords Risk Assessment.

Of the examples resulting from the search the following were found to be applicable for this evaluation:

SOER 81-15 (10/06/81)

Millstone operator error causing loss of one DC bus resulted in a reactor trip which was not followed by a turbine trip. There were significant operator challenges resulting from the turbine trip delay, a loss of control room annunciators and a partial loss of medium voltage busses.

SOER 91-1 (06/20/92)

Discussion of three 1990s Operations related activities resulting in reactor safety challenges. Within Entergy, EN-OP-116 implements measures to recognize and plan for infrequent activities or activities that, due to their subjects, are not controlled by approved procedures. Training information dating from March 2010 shows SOER 91-1 has been seen as primarily a concern for Operations although I&C Maintenance has received a one hour Fleet training class. The enhanced review and management visibility provided by EN-OP-116 could have been effective in preventing this incident. (Reference Contributing Cause 2)

SOER 10-2 (09/07/10)

Entitled Engaged Thinking Organizations, this document outlined significant operating events at eleven domestic and foreign sites. Common causes included tolerances of long-standing problems, failures to understand risk, weaknesses in supervisor oversight - all of which were significant in this event. Leadership for the response to this document is at the Fleet level with corrective actions controlled via CR-HQN-2010-0974.

OE 33804 - Lack of Rigor in the Evaluation of Risk in Decision-Making During Refuel Outage (Waterford 3, 05/16/2011)

During Refuel 17 (RF-17), the Operations Department exhibited multiple examples of a lack of rigor in the evaluation of risk in decision-making. The lack of rigor resulted in actions not being taken for an emergency feedwater (EFW) pump AB temperature logged as out of specifications, a portion of the station air and condensate make-up headers in containment were contaminated, and Page 34 of 93

transfer of reactor coolant system (RCS) inventory. The primary common cause was determined to be that some operations supervisors were allowing overconfidence as well as time pressure to impact the level of rigor applied to their decision making process. This resulted in a breakdown in normal reviews and communications standards during high work load outage conditions.

OE 34376 - Failure to Follow Requirements of the Operability Determination Process Procedure Resulted in Delayed Resolution of Operability Concern.

(Waterford 3, 08/17/2011)

Operations personnel found a function in the control circuit for the safety related essential chillers which appeared to prevent the restart of the chillers if a loss of offsite power (LOOP) event or safety injection actuation signal (SIAS) occurred within 20 minutes of the last start of a chiller. This concern was promptly entered into the site corrective action program. Procedure inadequacies and improper use of procedures delayed the final operability review until twenty-two days after the identification of the condition. This OE relates to the event in that Operations did not perform a risk assessment as required by procedure. Operations accepted engineering input stating that there was a missed surveillance, Technical Specification (TS) Surveillance Requirement (SR) 4.0.3 was not invoked at this time. Operations personnel perceived the risk as low.

OE 33613 - Loss Of Shutdown Cooling Due To Maintenance Activity Loss of Shutdown Cooling. (Browns Ferry Unit 3, 5/12/2011)

During the recent Unit 3 forced outage, a maintenance activity that had been planned for a refueling outage was scoped into the forced outage in order to resolve a degraded non-conforming item. As the result of lifting a wire on a relay during performance of this activity, an unplanned Primary Containment Isolation Signal (PCIS) Group 2 isolation occurred which resulted in the closure of the applicable isolation valves, a trip of the in- service Residual Heat Removal Pump, and a loss of shutdown cooling. Poor decision making and lack of risk recognition allowed the work scope to continue during plant conditions that included an elevated risk state.

OE 33864 & LER 298-110004 - Technical Specification Prohibited Condition for Non-Compliance with LCO 3.0.4 (Cooper, 06/13/2011)

On June 13, 2011, while reviewing a post Refueling Outage 26 (RE26) report, it was discovered that Technical Specification {TS} Limiting Condition for Operation (LCO) 3.0.4.b was not complied with during startup from RE26. TS LCO 3.0.4.b requires, in part, "When an LCO is not met, entry into a MODE or other specified condition in the Applicability shall only be made: b. After performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management Page 35 of 93

actions ... " Cooper Nuclear Station changed from Mode 2 to Mode 1 while in an LCO for the Low Pressure Coolant Isolation (LPCI} subsystem "B" being inoperable without performing a risk assessment prior to changing modes.

OE 33681 - Nuclear Regulatory Commission Notice Of Violation For Risk Not Properly Assessed And Managed For Work In The Switchyards/Transformer Yards. (Cooper, 05/03/2011)

On May 3, 2011, the Nuclear Regulatory Commission (NRC) issued a green-cited violation, NOV 2011-02-02, of 10 CFR 50.65(a)(4), "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," to Cooper Nuclear Station (CNS) for failure to adequately assess and manage the increase in risk associated with maintenance activities.

There was lack of staff understanding of what is required for a quality risk assessment. This fundamental shortcoming resulted in inadequate program design and implementation with respect to applicable CNS procedures, and inadequate training for personnel responsible for implementing those procedures.

Administrative Procedures for managing risk and controlling access to the plant switchyard were not user-friendly for the performance and documentation of qualitative and blended risk assessments Develop and provide training to Senior Reactor Operators, Shift Technical Engineers, Work Week Directors, the Switchyard System Engineer and his backup, the direct supervisor of the Switchyard System Engineer, the Corporate Switchyard System Engineer and his backup, and the Risk Management Engineers on performing Risk Management Assessments.

Develop and implement a Qualification for performance of Risk Management Assessments that support work order approval and schedule approval.

OE 33654 - Loss of 230kV Startup Power Due to Panel Modification. (Diablo Canyon, 05/17/2011)

During a Unit 2 shut down for refueling, modification to a shared Unit 1 / 2 relay panel inadvertently actuated an adjacent relay resulting in the loss of Unit 1 12kV startup power. The primary cause of the Unit 1 relay actuation was the risk assessments performed during the planning phase of the Unit 2 work did not adequately address the risks to the adjacent equipment of the on-line unit.

OE 33451 - Plant Risk Improperly Modeled for Several Hours. (Susquehanna, 01/26/2011)

A risk calculation was performed for online maintenance work on a motor generator (MG) set and, based on the known breaker blocking at the time of the calculation, it was determined that EOOS (Equipment Out Of Service) risk Page 36 of 93

assessment would remain Green during the work window. The root cause of the event was determined to be that the stations risk program ownership was not commensurate with the significance of performing accurate risk assessments.

OE 31058 - Adverse Trend in the Performance of Risk Assessments. (Palo Verde, 03/19/2010)

While in Modes 1 and 2, Operations has performed inadequate or untimely risk assessments, for work performed outside of its scheduled timeframe and emergent work activities. A method for identifying and managing risk impacting emergent and scheduled work outside of its scheduled timeframe during the execution week is not formally defined in the current work management process.

Summary For these examples, review of SOER 91-1 provided insights into the use of EN-OP-116 and its potential for preventing future similar events. In addition, this incident provided evidence of the need for actions taken in response to SOER 10-2 have not been effective. Plant OE examples provided specific ideas for corrective actions.

Page 37 of 93

Safety Significance Evaluation INDUSTRIAL SAFETY The initiating event of a short circuit in ED-11-2; 125 VDC PANEL posed a risk to Industrial Safety. During the maintenance the panel doors were open and an electrical maintenance repairman was removing a copper bus bar connection from the breaker 72-123; EMERGENCY AIRLOCK ED-123 location. With one hand supporting the copper bus bar and the other loosening the connection to the positive bus bar, the electrician observed an apparent flash of light which startled him. The copper bus bar slipped and made contact with the negative bus causing the short circuit and an arc flash..

The arc flash was very brief and there were no personnel injuries. The electrician was wearing standard PPE along with electrical safety gloves rated at 1000 volts. He was handling live 125 V DC equipment during the maintenance activity and the appropriate flash boundary had been established.

Performing work on energized equipment, although discouraged is allowed by EN-OP-102; PROTECTIVE and CAUTION TAGGING and EN-IS-123; ELECTRICAL SAFETY. The required face to face discussion with the Shift Manager in EN-OP-102 was met during a pre job discussion with the Shift Manager, although EN-OP-102 was never referred to. The required discussion is not listed in EN-IS-123. Although the three electricians involved with the work were briefed and fully aware of the hazards, an enhancement action is assigned to request clarification of EN-IS-123 (CA 40).

The actions taken in response to the event involved clearing the fault from ED-11-2 by electrical maintenance, several breaker operations and many equipment manipulations by the Operations Department. All of the activities were performed with no Industrial Safety incidents.

ENVIRONMENTAL SAFETY This event posed no risk to Environmental Safety. A thorough search of Condition Reports and Narrative Logs surrounding the event was performed.

There were no releases to affect ground water or to the atmosphere from the primary system to the environment.

During a reactor trip, there is risk that low levels of tritium could be released to the environment as secondary steam is released through the steam dump valves or code safety valves. The concentrations of this isotope are normally below regulatory levels and it dissipates into the atmosphere before it becomes an environmental safety concern. Monitoring per Plant Procedures CH 6.10, Radiological Environmental Monitoring Program and CH 6.20, Radioactive Page 38 of 93

Effluent Operating Procedure identified that the levels in secondary chemistry were low and that, as a result, any releases to the environment were negligible.

RADIOLOGICAL SAFETY This event itself posed no risk to radiological safety. A thorough search of Condition Reports and Narrative Logs surrounding the event was performed.

Although a CONTAINMENT HIGH RADIATION (CHR) ALARM was generated, this proved to be a result of de-energizing 2 out of 4 CHR monitors, which fail to the tripped condition. However, workers sustained unnecessary dose because of the normal evolutions involved with restoring the Plant which would not have been received if the reactor had not been inadvertently tripped.

NUCLEAR SAFETY The inadvertent short circuit caused by the copper bus bar connection directly and indirectly resulted in de-energizing of the following electrical buses:

ED-10R; 125 VDC BUS NO. 1- RIGHT ED-10L; 125 VDC BUS NO. 2-LEFT ED-11-2; 125 VDC PANEL ED-11-1; 125 VDC PANEL EY-10; PREFERRED AC BUS NO. 1 EY-30; PREFERRED AC BUS NO. 3 Note that the loss of ED-10R and ED-10L was the result of other protective features which operated unexpectedly. Specifically, ED-17; BATTERY CHARGER NO. 3 output fuses opened and breaker 72-01; ISOLATION BREAKER TO DC BATTERY NO. 1 ED-1 tripped on over current. ED-10R supplies power to ED-11-1 and ED-11-2 busses.

The fault from ED-11-2 propagated upstream, resulting in a loss of left train DC power to two-of-four inverters and subsequent loss of alternating current (AC) power from the inverters to two-of-four preferred busses. The loss of power initiated a reactor trip via the automatic actuation of the reactor protection system (RPS). Additional automatic actuations include the closure of the main steam isolation valves (MSIVs), actuation of the safety injection system (SIS), actuation of the containment isolation system (CIS), and actuation of the auxiliary feedwater system (AFS). The MSIVs, RPS, SIS, CIS and AFS performed as designed for the loss of power condition.

The operating crew entered EOP-1; STANDARD POST-TRIP ACTIONS upon the reactor trip and subsequently entered EOP-9; FUNCTIONAL RECOVERY PROCEDURE as directed by EOP-1 due to the loss of the electrical buses.

Page 39 of 93

The basis for entering EOP-9 is that no other Optimal EOP Safety Function Status Checks would pass acceptance criteria due solely to the loss of EY-10 and EY-30. At no time did the plant experience any loss of a Safety Function because the full right train of safety related equipment, including the right channel of DC power, remained available and fully functional throughout. However, the loss of 125 VDV redundancy created challenges for the operators and Plant personnel as noted in the Post-Event Review and the Operations Log in eSOMS.

Inoperable atmospheric steam dump valves Loss of letdown Main Generator output breakers did not trip Loss of 2400 VAC bus 1E Increase in unidentified PCS leakage Failure of Charger 1 Loss of preferred AC busses EY-10 and EY-30 Loss of some control room annunciators High steam generator level High pressurizer level This list is not all inclusive. Resolution of degraded and nonconforming conditions was documented in the attachments to the Offsite Safety Review Committee meeting minutes of 09/29/11.

Page 40 of 93

Corrective Action Plan Identified Corrective Actions Resp. Due Cause Dept. Date Immediate Actions (COMPLETED)

CC1 To reduce the risk of recurrence, EC32028 was approved and installed 09/26/11 to increase magnetic trip settings of breakers 72-01 and 72-02 to their highest level.

CC1 Plant trip conditions affecting left train 125 VDC breakers were resolved and approved via Startup On-Site Safety Review Committee RC1 A Level 1 Human Performance Error Review was conducted with the Maintenance crew that had been assigned to remove and inspect breakers in the ED-11-2 panel. (CA-06)

RC1 A Red Memo was issued by the Human Performance staff on 09/26/11 and stand downs were conducted at the Plant and Fleet levels.

RC1/CC4 This incident was treated as an avoidable human error under the MARC process for the Maintenance work crew Other Damaged bus connectors and suspect breakers in Panel ED-11-2 were replaced by 09/27/11 under WO291123, WO291124 and WO291210.

Other Maintenance Rule evaluation was completed per CR-PLP-2011-4822 CA-03 Other Equipment Failure Evaluation was completed per CR-PLP-2011-4822 CA-04 Page 41 of 93

Interim Actions (COMPLETED)

CC1 Operators received information sharing 09/26/11 on the new settings and the function of breakers 72-01 and 72-02. This information, which will remain in effect until coordination issues have been resolved via the engineering change process, was obtained from Engineering Change EC32038.

RC1 Guidance was issued to Maintenance supervisors for use of EN-IS-123 to assist them with identifying situations that could result in Plant shutdown and industrial safety risk when working on energized circuits. This now includes electrical superintendent approval when working on any exposed energized equipment (live conductive parts) at 50 volts and higher and completion of attachment 9.5 Electrical Safety Checklist. This requirement will remain in effect until EN-IS-123 has been revised to incorporate these changes.

RC1 Compensatory measures were implemented that administratively prevent work from being performed on the affected DC electrical distribution panels, and cables within the cable spreading room connected to the affected DC electrical distribution panels, when the associated DC bus is required to be operable.

RC1 Compensatory measures were implemented that allow only one battery charger to be connected an operable DC bus and the opening of breakers in the affected DC electrical distribution panels that supply power to non-safety related loads.

Short and Long Term Actions CAPR1 RC1, Reinforce and institutionalize Entergy Standards for Procedure Compliance, SVP Complete CC3, CC4 Accountability, and Unacceptable Behaviors via face to face communications from the COO through Individual Contributor Levels.

CAPR2 RC1, Implement, and ensure compliance with, Entergy Risk Management procedures EN- GMPO 1/26/12 CC3, CC4 WM-104 and EN-FAP-WM-002. (CA 63)

CC1/ CR- Complete installation of an Engineering Change to correct coordination issues with Design 06/15/12 PLP-2011- breakers 72-01 and 72-02. Closure requires Engineering Change installation and 4958 closeout. (CA-22 LTCA)

Page 42 of 93

CC1 Notify Operations that interim settings for breakers 72-01 and 72-02 have been Design 06/29/12 revised via the engineering change process and that EC32038 has been removed.

(CA-23 LTCA)

CC1 Identify other modification FC-407-14C procurements which could be subject to error Design 12/01/11 and initiate condition reports for further evaluation. (CA-24)

CC1 Analyze the coordination between the shunt breaker 72-01 (72-02) and D11-1 and Design 03/22/12 D11-2 (D21-1 and D21-2) panel fuses and propose a resolution to obtain better coordination. The panel fuses are FUZ/D11-1, FUZ/D11-2, FUZ/D21-1, and FUZ/D21-2. (CR-PLP-2011-4835 CA-07) This action is tied to the root cause evaluation of CR-PLP-2011-4822 . CARB chair extension approval is required.

RC1/ CC4/ Provide complete information sharing for all Maintenance workers on the use of the Maint 11/17/11 CR-PLP- three standard prejob brief checklists included in EN-HU-102 including the use of the 2011-4981 / Prejob Brief Decision Flowchart, EN-HU-102 Attachment 9.1 (CA-25)

OP5C RC1/ CC4/ Confirm that corrective actions assigned from the evaluation of CR-PLP-2011-5116 Maint 12/15/11 Extent / will adequately address the Fatigue Rule violation concerns identified by this OP5C evaluation. Develop follow up corrective actions and return to CARB for approval if CR-PLP-2011-5116 results are not satisfactory. (CA-26)

RC1/ CC4 / Provide information sharing to Maintenance personnel on the use of EN-HU-105 Maint 11/17/11 OP2A / including use of prejob briefs, critical steps LEL and IPTE. (CA-27)

OP5AD

/OP5AE RC1 / OP2D Perform a Focused Area Self Assessment of station risk assessment practices and PS&O 01/20/12

/ OP5T behaviors. (CA-28 Site Recovery Plan Activity)

Page 43 of 93

RC1 Revise EN-IS-123 to reduce the limit for electrical superintendent approval for work on Maint 04/28/12 energized equipment from 240 volts to 50 volts. (CA-29)

CC4/ Extent Using the SAT process, initiate a TEAR and perform a needs analysis on the need for Training 01/26/12

/OP2B / initial and continuing training in the use of EN-WM-104 for qualitative and quantitative OP5AD / risk assessment and their relationship to the work planning process described by EN-OP5AE / WM-104 and the use of prejob briefs described in EN-HU-102 and EN-HU-105.

OP5T Identify the correct population and establish schedule for training. If training is not recommended, develop a schedule of recommended actions and return to CARB for approval. (CA-30)

CC4/ Extent Based on results of Training needs analysis for EN-WM-104 training, determine scope Maint 02/15/12

/ OP5A / and schedule for effectiveness review. (CA-31)

OP5AE CC2/CC4/ Provide information sharing to Maintenance supervisors and superintendents on the Maint 11/17/11 Extent / use of use of EN-WM-104 for qualitative and quantitative risk assessment and its OP2B relationship to EN-WM-105. (CA-32)

/OP5AE CC1/ CC2/ Revise EPS-E-10 to include all outage and on-line maintenance on these 125 volt DC Maint 02/28/12 CC4 /OP4A / panels and breakers. Include critical steps and consideration of IPTE. Clarify Plant OP5A / impact to make clear the potential for train failure and Plant trip and remove Notes OP5D which provide instructions in lieu of actual procedure steps. Instructions should account for the fact that the physical layout and construction of the increases the chance of error during maintenance. (CA-33)

CC2/ Revise or cancel other Maintenance EPS (Emergency Power System) procedures that Maint 03/31/12 Extent/ have not been revised since the 2007 Entergy transition, which now contain outdated OP4A /OP5A references and which do not conform to Entergy standards of completeness. (CA-34)

/ OP5D Page 44 of 93

CC2/ Quarantine any Maintenance EPS procedures that have not been revised recently and Maint 11/17/11 Extent/ are considered out of date. (CA-35)

OP4A /

OP5D CC2/ CC4/ Develop a plan to prioritize and eliminate outdated references, workarounds, tribal Maint 11/28/11 Extent / knowledge and human performance traps in all Maintenance procedures and which OP5D includes plans to improve Maintenance worker ownership of procedure quality.(CA-36)

CC2/ CC4/ Complete the plan to eliminate outdated references, workarounds, tribal knowledge Maint 12/31/12 Extent / and human performance traps in all Maintenance procedures and which includes OP5D plans to improve Maintenance worker ownership of procedure quality. (CA-37)

CC4/ Extent Reconsider the existence of an emerging trend in NRC violations with a cross cutting Licensing 01/31/12 aspect in procedure compliance (H4b) based on situations that have been identified since the evaluation of CR-PLP-2011-2397. Issue a follow up condition report if required to evaluate a new recognized trend. (CA-38)

RC1/CC3/ Verify that completed actions to address weaknesses in management oversight of Maint 02/28/12 LOW work activities assigned from the evaluation of CR-PLP-2011-4522 (CA-11 through CA-13) that include the development, instruction and use of WILL sheets and the review for formal training, have addressed concerns identified for this evaluation.

Develop follow up corrective actions and return to CARB for approval if CR-PLP-2011-4522 results are not satisfactory. (CA-39)

Page 45 of 93

RC1 / OP2B Submit a training evaluation action request (TEAR) to improve PLP staff knowledge of CA&A 12/29/11 the meaning of a Condition Adverse to Quality (CAQ). Specifically, provide direction to PLP staff on the definitions of "Nuclear Safety", "Industrial Safety", "Equipment Reliability" and "Procedure Adherence". If the training needs analysis results in a finding of no training is necessary, then arrange to have this accepted or overridden by the corrective action review board (CARB). This corrective action is to remain open until the completion of the training needs analysis.

(Refer to Recovery Plan WT-PLP-2011-366 CA199, and CA238) (CA 65)

RC1 / OP2B Develop and implement WILL sheets on the 8 attributes of a strong safety culture. ISHP 12/18/11 (Close Recovery Plan WT-PLP-2011-366 CA401) (CA-50)

RC1 Coordinate a third party safety culture assessment, (Close Recovery Plan WT-PLP- NSA 2/28/12 2011-366 CA397) (CA-51)

RC1 Create and implement a WILL sheet specific to observing trip risk activities (Close Maint 12/8/11 Recovery Plan WT-PLP-2011-366 CA75) (CA-52)

RC1 Revise on-line scope add form to include statement that appropriate risk and risk PS&O 12/23/11 mitigators have been added to appropriate schedule. (Close Recovery Plan WT-PLP-2011-366 CA408) (CA-53)

RC1 Perform a causal analysis, which should include a review of previous 12 months CA&A 12/23/11 RCEs, significant ACEs, NRC findings, Cross-cut issues, AFIs, etc. Apply special focus on O&Ps. Use of 95-001/002/003 inspection manuals (Close Recovery Plan WT-PLP-2011-366 CA90) (CA-54)

RC1 CRG and DPICS to ensure that the keyword "Stop When Unsure" is applied all CR's GMPO 1/8/2012 written regarding failure to complete a task based the work being stopped because either: a. the workers are unsure, b. the task is not correct as written, c. the task cannot be completed as written, d. the replacement components are different, d. the scope of the work changes, e. the workers are directed to stop by Supervision/Management/Engineering. CRG and DPICS to ensure appropriate follow-up actions are assigned. (CA-55)

Page 46 of 93

RC1 At the T-5 Critical Evolutions Meeting (CEM) and the T-2 meeting, Members validate GMPO 1/8/2012 the rigor and correctness of the Risk Analysis associated with evolutions identified by EN-FAP-WM-002. For work packages that do not have adequate Risk Analysis as determined by the members, a CR will be generated with the keyword "Risk Management" applied and appropriate actions created. (CA-56)

RC1, CC3, Create an annual CBT to re-affirm employee understanding of and commitment to Training 3/9/12 CC4 Entergy Accountability, Behavioral and Procedure Use standards. Create an accompanying Job Familiarization Guide for use with new employees. Ensure created materials reference this CR and require CARB approval for removal from site curriculum. (CA-57)

Extent Submit the LER for the identified conditions within the 60-day time period. (CA-02) Licensing 11/22/11 Enhance Request EN-IS-123 clarification of the EN-OP-102 requirement for a Shift manager Maint 11/30/11 ment face-to-face meeting with workers when work on energized equipment without tagging is involved. (CA-40)

Enhance Request EN-WM-104 clarification for disposition of completed risk assessments as Maint 11/30/11 ment records or incorporation into work order packages. (CA-41)

Other Perform Learning Opportunity Review per EN-QV-112, Learning Opportunity Review QA 12/15/11 Process (CA-42)

Other Locate the actual root cause evaluation record for CPAL-97-1493 and initiate Maint 11/30/11 additional corrective actions to address issues not addressed by this corrective action plan. (CA-43)

Other Arrange with CA&A to have referenced actions from CR-PLP-2011-4835 and CR-PLP- Maint 11/30/11 2011-4522 appropriately linked in PCRS to this corrective action plan. (CA-44)

Page 47 of 93

CC2/ CC3/ Verify completion of CERT Team Report 18 recommended actions as identified in LO- NSA 03/15/12 CC4/ LOW WTPLP-2011-0366 which address procedure use, procedure quality and management oversight (CA-45)

EFR Obtain an LO document number and assign effectiveness review actions to verify that Maint 11/30/11 actions to preclude recurrence have been successful (CA-46)

OE Prepare and issue internal Entergy fleet OE summary (CA-13) OE 10/26/11 OE Prepare and issue external OE summary (CA-16) Maint 10/26/11 Page 48 of 93

Effectiveness Review Plan LO-PLPLO-2011-00061 CAPR1/ RC1 Reinforce and institutionalize Entergy Standards for Procedure Compliance, Accountability, and Unacceptable Behaviors via face to face communications from the COO through Individual Contributor Levels.

CAPR2/RC1 Implement, and ensure compliance with, Entergy Risk Management procedures EN-WM-104 and EN-FAP-WM-002.

Action Resp. Dept Due Date Focused self assessment by non-Method:

Palisades (PLP) personnel of Palisades procedure adherence with respect to promoting a sensitive risk culture Risk Management Attributes:

Work Practices Management Oversight 6/20/2012 Management Intrusiveness GMPO for first Non PLP personnel self assessment Success: assessment confirms that Palisades has properly institutionalized the applicable work oversight and methodology combined with institutionalized knowledge of work practice expectations Approximately every 6 months for 2 Timeliness:

years.

Page 49 of 93

References Documents reviewed Documents used in this evaluation which are not identified directly in the body of the report as they are used are identified as footnotes at the end of each report section.

Team Members Chuck Sherman - Sponsor/ RP Brad ODonnell - Electrical Maintenance Mark Floyd - Training Brian Meredith - System Engineering Maggie Koyo - System Engineering Ted Berry - Training Paul Johnson - HU/ IS George Stieber - Operations Richard Swanson - Contractor Al Baerren - Maintenance Attachments - Event Time Line from EA-PSA-SDP-D11-2-11-07 - Failure Modes Analysis - Failure Modes Chart - Barrier Analysis - Change Analysis - Safety Culture Evaluation - O&P Evaluation Checklist - Maintenance Crew Statements - Why Staircase Page 50 of 93

EA-PSA-SDP-D11-2 Entergy PSA Rev. 0 07 Engineering Analysis Attachment 01 - Page 51 of 93 : Event Timeline Chart and Narrative This attachment contains the following:

Event timeline in chart format (Table A01-1)

Event timeline in narrative format Page 51 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 52 of 93 Table A01-1: Event Timeline Chart Saturday 9/24 Sunday 9/25 Sunday 9/25 Friday 9/23 1607 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 2218 1109 1500 Electrical maintenance Battery chargers Temp mod 31973 Electrical While removing bus bar, MSIS (2/4 logic low SG Right channel SIAS (2/4 AFAS (2/4 logic low S/G Right channel CIS/CHR (2/4 restoring breaker 72-123 #1 ED-15 and #2 Installed. (Temp maintenance short occurred in dc panel pressure) due to loss of logic low PZR pressure) due level) due to loss of logic, RIAX-1805/RIAX-(Emergency Airlock ED- ED-16 initially in- power for breaker removed 4 dc ED-11-2 preferred ac buses EY-10 to loss of preferred ac buses preferred ac buses EY-10 1807) due to loss of 123) service 72-121 (generator panel ED-11-2 and EY-30 EY-10 and EY-30 and EY-30 preferred ac buses EY-10 exciter field breakers (72- and EY-30. Left channel breaker control) 119,72-120,72- containment isolation valves from 72-127 (test 121,72-123) closed due to loss of power cabinets))

Control room alarm: EK- FWP air Shunt trip breaker 72-01 MSIVs CV-0510 and CV- IE bus EA-13 de-energized, Turbine driven AFW pump PCP controlled bleedoff 0316 GEN FIELD compressor C- opened de-energizing dc 0501 and E-50B MFRV CV- no power to C-903B FWP P-8B starts (CV-0522B valves CV-2083 and CV-FORCING/OVER 903B cross-tied buses ED-10R and ED-10L 0703 closed on MSIS, and air compressor (was cross- failed open due to loss of 2099 close due to CHR/loss EXCITATION cycling supplying plant E-50A MFRV CV-0701 tied supplying plant air). ED-11-1). AFW flow of power, directing flow to on/off air system closed due to loss of power Closed MV-CA320 to control valves CV-0727 and primary system drain tank T-to EY-10 and EY-30 isolate FWP from instrument CV-0749 fail full-open. 74 in containment (5 gpm) air. C-2A instrument air Flow imbalance develops compressor was in "sleep" between SGs due to mode and started differential in dome pressures (no flow indication available)

Multiple containment Dc panels ED-11-1 and ED- All ADVs CV-0779, CV- In service PZR level control AFW pump P-8C starts PCS unidentified leakage >

isolation valves position 11-2, and preferred ac buses 0780, CV-0781, and CV- channel A fails, charging (AFAS) supplying 165 gpm 1 gpm for PCP controlled indication lost EY-10 and EY-30 de- 0782 fail closed/inoperable pumps P-55A and P-55B in to each SG. bleedoff isolation (LCO energized (quick open and normal service (93 gpm), and Loss of EY-10 causes low 3.4.13.A.1, B.1, B.2) operation) due to loss of letdown orifices CV-2003, suction pressure trip signal preferred ac panel EY-10 CV-2004,CV- 2005 close (0 which prevents P-8A (LCO 3.7.4) letdown),PZR heaters de- operation.)

energize Entered ONP-7.1 (72-119 Preferred ac panel EY-10 MSSVs lift on both SGs In service PZR pressure Inverter #1 ED-06 input Right channel CHP alarm failure caused loss of inoperable LCO 3.8.9.B control channel A fails, breaker to EY-10, 72-37 (2/4 logic,PSX-1801/PSX-service air and CV-1221 (LCO 3.0.3) spray valves CV-1057 and tripped (LCO 3.8.7.A) 1803) due to loss of EY-10 FWP building cross-tie to Preferred ac panel EY-30 CV-1059 fail closed, no and EY-30 panels, no fail open) inoperable LCO 3.8.9.B spray available actuation (actuation logic (LCO 3.0.3) requirements not met)

Reactor trip (2/4 logic RPS) Turbine trip (from reactor Operators enter EOP-1.0 Battery charger #1 ED-15, Dc bus ED-10R inoperable due to loss of preferred ac trip), generator breakers do Standard Post-Trip Actions output breaker closed but (LCO 3.8.9.6) buses EY-10 and EY-30 not open due to loss of dc charger not operating Dc bus ED-10L inoperable panel D-11-1 (LCO 3.8.9.6)

Page 52 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 53 of 93 Table A01-1: Event Timeline Chart Sunday 9/25 1515 Sunday 9/25 1517 Sunday 9/25 1527 Sunday 9/25 1531 Sunday 9/25 1537 Sunday 9/25 1542 Sunday 9/25 1544 Sunday 9/25 1549 Sunday 9/25 1555 MSSVs open and then Operator jumpered relay Enter EOP-9.0 Operator observed high Per EOP-9.0, enter ONP- Isolated RV-2006 NCO closed P-8C AFW Restored 1E bus EA-13 Observed PZR level operate 487u (Y-phase) to open Functional Recovery E-50A level (90%). 24.1 and ONP-24.3 due letdown relief by placing flow control valve CV- (lost on SIAS at 1506) >62.8% (LCO 3.4.9.A).

(throttle/close/open) to generator output Procedure (due to <3 out Order given to isolate to loss of preferred ac letdown orifice stop 0737A to isolate flow to and reenergized Actual PZR level 78%

maintain SG pressure breakers 25F7 and 25H9 of 4 preferred ac buses CV-0522B (steam to buses EY-10 and EY-30 valves CV-2003, CV- E-50A, continue associated PZR heaters PCS Tave 544F available) AFW pump P-8B) per 2004, and CV-2005 to supplying 165 gpm to EOP Supplement 19 close E-50B via CV-0736A (LCO 3.7.5) 1A bus EA-21 de- PZR level 62% ~1530 Entered ONP-2.3 PZR pressure peaks high Charging 73 gpm, 0 gpm energized. Primary Loss of DC Power (time 2200 psig. letdown, 5 gpm PCP coolant pumps P-50A not verified) PZR level 71% controlled bleedoff to and P-50C stop, P-50B primary system drain and P-50D remain in tank T-74 service Realigned PZR pressure control to B channel to enable spray, pressure begins lowering Realigned PZR level control and heater control select switch to B channel. Letdown orifices open and RV-2006 (letdown heat exchanger inlet safety relief) lifts due to CV-2009 (letdown containment isolation) being closed on CHR/loss of power. 1D bus EA-12 PZR backup heaters reenergize Charging pumps P-55A and P-55B in service (73 gpm charging,108 gpm letdown relieving to quench tank) 5 gpm PCP controlled bleedoff to PSDT Page 53 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 54 of 93 Table A01-1: Event Timeline Chart Sunday 9/25 1557 Sunday 9/25 1602 Sunday 9/25 1603 Sunday 9/25 1609 Sunday 9/25 1615 Sunday 9/25 1621 Sunday 9/25 1630 Sunday 9/25 1639 Sunday 9/25 1646 Electricians report no Charging pump P-55B Steam to P-8B turbine CV-0736A closed to SG E-50A MSSVs lift, Entered ONP-7.1 Loss Charging pump P-55B Restored AFW to E-50B Preferred ac bus EY-30 faults on dc buses ED- suction relief RV-2096 isolated by closing CV- isolate flow from AFW E-50B MSSVs throttle of Instrument Air (due to suction and discharge from P-8C 150 gpm realigned from bypass 10L and ED-10R. lifting to the equipment 0522B. 0 AFW flow to pump P-8C to E-50B, no open. MSSVs then loss of all instrument air valves closed to isolate regulator to #3 inverter Reenergized ED-10L drain tank T-80. The E-50A. Still supplying AFW flow to either SG operate compressors at 1557) suction relief RV-2096 ED-08 supply and ED-10R by closing tank overfilled causing 165 gpm to E-50B via P- at this time (throttle/close/open) to leak breaker 72-01 (ED-10L floor drains to backup on 8C and flow control maintain SG pressure and ED-10R now the 590' Auxiliary Bldg valve CV-0736A Tave 544F operable) (order sent to isolate P-55B)

Generator field breaker Restored power to 1E PCS Tave 529F. PZR PZR level peaks high Preferred ac bus EY-10 341 opened when ED- bus EA-13 and level 85% 101.5% placed on bypass 11-2 reenergized reenergized associated regulator. EY-10 pressurizer heaters operable Preferred ac bus EY-30 ADVs CV-0779, CV-powered via bypass 0780, CV-0781, and CV-regulator (EY-30 now 0782 operable due to operable) EY-10 restored (HIC-Left channel safety 0780A now powered),

injection actuated when started controlling heat EY-30 reenergized, removal using ADVs.

resulting in loss of 1E MSSVs close bus EA-13 Tave 540F Throttled safety injection. Stopped charging pumps P-55A and P-55B. Charging flow 0, letdown flow 0, 5 gpm PCP controlled bleedoff to PSDT.

PZR level 80%

When dc restored, instrument air compressor C-2A tripped (reason unknown)

Control room manually started instrument air compressors C-2B and C-2C Page 54 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 55 of 93 Table A01-1: Event Timeline Chart Sunday 9/25 1720 Sunday 9/25 1746 Sunday 9/25 1818 Sunday 9/25 1852 Sunday 9/25 1909 Sunday 9/25 1911 Sunday 9/25 1923 Sunday 9/25 1933 Sunday 9/25 2100 Entered ONP-4.1, Exited EOP-9 and Reset SIAS Restored P-8B steam Exited ONP-24.1, Loss Exited ONP-24.3, Loss ED-01, main station #3 battery charger ED- P-910 (main condenser Containment Spurious entered GOP-8, Power supply CV-0522B to of Y-10 of Y-30 battery left channel, 17 in service supplying vacuum pump) in-Isolation, reset CHR Reduction and Plant AUTO (LCO 3.7.5) inoperable per 3.8.4.B ED-01 (battery chargers service Shutdown to Mode 2 or (no connected battery #2 and #3 now in Mode 3 > 525oF(All 4 charger and surveillance service) preferred ac buses in requirement 3.8.4.1 not service) met)

1. 1 battery charger ED-15 inoperable per LCO 3.8.4.A.2 Table A01-1: Event Timeline Chart Sunday 9/25 2330 Sunday 9/25 2348 Monday 9/26 0156 Monday 9/26 0311 Monday 9/26 0441 Tuesday 9/27 1733 Test started instrument PZR level <62.8% (LCO Restored P-55B charging Placed #4 battery Main station battery ED- #1 inverter ED-06 air compressor C-2A 3.4.9) pump to service charger ED-18 in-service 01 left channel operable operable, supplying satisfactorily, and then (available) and removed #2 battery preferred ac bus EY-10 placed in AUTO (C-2B charger ED-16 from (LCO 3.8.7) still in-service, C-2C in service, #3 battery SLEEP mode) charger ED-17 and #4 battery charger ED-18 now in service Page 55 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 56 of 93 Event Timeline Narrative I. Initial Conditions (prior to event) 100% reactor power normal single charging and letdown lineup o Charging pump P-55A in service o Letdown orifice stop valve CV-2003 open o Primary coolant pump CBO returning to volume control tank T-54 pressurizer T-72 pressure and level control channel A in service auxiliary feedwater system in normal standby lineup

1. 1 battery charger ED-15 and #2 battery charger ED-16 in service feedwater purity air system cross-tied with and supplying the plant compressed air system II. Electrical Equipment Conditions Concurrent with the Reactor Trip at 1506 dc buses ED-10L and ED-10R de-energized o shunt trip breaker 72-01 opened o #1 battery charger de-energized dc distribution panels ED-11-1 and ED-11-2 de-energized

1. 1 battery charger ED-15 failed, not supplying associated buses ED-10L and ED-10R

1. 1 inverter ED-06 and #3 inverter ED-08 de-energized (ED-06 internal breaker also tripped) preferred ac buses EY-10 and EY-30 de-energized 2400v 1E bus EA-13 de-energized III. Conditions Resulting from Loss of Power to Preferred AC Buses EY-10 and EY-30 Reactor Trip / Turbine Trip: main generator breakers 25F7 and 25H9 did not open due to loss of ED-11-2.

Main Steam Isolation Signal: both main steam isolation valves CV-0501 and CV-0510 closed and both main feedwater regulating valves CV-0701 and CV-0703 closed. CV-0701 closed as result Page 56 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 57 of 93 of loss of EY-10 and EY-30; CV-0703 closed due to MSIS.

Auxiliary Feedwater Actuation Signal: P-8A did not receive a start signal due to loss of D-11-1, but also did not run due to low suction pressure trip logic actuation on loss of EY-10. P-8C started and supplied 165 gpm to each steam generator (E-50A and E-50B). Steam driven AFW pump P-8B started due to loss of panel ED-11-2 and AFW flow control valves CV-0749 (E-50A) and CV-0727 (E-50B) failed full open. P-8B flow indication was not available. Flow distribution was dependent on SG pressures. E-50A is the steam source for P-8B, resulting in initially lower pressure, while E-50B had no steam removal path other than MSSVs.

Safety Injection Actuation Signal: Right channel SIAS only - resulted in de-energizing (load shedding) 2400V 1E bus EA-13, isolating non-critical service water header isolation valve CV-1359 and starting associated equipment including charging pump P-55B.

Containment High Radiation: Right channel CHR only - resulted in containment isolation valves closing, including letdown isolation valve CV-2009 and PCP controlled bleedoff valve C-2099.

Left channel containment isolation valves also closed due to the loss of dc to their control circuits.

Containment High Pressure: Logic inputs were not sufficient for system actuation, i.e. no initiation signal was generated, alarm only.

Pressurizer Pressure Control: In service pressurizer pressure controller PIC-0101(channel A) de-energized - resulted in pressurizer spray valves CV-1057 and CV-1059 failing closed, and all available heaters energizing.

Pressurizer Level Control: In service pressurizer level controller LIC-0101(channel A) de-energized - resulted in letdown orifices closing, charging pump P-55A running at maximum speed (53 gpm) and all pressurizer heaters de-energizing. P-55C did not start due to loss of breaker control power (ED-11-1).

2400V 1E Bus EA-13: de-energized - resulted in unavailability of associated PZR heaters and FWP air compressors. Plant air compressor C-2A automatically started to restore pressure.

Atmospheric Steam Dump Valves: all ASDVs CV-0779, CV-0780, CV-0781 and CV-0782 failed closed (both normal and quick open) due to loss of power to controller HIC-0780A (EY-10).

Generator Output Breakers: breakers 25F7 and 25H9 failed closed and all switchyard breaker indication lost due to loss of ED-11-1. 1A bus EA-21 and 1F bus EA-23 did not transfer to startup power on turbine trip due to loss of ED-11-2. 1A bus EA-21 remained powered from #1-1 station power transformer EX-01 until operators opened the generator breakers using a jumper on relay 487u (Y phase) in control room panel EC-04. 1F bus EA-23 remained powered from #1-3 station power transformer until the generator breakers opened.

IV. Plant / Equipment Conditions and Operator Actions Following Event Initiation Notes:

Due to the high activity level and unavailability of some plant computer data during this event, times recorded in the Operator Log are generally correct, but may not exactly match information from other sources.

Effects of conditions/actions described below are depicted in Appendix 1 - PCS and SG Post-Trip Behavior.

Page 57 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 58 of 93 1506: Conditions noted in III above.

Main steam safety valves (MSSVs) on both steam generator headers opened and operated (throttled/closed/opened) to maintain SG pressures and lower PCS temperature and pressure.

(MSSVs opened due to ASDVs failing closed and MSIVs closing on MSIS.)

Operators entered EOP-1.0 Standard Post-Trip Actions.

1515: Due to there being no steaming path available, PCS temperature rose to 544°F resulting in MSSVs opening further and PCS temperature, pressure and level lowering. PCS temperature continued lowering primarily due to relatively cold (87°F) AFW being supplied to the steam generators (690 gpm total).

AFW pump P-8B flow control valves CV-0727 and CV-0749 failed full open. The flow delivered to each SG was dependent on piping losses and SG pressure differences. SG pressures were initially both ~930 psig. However, E-50As pressure lowered more than E-50Bs (possibly due to varying MSSV characteristics), resulting in significantly more cool AFW flow to E-50A, which further lowered its pressure. By 1530 total AFW flows (P-8B +P-8C) to the SGs were 502 gpm to E-50A and 195 gpm to E-50B. This flow imbalance contributed to over-filling E-50A.

1517: Power Control verified main generator breakers 25F7 and 25H9 were closed (failed to open on turbine trip). Operators installed a jumper on relay 487u (Y phase) in control room panel EC-04 to open the breakers per EOP-1.0. Opening the generator breakers de-energized 4160v 1A bus EA-21, stopping primary coolant pumps P-50A and P-50C. PCPs P-50B and P-50D remained in service, maintaining forced circulation with one operating pump in each PCS/SG loop.

1527: Operators entered EOP-9.0 Functional Recovery Procedure due to less than 3 preferred AC buses being available. (Pressurizer level 62%)

1531: Operator observed high SG E-50A water level (90%) and an NPO was directed to isolate steam to P-8B per EOP Supplement 19 Alternate Auxiliary Feedwater Methods, i.e. manually closing steam supply valve CV-0522B. Both SG levels had been observed approximately equal (35% - 40%) during EOP-1.0 verbal verifications (1515). Operators entered ONP-2.3 Loss of DC Power.

1537: Operators first addressed safety function MVAE-DC-1 due to it being jeopardized (acceptance criteria not being met). Per MVAE-DC-1 operators entered ONP 24.1 Loss of Preferred AC Bus Y-10 and ONP-24.3 Loss of Preferred AC Bus Y-30 to recover the buses.

Operator observed high PCS pressure (2200 psia) due to loss of power to pressurizer pressure controller channel A which failed spray valves CV-1057 and CV-1059 closed. Operator placed pressurizer pressure control channel B in service, lowered pressure in manual mode and then placed the controller in auto mode. PZR spray valves then remained available for pressure control.

Operator also noted loss of power to pressurizer level controller channel A and placed channel B and pressurizer heater select channel B in service. This resulted in letdown orifice stop valves CV-2003, CV-2004 and CV-2005 opening and charging pump P-55A speed lowering from 53 gpm to 33 gpm, and restored bus 1D pressurizer heater availability. Opening the letdown orifice valves resulted in letdown relief valve RV-2006 opening, due to CV-2009 having closed on CHR.

RV-2006 directed letdown flow (108 gpm, 560 gal total) to quench tank T-73 in containment, and resulted in relief valve 2006 discharge high temperature annunciator EK-0702 alarming.

(Pressurizer level 71%)

Page 58 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 59 of 93 1542: Operator closed letdown orifice stop valves CV-2003, CV-2004 and CV-2005 to isolate letdown flow per ARP-4 Annunciator Response Procedure Primary System Volume Level Pressure Scheme EK-07 (C-12).

At this time charging flow was 73 gpm with 0 letdown and 5 gpm PCP bleedoff flow, resulting in 68 gpm PCS net inventory addition. When the density change from charging temperature to PCS temperature is considered this gives a 90 gpm effective charging rate or 1.36%/minute pressurizer level rise rate (90 gpm / 66.16 g/% = 1.36%/m). (Pressurizer volume gal / %

indicated level = 66.16 g/% per surveillance procedure DWO-1 Operators Daily/Weekly Items Modes 1, 2, 3, and 4 Rev 80.)

1544: Operator closed CV-0737A, isolating P-8C AFW flow to steam generator E-50A. P-8C flow to E-50B continued at 165 gpm, and P-8B flow continued at 380 gpm to E-50A and 0 gpm to E-50B.

1549: Operators restored power to 2400v 1E bus EA-13 per SOP-30 Station Power and reenergized associated pressurizer heaters.

1555: Operator logged pressurizer level high (>62.8%) (actual level 78%). Due to PCS temperature continuing to lower, the observed level rate of rise was less than would be observed if temperature was stable. Changing PCS temperature one degree has the effect of changing PCS water volume 74.43 gallons (per DWO-1). (Note: Per PZR pressure/level recorder LPIR-0101B, pressurizer level exceeded 62.8% at 1528.)

1557: Operator aligned preferred ac bus EY-30 to be supplied from instrument ac bus EY-01 via the bypass regulator. Energizing EY-30 resulted in Left channel safety injection actuation which de-energized (load shed) 2400V 1E bus EA-13 and started associated equipment. P-55C did not start due to panel ED-11-1 being de-energized.

Operators verified SI throttling criteria met and stopped both operating charging pumps P-55A and P-55B to stop PCS inventory addition. Charging and letdown flows = 0, 5 gpm PCP bleedoff to primary system drain tank T-74 continues. (Pressurizer level 80%)

Electricians reported buses ED-10L and ED-10R fault free. Operator closed shunt trip breaker 72-01 reenergizing Left channel dc buses ED-10L, ED-10R, ED-11-1, ED-11-2 from battery ED-01.

Generator field breaker 341 automatically opened when ED-11-2 was reenergized. Instrument air compressor C-2A tripped for an unknown reason when dc power was restored. Operator manually started compressors C-2B and C-2B. The brief loss of air compressor had no noticeable effect.

1602: NPO reported charging pump P-55B suction relief valve RV-2096 lifting and not reseating, equipment drain tank T-80 full and floor drains backing up on the auxiliary building 590 elevation.

Control room directed closing pump suction and discharge valves to isolate P-55B and its suction relief. Water discharged from the relief was from concentrated boric acid tanks T-53A and T-53B.

Operators restored power to 1E bus EA-13 and reenergized associated pressurizer heaters.

1603: Auxiliary operator reported steam supply valve to P-8B turbine CV-0522B manually closed per EOP Supplement 19. AFW flow to and steam flow from E-50A = 0. AFW flow to E-50B continued at 165 gpm and steam flow from E-50B was controlled by associated MSSVs. PCS heat removal rate was reduced and PCS temperature stopped lowering and started rising. The Page 59 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 60 of 93 PCS heatup rate was 1°F/m, resulting in PZR level rising 1.125%/m. (Tave 529°F, PZR level 85%)

1609: Operator closed CV-0736A, isolating AFW flow to E-50B, slightly raising the PCS heatup rate. There was no AFW to either SG at this time and steam was only being removed from E-50B via MSSVs throttling.

1615: MSSVs on both steam generator headers opened due to PCS temperature rising to 544°F.

PZR level peaked at 101.5% and then lowered as PCS temperature lowered. (Note: There was no PCS inventory addition since 1557. The PZR level rise was entirely due to PCS heatup from 529°F to 544°F.) After opening, the MSSVs remained partially open, effectively controlling PCS Tave 540°F until the ASDVs were placed in service.

1621: Operators entered ONP-7.1 Loss of Instrument Air and placed C-2B and C-2C in service.

Compressor C-2A tripped during electrical bus restoration as previously noted.

1630: Charging pump P-55B suction and discharge valves reported closed, isolating suction relief valve leakage.

1639: Operator restored 150 gpm AFW flow to E-50B using P-8C.

1646: After confirming no faults on preferred ac bus EY-10, #3 inverter ED-08 was aligned to supply EY-30 and EY-10 was powered from instrument ac bus EY-01 via the bypass regulator. All preferred ac buses were now available.

All 4 ADVs were available when EY-10 was restored, and operators began using them for PCS temperature control. MSSVs fully closed. (Tave 539°F) 1720: Operators entered ONP-4.1 Containment Spurious Isolation and operator reset CHR.

1746: Operators exited EOP-9.0 and entered GOP-8 Power Reduction and Plant Shutdown to Mode 2 or Mode 3 > 525°F.

1818: Operators reset SIAS and restored non-critical service water per SOP-15 Service Water System.

1852: Operators restored AFW pump P-8B steam supply CV-0522B to AUTO per EOP Supplement 19.

1933: Placed #3 battery charger ED-17 in service supplying station battery ED-01. #2 and #3 battery chargers ED-16 and ED-17 in service.

2348: Pressurizer level lowered to 62% and continued lowering due to PCP bleedoff.

09/26/11, 0311: Placed #4 battery charger ED-18 in service supplying station battery ED-02.

Battery chargers #3 ED-17 and #4 ED-18 in service.

09/27/11, 1733: Placed #1 inverter ED-06 in service supplying #1 preferred ac bus EY-10.

Page 60 of 93

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Analysis Attachment 01 - Page 61 of 93 Acronyms AFAS Auxiliary Feedwater Actuation Signal AFW Auxiliary Feedwater ASDV Atmospheric Steam Dump Valve CAS Compressed Air System CBO Controlled Bleedoff CHP Containment High Pressure CHR Containment High Radiation CIS Containment Isolation Signal CVCS Chemical and Volume Control System FWP Feedwater Purity MFRV Main Feedwater Regulating Valve MSIS Main Steam Isolation Signal MSIV Main Steam Isolation Valve MSSV Main Steam Safety Valve NCO Nuclear Control Operator NPO Nuclear Plant Operator PCP Primary Coolant Pump PCS Primary Coolant System PSDT Primary System Drain Tank PZR Pressurizer RPS Reactor Protective System SG Steam Generator SI Safety Injection SIS Safety Injection Actuation Signal VCT Volume Control Tan Page 61 of 93

Attachment 2 - Failure Modes Analysis Problem Statement: Electrical Power was lost to DC Bus ED-10L and ED-10R Additional Failure Modes Supporting Evidence Refuting Evidence Assumptions Conclusion Information Simultaneous Power to 125 VDC Bus There was no reported None None It is extremely unlikely these events manual opening of: ED10-L & R was lost. observation of individuals could be coordinated to occur at the

[Bkr 72-18 (Battery opening these breakers. same time. Therefore this Failure No. 1 ED-1) or 72- The breakers would have to Mode is not considered to be 01 (Isolation Breaker have been opened simultaneous credible.

To DC Battery No. 1 with the shorting event ED-1)] observed during the ED-11-2 AND work.

Bkr 72-11 (Charger No. 3 ED-17)

AND Bkr 72-15 (Charger No. 1 ED-15)

A (+) to (-) short Power to 125 VDC Bus Multiple individuals observing The short caused Bkr 72- Upon It is extremely unlikely that a short occurred in ED-08 ED10-L & R was lost. the Electrical Maintenance 18 (Battery No. 1 ED-1) restoration, ED- would spontaneously occur in ED-(Inverter No. 3) or in work being performed in DC to open and the short 08 (Inverter No. 08 (Inverter No. 3) or its connected its connected power Distribution Panel ED-11-2 caused Battery Chargers 3) was reported power feed cable simultaneously feed cabling. observed an electrical arc when ED-15 and ED-17 to to be operating with the electrical arc caused by the a piece of copper bar attached cease output operation. normally. loss of physical control of the to the aluminum bus bar swung copper bar being worked in DC and made contact with the Distribution Panel ED-11-2.

opposite polarity bus. There is Therefore this Failure Mode is not also photographic evidence of considered to be credible.

the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Bus Multiple individuals observing The short caused Bkr 72- None It is extremely unlikely that a short occurred internally ED10-L & R was lost. the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in spare Page 62 of 93

to spare breaker 72- work being performed in DC to open and the short breaker 72-11 simultaneously with 11 (no connected Distribution Panel ED-11-2 caused Battery Chargers the electrical arc caused by the loss load or cabling) observed an electrical arc when ED-15 and ED-17 to of physical control of the copper bar a piece of copper bar attached cease output operation. being worked in DC Distribution to the aluminum bus bar swung Panel ED-11-2. Therefore this and made contact with the Failure Mode is not considered to opposite polarity bus. There is be credible.

also photographic evidence of the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Bus At the time of the event, ED-17 The short caused Bkr 72- Upon It is extremely unlikely that a short occurred in ED-17 ED10-L & R was lost. (Battery Charger No. 3) was in 18 (Battery No. 1 ED-1) restoration, ED- would spontaneously occur in ED-(Battery Charger No. standby with its breaker 72-12 to open and the short 17 (Battery 17 (Battery Charger No. 3) or its

3) or in its connected (Charger NO. 3 ED-17) OPEN. caused Battery Chargers Charger No. 3) connected power feed cable power feed cabling. Therefore, a short in ED-17 ED-15 and ED-17 to was reported to simultaneously with the electrical could not have affected 125 cease output operation. be operating arc caused by the loss of physical VDC Bus ED10-L & R as it normally. control of the copper bar being was not electrically connected. worked in DC Distribution Panel ED-11-2. Therefore this Failure Mode is not considered to be credible.

A (+) to (-) short Power to 125 VDC Bus Multiple individuals observing The short caused Bkr 72- None It is extremely unlikely that a short occurred in P-81A ED10-L & R was lost. the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in P-(DC Primary work being performed in DC to open and the short 81A (DC Primary Coolant Pump Coolant Pump Oil Distribution Panel ED-11-2 caused Battery Chargers Oil Lift Pump) or its connected Lift Pump) or in its observed an electrical arc when ED-15 and ED-17 to power feed cable simultaneously connected power a piece of copper bar attached cease output operation. with the electrical arc caused by the feed cabling. to the aluminum bus bar swung loss of physical control of the and made contact with the copper bar being worked in DC opposite polarity bus. There is Distribution Panel ED-11-2.

also photographic evidence of Therefore this Failure Mode is not the results of an electrical arc. considered to be credible.

A (+) to (-) short Power to 125 VDC Bus Multiple individuals observing The short caused Bkr 72- None It is extremely unlikely that a short occurred in P-81C ED10-L & R was lost. the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in P-(DC Primary work being performed in DC to open and the short 81C (DC Primary Coolant Pump Oil Coolant Pump Oil Distribution Panel ED-11-2 caused Battery Chargers Lift Pump) or in its connected Lift Pump) or in its observed an electrical arc when ED-15 and ED-17 to power feed cable simultaneously connected power a piece of copper bar attached cease output operation. with the electrical arc caused by the Page 63 of 93

feed cable. to the aluminum bus bar swung loss of physical control of the and made contact with the copper bar being worked in DC opposite polarity bus. There is Distribution Panel ED-11-2.

also photographic evidence of Therefore this Failure Mode is not the results of an electrical arc. considered to be credible.

A (+) to (-) short Power to 125 VDC Bus Multiple individuals observing The short caused Bkr 72- None It is extremely unlikely that a short occurred in ED-11-1 ED10-L & R was lost. the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in ED-(125 VDC Panel) or work being performed in DC to open and the short 11-1 (125 VDC Panel) or any of the any of the loads Distribution Panel ED-11-2 caused Battery Chargers loads connected to this panel connected to this observed an electrical arc when ED-15 and ED-17 to simultaneously with the electrical panel. a piece of copper bar attached cease output operation. arc caused by the loss of physical to the aluminum bus bar swung control of the copper bar being and made contact with the worked in DC Distribution Panel opposite polarity bus. There is ED-11-2. Therefore this Failure also photographic evidence of Mode is not considered to be the results of an electrical arc. credible.

A (+) to (-) short Power to 125 VDC Bus None The short caused Bkr 72- Based on This Failure Mode has a high occurred in ED-11-2 ED10-L & R was lost. 18 (Battery No. 1 ED-1) inspection post probability as being the cause of the (125 VDC Panel) or to open and the short event, Bkr 72- loss of electrical Power to DC Bus any of the loads Multiple individuals caused Battery Chargers 18 (Battery No. ED-10L and ED-10R.

connected to this observing the Electrical ED-15 and ED-17 to 1 ED-1) was panel. Maintenance work cease output operation. found being performed in DC CLOSED, but Distribution Panel ED- After the event, Bkr 72- breaker 72-01 11-2 observed an 37 (Inverter No.1 ED-06 (Isolation electrical arc when a Power Supply Breaker) Breaker To Dc piece of copper bar was found tripped. Per Battery No. 1 attached to the the Inverter vendor, ED-1) was aluminum bus bar capacitors on the feed discovered swung and made side of the Inverter TRIPPED.

contact with the would have fed a opposite polarity bus. connected fault. The Per Dwg. E-8 There is also vendor concurred that it Sh. 1, Breaker photographic evidence was reasonable to 72-01 (Isolation of the results of an conclude that Bkr 72-37 Breaker To Dc electrical arc. could have tripped from Battery No. 1 the current produced by ED-1) is Page 64 of 93

the Inverter capacitors. identified as a Located between ED- Non-Automatic 10R (125 VDC Bus) and shunt trip ED-11-2 (125 VDC breaker, that is Panel) is fuse FUZ/D11- this breaker 2 (Feeder Fuse To Relay would not In Panel ED-11A). This incorporate a fuse was found intact. magnetic or The assumption is that it thermal is reasonable to expect automatic trip that the fault current feature. As has contributed by ED-06 been discovered, (Inverter No. 1) would this breaker trip Bkr 72-37 and not does in fact fuse FUZ/D11-2. Note contain a that for the stated failure magnetic mode, all of the fault automatic trip current would have feature.

passed through fuse FUZ/D11-2, and this fuse was found intact.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- Upon It is extremely unlikely that a short occurred in ED-15 Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) restoration, ED- would spontaneously occur in ED-(Battery Charger No. lost. work being performed in DC to open and the short 15 (Battery 15 (Battery Charger No. 1) or its

1) or in its connected Distribution Panel ED-11-2 caused Battery Chargers Charger No. 1) connected power feed cable power feed cabling. observed an electrical arc when ED-15 and ED-17 to was reported to simultaneously with the electrical a piece of copper bar attached cease output operation. be operating arc caused by the loss of physical to the aluminum bus bar swung normally. control of the copper bar being and made contact with the worked in DC Distribution Panel opposite polarity bus. There is ED-11-2. Therefore this Failure also photographic evidence of Mode is not considered to be the results of an electrical arc. credible.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- None It is extremely unlikely that a short occurred internally Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in spare to spare breaker 72- lost. work being performed in DC to open and the short breaker 72-16 simultaneously with 16 (no connected Distribution Panel ED-11-2 caused Battery Chargers the electrical arc caused by the loss load or cabling) observed an electrical arc when ED-15 and ED-17 to of physical control of the copper bar Page 65 of 93

a piece of copper bar attached cease output operation. being worked in DC Distribution to the aluminum bus bar swung Panel ED-11-2. Therefore this and made contact with the Failure Mode is not considered to opposite polarity bus. There is be credible.

also photographic evidence of the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- Upon It is extremely unlikely that a short occurred in ED-06 Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) restoration, ED- would spontaneously occur in ED-(Inverter No. 1) or in lost. work being performed in DC to open and the short 06 (Inverter No. 06 (Inverter No. 1) or its connected its connected power Distribution Panel ED-11-2 caused Battery Chargers 1) was reported power feed cable simultaneously feed cabling. observed an electrical arc when ED-15 and ED-17 to to be operating with the electrical arc caused by the a piece of copper bar attached cease output operation. normally. loss of physical control of the to the aluminum bus bar swung copper bar being worked in DC and made contact with the Distribution Panel ED-11-2.

opposite polarity bus. There is Therefore this Failure Mode is not also photographic evidence of considered to be credible.

the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- None It is extremely unlikely that a short occurred in EU-72 Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in ED-(Public Address lost. work being performed in DC to open and the short 06 (Inverter No. 1) or its connected System Inverter) or Distribution Panel ED-11-2 caused Battery Chargers power feed cable simultaneously connected cabling. observed an electrical arc when ED-15 and ED-17 to with the electrical arc caused by the a piece of copper bar attached cease output operation. loss of physical control of the to the aluminum bus bar swung copper bar being worked in DC and made contact with the Distribution Panel ED-11-2.

opposite polarity bus. There is Therefore this Failure Mode is not also photographic evidence of considered to be credible.

the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- Upon It is extremely unlikely that a short occurred in the ED- Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) restoration, the would spontaneously occur in the 10L (125 VDC Bus) lost. work being performed in DC to open and the short ED-10L (125 ED-10L (125 VDC Bus) bus work bus work. Distribution Panel ED-11-2 caused Battery Chargers VDC Bus) bus simultaneously with the electrical observed an electrical arc when ED-15 and ED-17 to provided power arc caused by the loss of physical a piece of copper bar attached cease output operation. to its connected control of the copper bar being to the aluminum bus bar swung load without worked in DC Distribution Panel and made contact with the incident. ED-11-2. Therefore this Failure opposite polarity bus. There is Mode is not considered to be Page 66 of 93

also photographic evidence of credible.

the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- Upon It is extremely unlikely that a short occurred in the ED- Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) restoration, the would spontaneously occur in the 10R (125 VDC Bus) lost. work being performed in DC to open and the short ED-10R (125 ED-10R (125 VDC Bus) bus work bus work. Distribution Panel ED-11-2 caused Battery Chargers VDC Bus) bus simultaneously with the electrical observed an electrical arc when ED-15 and ED-17 to provided power arc caused by the loss of physical a piece of copper bar attached cease output operation. to its connected control of the copper bar being to the aluminum bus bar swung load without worked in DC Distribution Panel and made contact with the incident. ED-11-2. Therefore this Failure opposite polarity bus. There is Mode is not considered to be also photographic evidence of credible.

the results of an electrical arc.

A (+) to (-) short Power to 125 VDC Multiple individuals observing The short caused Bkr 72- It is extremely unlikely that a short occurred in the ED- Buss ED10-L & R was the Electrical Maintenance 18 (Battery No. 1 ED-1) would spontaneously occur in the 13 (Metering Section lost. work being performed in DC to open and the short ED-13 (Metering Section W/IN MN W/IN MN DC Dist Distribution Panel ED-11-2 caused Battery Chargers DC Dist Bus #1) ground detection Bus #1) ground observed an electrical arc when ED-15 and ED-17 to circuitry simultaneously with the detection circuitry. a piece of copper bar attached cease output operation. electrical arc caused by the loss of to the aluminum bus bar swung physical control of the copper bar and made contact with the being worked in DC Distribution opposite polarity bus. There is Panel ED-11-2. Therefore this also photographic evidence of Failure Mode is not considered to the results of an electrical arc. be credible.

Summary: The Failure Mode: A (+) to (-) short occurred in ED-11-2 (125 VDC Panel) or any of the loads connected to this panel, was considered to be the credible failure which resulted in loss of Electrical Power to DC Bus ED-10L and ED-10R. Specifically, the short was due to the contact of opposite polarity copper stand-offs, one of which was in the process of being removed by Electrical Maintenance when the fault occurred.

References:

Dwg. E-8 Sh. 1 and Operators Statements regarding the Plant Trip Notes: None Page 67 of 93

- Failure Modes Chart Page 68 of 93

Page 69 of 93 B

MAINTENANCE ON SHORT CIRCUIT DURING ED-11-2 ED-11-2 MAINTENANCE OBSERVED DEFICIENCIES ORGANIZATION WORK ON ENERGIZED AND PROCESS PANEL WEAKNESSES END RECOGNIZED JOB SKILL BARRIER ANALYSIS CHANGE ANALYSIS END Page 70 of 93

- Barrier Analysis GOAL HAZARD BARRIER HOW BARRIER FAILED IMPACT ON EVENT Work order plan did not include details for removal of bus bar Contributing Cause 2 Adequate information with damaged threads and available to plan Work order planning insulation of energized components. Used notes for to plan and complete work instructions and was based on WO Task LTA outdated procedure.

Indicated there was Plant trip Ops impact review concern which but that it was Root Cause 1 slight.

No Plant maintenance procedures included in WO plan Procedure quality but the procedure referenced was Contributing Cause 2 Plant Maintenance outdated Procedures LTA EPS-E-10 has been in use but no Maintenance feedback evidence of DRNs Contributing Cause 2 HPER input that EN-IS-123 vs EN-OP-102 needs clarification Enhancement Procedure quality per shift manager face-to-face meetings on energized equipment Fleet Procedures LTA work Incorporation of previous No evidence of previous NA comments unincorporated comments Page 71 of 93

Relevant OE30342 included in OE References LTA Planning development WO package NA Qualitative risk assessments at four points could have resulted in Root Cause 1; see change Risk assessment increased management attention analysis and better decision making Inappropriate work scheduling Managers were not intrusive, unaware and unable to control Management oversight Root Cause 1/ LOW what was going on Crew indicated concerns Feedback to correct identified were reported and Work crew review NA previously known problems resolved Breaker inspection and Crew develops replacement was not turned over; Face to face review good plan to Shift turnover LTA continued with same crew after NA perform work temporary mod was installed Opportunity to review work Crew review had opportunity and order package on schedule NA identified concerns Crew review LTA Opportunity to resolve Concerns related to drawing comments on work order Root Cause 1 and Contributing availability not resolved but crew package Cause 4 continued with work Prejob brief LTA Use of correct PJB form Based on interviews, EN-HU-102 was not referenced and checklists not used; in addition, during HPER, workers indicated they Root Cause 1 and Contributing Correct performance of were not clear about how to use Cause 4 PJB EN-HU-102 flowchart for selecting prejob brief level Page 72 of 93

Supervisor, duty station manager and asst maintenance manager Manager and supervisor were present at brief and should Supports Contributing Cause 3 oversight have identified failure to use and Root Cause 1 checklists OE provided was relevant but not successfully used due to weak Use of OE Contributing Cause 4 prejob brief During HPER discussions, workers were considered and Worker skills LTA Training and experience they considered themselves NA trained an experienced Worker decisions not to stop and regroup when deciding to remove bus connectors and to change Response to changes LTA Root Cause 1 and Contributing Worker regroup and rebrief from insulation sheets to Cause 4; see Change Analysis insulating gloves violated procedures and expectations Crew completes work as planned During HPER reviews, crew Worker and supervisor indicated there were no adverse Working conditions LTA NA recognition impacts from working conditions Weaknesses in job execution not recognized and corrected even though supervisor, duty station Oversight LTA Manager and supervisor Contributing Cause 3 and Root manager and asst maintenance oversight Cause 1 manager were present and able to recognize what was going on Page 73 of 93

- Change Analysis ATTRIBUTE PROBLEM PRIOR DIFFERENCES/ CHANGES IMPACT ON EVENT SITUATION SITUATION Work Decision is Only Replacement of breaker 72-123 Weak decision making and failure priority made to troubleshooting will involve work on energized bus to perform qualitative risk analysis decision replace 72- would be of panel ED-11-2 which has EOOS support Root Cause 1 123 performed orange risk factor Use of Insulating Prejob brief There is inadequate separation Failure to rebrief this change in insulating gloves are plan was to between opposing phase bus plans reduces chances for gloves used to sheets of connectors during repair work successful completion and remove insulating which increases the chance of supports Root Cause 1 damaged bus material short circuit connectors in panel ED-11-2 Work on Damaged bus Work order Removal reduces chances that Worker do not stop to change the damaged connectors plans indicate metal chips will fall into bus which instructions or rebrief the next bus are removed bus connectors is good; removal of connectors steps to be completed; supports connectors from panel will be repaired increases risk that errors will occur Root Cause 1 ED-11-2 to in the panel. because it increases the repair threads Task does not complexity of the task include the word REMOVE.

Page 74 of 93

Attachment 6 - Safety Culture Evaluation TABLE 1 - SAFETY CULTURE COMPARISON CR-PLP-2011-4822- Plant Trip SAFETY CULTURE During Panel ED-11-2 DESCRIPTION COMPONENT Maintenance

1. Decision-Making Licensee decisions demonstrate that nuclear safety is an overriding priority.

RC1

2. Resources The licensee ensures that personnel, equipment, procedures, and other RC1/ CC2 resources are available and adequate to assure nuclear safety.

3. Work Control The licensee plans and coordinates work activities, consistent with nuclear safety RC1

4. Work Practices Personnel work practices support human performance.

RC1/ CC2/ CC3

5. Corrective Action The licensee ensures that issues potentially impacting nuclear safety are No safety culture weakness Program promptly identified, fully evaluated, and that actions are taken to address safety determined for any of the identified issues in a timely manner, commensurate with their significance. causes

6. Operating Experience The licensee uses operating experience (OE) information, including vendor No safety culture weakness recommendations and internally generated lessons learned, to support plant determined for any of the identified safety. causes

7. Self- and The licensee conducts self- and independent assessments of their activities and No safety culture weakness Independent practices, as appropriate, to assess performance and identify areas for determined for any of the identified Assessments improvement. causes Page 75 of 93

CR-PLP-2011-4822- Plant Trip SAFETY CULTURE During Panel ED-11-2 DESCRIPTION COMPONENT Maintenance

8. Environment For An environment exists in which employees feel free to raise concerns both to No safety culture weakness Raising Concerns their management and/or the NRC without fear of retaliation and employees are determined for any of the identified encouraged to raise such concerns. causes

9. Preventing, Detecting A policy for prohibiting harassment and retaliation for raising nuclear safety No safety culture weakness and Mitigating concerns exists and is consistently enforced. determined for any of the identified Perceptions of causes Retaliation

10. Accountability Management defines the line of authority and responsibility for nuclear safety.

RC1/CC3

11. Continuous The licensee ensures that a learning environment exists. RC1/CC3 Learning Environment

12. Organizational Management uses a systematic process for planning, coordinating, and No safety culture weakness Change Management evaluating the safety impacts of decisions related to major changes in determined for any of the identified organizational structures and functions, leadership, policies, programs, causes procedures, and resources. Management effectively communicates such changes to affected personnel.

13. Safety Policies Safety policies and related training establish and reinforce that nuclear safety is No safety culture weakness an overriding priority in that. determined for any of the identified causes NOTES

1. Decision Making - Indicated because personnel in all parts of the Plant organization did not recognize, account for or prepare for the industrial safety and Plant operational risk involved with the panel ED-11-2 breaker maintenance. (H1a). This was described by the examples identified for RC1 and will be addressed by the corrective actions assigned to that cause and its Extent.

Page 76 of 93

2. Resources - Indicated because management personnel exceeded established work hours rules and failed to follow prejob brief requirements (H2b) and because work orders used for breaker maintenance did not include details appropriate for energized, high critical equipment (H2c)

Concerns will be addressed by the corrective actions for RC1 and CC2.

3. Work Control - Indicated because all parts of the Plant organization did not recognize, account for or prepare for the industrial safety and Plant operational risk involved with the panel ED-11-2 breaker maintenance. (H3a) This was described by the examples identified for RC1 and will be addressed by the corrective actions assigned to that cause and its Extent.

4. Work Practices - Oversight by managers and supervisors did not result in identification and correction (H4b) of the errors and weaknesses on the part of the Maintenance work crew (H4a) involved with the breaker inspection and maintenance work that lead to this event. Based on the evidence, the Plant organization did not recognize and account for the industrial safety and Plant trip risk involved(H4c) This will be addressed by corrective actions assigned for RC1, CC2 and CC3.

5. Accountability - Managers and supervisors did not recognize the industrial safety and Plant trip risk involved with the breaker inspection and maintenance work that lead to this event and did not reinforce safety standards among themselves or with those doing the work (A1b) . result in identification and correction (H4b) of the errors and weaknesses on the part of the Maintenance work crew (H4a) involved. This concern will be addressed by corrective actions assigned for RC1 and CC3.

6. Continuous Learning Environment - Regardless of supervisor and manager training based on SOER 10-2, none of those present at the prejob brief or at the work site, identified or corrected lapses in the conduct of the prejob brief, the lack of critical steps or the failure to stop and reconsider when the job plan changed (C2a). This concern will be addressed by corrective actions assigned for RC1 and CC3.

Page 77 of 93

TABLE 2 - DETAILED SAFETY CULTURE COMPONENT REVIEW CR-PLP-2011-4822- Plant Trip During Panel Description ED-11-2 Maintenance

1. Decision-Making Licensee decisions demonstrate that nuclear safety is an overriding priority. Specifically (as applicable):

DM H.1(a) The licensee makes safety-significant or risk-significant decisions using a systematic process, Applicable to RC1. See Note 1.

especially when faced with uncertain or unexpected plant conditions, to ensure safety is maintained. This includes formally defining the authority and roles for decisions affecting nuclear safety, communicating these roles to applicable personnel, and implementing these roles and authorities as designed and obtaining interdisciplinary input and reviews on safety-significant or risk-significant decisions.

DM H.1(b) The licensee uses conservative assumptions in decision making and adopts a requirement to No safety culture weakness determined demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate that it is unsafe in order to disapprove the action. The licensee conducts for any of the identified causes effectiveness reviews of safety-significant decisions to verify the validity of the underlying assumptions, identify possible unintended consequences, and determine how to improve future decisions.

DM H.1(c) The licensee communicates decisions and the basis for decisions to personnel who have a need No safety culture weakness determined to know the information in order to perform work safely, in a timely manner.

for any of the identified causes

2. Resources The licensee ensures that personnel, equipment, procedures, and other resources are available and adequate to assure nuclear safety. Specifically, those necessary for:

RES H.2(a) Maintaining long term plant safety by maintenance of design margins, minimization of long- No safety culture weakness determined standing equipment issues, minimizing preventative maintenance deferrals, and ensuring maintenance and engineering backlogs which are low enough to support safety.

for any of the identified causes RES H.2(b) Training of personnel and sufficient qualified personnel to maintain work hours within Applicable to RC1. See Note 2 working hours guidelines.

RES H.2(c) Complete, accurate and up-to-date design documentation, procedures, and work packages, and Applicable to CC2. See Note 2.

correct labeling of components.

RES H.2(d) Adequate and available facilities and equipment, including physical improvements, simulator No safety culture weakness determined fidelity and emergency facilities and equipment.

for any of the identified causes.

3. Work Control The licensee plans and coordinates work activities, consistent with nuclear safety. Specifically (as applicable):

WC H.3(a) The licensee appropriately plans work activities by incorporating

• risk insights;

• job site Applicable to RC1. See Note 3.

conditions, including environmental conditions which may impact human performance; plant structures, systems, and components; human-system interface; or radiological safety; and

• the need for planned contingencies, compensatory actions, and abort criteria.

Page 78 of 93

CR-PLP-2011-4822- Plant Trip During Panel Description ED-11-2 Maintenance WC H.3(b) The licensee appropriately coordinates work activities by incorporating actions to address: l

• No safety culture weakness determined the impact of changes to the work scope or activity on the plant and human performance.

• the impact of the work on different job activities, and the need for work groups to maintain for any of the identified causes interfaces with offsite organizations, and communicate, coordinate, and cooperate with each other during activities in which interdepartmental coordination is necessary to assure plant and human performance.

• The need to keep personnel apprised of work status, the operational impact of work activities, and plant conditions that may affect work activities.

• The licensee plans work activities to support long-term equipment reliability by limiting temporary modifications, operator work-arounds, safety systems unavailability, and reliance on manual actions. Maintenance scheduling is more preventive than reactive.

4. Work Practices Personnel work practices support human performance. Specifically (as applicable):

WP H.4(a) The licensee communicates human error prevention techniques, such as holding pre-job Applicable to CC3. See Note 4.

briefings, self and peer checking, and proper documentation of activities. These techniques are used commensurate with the risk of the assigned task, such that work activities are performed safely. Personnel are fit for duty. In addition, personnel do not proceed in the face of uncertainty or unexpected circumstances.

WP H.4(b) The licensee defines and effectively communicates expectations regarding procedural Applicable to CC2 and CC3. See Note 4.

compliance and personnel follow procedures WP H.4(c) The licensee ensures supervisory and management oversight of work activities, including Applicable to RC1. See Note 4.

contractors, such that nuclear safety is supported.

5. Corrective Action Program The licensee ensures that issues potentially impacting nuclear safety are promptly identified, fully evaluated, and that actions are taken to address safety issues in a timely manner, commensurate with their significance. Specifically (as applicable):

CAP P.1(a) The licensee implements a corrective action program with a low threshold for identifying No safety culture weakness determined issues. The licensee identifies such issues completely, accurately, and in a timely manner commensurate with their safety significance.

for any of the identified causes CAP P.1(b) The licensee periodically trends and assesses information from the CAP and other assessments No safety culture weakness determined in the aggregate to identify programmatic and common cause problems. The licensee communicates the results of the trending to applicable personnel.

for any of the identified causes CAP P.1(c) The licensee thoroughly evaluates problems such that the resolutions address causes and extent No safety culture weakness determined of conditions, as necessary. This includes properly classifying, prioritizing, and evaluating for operability and reportability conditions adverse to quality. This also includes, for significant for any of the identified causes problems, conducting effectiveness reviews of corrective actions to ensure that the problems are resolved.

CAP P.1(d) The licensee takes appropriate corrective actions to address safety issues and adverse trends in No safety culture weakness determined a timely manner, commensurate with their safety significance and complexity.

for any of the identified causes CAP P.1(e) If an alternative process (i.e., a process for raising concerns that is an alternate to the licensees No safety culture weakness determined corrective action program or line management) for raising safety concerns exists, then it results in appropriate and timely resolutions of identified problems.

for any of the identified causes Page 79 of 93

CR-PLP-2011-4822- Plant Trip During Panel Description ED-11-2 Maintenance

6. Operating Experience The licensee uses operating experience (OE) information, including vendor recommendations and internally generated lessons learned, to support plant safety. Specifically (as applicable):

OE P.2(a) The licensee systematically collects, evaluates, and communicates to affected internal No safety culture weakness determined stakeholders in a timely manner relevant internal and external OE.

for any of the identified causes OE P.2(b) The licensee implements and institutionalizes OE through changes to station processes, No safety culture weakness determined procedures, equipment, and training programs.

for any of the identified causes

7. Self- and Independent Assessments The licensee conducts self- and independent assessments of their activities and practices, as appropriate, to assess performance and identify areas for improvement. Specifically (as applicable):

SA P.3(a) The licensee conducts self-assessments at an appropriate frequency; such assessments are of No safety culture weakness determined sufficient depth, are comprehensive, are appropriately objective, and are self-critical. The licensee periodically assesses the effectiveness of oversight groups and programs such as CAP, for any of the identified causes and policies.

SA P.3(b) The licensee tracks and trends safety indicators which provide an accurate representation of No safety culture weakness determined performance.

for any of the identified causes SA P.3(c) The licensee coordinates and communicates results from assessments to affected personnel, No safety culture weakness determined and takes corrective actions to address issues commensurate with their significance.

for any of the identified causes

8. Environment For Raising An environment exists in which employees feel free to raise concerns both to their management and/or the NRC without fear of retaliation and Concerns employees are encouraged to raise such concerns. Specifically ( as applicable):

ERC S.1(a) Behaviors and interactions encourage free flow of information related to raising nuclear safety No safety culture weakness determined issues, differing professional opinions, and identifying issues in the CAP and through self assessments. Such behaviors include supervisors responding to employee safety concerns in an for any of the identified causes open, honest, and non-defensive manner and providing complete, accurate, and forthright information to oversight, audit, and regulatory organizations. Past behaviors, actions, or interactions that may reasonably discourage the raising of such issues are actively mitigated.

As a result, personnel freely and openly communicate in a clear manner conditions or behaviors, such as fitness for duty issues that may impact safety and personnel raise nuclear safety issues without fear of retaliation.

ERC S.1(b) If alternative processes (i.e., a process for raising concerns or resolving differing professional No safety culture weakness determined opinions that are alternates to the licensees corrective action program or line management) for raising safety concerns or resolving differing professional opinions exists, then they are for any of the identified causes communicated, accessible, have an option to raise issues in confidence, and are independent, in the sense that the program does not report to line management (i.e., those who would in the normal course of activities be responsible for addressing the issue raised).

Page 80 of 93

CR-PLP-2011-4822- Plant Trip During Panel Description ED-11-2 Maintenance

9. Preventing, Detecting, and A policy for prohibiting harassment and retaliation for raising nuclear safety concerns exists and is consistently enforced in that:

Mitigating Perceptions of Retaliation PDR S.2(a) All personnel are effectively trained that harassment and retaliation for raising safety concerns No safety culture weakness determined is a violation of law and policy and will not be tolerated for any of the identified causes PDR S.2(b) Claims of discrimination are investigated consistent with the content of the regulations No safety culture weakness determined regarding employee protection and any necessary corrective actions are taken in a timely manner, including actions to mitigate any potential chilling effect on others due to the for any of the identified causes personnel action under investigation.

PDR S.2(c) The potential chilling effects of disciplinary actions and other potentially adverse personnel No safety culture weakness determined actions (e.g., reductions, outsourcing, and reorganizations) are considered and compensatory actions are taken when appropriate.

for any of the identified causes

10. Accountability Management defines the line of authority and responsibility for nuclear safety. Specifically (as applicable):

ACC A.1(a) (a) Accountability is maintained for important safety decisions in that the system of rewards No safety culture weakness determined and sanctions is aligned with nuclear safety policies and reinforces behaviors and outcomes which reflect safety as an overriding priority.

for any of the identified causes ACC A.1(b) (b) Management reinforces safety standards and displays behaviors that reflect safety as an Applicable to RC1 and CC3. See Note 5.

overriding priority.

ACC A.1(c) (c) The workforce demonstrates a proper safety focus and reinforces safety principles among No safety culture weakness determined their peers.

for any of the identified causes

11. Continuous learning environment The licensee ensures that a learning environment exists. Specifically (as applicable):

CLE C.2(a) (a) The licensee provides adequate training and knowledge transfer to all personnel on site to Applicable to RC1 and CC3. See Note 6.

ensure technical competency.

CLE C.2(b) (b) Personnel continuously strive to improve their knowledge, skills, and safety performance No safety culture weakness determined through activities such as benchmarking, being receptive to feedback, and setting performance goals. The licensee effectively communicates information learned from internal and external for any of the identified causes sources about industry and plant issues.

12. Organizational change management OCM 12. Organizational Management uses a systematic process for planning, coordinating, and evaluating the No safety culture weakness determined change management safety impacts of decisions related to major changes in organizational structures and for any of the identified causes functions, leadership, policies, programs, procedures, and resources. Management effectively communicates such changes to affected personnel.

13. Safety policies Safety policies and related training establish and reinforce that nuclear safety is an overriding priority in that:

SP SP.4(a) (a) These policies require and reinforce that individuals have the right and responsibility to No safety culture weakness determined raise nuclear safety issues through available means, including avenues outside their organizational chain of command and to external agencies, and obtain feedback on the for any of the identified causes resolution of such issues.

SP SP.4(b) (b) Personnel are effectively trained on these policies. No safety culture weakness determined for any of the identified causes Page 81 of 93

CR-PLP-2011-4822- Plant Trip During Panel Description ED-11-2 Maintenance SP SP.4(c) (c) Organizational decisions and actions at all levels of the organization are consistent with the No safety culture weakness determined policies. Production, cost and schedule goals are developed, communicated, and implemented in a manner that reinforces the importance of nuclear safety.

for any of the identified causes SP SP.4(d) (d) Senior managers and corporate personnel periodically communicate and reinforce nuclear No safety culture weakness determined safety such that personnel understand that safety is of the highest priority.

for any of the identified causes Page 82 of 93

Attachment 7 - Evaluation for Organization and Programmatic Issues Include this Worksheet as an Attachment to the report. The questions are provided to promote consideration of like symptoms, not to define a specific failure mode. O&P causal factors are symptoms of the more basic causes of the event and are typically an action or condition that shaped the outcome of the situation.

For each causal factor block checked YES:

1. Ensure it is appropriately represented in the WHY Staircase as a cause or contributor.

2. In the BARRIER ANALYSIS, tie the O&P causal factors as appropriate to Barriers that failed, were weak, missing, or ineffective.

3. Summarize in the O&P section of the report how the identified Organizational & Programmatic weaknesses caused or contributed to the event and identify the Barrier which should have prevented it.

O&P Worksheet Contributed to or Potential O&P Failure Modes (Causal Factors) RC# AC # CC#

Caused Event?

YES NO

1) OP1X - Organization to Organization Interface Weaknesses Inadequate interface among Organizations (Good organizational structure but organizations dont communicate).

Excessive or lack of overlap in functions (Overall structural design results in overlaps or holes between organizations) a) OP1A - Does there appear to be evidence of inadequate interface among organizations?

Problems in this area surface in the form of a high human error rate in tasks requiring communication among different organizations. Usually this is caused by a lack of interface formality (tailgate meetings, formal N interface documentation or agreements, etc.), inadequate teamwork or trust among organizations, or inadequate physical settings.

b) OP1B - Is there evidence of excessive or lack of overlap functions between organizations?

Negative performance in this block is usually caused by a lack of organizational planning resulting in an N inadequate definition of job functions between one or more organizations.

c) OP1C - Is there evidence that the required notifications were not made when the job was begun, interrupted or completed? N Describes either the failure to perform the verbal communication of status when required by the process or the failure to design the process to require the verbal communication of status when successful implementation of the process depended upon this communication.

d) OP1D - Is there evidence that appropriate personnel and departmental interactions were not fully considered when new processes were created during the implementation phases of the change? N Changes to processes created new requirements for interaction between personnel or departments that were not considered in the implementation phase of the change.

e) OP1E - Is there evidence that planning was not coordinated with inputs from walk-downs and task analysis? N Job plan did not incorporate information gathered during field visits or task analysis concerning the steps and conditions required for successful completion of the task.

f) OP1F - Is there evidence that planning was not coordinated with all departments involved in task Interdepartmental communication and teamwork were not supported by the planned work flow. N

2) OP2X - Organization to Program Interface Weaknesses Lack of commitment to program implementation (organization never gets program off the ground)

Inadequate Program monitoring or management (organization does not monitor or manage the program effectively)

Lack of program evaluation process (program survives but Organization does not evaluate program, so it goes in the wrong direction)

Lack of organizational authority for program implementation (organization starves to death because no one is protecting it) a) OP2A - Is there evidence of a lack of commitment to program implementation?

Usually evidenced by slow program implementation. The failure is generally due to excessive program Y RC1/ CC4 implementation requirements or a lack of management support of the program.

b) OP2B - Is there evidence of inadequate program monitoring or inadequate management skills?

Indicated by a lack of program improvement over time. Usually it is caused by inadequate staffing or Y RC1/ LOW inadequate management skills.

Page 83 of 93

O&P Worksheet Contributed to or Potential O&P Failure Modes (Causal Factors) RC# AC # CC#

Caused Event?

YES NO c) OP2C - Is there evidence of a lack of a program evaluation process?

This area is more reactive, in that a program failure occurs before action is taken. However, the same items N contribute to negative performance, i.e., inadequate management practices, inadequate staffing for program implementation, or insufficient program design.

d) OP2D - Is there evidence of a lack of organizational authority for program implementation?

This code usually is associated with an insufficient budget for the program or fragmented responsibility Y RC1 and/or accountability for the program. Potential causes include a lack of organizational planning or a lack of management commitment to program implementation.

e) OP2E - Is there evidence of unclear or complex wording or grammar in program implementation documents? N Wording, grammar or symbols fail to clearly and concisely specify the required action; instructions provided for team of users fail to specify roles of each user.

f) OP2F - Is there evidence of an omission of relevant information in program implementation Y CC1, CC4, EOC documents that would have prevented an event from occurring (e.g. insufficient information in graphs, tables or illustration; lack of instructions or data sheet documentation requirements, etc.)

Over reliance on user's training, skills or experience; lack of detail for infrequent, complex, crucial or error-prone tasks; insufficient information in graphs, tables or illustrations; lack of instructions for data sheet documentation requirements g) OP2G - Is there evidence of the lack of a procedure that should have been written but does not exist? N The process meets administrative requirements for having a procedure, but no procedure has been written.

h) OP2H - Is there evidence that policy guidance or management expectations were not well defined or understood by personnel involved in performing the task?

Personnel exhibited a lack of understanding of existing policy and/or expectations, or policy/expectations Y were not defined.

i) OP2I - Is there evidence that job standards were not adequately defined or communicated?

Measurement of effectiveness could not be performed for specific job functions due to lack of defined N standards.

j) OP2J - Is there evidence that personnel exhibited insufficient awareness of the impact of actions on safety and reliability?

Management failed to provide direction regarding safeguards against non-conservative actions by personnel Y concerning nuclear safety or reliability k) OP2K - Is there evidence that management follow-up or monitoring of activities was ineffective Y in identifying shortcomings in implementation?

l) Management's methods for monitoring the success of initiatives were ineffective in identifying shortcomings in the implementation.

m) OP2L - Is there evidence that causes of a previous event or known problem were not determined? N Analysis methods failed to uncover the causal factors of consequential or non-consequential events.

n) OP2M - Is there evidence that the effects of changes on planned schedules were not adequately addressed prior to implementation? N Changes to processes which resulted in scheduled changes had effects on personnel or equipment that were not addressed in the change implementation.

o) OP2N - Is there evidence that the job scoping process did not properly identify potential task interruptions or environment stress? N Work scoping process was not effective in detecting reasonable obstructions to work flow (e.g., shift changes) or the impact of environmental conditions.

p) OP2O - Is there evidence that the job scoping process did not identify special circumstances or conditions that may be impacted or dependent on other circumstances or conditions? N Work scoping process was not effective in detecting work process elements having a dependency upon other circumstances or conditions.

q) OP2P - Is there evidence that the field walk down input to design was less than adequate?

Design change and/or field change requests as a result of inadequate field walk downs to verify actual N configurations of plant components, structures and systems that interface with or affect the designs.

3) OP3X - Program to Program Interface Weaknesses Lack of interface requirements (no formal procedures to make sure two programs talk to each other)

Conflicting program requirements (conflicting actions required by two different programs)

Inadequate interface requirements (information required is available but program interfaces are inadequate to get it)

Page 84 of 93

O&P Worksheet Contributed to or Potential O&P Failure Modes (Causal Factors) RC# AC # CC#

Caused Event?

YES NO a) OP3A - Is there evidence of a lack of interface requirements between two or more programs that are required to interface in that details necessary to ensure a consistent standard are not N adequately covered in programmatic implementing documents?

Usually this is caused by inadequate program design or an inadequate work planning process.

b) OP3B - Is there evidence of conflicting program requirements where one program has different actions from another program for the same issue? N This codes is used when different actions are required by two or more programs for the same situation. As a result, staff efficiency and accountability is negatively impacted.

c) OP3C - Is there evidence of inadequate interface requirements in that one program specifies actions different from another program for the same issue? N This code is used when actions are required by one program belonging to another program that is inadequate in perform the actions. The cause is usually inadequate program design and/or inadequate work planning processes

4) OP4X - Programmatic Deficiencies Insufficient detail (This is my first time doing this, how am I supposed to know what use normal process means?)

Inadequate scope (The procedure left out all the information on the electrical cables that need to be connected)

Excessive implementation requirements (so many requirements that people give up and dont try to follow the procedure)

Inadequate verification process (We havent really looked at our processes and given them a check up for over 15 years) a) OP4A - Is there evidence that there are insufficient details in a procedure to perform the task?

When a program is vague regarding what is required in a particular situation, it is usually indicative of an Y CC2 inadequate program design or insufficient feedback for individuals using the procedure.

b) OP4B - Is there evidence of inadequate job scope (omission of necessary functions) in an implementing procedure because of an inadequate program design or inadequate feedback from N the field?

Either inadequate program design or inadequate feedback from the field is usually taking place c) OP4C - Is there evidence of excessive implementation requirements that result in portions of the N program being ignored by the staff due to overload?

This can be caused by inadequate program design, lack of work prioritization, or inadequate staffing d) OP4D - Is there evidence of an inadequate verification process (single human error, high program failure rate, poor procedure quality or inadequate program design?

Program breakdown by a single human error; high program failure rate, poor procedure quality. Inadequate N program design e) OP4E - Is there evidence that there is a lack of responsibility by personnel because it is not well defined or personnel are not being held accountable? N Responsibility for process elements (procedures, engineering, training, etc.) was not placed with individuals or accountability for failures of those process elements was not placed with individuals.

f) OP4F - Is there evidence that a response to a known or repetitive problem was untimely?

Corrective action for known or recurring problems was not performed at or within the proper time. N g) OP4G - Is there evidence that needed changes to the plant were not approved or funded which N resulted in a plant issue?

Corrective actions for existing deficiencies that were previously identified were not approved or funded.

h) OP4H - Is there evidence that there was not a means or process to ensure procedures and documents were of adequate quality and up to date? N A process for changing procedures or other work documents to ensure quality and timeliness was nonexistent or inadequate i) OP4I - Is there evidence that duties were not well distributed among personnel that contributed N to a problem?

The work loading of individuals within a group or team did not adequately address training, experience, task frequency and duration, or other situational factors such that responsibility was inappropriately distributed.

j) OP4J - Is there evidence that too few workers are assigned to perform a task that contributed to N an issue?

Job planning did not allot a realistic number of man-hours based on the scope of work described.

Page 85 of 93

O&P Worksheet Contributed to or Potential O&P Failure Modes (Causal Factors) RC# AC # CC#

Caused Event?

YES NO k) OP4K - Is there evidence that an insufficient number of training or experienced workers were assigned to a task?

Though the overall number of personnel assigned matched the planned man-hour allotment, organization N methods failed to identify that personnel assigned did not have adequate experience or training to perform the work.

l) OP4L - Is there evidence that there is a problem in perform repetitive tasks and sub tasks which contributed to a problem?

Work flow plan repeated tasks or sub tasks to the detriment of successful completion of the evolution. N m) OP4M - Is there evidence that there was a less than adequate process for a configuration change to a design document? Y CC1 Documentation generated as a result of a design change which renders the as-left configuration of affected components, structures and systems indeterminate.

n) OP4N - Is there evidence that personnel exhibited insufficient awareness of the impact of actions Y Nuclear Culture on safety reliability because management failed to provide direction regarding safeguards against Safety Assessment non-conservative actions by personnel concerning nuclear safety or reliability?

Management failed to provide direction regarding safeguards against non-conservative actions by personnel concerning nuclear safety or reliability.

o) OP4O - Is there evidence that the planning process was not coordinated with inputs from walk N downs and task analysis?

Job plan did not incorporate information gathered during field visits or task analysis concerning the steps and conditions required for successful completion of the task.

p) OP4P - Is there evidence that previous industry or in-house operating experience was not N effectively used to prevent problems and an event occurred because the information was not properly assimilated by the organization (missed opportunity)?

Industry or in-house experience relating to a current problem existed previous to the problem, but was not assimilated by the organization (missed opportunity).

5) OP5X - Organizational Weaknesses Inadequate function or structure (poor internal organizational design that is missing vital functions)

Inadequate attention to emerging problems (organization doesnt pay attention to what is happening within it)

Inadequate work prioritization (organization doesnt prioritize their workloads so they waste time on unimportant things)

Inadequate communication within the organization (communication does not get up and down the organizational ladder)

Inadequate job skills, work practices, or decision making (organization had a problem because of its people) a) OP5A - Is there evidence of inadequate functions or structure which results in work not being performed due to a lack of organizational planning or inadequate staffing? Y RC1 Specific issues or work are not performed or addressed, usually due to a lack of organizational planning or inadequate staffing.

b) OP5B - Is there evidence of inadequate attention to emerging problems? N Repetitive organizational crises in morale, work practice, or repeat events, etc. The causes are usually associated with a lack of strong self assessment, strategic planning, and root cause processes. Additionally, inadequate vertical information flow to the decision makers in the organization and inadequate prioritization of work can contribute to a breakdown in this area.

c) OP5C - Is there evidence of an inadequate work prioritization process?

Normally associated with staff work overload, over-run of the committed budget, and increasing backlog of work items. It is usually caused by inadequate work prioritization and inadequate vertical communication of Y RC1/ CC4 the organization=s missions and goals.

d) OP5D - Is there evidence of inadequate communication within the organization?

Important issues are not being addressed or a breakdown of normal work processes has occurred. Low staff morale is usually the long term result. Common causes for this include an inadequate information flow path, Y RC1 lack of a teamwork type of culture, or inadequate physical settings e) OP5E - Is there evidence of inadequate job skills, work practices or decision making? N Generally evidenced by low morale and excessive human error rates. Causes usually include a punitive management style, inadequate supervision, training, staff qualification, or vertical communication, and conflicting or unreasonable organizational goals.

Page 86 of 93

O&P Worksheet Contributed to or Potential O&P Failure Modes (Causal Factors) RC# AC # CC#

Caused Event?

YES NO f) OP5F - Is there evidence that corrective actions for previously identified problems or event was N not adequate to prevent recurrence (failed to take meaningful corrective actions for consequential or non-consequential events)?

Management failed to take meaningful corrective action for consequential or non-consequential events.

g) OP5G - Is there evidence the supervisor was not properly notified of a suspected problem? N A problem requiring verbal communication with supervision arose, but was not verbally communicated to the supervisor.

h) OP5H - Is there evidence of that pertinent information is not being properly transmitted verbally between the transmitter and the listener and vice versa? N The sender failed to verbally transmit information to the listener. This requires a sender and listener to be present, and is regardless of either individuals position in management chain.

i) OP5I - Is there evidence that there are too many administrative duties assigned to supervisory N staff to properly perform supervisory activities?

The administrative load on immediate supervisors adversely affected their ability to supervise ongoing activities j) OP5J - Is there evidence that there is insufficient supervisory resources to provide the needed N supervision to plant personnel?

Supervisions resource is less than that required by task analysis considering the balance of procedures, supervision and training.

k) OP5K - Is there evidence that there is insufficient manpower to support the identified goals and N objectives of the plant?

Personnel are not available as required task analysis of goal/objective.

l) OP5L - Is there evidence that sufficient resources are not provided to ensure adequate training is N provided and maintained?

Training resources are not available as required by task analysis.

m) OP5M - Is there evidence that there is not adequate availability of appropriate materials and tools N to do the job?

A process for supplying personnel with appropriate materials or tools did not exist.

n) OP5N - Is there evidence that there is not a means provided for ensuring adequate equipment and N quality/reliability/operability for personnel equipment?

A process for ensuring personnel's equipment was satisfactory did not exist.

o) OP5O - Is there evidence that personnel selection did not ensure an appropriate match to ensure N a motivation for the worker?

Personnel selection processes failed to determine a mismatch between motivation and job description prior to task.

p) OP5P - Is there evidence that tasks and individual accountability were not made clear to the worker?

Tasks (and the individual accountability for the task) that were outside written guidance or training were not Y made clear to the worker.

q) OP5Q - Is there evidence that the progress and status of task is not adequately tracked by supervision? Y RC1 Supervision did not take the appropriate actions to monitor the task progress or status.

r) OP5R - Is there evidence that there is not an appropriate level of in-task supervision planned N prior to the task being performed?

Supervision did not adequately assess the task for points of supervisory interaction prior to assignment to workers.

s) OP5S - Is there evidence that direct supervisory involvement in the task interfered with the N overview role of supervision?

Supervision became so involved with the actual task steps that overall command and control were adversely affected t) OP5T - Is there evidence that emphasis on the schedule had an impact on doing a quality job and accepted standards were not met as a result of this emphasis? Y RC1 Accepted standards for methods were not met due to supervision's focus on completing the activity within a certain time frame.

u) OP5U - Is there evidence that job performance and self checking standards were not properly N Covered by OP5P communicated to the organization performing the work prior to the job being performed?

Supervision failed to adequately communicate how standards for job performance and self-checking could be applied to the actual job at hand Page 87 of 93

O&P Worksheet Contributed to or Potential O&P Failure Modes (Causal Factors) RC# AC # CC#

Caused Event?

YES NO v) OP5V - Is there evidence that too many concurrent tasks were assigned to the worker that were N beyond the individuals abilities?

Supervision failed to detect that concurrent job assignments for an individual exceeded the individual's abilities.

w) OP5W - Is there evidence that there is frequent job or task shuffling without adequate time to N shift attention away from the previous task?

Supervision transferred a worker from one task to another without adequate time to shift attention away from previous task.

x) OP5X - Is there evidence that supervision did not consider the workers need to use a higher N order of skills that consider the workers talents and strengths?

Supervision did not consider the worker's talents or innovative strengths that could be used to perform more challenging work.

y) OP5Y - Is there evidence that worker assignments did not consider the workers previous task? N Supervision did not adequately assess the previous task's impact upon the worker's ability to implement the current task.

z) OP5Z - Is there evidence that a workers assignment did not consider the workers ingrained work N patterns and necessary work patterns for successful completion of the current task?

Supervision failed to assess the incompatibility between worker's ingrained work patterns and necessary work patterns for successful completion of the current task.

aa) OP5AA - Is there evidence that there is too an infrequent contact with the workers to detect work N habit and attitude changes?

Supervision not aware of deviation from desired work habits/attitudes due to lack of interaction with personnel.

bb) OP5AB - Is there evidence that supervision provides feedback on negative performance of an N individual but not on positive performance?

Worker's performance adversely affected by supervision's focus on negative performance feedback.

cc) OP5AC - Is there evidence of a lack of teamwork as a result of inadequate training content? N Training content did not adequately address actions individuals must take in order for the crew or team as a whole to be successful.

dd) OP5AD - Is there evidence of a lack of evaluation of risk and consequences prior to making a change that would have an adverse impact as a result of the change?

Elements of the process change were not recognized as having adverse impact or increased risk of adverse Y RC1 impact prior to implementing the change.

ee) OP5AE - Is there evidence that personnel exhibited insufficient awareness of the impact of actions on safety and reliability? Y RC1 Management failed to provide direction regarding safeguards against non-conservative actions by personnel concerning nuclear safety or reliability.

ff) OP5AF - Is there evidence that causes of a previous event or known problem were not N determined?

Analysis methods failed to uncover the causal factors of consequential or non-consequential events.

gg) OP5AG - Is there evidence that a response to a known or repetitive problem was untimely? N Corrective action for known or recurring problems was not performed at or within the proper time.

hh) OP5AH - Is there evidence that needed changes were not approved or funded that resulted in a N plant problem?

Corrective actions for existing deficiencies that were previously identified were not approved or funded.

ii) OP5AI - Is there evidence that a means was not provided to ensure procedures and documents N are of adequate quality and up to date?

A process for changing procedures or other work documents to ensure quality and timeliness was nonexistent or inadequate.

jj) OP5AJ - Is there evidence that planning was not coordinated with inputs from walk downs and N task analysis?

Job plan did not incorporate information gathered during field visits or task analysis concerning the steps and conditions required for successful completion of the task.

Page 88 of 93

- Maintenance Crew Statements Statement #1 Date: October 5th, 2011 Event Date: September 25th, 2011 To Whom It May Concern:

I would like to start this statement by stating the fact that there have been 10 days since the event and in that waiting period there have been lots of speculation, misleading information, rumors, and emotional feelings that have now affected site personnels thoughts as well as mine. I do feel that this 10 day waiting period has been too long to clearly recall the exact event without some slight influence from conversations and meetings on what had transpired that day. Therefore this is how the day of the event unfolded to the best of my knowledge.

Started Sunday morning 9-25-11 with turnover from nightshift on temp mod package for 72-127 we had to wait until the supervisor arrived, after supervisor arrived a prejob brief was conducted, the brief went over work instructions, critical steps, human performance tools to be used, safety concerns and was the pre job brief form that the previous shift had filled out. We went over everything that was on the pre job brief form. The brief was held with the supervisor, engineering and acting maintenance manager present, there may have been others there but I cant recall and then had a briefing with ops. The temp mod was implemented and performed without incident.

After lunch on 9-25-11 a prejob brief was performed on the three work packages for inspect and replace breakers 72-119, 72-120, 72-121 and 72-123, the prejob brief was conducted with repairmen, engineering, electrical supervisor, acting maintenance manager, the duty station manager and the NRC present. The briefing was conducted discussing detailed work instructions, safety concerns and the human performance tools to be used, however the brief was performed from memory without using a prejob briefing checklist. After the briefing everyone went out to the ED-il panel, we conducted a job site review with our yellow cards. Performed live dead live on breakers that we needed to remove sat. I determed breaker 72-120 and removed breaker, then engineering and supervisor and NRC inspected bus. I then removed breaker 72-i 19 and engineering and supervisor and NRC inspected cubicle and bus. I then removed 72-121 and engineering and supervisor and NRC inspected cubicle and bus. I then removed 72-123 and engineering and supervisor and NRC inspected cubicle and bus. 72-119 top bus bar had thread damage and the work instruction step 4.7.7 stated as needed clean and tighten bus bar connections including chasing threads and replacing fasteners, we discussed with supervisor, acting maintenance manager and engineering how to chase threads on the live bus and we were told that our work instruction step allowed us to remove bus bar stab off of the live bus because we didnt want to chase threads on a live bus and the reasons were

1. 1 the metal shavings could short out the bus #2 we dont have an insulated thread chaser. It was discussed by repairmen how to remove the bus bar and retain positive control of the Philips head bus bar retaining screw so that it wouldnt fall into the bus, the decision was to hold the screw with an insulated screw driver and the bus bar to be held Page 89 of 93

with an insulated gloved hand. I was on the left side of ______ when he was in position to remove bus bar, he had the insulated screw driver on the retaining screw and his insulated gloved hand on the bus bar and with positive pressure on the screw to loosen, he began to loosen the screw when I saw an arc near the retaining screw and so did ______, he reacted and pulled his hands out of the panel with the thought that it was blowing up in his face, he was trying to protect his face and possibly his life, that is when the bus bars came in contact with each other and shorted out.

Statement #2 7:00AM 9-25-2011 Received a detailed turnover from C-shift of work to be performed, events that led up to this point.

Supervisor was scheduled to be in at 8:00AM so we waited until he arrived to brief the days work.

Tried with help of engineerings help to find some kind of detail on panel construction, were not able to find any. Held brief with 3 electricians, supervisor and engineering on work for the day. Temp mod, breakers to be removed, engineerings role, etc. Installed temp mod, finished before lunch.

Lunch break Briefly talked about breaker removal and the points at which engineering would step in to evaluate and take pics etc.

Removed 72-120 breaker, Eng. evaluated and took pics. Noted gap between the copper bus bar and breaker. With approval from supervisors and engineering checked breaker mounting screw to see if it was loose, it was not.Removed 72-119 breaker noted the threads to the copper bar in question needed to be chased. This isthe point when it was decided that the bar needed to be removed and taken to shop for repairs.

We continued removing removing breakers 72-121 and 72-123 at the request of our supervisor. As with the other 2 breakers engineering did there evaluating as we removed them.

At this point we (electricians) dicussed how to to safely remove piece of busbar decided on the method we used. I then donned my low voltage gloves and insulated screwdriver and when I started to loosen screw is when I saw arcing and reacted.

Statement #3 Statement of events on Sunday September 25th 2011 I arrived to work at 08:00 on Sunday, and received a face to face turnover with electrical maintenance superintendent, It was discussed that we would first install a temp mod to provide alternate power to the generator voltage regulator and then the sequence of the breaker removal and install of he the DC breakers located in panel D-11-2 was discussed including the importance of insulating the positive and negative buss bar standoffs to prevent Page 90 of 93

an electrical short. The repairmen were briefed and ready to install the temp mod to provide alternate power to breaker 72-121 which provides control power to the generator voltage regulator. I then reviewed the TM to have an understanding of the work involved and had a short informal brief with the three repairmen to ensure we all understood the TM installation and what the repairmens rolls and responsibilities would be. A briefing was then conducted in the control room with the shift manager, control room supervisor and the shift engineer to discuss our work and to establish communications with the control room in the event of an issue occurring during the work. The critical steps discussed were validating that the polarity of the DC power was the same between the temp power and the power currently feeding the voltage regulator. After the brief in the control room work commenced at the temp mod was installed successfully at 11:00. At approximately 13:00, planning had completed the three work orders to remove and inspect the four breakers in panel D11-2. A pre-job brief was held with electrical maintenance, engineering, the acting maintenance manager, duty station manager, and the NRC to discuss the sequence of the work, safety and human performance tools to be used. It was discussed what is the worst thing that can happen and we discussed a short circuit event and that insulating the buss connection stabs would be the method to prevent this. After the completion of the brief, I asked around the table if anyone had any questions or concerns and no one had further input. Work shortly commenced at the D-11-2 panel after an additional brief with the control room and the work orders were taken to working. The sequence of events was to first remove breaker 72-120 and to inspect the connection points between the line side stabs of breaker 72-119 and the positive and negative bus bars and then to continue down the panel and remove breaker 72-121 and then 72-123. Upon the removal of 72-120 and a 1/16 of an inch air gap was found between the positive line stab of 72-119 and the positive buss bar stand off, this was due to a cross threaded connection screw. Breakers 72-121 and 72-123 were then removed with no additional issues found. After discussion with engineering and the repairman the decision was made to remove the positive and negative standoffs to repair the threads on the positive connection stap and then to swap the positive and negative standoffs so that breaker 72- 119 would not have a repaired mounting hole. This meant breaker 72-120 would now have the repaired hole at the connection between the negative line side stab of the breaker, this was determined because 72-120 is a spare breaker. The work instruction note stated to support or insulate the buss bar stand offs to prevent an electrical short. While it was discussed in previous briefings that insulation would be used two repairmen felt they could retain positive control of the standoff and remove it safely. This action was not discussed with me prior to removing the positive bus bar. Standing behind the work boundary I was observing _____

remove the positive bus bar when he lost control and the short occurred. At this point the plant tripped, shortly after we were asked to remove the fault from the panel D11-2 so operations could attempt to restore DC power. After the event ______ conducted a fatigue assessment and I then escorted _____ to the emergency room for fitness for dutytesting.

Statement #4 Plant tripped 9-25-11 statement date 10-5-11 Prejob brief attendance maintenance crew, supervisor, NRC, duty station manager, asst maint mgr, and two design engineers. talked about the job and what we were going to do, we removed 72-119 and found a cross threaded screw it was thought to be the smoking gun everybody that was in the brief came a crossed Page 91 of 93

the boundary to see even the shift manger, this went on for each breaker that was removed 4 total we didnt have any new buss stabs so we were going to swap the spare breaker stabs which had good holes with the breaker with the bad holes. The job was going well and the NRC left we looked at the work plan and it gave us direction to support the stab and remove it, the hot stab was then supported with a tested voltage gloves and the screw loosened an arc was seen and the stab was let go of, letting the positive stab fall into negative stab at no time did any body see the danger before us or we wouldnt have done it. My role in this job was handing tools to the teem handing tape anything that would make the job go as expected Page 92 of 93

, "Why Staircase" WHY STAIRCASE Problem statement: On September 25, 2011, at 1506, while performing maintenance activities on DC electric distribution panel D-11-2, a short circuit condition occurred resulting in reactor trip.

Why? Reactor tripped due to loss of power to two-of-four RPS channels Why? Loss of left train DC Bus results loss of power to channels A & C Why?1 Shunt trip breaker 72-01 opened Why?1 Latent Design Issue Why?2 D-11-2 short resulted in Bus trip Why?2 Loose stab dropped causing short Why?2 No insulation protection for bus Why?2 Workers decided insulation was not needed Why?2 Workers and supervision did not stop and question Why?2.1 Workers rationalized skill of craft Why?2.1 Workers did not recognize risk to themselves or to the plant Why?2.1 Common practice to work on energized equipment Why?2.1 Work on energized equipment considered low risk Why?2.2 Supervision did not recognize risk and ensure insulation was in place Why?2.2 Work not characterized as risk to workers or plant Why?2.2 Plant EOOS assessment of risk incomplete Why?2.2 EOOS result not questioned by management Why?2.2 Management not always recognizing or managing risk Why?2.2 Management not sensitive to risk Why?2.2 Senior management has not ensured the plant culture is risk sensitive Page 93 of 93