ML19043A950

From kanterella
Jump to navigation Jump to search
DPO-2017-009, Case File (Public)
ML19043A950
Person / Time
Issue date: 06/13/2019
From: Troy Pruett
NRC Region 4
To:
Figueroa G
References
DPO-2017-009
Download: ML19043A950 (71)


Text

DPO Case File for DPO-2017-009 The following pdf represents a collection of documents associated with the submittal and disposition of a differing professional opinion (DPO) from an NRC employee involving the significance determination for loss of decay heat removal at Grand Gulf.

Management Directive (MD) 10.159, NRC Differing Professional Opinions Program, describes the DPO Program. https://www.nrc.gov/docs/ML1513/ML15132A664.pdf The DPO Program is a formal process that allows employees and NRC contractors to have their differing views on established, mission-related issues considered by the highest level managers in their organizations, i.e., Office Directors and Regional Administrators. The process also provides managers with an independent, multi-person review of the issue (one person chosen by the employee). After a decision is issued to an employee, he or she may appeal the decision to the Executive Director for Operations (or the Commission, for those offices that report to the Commission).

Because the disposition of a DPO represents a multi-step process, readers should view the records as a collection. In other words, reading a document in isolation will not provide the correct context for how this issue was reviewed and considered by the NRC.

It is important to note that the DPO submittal includes the personal opinions, views, and concerns by NRC employees. The NRCs evaluation of the concerns and the NRCs final position are included in the DPO Decision.

The records in this collection have been reviewed and approved for public dissemination.

Document 1: DPO Submittal Document 2: Memo Establishing DPO Panel Document 3: DPO Panel Report Document 4: DPO Decision Document 5: DPO Appeal Document 6: Statement of Views Document 7: DPO Appeal Decision

Document 1: DPO Submittal

Document 2: Memo Establishing DPO Panel November 29, 2017 MEMORANDUM TO: Raymond K. Lorson, Panel Chairperson Office of Nuclear Reactor Regulation Frank J. Arner, Panel Member Region I M. Scott Freeman, Panel Member Region II THRU: Anne T. Boland, Director /RA/

Office of Enforcement FROM: Renée M. Pedersen /RA/

Sr. Differing Professional Views Program Manager Office of Enforcement

SUBJECT:

AD HOC REVIEW PANEL - DIFFERING PROFESSIONAL OPINION ON A GRAND GULF SPECIAL INSPECTION REPORT (DPO-2017-009)

In accordance with Management Directive (MD) 10.159, The NRC Differing Professional Opinion Program; and in my capacity as the Differing Professional Opinion (DPO) Program Manager; and in coordination with Anne Boland, Director, Office of Enforcement, Kriss Kennedy, Regional Administrator, Region IV; and the DPO submitter; you are being appointed as members of a DPO Ad Hoc Review Panel (DPO Panel) to review a DPO submitted by an U.S. Nuclear Regulatory Commission (NRC) employee.

The DPO (Enclosure 1) involves the significance determination for a loss of decay heat removal at Grand Gulf documented in a special inspection report. This issue was previously addressed in NCP-2017-010 (https://www.nrc.gov/docs/ML1730/ML17304A014.pdf). The DPO has been forwarded to Mr. Kennedy for consideration and issuance of a DPO Decision.

CONTACTS: Renée Pedersen, OE (301) 287-9426 Gladys Figueroa-Toledo, OE (301) 287-9497

R. Lorson, et al. 2 The DPO Panel has a critical role in the success of the DPO Program. Your responsibilities for conducting the independent review and documenting your conclusions in a report are addressed in the handbook for MD 10.159 in Section II.F and Section II.G, respectively. The DPO Web site also includes helpful information, including interactive flow charts, frequently asked questions, and closed DPO cases, including previous DPO Panel reports. We will also be sending you additional information that should help you implement the DPO process.

Because this process is not routine, we will be meeting and communicating with all parties during the process to ensure that everyone understands the process, goals, and responsibilities.

Disposition of this DPO should be considered an important and time sensitive activity. The timeliness goal for issuing a DPO Decision is 120 calendar days from the day the DPO is accepted for review. In this case, the DPO was accepted for review on November 7, 2017. The timeliness goal for issuing this DPO Decision is March 7, 2018.

Process Milestones and Timeliness Goals for this DPO are included as Enclosure 2. The timeframes for completing process milestones are identified strictly as goalsa way of working towards reaching the DPO timeliness goal of 120 calendar days. The timeliness goal identified for your DPO task is 75 calendar days from the date of this memorandum (February 12, 2018).

Although timeliness is an important DPO Program objective, the DPO Program also sets out to ensure that issues receive a thorough and independent review. The overall timeliness goal should be based on the significance and complexity of the issues and the priority of other agency work. Therefore, if you determine that your activity will result in the need for an extension beyond the overall 120-day timeliness goal, please send an e-mail to Mr. Kennedy with a copy to DPOPM.Resource@nrc.gov and include the reason for the extension request and a proposed completion date for your work and a proposed timeliness goal for issuance of a DPO Decision. Mr. Kennedy is responsible for subsequently forwarding the request for a new DPO timeliness goal to the EDO for approval.

An important aspect of our organizational culture includes maintaining an environment that encourages, supports, and respects differing views. As such, you should exercise discretion and treat this matter appropriately. Documents should be distributed on an as-needed basis. In an effort to preserve privacy, minimize the effect on the work unit, and keep the focus on the issues, you should simply refer to the employees as the DPO submitters. Avoid conversations that could be perceived as hallway talk on the issue and refrain from behaviors that could be perceived as retaliatory or chilling to the DPO submitters or that could potentially create a chilled environment for others. It is appropriate for employees to discuss the details of the DPO with their co-workers as part of the evaluation; however, as with other predecisional processes, employees should not discuss details of the DPO outside the agency. If you have observed inappropriate behaviors, heard allegations of retaliation or harassment, or receive outside inquiries or requests for information, please notify me or Gladys.

On an administrative note, please ensure that all DPO-related activities are charged to Activity Code ZG0007.

R. Lorson, et al. 3 We appreciate your willingness to serve and your dedication to completing a thorough and objective review of this DPO. Successful resolution of the issues is important for NRC and its stakeholders. If you have any questions or concerns, please feel free to contact me or Gladys.

We look forward to receiving your independent review results and recommendations.

Enclosures:

1. DPO-2017-009
2. Process Milestones and Timeliness Goals cc:

K. Kennedy, RIV S. Morris, RIV T. Pruett, RIV B. Welling, RI S. Sandal, RII A. Boland, OE G. Figueroa-Toledo, OE

R. Lorson, et al. 4

SUBJECT:

AD HOC REVIEW PANEL - DIFFERING PROFESSIONAL OPINION ON A COOPER PROBLEM IDENTIFICATION RESOLUTION INSPECTION REPORT (DPO-2017-009) DATE: November 29, 2017 ADAMS Package: ML17333A684 MEMO: ML17333A688 - ML17311A270 - ML17333A690 OE-011 OFFICE OE: DPO/PM OE: DPO/PM OE: D NAME GFigueroa RPedersen ABoland DATE 11/ 28 /2017 11/ 29 /2017 11 29 /2017 OFFICIAL RECORD COPY

Document 3: DPO Panel Report UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 April 23, 2018 MEMORANDUM TO: Kriss M. Kennedy, Regional Administrator Region IV FROM: Raymond K. Lorson, DPO Panel Chair /RA/

Frank J. Arner, DPO Panel Member /RA Raymond Lorson for/

M. Scott Freeman, DPO Panel Member /RA Raymond Lorson for/

SUBJECT:

DIFFERING PROFESSIONAL OPINION PANEL REPORT ON GRAND GULF SPECIAL INSPECTION REPORT (DPO-2017-009)

In a memorandum dated November 29, 2017, we were appointed as members of a Differing Professional Opinion (DPO) Ad Hoc Review Panel (DPO Panel) to review a DPO regarding the Region IV decision that issues related to the Alternate Decay Heat Removal System discussed in Special Inspection Report 05000416/2016008 were of very low significance (Green) instead of a more significant classification. The panel has reviewed the DPO in accordance with the guidance in Management Directive 10.159, The NRC Differing Professional Opinion Program.

The DPO Panel Report is enclosed for your consideration.

The results of the DPO Panels evaluation of the concerns raised in the DPO are detailed in the enclosed DPO Panel Report. Based on our review of concerns raised in the DPO, the DPO Panel concludes that this issue (Grand Gulf ADHR) is best characterized as Green; that adequate risk tools existed to complete the Significant Determination Process (SDP), the proper risk metrics were used, and the Quantitative Health Objectives (QHOs) were addressed. The DPO Panel further concluded that the Significance and Enforcement Review Panel (SERP) process was implemented informally after one member opted for a different position. This approach appeared to have impacted the timeliness associated with issuance of the inspection report for this event. Our recommendations are included in the report.

Please do not hesitate to contact us if you have any questions regarding the enclosed report.

Enclosure:

DPO Panel Report cc: TPruett, Region IV ABoland, OE GFiguero Toledo, OE CONTACT: Raymond K. Lorson, NRR (301) 415-1272

Differing Professional Opinion (DPO)

On Grand Gulf Special Inspection Report (DPO-2017-009)

DPO Panel Report

______________________/RA/_____________________

Raymond K. Lorson, Panel Chair

____________/RA Raymond Lorson for/_____________

Frank J. Arner, Panel Member

____________/RA Raymond Lorson for/_____________

M. Scott Freeman, Panel Member Date: April 23, 2018

Introduction On November 17, 2017, the Office of Enforcement (OE) acknowledged a differing professional opinion (DPO) regarding issues related to the Alternate Decay Heat Removal System (ADHR) at Grand Gulf Nuclear Station as discussed in Special Inspection Report 05000416/20160085.

On November 29, 2017, OE issued a memorandum establishing the DPO Panel to review the DPO and associated decision on significance determination for loss of ADHR as described in the Special Inspection Report and Non-Concurrence NCP-2017-010. On December 14, 2017, the DPO Panel met with the submitter by telephone to establish a concise statement of the submitters concerns, to which the submitter agreed on December 22, 2017. The DPO Panel then performed a detailed review of the concerns and issues, reviewed the detailed risk evaluation for the issue, evaluated the risk tools used to conduct the evaluation, and interviewed NRC staff associated with the special inspection and non-concurrence.

Statement of Concerns as agreed with Submitter Based on a review of the DPO package, the following concerns as expressed by the submitter were identified by the DPO Panel:

1. The agency did not follow its own guidance when evaluating this finding. This concern stemmed from two specific process issues.
  • The SERP process. When the submitter, a SERP member, withdrew support for Green, the issue should have gone back for another SERP to consider use of Appendix M. If unanimous consent could not be reached, the issue should have been escalated to the office director level. This was recommended in part B of the NCP, but not implemented.
  • The use of Manual Chapter (IMC) 0609, Appendix M. The submitter believes this should have been used to evaluate the finding based on the following:

o The detailed risk evaluation (DRE) did not capture the programmatic failures in the Grand Gulf Nuclear Station (GGNS) operations department, and those same failures could not be modeled using simplified plant analysis risk (SPAR). This was acknowledged in NCP 2017-010.

o The human error probability (HEP) analysis used nominal failure probabilities that did not reflect station operations past performance.

o The analysis only looked at discreet HEPs.

o There were no HEP worksheets to support the selected HEPs.

2. The large early release frequency (LERF) determination for this finding was inadequate based on the following:
  • Removing core damage sequences from the model in a pseudo-quantitative attempt to determine LERF based on evacuation studies cannot be performed using existing NRC risk tools.
  • There was no agency guidance for applying evacuation credit to LERF determinations.

Because of this, the evaluation of NCP 2017-010 should have addressed how evacuation credit should be applied.

  • Evacuation Success was not defined (some may refuse to evacuate).
  • The probability of failure to evacuate the nearby population is very uncertain.
  • The use of 8 days for LERF cutoff is for a generic population and does not consider the differences in health among the population.

2

  • Appendix M should have been used to fill the gap in guidance.
3. The significance determination process (SDP) in this finding did not meet the Qualitative Safety Goal:
  • The evaluation determined large releases that could result in overexposure to workers and the public, yet it was considered Green.
  • The evaluation did not support the intent of the cancer fatality Quantitative Health Objectives (QHO).
  • Appendix M should have been used to address these items for this issue.
4. As related to this issue, the NCC process was not implemented appropriately:
  • The DPO Panel should not report to the same individual as the one making the final call on the NCC.
  • This DPO should have been assigned to a different office director.
  • Basis in Part C for deciding differently for Part B is missing.

Evaluation of Concerns Concern 1 The agency did not follow its own guidance when evaluating this finding. This concern stemmed from two specific process issues.

  • The SERP process. When the submitter, a SERP member, withdrew support for Green, the issue should have gone back for another SERP to consider use of Appendix M. If unanimous consent could not be reached, the issue should have been escalated to the office director level. This was recommended in part B of the NCC, but not implemented.
  • The use of Manual Chapter (IMC) 0609, Appendix M. The submitter believes this should have been used to evaluate the finding based on the following:

o The detailed risk evaluation (DRE) did not capture the programmatic failures in the GGNS operations department, and those same failures could not be modeled using SPAR. This was acknowledged in NCP 2017-010.

o The human error probability (HEP) analysis used nominal failure probabilities that did not reflect station operations past performance.

o The analysis only looked at discreet HEPs.

o There were no HEP worksheets to support the selected HEPs.

Conclusion and Discussion:

In summary, the DPO panel agrees with the submitter that the SERP process was not completely followed after the submitter withdrew support for Green; however, the use of the non-concurrence process effectively got the issue to where it should have been, had the process been followed. Specifically, the issue was elevated to the Regional Administrator to decide the significance of the finding. The DPO panel disagrees with the submitter regarding the use of IMC 0609, Appendix M. The DPO panel concluded that using the Grand Gulf Shutdown SPAR Model Event Trees was the best approach for quantifying the significance of the issue and that, therefore, this was NOT a case where Appendix M should have been used.

3

The SERP Process The guidance for implementing the SERP process could be found in several places. The first was IMC 0609, Attachment 1, which was effective December 8, 2016. The second place was IMC 0609, Attachment 1TP, which was effective November 15, 2016, and was part of the pilot for the new Inspection Finding Review Board Process. These two chapters were entirely dedicated to the SERP process. The final place where guidance on the SERP process could be found was the Enforcement Manual, Revision 10. Section 1.2.13 was specifically dedicated to the SERP Process.

After reviewing these documents, the DPO Panel determined that the guidance required the SERP to unanimously agree on a final decision. If there was disagreement, the SERP was to specify actions to resolve any dissent. If those actions resulted in no resolution, the issue was to be escalated to the appropriate office director, in this case the Regional Administrator (IMC 0609, Att 1, 04.02c & Att 1TP, 04.01). To facilitate resolution and tracking, the guidance required the EATS Strategy Form be routed to all SERP members for review and comment (IMC 0609, Att1 & Att 1TP, 02.05, Enf Man 1.2.12.2E & 1.2.13.4F). However, the guidance was not very specific about what should be done if, after review, a member of the SERP were to disagree with the conclusion, as happened with the Grand Gulf special inspection. The DPO Panel concluded that this would be essentially equivalent to the case where the SERP was not unanimous and the issue was required to be returned to SERP for actions to resolve the dissent as described in IMC 0609, Attachment 1TP, Section 04.01.

In the case of the Grand Gulf special inspection, the DPO Panel determined that the guidance was followed up through the point of making the final SERP decision. However, after the final SERP on April 13, 2017, unanimously decided that the significance of the issue was Green, the process did not appear to be followed. On April 21, 2017, the Region IV representative (DPO submitter) sent an e-mail to Region IV staff outlining the reasons for withdrawing support for Green and stating the desire to have another SERP, which would be allowed under Enforcement Manual Section 1.2.13.4F. The SERP voting members (alternates who voted at the meeting on April 13), except for the OE representative, were copied on that e-mail. Strict compliance with the process would have dictated that the Region IV representative would disagree upon review of the final EATS strategy form, another SERP would be held, a vote recorded, and actions be specified to address the Region IV representatives concerns. If those concerns could not be resolved in 14 days, the issue would then be escalated to the Region IV Regional Administrator. Instead, there were a series of e-mails and phone calls between Region IV and NRR where the Region IV representative developed an options paper and proposed using IMC 0609 Appendix M. After NRR disagreed with using Appendix M, the Region IV representative filed a non-concurrence, which was dispositioned by the Region IV Regional Administrator. The DPO Panel concluded that use of e-mail in this case was acceptable under Enforcement Manual Section 1.2.13.4F. However, the Region IV representative did not specifically ask for a meeting in the options paper and did not include the OE representative. Section 1.2.13.4F required that all parties be involved and that it be recorded on the EATS strategy form.

Assuming the Regional Administrator would have made the same decision as documented in the non-concurrence, this would have completed the process by early May 2017. The submitter could have non-concurred at that point, but that would have been approximately 3 months earlier. The DPO Panel concluded that the non-concurrence forced the issue to the place specified in the SERP guidance with the Regional Administrator agreeing with the SERP, but the time spent 4

resolving the non-concurrence may have been avoided had the SERP process been fully implemented in April 2017.

Use of IMC 0609 Appendix M Regarding the use of IMC 0609, Appendix M, the submitter put forth two main reasons why Appendix M should have been used on this issue. The first was that programmatic failures of the Grand Gulf operations department should have been taken into account, and the second was that HEP analysis did not accurately reflect station operations past performance. The DPO Panel looked at both of these.

Programmatic Failures of GGNS Operations:

The analysis section for the finding, as documented in the report, stated that the failure to perform the technical specification (TS) required action to verify an alternate method of decay heat removal is available when residual heat removal (RHR) shutdown cooling subsystem is inoperable was a performance deficiency. In accordance with guidance within IMC 0308, , Significance Determination Process Technical Bases, Section 5, once the staff has described how a licensee performance deficiency is the proximate cause of a degraded condition, the SDP, via applicable attachments and appendices, estimates the safety or security significance of the degraded condition. Therefore, the failure to perform the TS required action to verify an alternate method of decay heat removal would be the applicable focus when developing risk insights. IMC 0308 guidance is that inspection findings are evaluated on their own merit and therefore each finding, which has been determined to be the proximate cause of a particular degraded condition, is assessed on its own. The DPO Panel noted that the documented PD and finding was not specific to programmatic breakdowns of any department but was related to the specific failure to verify an alternate method of decay heat. Therefore, it would be expected that the analyst would attempt to evaluate the issue using the appropriate SDP IMC 0609 guidance when evaluating the issue. In this case IMC 0609, Appendix G, Boiling Water Reactor (BWR) and Pressurized Water Reactor (PWR) Phase 2 Significance Determination Process for Shutdown, would be the guidance initially used to evaluate the issue.

This would have led to a Phase 1 screening requiring a Phase 2 review prior to performing a detailed risk evaluation (DRE). It is noted that Phase 2 results are often very conservative and this is appropriate in order to capture issues which need a more detailed review to ensure the appropriate increase in risk is determined.

The Risk Assessment Standardization Project (RASP) manual, Volume 4, provides guidance for Shutdown Events. The DPO Panel noted the following guidance from Section 3.0, Scenario definition and quantification of Volume 4 of the RASP manuals:

Shutdown scenarios can be defined and their CCDPs (for event analysis) or CDPs (for plant condition analysis) can be calculated using a SPAR-SD model.

In this Handbook, it is assumed that there may or may not be a plant-specific SPAR-SD model available to the analysts. At this time, there are only a few SPAR-SD models available. The analyst may need to construct the needed SD scenarios using portions of model logic from the at-power model, SD event tree templates, and the SD HEP library mentioned in Section 2, and illustrated in Figure 2-1. The system fault trees can be borrowed from the existing at-power model and modified as necessary to map the realistic SD conditions. If available, 5

use a plant-specific SPAR-SD model. The most likely case is that such a model will not be available. In that case, construct (or import from the ET library) the minimum number of ETs to carry out the analysis.

The DPO Panels noted that it was clear from a review of this case that the Grand Gulf Station is one of several plants that had an Idaho National Labs (INL) SPAR model which included shutdown plant operating state (POS) event trees. Therefore, as noted above, the guidance is to use the plant-specific SPAR-SD model, as it will provide the best estimate over any estimation that would have to be developed in their absence. The DPO Panel downloaded the current version of the Grand Gulf SPAR model and reviewed the event trees and compared them to the previous model used in the DRE for the applicable condition. The finding exposure time occurred within the early POS 1 condition. The DPO Panels performed a detailed evaluation of the dominant event tree that was utilized for the DRE and concluded that it was technically sound with respect to the expected top mitigating events for the Loss of Shutdown Event (Early) sequence. The DPO Panel determined the Loss of SDC Initiating Event Tree dominated the conditional risk increase for the finding and therefore was focused on.

In evaluating the concern of capturing the stated programmatic failures, the DPO Panel determined the performance deficiency (PD) and finding, as written, did not provide technical justification to not use the as-built Grand Gulf SPAR model. If this model were not to be used, this approach would conflict with the current guidance of capturing the risk of the finding using the best estimate tool. An available SPAR model is thought to provide the best estimate with which to model an event such as this because it is much more detailed than if performing a DRE at a site which needs a model constructed. The process provides for performance of a DRE after the initial screening using a Phase 2 approach within IMC 0609, Appendix G, which has generic event trees.

The term SDP describes an overall process that is designed to meet ROP founding principles such as objectivity, scrutability, repeatability, and timeliness. As stated within IMC 0308 guidance:

Each SDP tool should attempt to provide a decision logic or a decision framework that remains relatively constant across applicable inspection findings.

This enhances objectivity by reducing the likelihood that SDP results are influenced by different value judgments held by different individuals. Where practicable, a probabilistic risk framework is used to add this desired discipline to SDP results. The test of having achieved such objectivity is when different individuals using a given SDP decision logic or framework arrive at the same result when using the same input conditions and assumptions. Achieving SDP result consistency and repeatability is the intended outcome of the objectivity attribute. This attribute can be achieved through peer reviews of SDP assessments to assure consistency in SDP decision-making.

When a quantitative risk model is used, the greatest challenge to achieving this attribute is to allow stakeholders a means to independently assess SDP result sensitivity to the most influential assumptions, to understand the basis of the assumptions, and to reveal the limitations and uncertainties of the risk model used and how these were considered by the staff in arriving at a final result.

When quantitative risk insights and inputs from other factors considered for decision making are used, the bases of the significant factors influencing the 6

decision outcome must be clearly documented in detail for scrutability and effective communication of the final risk-informed decision.

The DPO Panel focused on the above-noted fundamental principles of IMC 0308 when reviewing the detailed risk evaluation (DRE) to assess whether the DRE was clear in its critical assumptions and had a clear technical basis. The DPO Panel noted the following observations and assessments with regard to the DRE for the ADHR issue:

  • The DPO Panel independently reviewed the Loss of Shutdown Cooling Initiating Event Frequencies (IEFs) and determined that the revised IEF used in this assessment of 1.37/year events was appropriate. This was performed by reviewing the referenced EPRI documents within the inspection report and adding the number of events noted to determine a best estimate for frequency. It was noted that this was a significant increase over the 0.11/year events assumed in the SPAR model. The bases of the SPAR model IEF for LOSDC early events (0.11/year) was not able to be determined; however, the increase in the IEF by the analyst was found to be in agreement with the referenced EPRI documentation through a rough estimate by the DPO Panel. It was noted that the IEF used for the Loss of Shutdown Cooling (LOSDC) (Early) event tree would increase the CCDF by an order of magnitude. The DPO Panel could not determine if this was an overly conservative estimate given that not all LOSDC events occur within the first week (i.e., early events) and therefore noted this estimate for this specific condition may be somewhat high. However, even if this was a conservative estimate, it was determined to be appropriate for this assessment given the knowledge available.

Application of Human Error Probabilities The DPO Panel recognized that assumptions used for operator failure rates (Human Error Probability) can be significant contributors to the risk assessment for shutdown condition events.

Therefore, the DPO Panel performed a detailed review of the basic events in the model relative to operator actions and core damage sequence cut-sets to further analyze the DRE. The DPO Panel noted that the DRE increased several of the operator action nominal failure rates above and beyond their normal baseline probability settings. This included the failure to establish shutdown cooling (SDC) or suppression pool cooling, SD-XHE-XM-RHR-NOM, from 1E-3 to 1E-2. This is a basic operation for plant operating staff and the SPAR-H calculator would normally assume a 1E-3 failure probability. The DPO Panel determined this adjustment to be a conservative value set by the analyst. Two other operator actions were noted to have been increased from their nominal failure probability values as well; SD-XHE-XM-ECS-NOM, (Operator Fails to establish low pressure or high pressure (LPI/HPI) Injection) from 1E-3 to 1E-2, and SD-XHE-XM-ALTI-NOM (Fail to initiate alternate injection given lo/hi pressure injection fails) from 4E-3 to 1E-2. This was determined to be conservative given the amount of time that would be available to complete these actions.

The DPO Panel determined that the significant contributors from a review of the core damage cut-sets were the failure of the operators to depressurize the reactor, ADS-XHE-XM-MDEPR, normally with a 5E-4 failure probability and the operators failing to vent the containment (SD-XHE-XM-VENT) normally set at 1E-3. The DPO Panel noted the analyst did a detailed SPAR-H calculation on these and adjusted the failure to depressurize basic event to a higher rate set at 1E-3. The DPO Panel noted the diagnosis and action to depressurize, if a LOSDC occurred, is a relatively simple task performed in the control room if SDC cannot be recovered. The DPO Panel reviewed the Licensee procedure relative to this action, and it was a clear established 7

action to perform. A second critical action was associated with containment venting. The failure to vent containment was assigned a value of 1.1E-3 consistent with its original value. The DPO Panel noted this value was also consistent with the value given in IMC 0609 Appendix G, which typically uses conservative/bounding values as an initial review. Additionally, there is sufficient time available to complete this action - over many shifts and likely days - prior to the point where containment may fail dependent on the core damage sequence path. The sequence where this action had a higher risk contribution (successful low pressure injection and depressurization) would allow a large amount of time being available for this operator action.

Therefore, this was also determined to be a very reasonable assumption.

Finally, the existing SPAR model has post processing rules which limit the amount of credit for operator success when there are two operator actions in a core damage cut-set, such that a cap is put on the failure rate to keep it elevated when several operator actions exist. The SPAR model would take two operator action basic events and if both were at 1E-4 in a cut-set, the result would be capped at 1E-6 due to the applied post processing rule. The analyst for this DRE appropriately recognized that this cap set by the model may not be conservative because of large uncertainties involved. Therefore, the analyst developed a revised post processing rule to cap two operator error actions. As an example and as documented in the DRE, the combined HEPs were increased from an original value of 1E-3 to 1E-2. Therefore, when two operator actions were in a cut-set, the DPO Panel noted, through a review of the dominant cut-sets within the DRE, that the value was capped at 1E-4 or two orders of magnitude higher than what the SPAR model rules typically would apply. For instance, if a cut-set had the failure to recover or establish SDC after the initial loss of SDC, (XSD-XHE-XM-RHR-NOM) and the operators failed to depressurize the reactor (XADS-XHE-XM-MDEPR), the multiple operator action failure probability was capped at 1E-4 (basic event SD-XHE-XM-REPLC1). This was determined to be appropriate by the DPO Panel with respect to the added conservatism due to the uncertainties involved in these failure rates.

The DPO Panel noted that in the dominant cut-sets, there was extra time available between assumed operator actions to achieve success. For instance, time would exist to diagnose and determine what action they would need to use, such as depressurizing the reactor upon failure to recover SDC. The DPO Panel, as noted above, also reviewed the associated procedure for loss of SDC, which clearly described the required actions for the operators if SDC could not be recovered and this was consistent with the Event Tree. Lastly, by adding this post processing rule, the analyst was consistent with Table B-1-3 of the RASP manual Volume 4, Appendix B, regarding HEP Dependency Rules. For the dominant operator actions, the DPO Panel determined they fell into the Weak dependency Level with an approximation of 1E-2. This is due to the longer time windows available to take the actions for the dominant cut-sets, and the actions were not complex and cues would be available.

In summary, the DPO Panel concluded that the analyst developed detailed HEP values using SPAR-H where required, adjusted the appropriate HEPs from their nominal values for several basic operator action events and used conservative values for other human error probabilities by increasing their failure rates by an order of magnitude. Therefore, the appropriate HEPs that influenced the risk of this finding were adjusted, and the DPO Panel had no concerns with the selected HEPs that were revised.

The DPO Panel did not find any requirement to attach HEP worksheets to the DRE to support the selected HEPs and noted these calculations are performed within the SPAR-H model which reflects all performance shaping factors used. Additionally, and more importantly, the DPO Panel found the basis provided by the analyst for the revision to the HEPs to be clearly 8

articulated within the DRE. Lastly, there is no requirement for an analyst to try to determine station operations past performance in determining appropriate HEP values, and this would violate the concept of mapping the DRE to the PD/finding as written and conflict with the guidance within IMC 0308 to focus only on the documented PD.

Other DRE Observations From a review of the DRE and interviews with the analyst, the DPO Panel independently determined that there were other inherent conservatisms built into this DRE. They noted that in the Base Case model for the dominant event tree, several modifications were made. As noted in the DRE from a review of EPRI data and consultation with other analysts, this DRE noted that approximately 1 to 10 percent of LOSDC events are non-recoverable. Therefore, a 10 percent failure to recover from a LOSDC was applied as a best estimate. The DPO Panel performed an independent review of the data contained within EPRI reports and determined that a best estimate using severity factors of 1.0 (boiling occurred) for previous LOSDC events would lead to a nominal 0.03 probability for failure to recover a LOSDC event. Therefore, using 0.1 was thought to possibly be conservative, but appropriate, in that it would remain a conservative assumption. This would result in a higher risk calculated. However, as a surrogate, the failure to run basic event for the RHR, pump B, RHR-MDP-FR-PUMPB, was set to a probability of 0.1 (the non-recovery assumption above). This was performed to try to simulate this failure to recover in the core damage cut-sets. The DPO Panel looked at EPRI data for failures per hour from LOSDC events for pump failures, and at the SPAR model which used a failure to run in the E-4 range for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The DPO Panel used failure data per hour for loss of RHR flow events, loss of cooling to heat exchangers and failure of pump events and applied a conservative 30 day time period to determine a 2.4E-2 failure probability relative to the B RHR pump to fail.

More importantly, because the analyst used RHR fail to run as a surrogate for fail to recover SDC, the DPO Panel noted it would automatically fail the mitigating action for establishing suppression pool cooling in the event tree. This was thought to be a very conservative assumption given that only about 14 percent of LOSDC events was noted to be due to a loss of the pump, pump flow-path, or heat exchangers. The majority of events are caused by RHR isolation and Reactor Pressure Vessel Isolation events where the suction path and return path are isolated, which, through interlocks, causes an RHR pump trip. By virtue of minimal cut-sets and Boolean algebra operations within the SPAR model, this surrogate gave reduced credit from that which would normally be available to the operators for being able to open suppression pool (SP) suction valves and the return valve to establish SP cooling to mitigate a LOSDC event. The DPO Panel noted this would impact one of the two dominant core damage sequences and therefore would have an impact of a higher risk estimate due to the reduction in credit for suppression pool cooling.

Additionally, the SPAR model 6-hour-fail-to-recover SDC sequence, which also had a significant risk contribution in the failure to recover SDC and failure to depressurize events, assumed failure of High Pressure Injection due to loss of C Service Water cooling in many of the CD cut-sets. The DPO Panel noted, through a review of the model and system diagrams, that the loss of the C Service Water cooling function would result in loss of room cooling to the high pressure pump; however, the suction source would be on the condensate storage tank, a much cooler source of water than the suppression pool (i.e., lower heat source to room), and the CST would likely be available for many hours to support injection based on the decay heat rate.

Therefore, the DPO Panel could not determine the technical basis for the relatively early core damage failure time sequence (i.e., 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />) for loss of C SW events, which increases the probability of failing to recover SDC. The DPO Panel noted that the high pressure pump may survive for a much longer time than the 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> given for SDC recovery in the model. This could 9

not be verified but was thought to be another possible conservatism in the SPAR model for one of the two dominant CD sequences.

The two modeling observations noted above were determined to not adversely affect the outcome or conclusion of the DRE in any way, but served to provide additional technical justification for the conclusion that the final determination of safety significance was appropriately determined to be of very low safety significance and would only have reduced the calculated CDF/yr if further pursued. This was not able to be quantified but would, in the opinion of the DPO Panel, offset any uncertainties attributed to the assignment of HEPs within this DRE.

In conclusion, the DRE was found to be fundamentally sound and clearly documented by the analyst, with the assumptions clearly articulated and consistent with the requirements and guidance within IMC 0308 for performance of safety significance reviews of conditional events.

Based on the above review, the DPO Panel concluded that Appendix M, Significance Determination Process Using Qualitative Criteria, would not be appropriate for this finding. The PRA method and tools in this case and SDP appendices were determined to address the finding and provide a reasonable estimate of the significance due to the detailed modeling performed.

As noted, there appeared to be several conservatisms applied which would more than offset any uncertainties with the established human error probabilities. The use of the appropriate SDP appendix and tools, in this case a DRE using an existing model for shutdown condition, supports the ROP objective to improve objectivity and repeatability. This results in greater discipline and objectivity to the ROP decision process and less reliance on subjectivity.

Additional Process Discussion As part of reviewing the Grand Gulf Special Inspection, the DPO Panel also looked at implementation of the incident investigation process related to the issue at Grand Gulf. This was mainly due to the timeline for evaluating the condition and getting an inspection team to site. As mentioned in the Policy Section of MD 8.3, there is a timeliness aspect to investigating incidents. Also, one of the objectives of the policy is to promote public confidence in the agency. In the Grand Gulf Special Inspection, it took 13 days to analyze the degraded condition, another 25 days for the team to be formed and dispatched to the site, and another 361 days to issue the report. The DPO panel concluded the amount of time to disposition this Green finding impacted the NRCs timeliness in communicating the regulatory decision associated with this event.

The DPO panel noted that the majority of the delay was attributed to finalizing the significance determination with a smaller portion associated with forming and dispatching the special inspection team. To understand the requirements for this process, the DPO Panel reviewed the guidance in Management Directive 8.3, Inspection Procedure 93800, for augmented inspections, and Inspection Procedure 93812, for special inspections.

Requirements for an augmented inspection team, as specified in IP 93800 were to focus on fact finding without documenting any findings or significance determination. In contrast, the revision of IP 93812 in place at the time of the Grand Gulf special inspection allowed both approaches.

Additionally, IP 93800 required the AIT report to be issued in 30 days, whereas IP 93812 provided no guidance for SIT reports, except to follow IMC 0612 (45 days). While the latest revision of IP 93812, effective November 15, 2017, specified that the SIT report was not to be held up to complete significance determination, the DPO panel concluded that documenting 10

inspection findings was, at least in part, responsible for the long timeline. Another difference between the AIT and SIT guidance was signature authority for the reports. Both inspection teams were designated to report directly to the regional administrator, and while IP 93800 specified that the AIT report was to be signed by the regional administrator, no such guidance existed in IP 93812 for special inspections.

Concern 2 The LERF determination for this finding was inadequate, based on the following:

  • Removing core damage sequences from the model in a pseudo-quantitative attempt to determine LERF based on evacuation studies cannot be performed using existing NRC risk tools.
  • There was no agency guidance for applying evacuation credit to LERF determinations.

Because of this, the evaluation of NCP 2017-010 should have addressed how evacuation credit should be applied.

  • Evacuation Success was not defined (some may refuse to evacuate).
  • The probability of failure to evacuate the nearby population is very uncertain.
  • The use of 8 days for LERF cutoff is for a generic population and does not consider the differences in health among the population.
  • Appendix M should have been used to fill the gap in guidance.

Conclusion and Discussion:

As noted through a review of the DRE, while the risk estimate was determined to be appropriate, the DPO Panel, as previously discussed, identified a number of conservatisms, which if removed, may have resulted in a conditional risk increase of CDF for the finding below a 1E-7/yr increase in CDF. An increase in CDF below 1E-7/yr would not require a separate LERF evaluation in accordance with guidance documents.

Notwithstanding the above, the DPO Panel performed a LERF review for this Grand Gulf issue based on the DRE estimate of an increase in CDF risk of 3.2E-7/yr.

From IMC 0609, Appendix H, Containment Integrity Significance Determination Process, LERF is defined as the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects.

IMC 0308, Attachment 3, provides the basis document for the application of IMC 0609, Appendix H. Similar to information used for Appendix G to IMC 609, the guidance for assessing containment findings for plant shutdown divides an outage into Time Windows (TWs) and Plant Operating States (POSs). Shutdown LERF deficiencies are analyzed according to what TW and POS the finding occurred in.

IMC 0308 in part states For BWRs, In TW-Late (TWL), it is assumed that LERF cannot occur due to decay of the short-lived isotopes that are principally responsible for early health effects (mainly Iodine and Tellurium). Thus, no LERF significance determination issue is applicable for TWL. However, LERF can potentially occur in TW-E (Time Window Early) at both PWRs and BWRs. For both PWRs and BWRs, a finding that is associated with a core damage scenario is considered a potential LERF scenario during the first eight days of shutdown. The reason for 11

this is twofold: (1) the failures of containment function of most concern occur relatively close to the onset of core damage, and (2) difficulty of making a case that evacuation would have been initiated early enough to prevent a large release.

Type A Findings at Shutdown - Phase 2 Assessment.

As stated above, each core damage scenario occurring during the first 8 days of shutdown is considered for LERF at shutdown. The Factor for Type A findings related to these accidents are shown in (IMC 0609, Appendix H), Table 5.4, Phase 2 Assessment Factors

-Type A Findings at Shutdown, for various reactor/containment type combinations. The factors are identified according to the status of containment. For each core damage scenario that (1) involves an intact containment and (2) the finding occurs during the first 8 days of the outage, the factor and risk significance category of the finding is different for the various reactor and containment types.

The DPO Panel noted the following information through a review of IMC 0308 and IMC 0609 Appendix H. Grand Gulf is a BWR with a Mark III containment. BWRs with Mark III containments are vulnerable to hydrogen combustion events especially since there are no requirements for the igniter system to be available at shutdown. If the igniters are not available, the LERF Factor is 0.2 and the finding becomes a candidate for increase of risk significance category. The factor of 0.2 is derived from the discussion in Section 5.1.3 of NUREG-1765 (Basis Document for Large Early Release Frequency (LERF) Significance Determination Process (SDP) Inspection Findings that May Affect LERF). If the igniters can be recovered by operator action and are made available, the finding can be screened out. The DPO Panel could not determine if the igniters were available to be recovered in this case or available so conservatively assumed they were not.

The DPO Panel also noted that NUREG 1765 stated within the Scope and Limitations section that the focus of the LERF-based SDP is on internal events at full power. Issues associated with shutdown risk, emergency preparedness, radiation safety, and safeguards are not addressed. Notwithstanding this, the DPO Panel determined that NUREG 1765 provided important insights into the LERF factor number guidance used within the process for Mark III containments. The "Factor" in Table 2 relates the frequency range for a particular set of core damage (CD) accidents to the LERF: delta LERF = Factor x delta CDF affecting LERF sequences. The Mark III containment is predicted to fail with a relatively high probability during high pressure and SBO core melt sequences, but the suppression pool is expected to remain intact. Thus, the release is scrubbed and the LERF determination is relatively low. As shown in Section 5.1.3, the factor applies to all transients with the RCS at high pressure and to all SBO sequences regardless of whether the RCS is at high or low pressure.

The DPO Panel noted that Section 5 of NUREG 1765 specifically discusses BWR reactors with Mark III containments. The accident sequences in Mark III containments that contribute to LERF involve both early containment failure and bypass of the suppression pool. Accident sequences leading to releases that pass through the suppression pool are scrubbed, i.e., most of the fission products are retained in the pool; hence, these releases are not large. Thus containment failures involving failures of the wet-well airspace alone will not be contributors to LERF.

Mark III containments have a double-layer containment, with the drywell and suppression pool forming one layer and the outer containment structure (wet-well) the second layer. BWR Mark III containments also rely on the suppression pool to condense steam and scrub fission products 12

released from the RCS during a severe accident. Releases that are scrubbed do not contribute to LERF (e.g., sequences in which the discharge is through the safety or relief valves and sequences with the drywell intact). Thus, the major contributors to LERF are accidents that fail the containment and the drywell or directly bypass the suppression pool.

In summary, through a review of the NUREG, the DPO Panel noted that the conditional probability for transient sequences with the RCS at high pressure and for all SBO sequences is close to 0.2 so that the Mark III containment fails at the same time that the suppression pool is bypassed. The conversion Factor for Type A findings is therefore 0.2 for all SBO sequences and for that fraction of the transient accident class that has a high RCS pressure during core meltdown. Thus if a finding related to any SBO or transient with high RCS pressure is processed through the CDF-based SDP, the risk significance should be evaluated for a potential increase because of LERF considerations. For this finding, the DPO Panel noted that short term core damage (CD) sequences were similar to the above evaluation. The longer term CD sequences, such as 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, may result in containment failure so the DPO Panel noted applying a factor would not be applicable from a conservative standpoint regardless if scrubbing were still maintained because of the nature of boiling within the suppression pool.

The DPO Panel then reviewed the applicable document to be used in this assessment, APPENDIX H CONTAINMENT INTEGRITY SIGNIFICANCE DETERMINATION PROCESS, IMC 0609. The background of the document states: Core damage accidents that lead to large, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population have the potential to cause early health effects, e.g. prompt fatalities. The frequency of all accidents of this type is called the large early release frequency (LERF) as described in Regulatory Guide 1.174 (reference 1). Such accidents include unscrubbed releases associated with early containment failure at or shortly after reactor vessel breach, containment bypass events, and loss of containment Isolation.

The DPO Panel noted that within the LIMITATIONS AND PRECAUTIONS of IMC 0609 Appendix H, it is stated that its use generates a reasonably conservative, order-of-magnitude assessment of the risk significance of inspection findings. The approach in this appendix has numerous assumptions and limitations, which include the following:

  • Since this SDP is focused on LERF, i.e., early fatality risk, long-term risk effects such as population dose and latent cancer fatalities are not addressed in this guidance. In addition, long term accident sequences that involve failure of containment heat removal and ultimately progress to containment failure, e.g., loss of containment heat removal sequences in BWRs, are assumed not to contribute to LERF. It is assumed that effective emergency response actions can be taken within the long time frame of these accident sequences.
  • For the evaluation of risk significance during shutdown, only the period within 8 days of the beginning of the outage is considered. After 8 days, it is assumed that the short-lived, volatile isotopes that are principally responsible for early health effects have decayed sufficiently such that the finding would not contribute to LERF. It is implied that, in addition, all core damage sequences are considered as candidate LERF sequences because it is not known when evacuation would begin.

The DPO Panel noted that Section 5.2 of IMC 0609 Appendix H is the appropriate Approach for Assessing Type A Findings During Shutdown. Using Table 5.4 of the Phase 2 Assessment 13

Factors for Type A findings at shutdown for a Mark III containment such as Grand Gulf, a 0.2 factor would be applied if igniters are not available for the appropriate sequences.

As noted above, the NUREG 1765 gets into the background behind these values.

In reviewing Section (5) of the DRE relative to the evaluation of LERF, the DPO Panel added up the dominant short term CD sequences which would be assumed to all be involved with the failure to recover LOSDC within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, resulting in early core damage. They noted, however, these short term sequences are similar to the transient evaluations performed along with SBO events and described within the Mark III NUREG 1765 evaluations. At this point, the suppression pool and containment would be heating up but the conditional failure would be low.

Therefore, from a review of the current guidance within Appendix H, the determined that a 0.2 factor would be applicable to the short term CD sequences because of the likelihood of scrubbing effects. They noted the DRE for this finding had not applied this factor for these short term sequences.

As documented in the DRE, Table 3 ADHR Issue Dominant Sequences, the total CDF from short term sequences was determined to be 3.82E-6/yr. Applying the exposure time of 7 days, this resulted in a 7.32E-8/yr increase in CDF. Therefore, 7.32E-8/yr x 0.2 applicable Mark III factor recognizing scrubbing through the SP would result in a LERF contribution for the short term sequences of 1.5E-8/yr.

The DRE determined the Long term cut-set CDF contribution at an exposure time of 4 days consistent with the 8 day early LERF guidance, and it resulted in a 5.47E-8/yr for long term event contribution. However, the DRE used guidance within IMC 0308 and 0609 to eliminate these long term sequences from LERF based on an evaluation that the affected population could be evacuated before CD was postulated to occur. The DPO Panel noted through a sensitivity case that if these long term sequences were to remain in the calculation, given the factor applied to the short term sequences of 0.2, the two contributions added together would be an increase of 6.97E-8/yr delta LERF based on the CDF results.

This would indicate the delta LERF contribution would not increase the risk significance above that calculated by the CDF increase for the condition even if the longer term sequences were not removed based on assumed effective evacuation.

Thus, in conclusion, the DPO Panel noted that applying the appropriate factor for short term CDF sequences in the DRE appeared to result in a value below 1E-7/yr. This would be the case even if the long term sequences would not have been removed by the analyst in the current DRE and the result would remain a very low risk significance issue, based on LERF.

Removing core damage sequences While it would not impact the significance of this finding, the DPO Panel determined that the guidance within Appendix H is not detailed in nature with respect to long term sequences and does not provide very good guidance or a defined methodology on how to apply the concept of eliminating longer term sequences within the limitations and precautions section. This could lead to inconsistent applications given the variety of evacuation assumptions. To specifically review this case, emails were reviewed between the analyst and a staff member from the Office of Research, which indicated that for this case it would likely have taken 12 or more hours until core damage after reaching the top of active fuel, providing at least 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> or more hours for evacuation. However, this would be based on a variety of conditions. Therefore, while the analyst followed guidance within Appendix H, which implies this removal of longer term 14

sequences can be pursued, the methodology suggested within Appendix H was found to be vague without details on how to perform this in a consistent manner. Because it was found in the Appendix H limitations and precautions section and was further evaluated through discussions and evaluation with research, the DPO Panel could not find a definitive concern with applying the process to remove the sequences and evaluate timing and evacuation.

However, notwithstanding this, in this case, this review found that the elimination of long term CD sequences would not need to be applied because application of the 0.2 factor for short term sequences would result in the conclusion of very low safety significance.

The above is noted to be an observation that additional guidance for how to more definitively evaluate the above process for elimination of long term sequences would be helpful to both analysts and stakeholders.

Agency guidance for applying evacuation credit to LERF determinations.

The DPO Panel found that there is limited guidance as referenced above, however they agree it is limited in nature within Appendix H and there may be an opportunity for improvement in this area for how to give credit if warranted for longer term sequences within the first 8 days of shutdown Because this review found that the delta LERF calculation would have resulted in a very low safety significance of this event by applying the appropriate factor to short term sequences, with this basis outlined and defined within the NUREG for Mark III containments, the evaluation of evacuation success and probability of failure to evacuate were determined to be beyond the nature of the scope of this review. The use of 8 days is clearly defined within our guidance, including the background NUREG documents, and is consistent with well-established agency guidance for assessing potential LERF impacts.

In summary, based on the above review, even neglecting the elimination of the long term sequences in the delta LERF review performed within the DRE, by applying the appropriate factor for shorter term sequences, this issue would be below the threshold for increasing the risk significance due to delta LERF. As noted and calculated above, the contribution of the long term and short term sequences added together would be 6.97E-8/yr LERF contribution based on the conservatively determined CDF results. This would indicate the delta LERF contribution would not increase the risk significance above that calculated by the CDF increase for the condition.

In consideration of the DRE reviewed and the above LERF review, the DPO Panel determined that an Appendix M process would not be warranted and would decrease the scrutability of the final determination of safety significance.

Concern 3 The SDP in this finding did not meet the Qualitative Safety Goal:

  • The evaluation determined large releases that could result in overexposure to workers and public, yet it was considered Green.
  • The evaluation did not support the intent of the cancer fatality QHO.
  • Appendix M should have been used to address these items for this issue.

Conclusion and Discussion:

15

The threshold for a determination of a higher risk significance for LERF would be 1E-7/yr or above to make the LERF the main contributor to the significance. The DPO Panel determined that the DRE as written and using existing guidance for removal of long term sequences (although this guidance could be improved and more well defined) and an independent review of applying the appropriate LERF factor of 0.2 for short term sequences for a Mark III containment, all resulted in confirming a very low safety significant determination for LERF based on the CDF result.

The Established Quantitative Health Objectives (QHOs) are Early fatality risk (0.1%) of total accident risk) and latent cancer risk (0.1%) from all causes) for an individual living in the vicinity of a Nuclear Power Plant (NPP).

Based on the risk of accidental death in the U.S, this implies a prompt fatality QHO of 5E-7/year.

The existing guidance for when LERF becomes a greater than very low safety significant issue is when the increase in LERF contribution, as calculated, is greater than 1E-7/yr. This issue was below that threshold, and there is no existing guidance that risk evaluations related to SDPs need to evaluate for the cancer fatality QHO.

Based on a thorough review of the DRE, independent reviews, and LERF reviews, Appendix M would not have been appropriate for this issue, as all the tools existed within the given appendixes to evaluate the issue.

Concern 4 As related to this issue, the NCC process was not implemented appropriately:

  • The DPO panel should not report to the same individual as the one making the final call on the NCC.
  • This DPO should have been assigned to a different office director.
  • Basis in Part C for deciding differently for Part B is missing.

Conclusion and Discussion:

The DPO panel determined that assigning this DPO to the Region IV Regional Administrator followed the guidance in MD 10.159 (Section III.I.5). However, the DPO Panel also concluded that the submitter had a valid concern when raising this issue because the DPO and NCC officials are not independent.

The DPO Panel reached out to the non-concurrence decision-maker about why the basis for Part C being different from that recommended in Part B was not included. The answer was that the reasoning was included in the text and that the quote from Appendix M at the end of Part C was intended to tie back to the reasoning listed earlier in Part C. The DPO Panel determined this was a reasonable and logical approach. While it was a little difficult to initially understand the logic tie between the early text and the ending of Part C, overall, Part C was very clear regarding the basis for the decision. The early text provides reasoning for why the tools and modelling were acceptable, considered operator performance, considered the use of CDF and LERF metrics, and use of the SPAR model.

Overall Conclusion(s) 16

The DPO Panel concludes that this issue (Grand Gulf ADHR) is best characterized as Green, that adequate risk tools existed to complete the SDP, the proper risk metrics were used, and the QHOs were addressed. The DPO Panel further concluded that the SERP process was implemented informally after one member opted for a different position. This informal approach appeared to impact the timeliness associated with issuance of the inspection report for this event.

Recommendation(s)

This section should include a list of recommendations directly related to the DPO.

1. Document all actions post-SERP on the EATS Strategy Form for EA-16-277.
2. Consider adding explicit guidance to the Enforcement Manual and IMC 0609 that, if a SERP member disagrees with the outcome after reviewing the EATS strategy form (provided its within a set time limit), that SERP must take action to resolve the disagreement or escalate to RA.
3. The DPO panel recommends that the significance of ADHR issue remain at Green, but to address some of the programmatic concerns raised in the DPO and NCP, the region should consider the following under the ROP:
a. Inspect the extent evaluation, the cause evaluation, and corrective action implementation of the ADHR issue as an annual sample under IP 71152.
b. Add this issue to the next biennial PI&R team inspection.
c. Emphasize the programmatic issues during equipment alignment walk downs using IP 71111.04.
d. Emphasize the programmatic issues during Plant Status tours.
e. Consider more frequent accompaniments of operators on rounds as part of Plant Status tours.
f. Consider using PMT samples in IP 71111.19 as a means of inspecting the programmatic issues.
g. Similarly use outage observations in IP71111.20.
4. Consider making the SERP process more formal by:
a. Requiring recorded votes by division on the EATS strategy form
b. Recording the specified actions taken for disagreement
c. Requiring SERP member approval of the final EATS strategy form.
5. Consider the following to improve the public confidence of the incident investigation process:
a. Designating SES level signature authority on special inspection reports.

Procedures call for AITs & SITs to report directly to the Regional Administrator.

Given that a SIT is driven by lower risk than an AIT, it would be logical to designate the applicable division director to sign the SIT reports.

b. Consider changing the SIT procedure (93812) to be fact finding only, similar to the AIT. That would mean no findings or SDP would be done by the SIT, rather they would determine facts related to what happened and what caused it. For items that look like performance deficiencies the SIT could open a URI, which would then be followed up later by the ROP. In the case of Grand Gulf, this change would have allowed the report to be issued within 45 days and provided the public the facts of the event, including that it was fixed, while allowing issue evaluation to continue.
c. Consider adding a timeliness component to the incident investigation process.

When deciding whether or not to send a team to investigate an incident or condition, regional offices should consider timeliness of the analysis and team 17

deployment. The DPO Panel suggests that timeliness be based on the likelihood of lost evidence, rather than any set timeframe. The regional office should also consider the new 120-day metric when deploying a team. Undo delays in deployment can challenge that metric

6. Consider the need to request additional clarification within IMC 0609, Appendix H and IMC 0308, Appendix H, and applicable section of the RASP handbook on a more defined method to address eliminating longer term accident sequences from LERF reviews.

Appendices/Enclosures - As necessary Timeline:

1. August 10, 2016 - PSW valves to ADHR heat exchanger tagged closed for planned maintenance.
2. September 4, 2016 - RHR A declared inoperable because pump failed to meet SR 3.5.1.4 (quarterly IST).
3. September 8, 2016 - Unit shutdown to replace RHR A pump.
4. September 9, 2016 - RHR A removed for maintenance and thus could not provide DHR.

Operators take credit for ADHR to meet TS 3.4.10, Action A.1

5. September 22, 2016 - RHR A returned to service.
6. September 23, 2016 - GGNS ADHR issue identified when licensee operators attempted to place ADHR in service and discovered PSW valves to the ADHR heat exchanger were tagged closed.
7. September 24, 2016 - RHR A declared fully operable.
8. September 27, 2016 - PSW valves to ADHR heat exchanger reopened.
9. September 27, 2016 - Licensee management informs NRC of decision to delay unit startup due to operational performance concerns.
10. October 6, 2016 - MD 8.3 completed using IMC 0609 Appendix G Phase 2 worksheets.

Delta CDP determined to be 9.8E-6.

11. October 31, 2016 - Special Inspection arrives on site.
a. Mark Haire, Team Leader
b. David Proulx
c. Neal Day
d. David Loveless
12. November 4, 2016 - Site portion of inspection complete.
13. December 29, 2016 - IFRB Planning Meeting held in RIV. The board directed a discussion with DRA regarding initiating event frequencies.
14. January 12, 2017 - IFRB Follow-up Meeting held in RIV. Board directed additional engagement with DRA to develop a defendable risk analysis.
15. January 22, 2017 - 120 Metric passed.
16. January 31, 2017 - GGNS restart from forced outage.
17. January 31, 2017 - NRR/DRA completes the DRE. The DRE calculates delta CDF at 5.8E-6 using Sensitivity 4, which accounts for nominal T&M.
18. February 2, 2017 - IFRB Follow-up Meeting in RIV. Board finalized the PD, the DRE approach, and significance. Decided no planning SERP was needed.
19. February 16, 2017 - SERP Meeting. Panel agreed to issue a White finding and choice letter with violation of TS 3.4.10. See EATS Form EA-2016-277. Choice letter never issued.
20. February 23, 2017 - Licensee provides Calculation PRA-GG-01-001S01 Rev 0, GGNS At-Power Level 1 Accident Sequence Analysis, showing that only a small fraction of 18

containment failures would result in failure of HPCS in the lower elevation of the auxiliary building. This was prompted by phone call to licensee to inform them of the SERP decision. DRA begins reevaluating the significance.

21. March 23, 2017 - DRA completes revision of DRE based on calculation submitted by licensee. This evaluation includes event tree modification and LERF hand calculations.

It calculates delta CDF at 3.2E-7 and delta LERF at 7.3E-8.

22. April 13, 2017 - SERP Meeting. Panel agreed to change significance to Green for both CDF and LERF. EATS reports this as a unanimous decision. The change was based on licensee submitted PRA information that changed the agency assumption that all containment failure events resulted in loss of injection.
23. April 21, 2017, - DRP DD suggests the issue should be White in email to regional DRP folks and SERP members. This was based on two new questions related to LERF consideration. DD requests RIV staff set up additional enforcement panel in region.
24. April 26, 2017 - Regional Enforcement Panel. After analysis with RASCAL, the panel concluded that prompt fatalities would not occur later than one day after shutdown and agreed with the Green significance, which was one of the two reasons for the DD to withdraw the Green decision.
25. May 8, 2017 - Report concurrence by inspection team members.
26. May 31, 2017 - Special Inspection Exit
27. July 14, 2017 - DRP DD provides an options paper to NRR/DIRS & the RA. The text implies a request to reconsider the finding using IMC 0609, Appendix M (Option B). A later e-mail (July18, 2017) confirms that RIV DD asked for a meeting that week.
28. July 28, 2017 - E-mail from DIRS requesting DRA thoughts on the options paper.
29. August 2, 2017 - In response To July 28 email, DRA proposes to accept the finding as Green (Option A).
30. August 3, 2017 - In e-mail to DD, NRR notifies RIV they prefer Option A.
31. August 4, 2017 - Non-Concurrence by DRP DD.
32. August 10, 2017 - Part B of non-concurrence form completed by Deputy RA recommending an additional SERP and use of Appendix M.
33. October 27, 2017 - Final decision on non-concurrence. RA signed as both coordinator and approver.
34. October 27, 2017 - Final concurrence by Report signer (DRP Branch Chief) and RA
35. October 27, 2017 - Inspection Report issued
36. October 31, 2017 - DPO filed 19

SUBJECT:

DIFFERING PROFESSIONAL OPINION PANEL REPORT ON GRAND GULF SPECIAL INSPECTION REPORT (DPO-2017-009) DATED APRIL 23, 2018 DISTRIBUTION: OEDO-17-00071 RidsNrrOd Resource RidsRgn1MailCenter Resource RidsRgn2MailCenter Resource RidsRgn4MailCenter Resource ADAMS Package Accession No. ML18108A138 *via email OFFICE RGN-II

  • RGN-I
  • NRR NAME MFreeman FArner RLorson DATE 4/18/2018 4/19/2018 4/23/2018 OFFICIAL RECORD COPY

Document 4: DPO Decision DPO Case File for DPO-2017-009 The following pdf represents a collection of documents associated with the submittal and disposition of a differing professional opinion (DPO) from an NRC employee involving the significance determination for loss of decay heat removal at Grand Gulf.

Management Directive (MD) 10.159, NRC Differing Professional Opinions Program, describes the DPO Program. https://www.nrc.gov/docs/ML1513/ML15132A664.pdf The DPO Program is a formal process that allows employees and NRC contractors to have their differing views on established, mission-related issues considered by the highest level managers in their organizations, i.e., Office Directors and Regional Administrators. The process also provides managers with an independent, multi-person review of the issue (one person chosen by the employee). After a decision is issued to an employee, he or she may appeal the decision to the Executive Director for Operations (or the Commission, for those offices that report to the Commission).

Because the disposition of a DPO represents a multi-step process, readers should view the records as a collection. In other words, reading a document in isolation will not provide the correct context for how this issue was reviewed and considered by the NRC.

It is important to note that the DPO submittal includes the personal opinions, views, and concerns by NRC employees. The NRCs evaluation of the concerns and the NRCs final position are included in the DPO Decision.

The records in this collection have been reviewed and approved for public dissemination.

Document 1: DPO Submittal Document 2: Memo Establishing DPO Panel Document 3: DPO Panel Report Document 4: DPO Decision Document 5: DPO Appeal Document 6: Statement of Views Document 7: DPO Appeal Decision

Document 1: DPO Submittal

Document 2: Memo Establishing DPO Panel November 29, 2017 MEMORANDUM TO: Raymond K. Lorson, Panel Chairperson Office of Nuclear Reactor Regulation Frank J. Arner, Panel Member Region I M. Scott Freeman, Panel Member Region II THRU: Anne T. Boland, Director /RA/

Office of Enforcement FROM: Renée M. Pedersen /RA/

Sr. Differing Professional Views Program Manager Office of Enforcement

SUBJECT:

AD HOC REVIEW PANEL - DIFFERING PROFESSIONAL OPINION ON A GRAND GULF SPECIAL INSPECTION REPORT (DPO-2017-009)

In accordance with Management Directive (MD) 10.159, The NRC Differing Professional Opinion Program; and in my capacity as the Differing Professional Opinion (DPO) Program Manager; and in coordination with Anne Boland, Director, Office of Enforcement, Kriss Kennedy, Regional Administrator, Region IV; and the DPO submitter; you are being appointed as members of a DPO Ad Hoc Review Panel (DPO Panel) to review a DPO submitted by an U.S. Nuclear Regulatory Commission (NRC) employee.

The DPO (Enclosure 1) involves the significance determination for a loss of decay heat removal at Grand Gulf documented in a special inspection report. This issue was previously addressed in NCP-2017-010 (https://www.nrc.gov/docs/ML1730/ML17304A014.pdf). The DPO has been forwarded to Mr. Kennedy for consideration and issuance of a DPO Decision.

CONTACTS: Renée Pedersen, OE (301) 287-9426 Gladys Figueroa-Toledo, OE (301) 287-9497

R. Lorson, et al. 2 The DPO Panel has a critical role in the success of the DPO Program. Your responsibilities for conducting the independent review and documenting your conclusions in a report are addressed in the handbook for MD 10.159 in Section II.F and Section II.G, respectively. The DPO Web site also includes helpful information, including interactive flow charts, frequently asked questions, and closed DPO cases, including previous DPO Panel reports. We will also be sending you additional information that should help you implement the DPO process.

Because this process is not routine, we will be meeting and communicating with all parties during the process to ensure that everyone understands the process, goals, and responsibilities.

Disposition of this DPO should be considered an important and time sensitive activity. The timeliness goal for issuing a DPO Decision is 120 calendar days from the day the DPO is accepted for review. In this case, the DPO was accepted for review on November 7, 2017. The timeliness goal for issuing this DPO Decision is March 7, 2018.

Process Milestones and Timeliness Goals for this DPO are included as Enclosure 2. The timeframes for completing process milestones are identified strictly as goalsa way of working towards reaching the DPO timeliness goal of 120 calendar days. The timeliness goal identified for your DPO task is 75 calendar days from the date of this memorandum (February 12, 2018).

Although timeliness is an important DPO Program objective, the DPO Program also sets out to ensure that issues receive a thorough and independent review. The overall timeliness goal should be based on the significance and complexity of the issues and the priority of other agency work. Therefore, if you determine that your activity will result in the need for an extension beyond the overall 120-day timeliness goal, please send an e-mail to Mr. Kennedy with a copy to DPOPM.Resource@nrc.gov and include the reason for the extension request and a proposed completion date for your work and a proposed timeliness goal for issuance of a DPO Decision. Mr. Kennedy is responsible for subsequently forwarding the request for a new DPO timeliness goal to the EDO for approval.

An important aspect of our organizational culture includes maintaining an environment that encourages, supports, and respects differing views. As such, you should exercise discretion and treat this matter appropriately. Documents should be distributed on an as-needed basis. In an effort to preserve privacy, minimize the effect on the work unit, and keep the focus on the issues, you should simply refer to the employees as the DPO submitters. Avoid conversations that could be perceived as hallway talk on the issue and refrain from behaviors that could be perceived as retaliatory or chilling to the DPO submitters or that could potentially create a chilled environment for others. It is appropriate for employees to discuss the details of the DPO with their co-workers as part of the evaluation; however, as with other predecisional processes, employees should not discuss details of the DPO outside the agency. If you have observed inappropriate behaviors, heard allegations of retaliation or harassment, or receive outside inquiries or requests for information, please notify me or Gladys.

On an administrative note, please ensure that all DPO-related activities are charged to Activity Code ZG0007.

R. Lorson, et al. 3 We appreciate your willingness to serve and your dedication to completing a thorough and objective review of this DPO. Successful resolution of the issues is important for NRC and its stakeholders. If you have any questions or concerns, please feel free to contact me or Gladys.

We look forward to receiving your independent review results and recommendations.

Enclosures:

1. DPO-2017-009
2. Process Milestones and Timeliness Goals cc:

K. Kennedy, RIV S. Morris, RIV T. Pruett, RIV B. Welling, RI S. Sandal, RII A. Boland, OE G. Figueroa-Toledo, OE

R. Lorson, et al. 4

SUBJECT:

AD HOC REVIEW PANEL - DIFFERING PROFESSIONAL OPINION ON A COOPER PROBLEM IDENTIFICATION RESOLUTION INSPECTION REPORT (DPO-2017-009) DATE: November 29, 2017 ADAMS Package: ML17333A684 MEMO: ML17333A688 - ML17311A270 - ML17333A690 OE-011 OFFICE OE: DPO/PM OE: DPO/PM OE: D NAME GFigueroa RPedersen ABoland DATE 11/ 28 /2017 11/ 29 /2017 11 29 /2017 OFFICIAL RECORD COPY

Document 3: DPO Panel Report UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 April 23, 2018 MEMORANDUM TO: Kriss M. Kennedy, Regional Administrator Region IV FROM: Raymond K. Lorson, DPO Panel Chair /RA/

Frank J. Arner, DPO Panel Member /RA Raymond Lorson for/

M. Scott Freeman, DPO Panel Member /RA Raymond Lorson for/

SUBJECT:

DIFFERING PROFESSIONAL OPINION PANEL REPORT ON GRAND GULF SPECIAL INSPECTION REPORT (DPO-2017-009)

In a memorandum dated November 29, 2017, we were appointed as members of a Differing Professional Opinion (DPO) Ad Hoc Review Panel (DPO Panel) to review a DPO regarding the Region IV decision that issues related to the Alternate Decay Heat Removal System discussed in Special Inspection Report 05000416/2016008 were of very low significance (Green) instead of a more significant classification. The panel has reviewed the DPO in accordance with the guidance in Management Directive 10.159, The NRC Differing Professional Opinion Program.

The DPO Panel Report is enclosed for your consideration.

The results of the DPO Panels evaluation of the concerns raised in the DPO are detailed in the enclosed DPO Panel Report. Based on our review of concerns raised in the DPO, the DPO Panel concludes that this issue (Grand Gulf ADHR) is best characterized as Green; that adequate risk tools existed to complete the Significant Determination Process (SDP), the proper risk metrics were used, and the Quantitative Health Objectives (QHOs) were addressed. The DPO Panel further concluded that the Significance and Enforcement Review Panel (SERP) process was implemented informally after one member opted for a different position. This approach appeared to have impacted the timeliness associated with issuance of the inspection report for this event. Our recommendations are included in the report.

Please do not hesitate to contact us if you have any questions regarding the enclosed report.

Enclosure:

DPO Panel Report cc: TPruett, Region IV ABoland, OE GFiguero Toledo, OE CONTACT: Raymond K. Lorson, NRR (301) 415-1272

Differing Professional Opinion (DPO)

On Grand Gulf Special Inspection Report (DPO-2017-009)

DPO Panel Report

______________________/RA/_____________________

Raymond K. Lorson, Panel Chair

____________/RA Raymond Lorson for/_____________

Frank J. Arner, Panel Member

____________/RA Raymond Lorson for/_____________

M. Scott Freeman, Panel Member Date: April 23, 2018

Introduction On November 17, 2017, the Office of Enforcement (OE) acknowledged a differing professional opinion (DPO) regarding issues related to the Alternate Decay Heat Removal System (ADHR) at Grand Gulf Nuclear Station as discussed in Special Inspection Report 05000416/20160085.

On November 29, 2017, OE issued a memorandum establishing the DPO Panel to review the DPO and associated decision on significance determination for loss of ADHR as described in the Special Inspection Report and Non-Concurrence NCP-2017-010. On December 14, 2017, the DPO Panel met with the submitter by telephone to establish a concise statement of the submitters concerns, to which the submitter agreed on December 22, 2017. The DPO Panel then performed a detailed review of the concerns and issues, reviewed the detailed risk evaluation for the issue, evaluated the risk tools used to conduct the evaluation, and interviewed NRC staff associated with the special inspection and non-concurrence.

Statement of Concerns as agreed with Submitter Based on a review of the DPO package, the following concerns as expressed by the submitter were identified by the DPO Panel:

1. The agency did not follow its own guidance when evaluating this finding. This concern stemmed from two specific process issues.
  • The SERP process. When the submitter, a SERP member, withdrew support for Green, the issue should have gone back for another SERP to consider use of Appendix M. If unanimous consent could not be reached, the issue should have been escalated to the office director level. This was recommended in part B of the NCP, but not implemented.
  • The use of Manual Chapter (IMC) 0609, Appendix M. The submitter believes this should have been used to evaluate the finding based on the following:

o The detailed risk evaluation (DRE) did not capture the programmatic failures in the Grand Gulf Nuclear Station (GGNS) operations department, and those same failures could not be modeled using simplified plant analysis risk (SPAR). This was acknowledged in NCP 2017-010.

o The human error probability (HEP) analysis used nominal failure probabilities that did not reflect station operations past performance.

o The analysis only looked at discreet HEPs.

o There were no HEP worksheets to support the selected HEPs.

2. The large early release frequency (LERF) determination for this finding was inadequate based on the following:
  • Removing core damage sequences from the model in a pseudo-quantitative attempt to determine LERF based on evacuation studies cannot be performed using existing NRC risk tools.
  • There was no agency guidance for applying evacuation credit to LERF determinations.

Because of this, the evaluation of NCP 2017-010 should have addressed how evacuation credit should be applied.

  • Evacuation Success was not defined (some may refuse to evacuate).
  • The probability of failure to evacuate the nearby population is very uncertain.
  • The use of 8 days for LERF cutoff is for a generic population and does not consider the differences in health among the population.

2

  • Appendix M should have been used to fill the gap in guidance.
3. The significance determination process (SDP) in this finding did not meet the Qualitative Safety Goal:
  • The evaluation determined large releases that could result in overexposure to workers and the public, yet it was considered Green.
  • The evaluation did not support the intent of the cancer fatality Quantitative Health Objectives (QHO).
  • Appendix M should have been used to address these items for this issue.
4. As related to this issue, the NCC process was not implemented appropriately:
  • The DPO Panel should not report to the same individual as the one making the final call on the NCC.
  • This DPO should have been assigned to a different office director.
  • Basis in Part C for deciding differently for Part B is missing.

Evaluation of Concerns Concern 1 The agency did not follow its own guidance when evaluating this finding. This concern stemmed from two specific process issues.

  • The SERP process. When the submitter, a SERP member, withdrew support for Green, the issue should have gone back for another SERP to consider use of Appendix M. If unanimous consent could not be reached, the issue should have been escalated to the office director level. This was recommended in part B of the NCC, but not implemented.
  • The use of Manual Chapter (IMC) 0609, Appendix M. The submitter believes this should have been used to evaluate the finding based on the following:

o The detailed risk evaluation (DRE) did not capture the programmatic failures in the GGNS operations department, and those same failures could not be modeled using SPAR. This was acknowledged in NCP 2017-010.

o The human error probability (HEP) analysis used nominal failure probabilities that did not reflect station operations past performance.

o The analysis only looked at discreet HEPs.

o There were no HEP worksheets to support the selected HEPs.

Conclusion and Discussion:

In summary, the DPO panel agrees with the submitter that the SERP process was not completely followed after the submitter withdrew support for Green; however, the use of the non-concurrence process effectively got the issue to where it should have been, had the process been followed. Specifically, the issue was elevated to the Regional Administrator to decide the significance of the finding. The DPO panel disagrees with the submitter regarding the use of IMC 0609, Appendix M. The DPO panel concluded that using the Grand Gulf Shutdown SPAR Model Event Trees was the best approach for quantifying the significance of the issue and that, therefore, this was NOT a case where Appendix M should have been used.

3

The SERP Process The guidance for implementing the SERP process could be found in several places. The first was IMC 0609, Attachment 1, which was effective December 8, 2016. The second place was IMC 0609, Attachment 1TP, which was effective November 15, 2016, and was part of the pilot for the new Inspection Finding Review Board Process. These two chapters were entirely dedicated to the SERP process. The final place where guidance on the SERP process could be found was the Enforcement Manual, Revision 10. Section 1.2.13 was specifically dedicated to the SERP Process.

After reviewing these documents, the DPO Panel determined that the guidance required the SERP to unanimously agree on a final decision. If there was disagreement, the SERP was to specify actions to resolve any dissent. If those actions resulted in no resolution, the issue was to be escalated to the appropriate office director, in this case the Regional Administrator (IMC 0609, Att 1, 04.02c & Att 1TP, 04.01). To facilitate resolution and tracking, the guidance required the EATS Strategy Form be routed to all SERP members for review and comment (IMC 0609, Att1 & Att 1TP, 02.05, Enf Man 1.2.12.2E & 1.2.13.4F). However, the guidance was not very specific about what should be done if, after review, a member of the SERP were to disagree with the conclusion, as happened with the Grand Gulf special inspection. The DPO Panel concluded that this would be essentially equivalent to the case where the SERP was not unanimous and the issue was required to be returned to SERP for actions to resolve the dissent as described in IMC 0609, Attachment 1TP, Section 04.01.

In the case of the Grand Gulf special inspection, the DPO Panel determined that the guidance was followed up through the point of making the final SERP decision. However, after the final SERP on April 13, 2017, unanimously decided that the significance of the issue was Green, the process did not appear to be followed. On April 21, 2017, the Region IV representative (DPO submitter) sent an e-mail to Region IV staff outlining the reasons for withdrawing support for Green and stating the desire to have another SERP, which would be allowed under Enforcement Manual Section 1.2.13.4F. The SERP voting members (alternates who voted at the meeting on April 13), except for the OE representative, were copied on that e-mail. Strict compliance with the process would have dictated that the Region IV representative would disagree upon review of the final EATS strategy form, another SERP would be held, a vote recorded, and actions be specified to address the Region IV representatives concerns. If those concerns could not be resolved in 14 days, the issue would then be escalated to the Region IV Regional Administrator. Instead, there were a series of e-mails and phone calls between Region IV and NRR where the Region IV representative developed an options paper and proposed using IMC 0609 Appendix M. After NRR disagreed with using Appendix M, the Region IV representative filed a non-concurrence, which was dispositioned by the Region IV Regional Administrator. The DPO Panel concluded that use of e-mail in this case was acceptable under Enforcement Manual Section 1.2.13.4F. However, the Region IV representative did not specifically ask for a meeting in the options paper and did not include the OE representative. Section 1.2.13.4F required that all parties be involved and that it be recorded on the EATS strategy form.

Assuming the Regional Administrator would have made the same decision as documented in the non-concurrence, this would have completed the process by early May 2017. The submitter could have non-concurred at that point, but that would have been approximately 3 months earlier. The DPO Panel concluded that the non-concurrence forced the issue to the place specified in the SERP guidance with the Regional Administrator agreeing with the SERP, but the time spent 4

resolving the non-concurrence may have been avoided had the SERP process been fully implemented in April 2017.

Use of IMC 0609 Appendix M Regarding the use of IMC 0609, Appendix M, the submitter put forth two main reasons why Appendix M should have been used on this issue. The first was that programmatic failures of the Grand Gulf operations department should have been taken into account, and the second was that HEP analysis did not accurately reflect station operations past performance. The DPO Panel looked at both of these.

Programmatic Failures of GGNS Operations:

The analysis section for the finding, as documented in the report, stated that the failure to perform the technical specification (TS) required action to verify an alternate method of decay heat removal is available when residual heat removal (RHR) shutdown cooling subsystem is inoperable was a performance deficiency. In accordance with guidance within IMC 0308, , Significance Determination Process Technical Bases, Section 5, once the staff has described how a licensee performance deficiency is the proximate cause of a degraded condition, the SDP, via applicable attachments and appendices, estimates the safety or security significance of the degraded condition. Therefore, the failure to perform the TS required action to verify an alternate method of decay heat removal would be the applicable focus when developing risk insights. IMC 0308 guidance is that inspection findings are evaluated on their own merit and therefore each finding, which has been determined to be the proximate cause of a particular degraded condition, is assessed on its own. The DPO Panel noted that the documented PD and finding was not specific to programmatic breakdowns of any department but was related to the specific failure to verify an alternate method of decay heat. Therefore, it would be expected that the analyst would attempt to evaluate the issue using the appropriate SDP IMC 0609 guidance when evaluating the issue. In this case IMC 0609, Appendix G, Boiling Water Reactor (BWR) and Pressurized Water Reactor (PWR) Phase 2 Significance Determination Process for Shutdown, would be the guidance initially used to evaluate the issue.

This would have led to a Phase 1 screening requiring a Phase 2 review prior to performing a detailed risk evaluation (DRE). It is noted that Phase 2 results are often very conservative and this is appropriate in order to capture issues which need a more detailed review to ensure the appropriate increase in risk is determined.

The Risk Assessment Standardization Project (RASP) manual, Volume 4, provides guidance for Shutdown Events. The DPO Panel noted the following guidance from Section 3.0, Scenario definition and quantification of Volume 4 of the RASP manuals:

Shutdown scenarios can be defined and their CCDPs (for event analysis) or CDPs (for plant condition analysis) can be calculated using a SPAR-SD model.

In this Handbook, it is assumed that there may or may not be a plant-specific SPAR-SD model available to the analysts. At this time, there are only a few SPAR-SD models available. The analyst may need to construct the needed SD scenarios using portions of model logic from the at-power model, SD event tree templates, and the SD HEP library mentioned in Section 2, and illustrated in Figure 2-1. The system fault trees can be borrowed from the existing at-power model and modified as necessary to map the realistic SD conditions. If available, 5

use a plant-specific SPAR-SD model. The most likely case is that such a model will not be available. In that case, construct (or import from the ET library) the minimum number of ETs to carry out the analysis.

The DPO Panels noted that it was clear from a review of this case that the Grand Gulf Station is one of several plants that had an Idaho National Labs (INL) SPAR model which included shutdown plant operating state (POS) event trees. Therefore, as noted above, the guidance is to use the plant-specific SPAR-SD model, as it will provide the best estimate over any estimation that would have to be developed in their absence. The DPO Panel downloaded the current version of the Grand Gulf SPAR model and reviewed the event trees and compared them to the previous model used in the DRE for the applicable condition. The finding exposure time occurred within the early POS 1 condition. The DPO Panels performed a detailed evaluation of the dominant event tree that was utilized for the DRE and concluded that it was technically sound with respect to the expected top mitigating events for the Loss of Shutdown Event (Early) sequence. The DPO Panel determined the Loss of SDC Initiating Event Tree dominated the conditional risk increase for the finding and therefore was focused on.

In evaluating the concern of capturing the stated programmatic failures, the DPO Panel determined the performance deficiency (PD) and finding, as written, did not provide technical justification to not use the as-built Grand Gulf SPAR model. If this model were not to be used, this approach would conflict with the current guidance of capturing the risk of the finding using the best estimate tool. An available SPAR model is thought to provide the best estimate with which to model an event such as this because it is much more detailed than if performing a DRE at a site which needs a model constructed. The process provides for performance of a DRE after the initial screening using a Phase 2 approach within IMC 0609, Appendix G, which has generic event trees.

The term SDP describes an overall process that is designed to meet ROP founding principles such as objectivity, scrutability, repeatability, and timeliness. As stated within IMC 0308 guidance:

Each SDP tool should attempt to provide a decision logic or a decision framework that remains relatively constant across applicable inspection findings.

This enhances objectivity by reducing the likelihood that SDP results are influenced by different value judgments held by different individuals. Where practicable, a probabilistic risk framework is used to add this desired discipline to SDP results. The test of having achieved such objectivity is when different individuals using a given SDP decision logic or framework arrive at the same result when using the same input conditions and assumptions. Achieving SDP result consistency and repeatability is the intended outcome of the objectivity attribute. This attribute can be achieved through peer reviews of SDP assessments to assure consistency in SDP decision-making.

When a quantitative risk model is used, the greatest challenge to achieving this attribute is to allow stakeholders a means to independently assess SDP result sensitivity to the most influential assumptions, to understand the basis of the assumptions, and to reveal the limitations and uncertainties of the risk model used and how these were considered by the staff in arriving at a final result.

When quantitative risk insights and inputs from other factors considered for decision making are used, the bases of the significant factors influencing the 6

decision outcome must be clearly documented in detail for scrutability and effective communication of the final risk-informed decision.

The DPO Panel focused on the above-noted fundamental principles of IMC 0308 when reviewing the detailed risk evaluation (DRE) to assess whether the DRE was clear in its critical assumptions and had a clear technical basis. The DPO Panel noted the following observations and assessments with regard to the DRE for the ADHR issue:

  • The DPO Panel independently reviewed the Loss of Shutdown Cooling Initiating Event Frequencies (IEFs) and determined that the revised IEF used in this assessment of 1.37/year events was appropriate. This was performed by reviewing the referenced EPRI documents within the inspection report and adding the number of events noted to determine a best estimate for frequency. It was noted that this was a significant increase over the 0.11/year events assumed in the SPAR model. The bases of the SPAR model IEF for LOSDC early events (0.11/year) was not able to be determined; however, the increase in the IEF by the analyst was found to be in agreement with the referenced EPRI documentation through a rough estimate by the DPO Panel. It was noted that the IEF used for the Loss of Shutdown Cooling (LOSDC) (Early) event tree would increase the CCDF by an order of magnitude. The DPO Panel could not determine if this was an overly conservative estimate given that not all LOSDC events occur within the first week (i.e., early events) and therefore noted this estimate for this specific condition may be somewhat high. However, even if this was a conservative estimate, it was determined to be appropriate for this assessment given the knowledge available.

Application of Human Error Probabilities The DPO Panel recognized that assumptions used for operator failure rates (Human Error Probability) can be significant contributors to the risk assessment for shutdown condition events.

Therefore, the DPO Panel performed a detailed review of the basic events in the model relative to operator actions and core damage sequence cut-sets to further analyze the DRE. The DPO Panel noted that the DRE increased several of the operator action nominal failure rates above and beyond their normal baseline probability settings. This included the failure to establish shutdown cooling (SDC) or suppression pool cooling, SD-XHE-XM-RHR-NOM, from 1E-3 to 1E-2. This is a basic operation for plant operating staff and the SPAR-H calculator would normally assume a 1E-3 failure probability. The DPO Panel determined this adjustment to be a conservative value set by the analyst. Two other operator actions were noted to have been increased from their nominal failure probability values as well; SD-XHE-XM-ECS-NOM, (Operator Fails to establish low pressure or high pressure (LPI/HPI) Injection) from 1E-3 to 1E-2, and SD-XHE-XM-ALTI-NOM (Fail to initiate alternate injection given lo/hi pressure injection fails) from 4E-3 to 1E-2. This was determined to be conservative given the amount of time that would be available to complete these actions.

The DPO Panel determined that the significant contributors from a review of the core damage cut-sets were the failure of the operators to depressurize the reactor, ADS-XHE-XM-MDEPR, normally with a 5E-4 failure probability and the operators failing to vent the containment (SD-XHE-XM-VENT) normally set at 1E-3. The DPO Panel noted the analyst did a detailed SPAR-H calculation on these and adjusted the failure to depressurize basic event to a higher rate set at 1E-3. The DPO Panel noted the diagnosis and action to depressurize, if a LOSDC occurred, is a relatively simple task performed in the control room if SDC cannot be recovered. The DPO Panel reviewed the Licensee procedure relative to this action, and it was a clear established 7

action to perform. A second critical action was associated with containment venting. The failure to vent containment was assigned a value of 1.1E-3 consistent with its original value. The DPO Panel noted this value was also consistent with the value given in IMC 0609 Appendix G, which typically uses conservative/bounding values as an initial review. Additionally, there is sufficient time available to complete this action - over many shifts and likely days - prior to the point where containment may fail dependent on the core damage sequence path. The sequence where this action had a higher risk contribution (successful low pressure injection and depressurization) would allow a large amount of time being available for this operator action.

Therefore, this was also determined to be a very reasonable assumption.

Finally, the existing SPAR model has post processing rules which limit the amount of credit for operator success when there are two operator actions in a core damage cut-set, such that a cap is put on the failure rate to keep it elevated when several operator actions exist. The SPAR model would take two operator action basic events and if both were at 1E-4 in a cut-set, the result would be capped at 1E-6 due to the applied post processing rule. The analyst for this DRE appropriately recognized that this cap set by the model may not be conservative because of large uncertainties involved. Therefore, the analyst developed a revised post processing rule to cap two operator error actions. As an example and as documented in the DRE, the combined HEPs were increased from an original value of 1E-3 to 1E-2. Therefore, when two operator actions were in a cut-set, the DPO Panel noted, through a review of the dominant cut-sets within the DRE, that the value was capped at 1E-4 or two orders of magnitude higher than what the SPAR model rules typically would apply. For instance, if a cut-set had the failure to recover or establish SDC after the initial loss of SDC, (XSD-XHE-XM-RHR-NOM) and the operators failed to depressurize the reactor (XADS-XHE-XM-MDEPR), the multiple operator action failure probability was capped at 1E-4 (basic event SD-XHE-XM-REPLC1). This was determined to be appropriate by the DPO Panel with respect to the added conservatism due to the uncertainties involved in these failure rates.

The DPO Panel noted that in the dominant cut-sets, there was extra time available between assumed operator actions to achieve success. For instance, time would exist to diagnose and determine what action they would need to use, such as depressurizing the reactor upon failure to recover SDC. The DPO Panel, as noted above, also reviewed the associated procedure for loss of SDC, which clearly described the required actions for the operators if SDC could not be recovered and this was consistent with the Event Tree. Lastly, by adding this post processing rule, the analyst was consistent with Table B-1-3 of the RASP manual Volume 4, Appendix B, regarding HEP Dependency Rules. For the dominant operator actions, the DPO Panel determined they fell into the Weak dependency Level with an approximation of 1E-2. This is due to the longer time windows available to take the actions for the dominant cut-sets, and the actions were not complex and cues would be available.

In summary, the DPO Panel concluded that the analyst developed detailed HEP values using SPAR-H where required, adjusted the appropriate HEPs from their nominal values for several basic operator action events and used conservative values for other human error probabilities by increasing their failure rates by an order of magnitude. Therefore, the appropriate HEPs that influenced the risk of this finding were adjusted, and the DPO Panel had no concerns with the selected HEPs that were revised.

The DPO Panel did not find any requirement to attach HEP worksheets to the DRE to support the selected HEPs and noted these calculations are performed within the SPAR-H model which reflects all performance shaping factors used. Additionally, and more importantly, the DPO Panel found the basis provided by the analyst for the revision to the HEPs to be clearly 8

articulated within the DRE. Lastly, there is no requirement for an analyst to try to determine station operations past performance in determining appropriate HEP values, and this would violate the concept of mapping the DRE to the PD/finding as written and conflict with the guidance within IMC 0308 to focus only on the documented PD.

Other DRE Observations From a review of the DRE and interviews with the analyst, the DPO Panel independently determined that there were other inherent conservatisms built into this DRE. They noted that in the Base Case model for the dominant event tree, several modifications were made. As noted in the DRE from a review of EPRI data and consultation with other analysts, this DRE noted that approximately 1 to 10 percent of LOSDC events are non-recoverable. Therefore, a 10 percent failure to recover from a LOSDC was applied as a best estimate. The DPO Panel performed an independent review of the data contained within EPRI reports and determined that a best estimate using severity factors of 1.0 (boiling occurred) for previous LOSDC events would lead to a nominal 0.03 probability for failure to recover a LOSDC event. Therefore, using 0.1 was thought to possibly be conservative, but appropriate, in that it would remain a conservative assumption. This would result in a higher risk calculated. However, as a surrogate, the failure to run basic event for the RHR, pump B, RHR-MDP-FR-PUMPB, was set to a probability of 0.1 (the non-recovery assumption above). This was performed to try to simulate this failure to recover in the core damage cut-sets. The DPO Panel looked at EPRI data for failures per hour from LOSDC events for pump failures, and at the SPAR model which used a failure to run in the E-4 range for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The DPO Panel used failure data per hour for loss of RHR flow events, loss of cooling to heat exchangers and failure of pump events and applied a conservative 30 day time period to determine a 2.4E-2 failure probability relative to the B RHR pump to fail.

More importantly, because the analyst used RHR fail to run as a surrogate for fail to recover SDC, the DPO Panel noted it would automatically fail the mitigating action for establishing suppression pool cooling in the event tree. This was thought to be a very conservative assumption given that only about 14 percent of LOSDC events was noted to be due to a loss of the pump, pump flow-path, or heat exchangers. The majority of events are caused by RHR isolation and Reactor Pressure Vessel Isolation events where the suction path and return path are isolated, which, through interlocks, causes an RHR pump trip. By virtue of minimal cut-sets and Boolean algebra operations within the SPAR model, this surrogate gave reduced credit from that which would normally be available to the operators for being able to open suppression pool (SP) suction valves and the return valve to establish SP cooling to mitigate a LOSDC event. The DPO Panel noted this would impact one of the two dominant core damage sequences and therefore would have an impact of a higher risk estimate due to the reduction in credit for suppression pool cooling.

Additionally, the SPAR model 6-hour-fail-to-recover SDC sequence, which also had a significant risk contribution in the failure to recover SDC and failure to depressurize events, assumed failure of High Pressure Injection due to loss of C Service Water cooling in many of the CD cut-sets. The DPO Panel noted, through a review of the model and system diagrams, that the loss of the C Service Water cooling function would result in loss of room cooling to the high pressure pump; however, the suction source would be on the condensate storage tank, a much cooler source of water than the suppression pool (i.e., lower heat source to room), and the CST would likely be available for many hours to support injection based on the decay heat rate.

Therefore, the DPO Panel could not determine the technical basis for the relatively early core damage failure time sequence (i.e., 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />) for loss of C SW events, which increases the probability of failing to recover SDC. The DPO Panel noted that the high pressure pump may survive for a much longer time than the 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> given for SDC recovery in the model. This could 9

not be verified but was thought to be another possible conservatism in the SPAR model for one of the two dominant CD sequences.

The two modeling observations noted above were determined to not adversely affect the outcome or conclusion of the DRE in any way, but served to provide additional technical justification for the conclusion that the final determination of safety significance was appropriately determined to be of very low safety significance and would only have reduced the calculated CDF/yr if further pursued. This was not able to be quantified but would, in the opinion of the DPO Panel, offset any uncertainties attributed to the assignment of HEPs within this DRE.

In conclusion, the DRE was found to be fundamentally sound and clearly documented by the analyst, with the assumptions clearly articulated and consistent with the requirements and guidance within IMC 0308 for performance of safety significance reviews of conditional events.

Based on the above review, the DPO Panel concluded that Appendix M, Significance Determination Process Using Qualitative Criteria, would not be appropriate for this finding. The PRA method and tools in this case and SDP appendices were determined to address the finding and provide a reasonable estimate of the significance due to the detailed modeling performed.

As noted, there appeared to be several conservatisms applied which would more than offset any uncertainties with the established human error probabilities. The use of the appropriate SDP appendix and tools, in this case a DRE using an existing model for shutdown condition, supports the ROP objective to improve objectivity and repeatability. This results in greater discipline and objectivity to the ROP decision process and less reliance on subjectivity.

Additional Process Discussion As part of reviewing the Grand Gulf Special Inspection, the DPO Panel also looked at implementation of the incident investigation process related to the issue at Grand Gulf. This was mainly due to the timeline for evaluating the condition and getting an inspection team to site. As mentioned in the Policy Section of MD 8.3, there is a timeliness aspect to investigating incidents. Also, one of the objectives of the policy is to promote public confidence in the agency. In the Grand Gulf Special Inspection, it took 13 days to analyze the degraded condition, another 25 days for the team to be formed and dispatched to the site, and another 361 days to issue the report. The DPO panel concluded the amount of time to disposition this Green finding impacted the NRCs timeliness in communicating the regulatory decision associated with this event.

The DPO panel noted that the majority of the delay was attributed to finalizing the significance determination with a smaller portion associated with forming and dispatching the special inspection team. To understand the requirements for this process, the DPO Panel reviewed the guidance in Management Directive 8.3, Inspection Procedure 93800, for augmented inspections, and Inspection Procedure 93812, for special inspections.

Requirements for an augmented inspection team, as specified in IP 93800 were to focus on fact finding without documenting any findings or significance determination. In contrast, the revision of IP 93812 in place at the time of the Grand Gulf special inspection allowed both approaches.

Additionally, IP 93800 required the AIT report to be issued in 30 days, whereas IP 93812 provided no guidance for SIT reports, except to follow IMC 0612 (45 days). While the latest revision of IP 93812, effective November 15, 2017, specified that the SIT report was not to be held up to complete significance determination, the DPO panel concluded that documenting 10

inspection findings was, at least in part, responsible for the long timeline. Another difference between the AIT and SIT guidance was signature authority for the reports. Both inspection teams were designated to report directly to the regional administrator, and while IP 93800 specified that the AIT report was to be signed by the regional administrator, no such guidance existed in IP 93812 for special inspections.

Concern 2 The LERF determination for this finding was inadequate, based on the following:

  • Removing core damage sequences from the model in a pseudo-quantitative attempt to determine LERF based on evacuation studies cannot be performed using existing NRC risk tools.
  • There was no agency guidance for applying evacuation credit to LERF determinations.

Because of this, the evaluation of NCP 2017-010 should have addressed how evacuation credit should be applied.

  • Evacuation Success was not defined (some may refuse to evacuate).
  • The probability of failure to evacuate the nearby population is very uncertain.
  • The use of 8 days for LERF cutoff is for a generic population and does not consider the differences in health among the population.
  • Appendix M should have been used to fill the gap in guidance.

Conclusion and Discussion:

As noted through a review of the DRE, while the risk estimate was determined to be appropriate, the DPO Panel, as previously discussed, identified a number of conservatisms, which if removed, may have resulted in a conditional risk increase of CDF for the finding below a 1E-7/yr increase in CDF. An increase in CDF below 1E-7/yr would not require a separate LERF evaluation in accordance with guidance documents.

Notwithstanding the above, the DPO Panel performed a LERF review for this Grand Gulf issue based on the DRE estimate of an increase in CDF risk of 3.2E-7/yr.

From IMC 0609, Appendix H, Containment Integrity Significance Determination Process, LERF is defined as the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects.

IMC 0308, Attachment 3, provides the basis document for the application of IMC 0609, Appendix H. Similar to information used for Appendix G to IMC 609, the guidance for assessing containment findings for plant shutdown divides an outage into Time Windows (TWs) and Plant Operating States (POSs). Shutdown LERF deficiencies are analyzed according to what TW and POS the finding occurred in.

IMC 0308 in part states For BWRs, In TW-Late (TWL), it is assumed that LERF cannot occur due to decay of the short-lived isotopes that are principally responsible for early health effects (mainly Iodine and Tellurium). Thus, no LERF significance determination issue is applicable for TWL. However, LERF can potentially occur in TW-E (Time Window Early) at both PWRs and BWRs. For both PWRs and BWRs, a finding that is associated with a core damage scenario is considered a potential LERF scenario during the first eight days of shutdown. The reason for 11

this is twofold: (1) the failures of containment function of most concern occur relatively close to the onset of core damage, and (2) difficulty of making a case that evacuation would have been initiated early enough to prevent a large release.

Type A Findings at Shutdown - Phase 2 Assessment.

As stated above, each core damage scenario occurring during the first 8 days of shutdown is considered for LERF at shutdown. The Factor for Type A findings related to these accidents are shown in (IMC 0609, Appendix H), Table 5.4, Phase 2 Assessment Factors

-Type A Findings at Shutdown, for various reactor/containment type combinations. The factors are identified according to the status of containment. For each core damage scenario that (1) involves an intact containment and (2) the finding occurs during the first 8 days of the outage, the factor and risk significance category of the finding is different for the various reactor and containment types.

The DPO Panel noted the following information through a review of IMC 0308 and IMC 0609 Appendix H. Grand Gulf is a BWR with a Mark III containment. BWRs with Mark III containments are vulnerable to hydrogen combustion events especially since there are no requirements for the igniter system to be available at shutdown. If the igniters are not available, the LERF Factor is 0.2 and the finding becomes a candidate for increase of risk significance category. The factor of 0.2 is derived from the discussion in Section 5.1.3 of NUREG-1765 (Basis Document for Large Early Release Frequency (LERF) Significance Determination Process (SDP) Inspection Findings that May Affect LERF). If the igniters can be recovered by operator action and are made available, the finding can be screened out. The DPO Panel could not determine if the igniters were available to be recovered in this case or available so conservatively assumed they were not.

The DPO Panel also noted that NUREG 1765 stated within the Scope and Limitations section that the focus of the LERF-based SDP is on internal events at full power. Issues associated with shutdown risk, emergency preparedness, radiation safety, and safeguards are not addressed. Notwithstanding this, the DPO Panel determined that NUREG 1765 provided important insights into the LERF factor number guidance used within the process for Mark III containments. The "Factor" in Table 2 relates the frequency range for a particular set of core damage (CD) accidents to the LERF: delta LERF = Factor x delta CDF affecting LERF sequences. The Mark III containment is predicted to fail with a relatively high probability during high pressure and SBO core melt sequences, but the suppression pool is expected to remain intact. Thus, the release is scrubbed and the LERF determination is relatively low. As shown in Section 5.1.3, the factor applies to all transients with the RCS at high pressure and to all SBO sequences regardless of whether the RCS is at high or low pressure.

The DPO Panel noted that Section 5 of NUREG 1765 specifically discusses BWR reactors with Mark III containments. The accident sequences in Mark III containments that contribute to LERF involve both early containment failure and bypass of the suppression pool. Accident sequences leading to releases that pass through the suppression pool are scrubbed, i.e., most of the fission products are retained in the pool; hence, these releases are not large. Thus containment failures involving failures of the wet-well airspace alone will not be contributors to LERF.

Mark III containments have a double-layer containment, with the drywell and suppression pool forming one layer and the outer containment structure (wet-well) the second layer. BWR Mark III containments also rely on the suppression pool to condense steam and scrub fission products 12

released from the RCS during a severe accident. Releases that are scrubbed do not contribute to LERF (e.g., sequences in which the discharge is through the safety or relief valves and sequences with the drywell intact). Thus, the major contributors to LERF are accidents that fail the containment and the drywell or directly bypass the suppression pool.

In summary, through a review of the NUREG, the DPO Panel noted that the conditional probability for transient sequences with the RCS at high pressure and for all SBO sequences is close to 0.2 so that the Mark III containment fails at the same time that the suppression pool is bypassed. The conversion Factor for Type A findings is therefore 0.2 for all SBO sequences and for that fraction of the transient accident class that has a high RCS pressure during core meltdown. Thus if a finding related to any SBO or transient with high RCS pressure is processed through the CDF-based SDP, the risk significance should be evaluated for a potential increase because of LERF considerations. For this finding, the DPO Panel noted that short term core damage (CD) sequences were similar to the above evaluation. The longer term CD sequences, such as 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, may result in containment failure so the DPO Panel noted applying a factor would not be applicable from a conservative standpoint regardless if scrubbing were still maintained because of the nature of boiling within the suppression pool.

The DPO Panel then reviewed the applicable document to be used in this assessment, APPENDIX H CONTAINMENT INTEGRITY SIGNIFICANCE DETERMINATION PROCESS, IMC 0609. The background of the document states: Core damage accidents that lead to large, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population have the potential to cause early health effects, e.g. prompt fatalities. The frequency of all accidents of this type is called the large early release frequency (LERF) as described in Regulatory Guide 1.174 (reference 1). Such accidents include unscrubbed releases associated with early containment failure at or shortly after reactor vessel breach, containment bypass events, and loss of containment Isolation.

The DPO Panel noted that within the LIMITATIONS AND PRECAUTIONS of IMC 0609 Appendix H, it is stated that its use generates a reasonably conservative, order-of-magnitude assessment of the risk significance of inspection findings. The approach in this appendix has numerous assumptions and limitations, which include the following:

  • Since this SDP is focused on LERF, i.e., early fatality risk, long-term risk effects such as population dose and latent cancer fatalities are not addressed in this guidance. In addition, long term accident sequences that involve failure of containment heat removal and ultimately progress to containment failure, e.g., loss of containment heat removal sequences in BWRs, are assumed not to contribute to LERF. It is assumed that effective emergency response actions can be taken within the long time frame of these accident sequences.
  • For the evaluation of risk significance during shutdown, only the period within 8 days of the beginning of the outage is considered. After 8 days, it is assumed that the short-lived, volatile isotopes that are principally responsible for early health effects have decayed sufficiently such that the finding would not contribute to LERF. It is implied that, in addition, all core damage sequences are considered as candidate LERF sequences because it is not known when evacuation would begin.

The DPO Panel noted that Section 5.2 of IMC 0609 Appendix H is the appropriate Approach for Assessing Type A Findings During Shutdown. Using Table 5.4 of the Phase 2 Assessment 13

Factors for Type A findings at shutdown for a Mark III containment such as Grand Gulf, a 0.2 factor would be applied if igniters are not available for the appropriate sequences.

As noted above, the NUREG 1765 gets into the background behind these values.

In reviewing Section (5) of the DRE relative to the evaluation of LERF, the DPO Panel added up the dominant short term CD sequences which would be assumed to all be involved with the failure to recover LOSDC within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, resulting in early core damage. They noted, however, these short term sequences are similar to the transient evaluations performed along with SBO events and described within the Mark III NUREG 1765 evaluations. At this point, the suppression pool and containment would be heating up but the conditional failure would be low.

Therefore, from a review of the current guidance within Appendix H, the determined that a 0.2 factor would be applicable to the short term CD sequences because of the likelihood of scrubbing effects. They noted the DRE for this finding had not applied this factor for these short term sequences.

As documented in the DRE, Table 3 ADHR Issue Dominant Sequences, the total CDF from short term sequences was determined to be 3.82E-6/yr. Applying the exposure time of 7 days, this resulted in a 7.32E-8/yr increase in CDF. Therefore, 7.32E-8/yr x 0.2 applicable Mark III factor recognizing scrubbing through the SP would result in a LERF contribution for the short term sequences of 1.5E-8/yr.

The DRE determined the Long term cut-set CDF contribution at an exposure time of 4 days consistent with the 8 day early LERF guidance, and it resulted in a 5.47E-8/yr for long term event contribution. However, the DRE used guidance within IMC 0308 and 0609 to eliminate these long term sequences from LERF based on an evaluation that the affected population could be evacuated before CD was postulated to occur. The DPO Panel noted through a sensitivity case that if these long term sequences were to remain in the calculation, given the factor applied to the short term sequences of 0.2, the two contributions added together would be an increase of 6.97E-8/yr delta LERF based on the CDF results.

This would indicate the delta LERF contribution would not increase the risk significance above that calculated by the CDF increase for the condition even if the longer term sequences were not removed based on assumed effective evacuation.

Thus, in conclusion, the DPO Panel noted that applying the appropriate factor for short term CDF sequences in the DRE appeared to result in a value below 1E-7/yr. This would be the case even if the long term sequences would not have been removed by the analyst in the current DRE and the result would remain a very low risk significance issue, based on LERF.

Removing core damage sequences While it would not impact the significance of this finding, the DPO Panel determined that the guidance within Appendix H is not detailed in nature with respect to long term sequences and does not provide very good guidance or a defined methodology on how to apply the concept of eliminating longer term sequences within the limitations and precautions section. This could lead to inconsistent applications given the variety of evacuation assumptions. To specifically review this case, emails were reviewed between the analyst and a staff member from the Office of Research, which indicated that for this case it would likely have taken 12 or more hours until core damage after reaching the top of active fuel, providing at least 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> or more hours for evacuation. However, this would be based on a variety of conditions. Therefore, while the analyst followed guidance within Appendix H, which implies this removal of longer term 14

sequences can be pursued, the methodology suggested within Appendix H was found to be vague without details on how to perform this in a consistent manner. Because it was found in the Appendix H limitations and precautions section and was further evaluated through discussions and evaluation with research, the DPO Panel could not find a definitive concern with applying the process to remove the sequences and evaluate timing and evacuation.

However, notwithstanding this, in this case, this review found that the elimination of long term CD sequences would not need to be applied because application of the 0.2 factor for short term sequences would result in the conclusion of very low safety significance.

The above is noted to be an observation that additional guidance for how to more definitively evaluate the above process for elimination of long term sequences would be helpful to both analysts and stakeholders.

Agency guidance for applying evacuation credit to LERF determinations.

The DPO Panel found that there is limited guidance as referenced above, however they agree it is limited in nature within Appendix H and there may be an opportunity for improvement in this area for how to give credit if warranted for longer term sequences within the first 8 days of shutdown Because this review found that the delta LERF calculation would have resulted in a very low safety significance of this event by applying the appropriate factor to short term sequences, with this basis outlined and defined within the NUREG for Mark III containments, the evaluation of evacuation success and probability of failure to evacuate were determined to be beyond the nature of the scope of this review. The use of 8 days is clearly defined within our guidance, including the background NUREG documents, and is consistent with well-established agency guidance for assessing potential LERF impacts.

In summary, based on the above review, even neglecting the elimination of the long term sequences in the delta LERF review performed within the DRE, by applying the appropriate factor for shorter term sequences, this issue would be below the threshold for increasing the risk significance due to delta LERF. As noted and calculated above, the contribution of the long term and short term sequences added together would be 6.97E-8/yr LERF contribution based on the conservatively determined CDF results. This would indicate the delta LERF contribution would not increase the risk significance above that calculated by the CDF increase for the condition.

In consideration of the DRE reviewed and the above LERF review, the DPO Panel determined that an Appendix M process would not be warranted and would decrease the scrutability of the final determination of safety significance.

Concern 3 The SDP in this finding did not meet the Qualitative Safety Goal:

  • The evaluation determined large releases that could result in overexposure to workers and public, yet it was considered Green.
  • The evaluation did not support the intent of the cancer fatality QHO.
  • Appendix M should have been used to address these items for this issue.

Conclusion and Discussion:

15

The threshold for a determination of a higher risk significance for LERF would be 1E-7/yr or above to make the LERF the main contributor to the significance. The DPO Panel determined that the DRE as written and using existing guidance for removal of long term sequences (although this guidance could be improved and more well defined) and an independent review of applying the appropriate LERF factor of 0.2 for short term sequences for a Mark III containment, all resulted in confirming a very low safety significant determination for LERF based on the CDF result.

The Established Quantitative Health Objectives (QHOs) are Early fatality risk (0.1%) of total accident risk) and latent cancer risk (0.1%) from all causes) for an individual living in the vicinity of a Nuclear Power Plant (NPP).

Based on the risk of accidental death in the U.S, this implies a prompt fatality QHO of 5E-7/year.

The existing guidance for when LERF becomes a greater than very low safety significant issue is when the increase in LERF contribution, as calculated, is greater than 1E-7/yr. This issue was below that threshold, and there is no existing guidance that risk evaluations related to SDPs need to evaluate for the cancer fatality QHO.

Based on a thorough review of the DRE, independent reviews, and LERF reviews, Appendix M would not have been appropriate for this issue, as all the tools existed within the given appendixes to evaluate the issue.

Concern 4 As related to this issue, the NCC process was not implemented appropriately:

  • The DPO panel should not report to the same individual as the one making the final call on the NCC.
  • This DPO should have been assigned to a different office director.
  • Basis in Part C for deciding differently for Part B is missing.

Conclusion and Discussion:

The DPO panel determined that assigning this DPO to the Region IV Regional Administrator followed the guidance in MD 10.159 (Section III.I.5). However, the DPO Panel also concluded that the submitter had a valid concern when raising this issue because the DPO and NCC officials are not independent.

The DPO Panel reached out to the non-concurrence decision-maker about why the basis for Part C being different from that recommended in Part B was not included. The answer was that the reasoning was included in the text and that the quote from Appendix M at the end of Part C was intended to tie back to the reasoning listed earlier in Part C. The DPO Panel determined this was a reasonable and logical approach. While it was a little difficult to initially understand the logic tie between the early text and the ending of Part C, overall, Part C was very clear regarding the basis for the decision. The early text provides reasoning for why the tools and modelling were acceptable, considered operator performance, considered the use of CDF and LERF metrics, and use of the SPAR model.

Overall Conclusion(s) 16

The DPO Panel concludes that this issue (Grand Gulf ADHR) is best characterized as Green, that adequate risk tools existed to complete the SDP, the proper risk metrics were used, and the QHOs were addressed. The DPO Panel further concluded that the SERP process was implemented informally after one member opted for a different position. This informal approach appeared to impact the timeliness associated with issuance of the inspection report for this event.

Recommendation(s)

This section should include a list of recommendations directly related to the DPO.

1. Document all actions post-SERP on the EATS Strategy Form for EA-16-277.
2. Consider adding explicit guidance to the Enforcement Manual and IMC 0609 that, if a SERP member disagrees with the outcome after reviewing the EATS strategy form (provided its within a set time limit), that SERP must take action to resolve the disagreement or escalate to RA.
3. The DPO panel recommends that the significance of ADHR issue remain at Green, but to address some of the programmatic concerns raised in the DPO and NCP, the region should consider the following under the ROP:
a. Inspect the extent evaluation, the cause evaluation, and corrective action implementation of the ADHR issue as an annual sample under IP 71152.
b. Add this issue to the next biennial PI&R team inspection.
c. Emphasize the programmatic issues during equipment alignment walk downs using IP 71111.04.
d. Emphasize the programmatic issues during Plant Status tours.
e. Consider more frequent accompaniments of operators on rounds as part of Plant Status tours.
f. Consider using PMT samples in IP 71111.19 as a means of inspecting the programmatic issues.
g. Similarly use outage observations in IP71111.20.
4. Consider making the SERP process more formal by:
a. Requiring recorded votes by division on the EATS strategy form
b. Recording the specified actions taken for disagreement
c. Requiring SERP member approval of the final EATS strategy form.
5. Consider the following to improve the public confidence of the incident investigation process:
a. Designating SES level signature authority on special inspection reports.

Procedures call for AITs & SITs to report directly to the Regional Administrator.

Given that a SIT is driven by lower risk than an AIT, it would be logical to designate the applicable division director to sign the SIT reports.

b. Consider changing the SIT procedure (93812) to be fact finding only, similar to the AIT. That would mean no findings or SDP would be done by the SIT, rather they would determine facts related to what happened and what caused it. For items that look like performance deficiencies the SIT could open a URI, which would then be followed up later by the ROP. In the case of Grand Gulf, this change would have allowed the report to be issued within 45 days and provided the public the facts of the event, including that it was fixed, while allowing issue evaluation to continue.
c. Consider adding a timeliness component to the incident investigation process.

When deciding whether or not to send a team to investigate an incident or condition, regional offices should consider timeliness of the analysis and team 17

deployment. The DPO Panel suggests that timeliness be based on the likelihood of lost evidence, rather than any set timeframe. The regional office should also consider the new 120-day metric when deploying a team. Undo delays in deployment can challenge that metric

6. Consider the need to request additional clarification within IMC 0609, Appendix H and IMC 0308, Appendix H, and applicable section of the RASP handbook on a more defined method to address eliminating longer term accident sequences from LERF reviews.

Appendices/Enclosures - As necessary Timeline:

1. August 10, 2016 - PSW valves to ADHR heat exchanger tagged closed for planned maintenance.
2. September 4, 2016 - RHR A declared inoperable because pump failed to meet SR 3.5.1.4 (quarterly IST).
3. September 8, 2016 - Unit shutdown to replace RHR A pump.
4. September 9, 2016 - RHR A removed for maintenance and thus could not provide DHR.

Operators take credit for ADHR to meet TS 3.4.10, Action A.1

5. September 22, 2016 - RHR A returned to service.
6. September 23, 2016 - GGNS ADHR issue identified when licensee operators attempted to place ADHR in service and discovered PSW valves to the ADHR heat exchanger were tagged closed.
7. September 24, 2016 - RHR A declared fully operable.
8. September 27, 2016 - PSW valves to ADHR heat exchanger reopened.
9. September 27, 2016 - Licensee management informs NRC of decision to delay unit startup due to operational performance concerns.
10. October 6, 2016 - MD 8.3 completed using IMC 0609 Appendix G Phase 2 worksheets.

Delta CDP determined to be 9.8E-6.

11. October 31, 2016 - Special Inspection arrives on site.
a. Mark Haire, Team Leader
b. David Proulx
c. Neal Day
d. David Loveless
12. November 4, 2016 - Site portion of inspection complete.
13. December 29, 2016 - IFRB Planning Meeting held in RIV. The board directed a discussion with DRA regarding initiating event frequencies.
14. January 12, 2017 - IFRB Follow-up Meeting held in RIV. Board directed additional engagement with DRA to develop a defendable risk analysis.
15. January 22, 2017 - 120 Metric passed.
16. January 31, 2017 - GGNS restart from forced outage.
17. January 31, 2017 - NRR/DRA completes the DRE. The DRE calculates delta CDF at 5.8E-6 using Sensitivity 4, which accounts for nominal T&M.
18. February 2, 2017 - IFRB Follow-up Meeting in RIV. Board finalized the PD, the DRE approach, and significance. Decided no planning SERP was needed.
19. February 16, 2017 - SERP Meeting. Panel agreed to issue a White finding and choice letter with violation of TS 3.4.10. See EATS Form EA-2016-277. Choice letter never issued.
20. February 23, 2017 - Licensee provides Calculation PRA-GG-01-001S01 Rev 0, GGNS At-Power Level 1 Accident Sequence Analysis, showing that only a small fraction of 18

containment failures would result in failure of HPCS in the lower elevation of the auxiliary building. This was prompted by phone call to licensee to inform them of the SERP decision. DRA begins reevaluating the significance.

21. March 23, 2017 - DRA completes revision of DRE based on calculation submitted by licensee. This evaluation includes event tree modification and LERF hand calculations.

It calculates delta CDF at 3.2E-7 and delta LERF at 7.3E-8.

22. April 13, 2017 - SERP Meeting. Panel agreed to change significance to Green for both CDF and LERF. EATS reports this as a unanimous decision. The change was based on licensee submitted PRA information that changed the agency assumption that all containment failure events resulted in loss of injection.
23. April 21, 2017, - DRP DD suggests the issue should be White in email to regional DRP folks and SERP members. This was based on two new questions related to LERF consideration. DD requests RIV staff set up additional enforcement panel in region.
24. April 26, 2017 - Regional Enforcement Panel. After analysis with RASCAL, the panel concluded that prompt fatalities would not occur later than one day after shutdown and agreed with the Green significance, which was one of the two reasons for the DD to withdraw the Green decision.
25. May 8, 2017 - Report concurrence by inspection team members.
26. May 31, 2017 - Special Inspection Exit
27. July 14, 2017 - DRP DD provides an options paper to NRR/DIRS & the RA. The text implies a request to reconsider the finding using IMC 0609, Appendix M (Option B). A later e-mail (July18, 2017) confirms that RIV DD asked for a meeting that week.
28. July 28, 2017 - E-mail from DIRS requesting DRA thoughts on the options paper.
29. August 2, 2017 - In response To July 28 email, DRA proposes to accept the finding as Green (Option A).
30. August 3, 2017 - In e-mail to DD, NRR notifies RIV they prefer Option A.
31. August 4, 2017 - Non-Concurrence by DRP DD.
32. August 10, 2017 - Part B of non-concurrence form completed by Deputy RA recommending an additional SERP and use of Appendix M.
33. October 27, 2017 - Final decision on non-concurrence. RA signed as both coordinator and approver.
34. October 27, 2017 - Final concurrence by Report signer (DRP Branch Chief) and RA
35. October 27, 2017 - Inspection Report issued
36. October 31, 2017 - DPO filed 19

SUBJECT:

DIFFERING PROFESSIONAL OPINION PANEL REPORT ON GRAND GULF SPECIAL INSPECTION REPORT (DPO-2017-009) DATED APRIL 23, 2018 DISTRIBUTION: OEDO-17-00071 RidsNrrOd Resource RidsRgn1MailCenter Resource RidsRgn2MailCenter Resource RidsRgn4MailCenter Resource ADAMS Package Accession No. ML18108A138 *via email OFFICE RGN-II

  • RGN-I
  • NRR NAME MFreeman FArner RLorson DATE 4/18/2018 4/19/2018 4/23/2018 OFFICIAL RECORD COPY

Document 4: DPO Decision

Document 5: DPO Appeal Submittal

Document 6: Statement of Views UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 1600 EAST LAMAR BOULEVARD ARLINGTON, TEXAS 76011*4511 February 11, 2019 MEMORANDUM TO: Margaret Doane, Executive Director for Operations VIA: Ian A. Gifford, Differing Views Program Manager Office of Enforcement FROM: Scott A. Morris, Regional Administrator Region IV

/

/r-11 a

SUBJECT:

STATEMENT OF VIEWS CONCERNING APPEAL 0 PROFESSIONAL OPINION DECISION INVOLVING INSPECTION FINDING (DP0-2017-009)

On January 23, 2019, an appeal of the decision made by my predecessor, Mr. Kriss M. Kennedy, on Differing Professional Opinion (DPO) 2017-009 was submitted by Mr. Troy Pruett. The Office of Enforcement (OE) subsequently accepted Mr. Pruett's appeal for processing. In accordance with the guidance in MD 10.159, "The NRC Differing Professional Opinions Program," the Regional Administrator is required to develop a written "statement of views" on the contested issues included in the appeal. The purpose of this memorandum is to provide my views on the issue(s) accepted for appeal review by OE. Please note that my views are not entirely consistent with those of my predecessor who has since retired from the NRC and therefore not available to comment.

Statement of Views I reviewed the entirety of the DPO package, including the original non-concurrence on the technical issue which later became the focus of the DPO. In the appeal, Mr. Pruett specifically states that "The (DPO) Panel and deciding official expended resources to re-perform the significance determination and did not directly address the overriding concern in the DPO (treatment of programmatic failures in management oversight) ... I do believe the Panel erred when they ignored the qualitative assessment of risk from programmatic failures. Therefore, the final significance determination reached by the Panel is incorrect (underestimated the actual safety significance)." Note that Mr. Kennedy agreed with the DPO Panel when rendering his decision on the DPO. I offer the following views for your consideration in deciding this matter:

1. The significance determination methodology NRC analysts employed to evaluate the technical issue at hand (a performance deficiency and finding at Grand Gulf) was complex and required a detailed risk evaluation (DRE) consistent with governing Inspection Manual procedures. The DPO Panel fully and independently re-performed the DRE and the original analyst's work in assessing the risk significance of the finding.
2. It is not clear to me what degree of discussion the eventual Significance Evaluation Review Panel (SERP) members had in assessing the assumptions and uncertainties associated with the analyst's DRE. What is clear is that the Panel members could not

M. Doane 2 achieve consensus the final risk assessment, which led to one Panel member (Mr. Pruett) withdrawing from the Panel and submitting a non-concurrence on the Panel's final decision.

3. As the "Step B" official in the above-mentioned non-concurrence, I recommended that that the issue be remanded back to the SERP and then processed in accordance with IMC 0609 guidance if the SERP decision is not unanimous. Doing so would require the issue to be reviewed by multiple office directors prior to arriving a final significance determination. This recommendation was not adopted by the non-concurrence deciding official (Mr. Kennedy).
4. The original licensee performance deficiency at issue dates back to September 2016, nearly 2 % years ago. As such, I do not recommend any re-assessment of the significance of this issue (to the extent you decide to direct one be conducted), be included as a performance input for the Grand Gulf licensee. The original GREEN finding should stand.
5. It is clear that at the time of the original performance deficiency there were programmatic issues affecting licensee performance, particularly in the Grand Gulf operations department. These and other issues resulted in an extended shutdown of the facility while the operations department underwent extensive re-training. Licensee management oversight of plant operations was also clearly culpable in this weak performance.
6. Since the performance deficiency occurred, there has been a nearly wholesale change-out of senior and mid-level managers at the station who (among other significant actions) have committed to, conveyed and enforced elevated standards of their employees' performance.
7. Further, there has been increased NRC oversight of Grand Gulf since 2017 as the station has been in the "Regulatory Response Column" of the Reactor Oversight Process (ROP) Action Matrix. The NRC staff has completed two Problem Identification and Resolution inspections at the station since the 2016 performance deficiency occurred which have shown some improved performance in operations and management oversight.
8. I am not and have never been a qualified NRC risk analyst and as such am not sufficiently skilled to judge the adequacy of the original DRE or the subsequently-performed DPO Panel DRE, both of which resulted in GREEN significance determinations.
9. Notwithstanding Item 8 above, I continue to believe that the SERP should have followed the process I recommended as part of my Step B input on the original non-concurrence.

That is, given that the original SERP (i.e., before Mr. Pruett withdrew) could not achieve consensus, the issue should have been elevated to a higher level of NRC management for disposition consistent with IMC 0609.

10. On Page 5 of their report, the DPO Panel correctly noted that the documented performance deficiency and finding was not attributed to a programmatic breakdown in the NRC inspection report. It seems likely that neither the DRE risk analyst nor the DPO Panel read the entire inspection report narrative to fully appreciate the programmatic aspects of licensee performance that may have been (or were) influential to this case.

M. Doane 3

11. I agree with the DPO Panel with the need for the NRC staff to maximize objectivity and repeatability when assessing licensee performance deficiencies. However, I do not believe that the SERP should have categorically rejected at least some qualitative assessment of the impact of programmatic issues on the quantitative DRE result to meet these ideals. It is not clear to me that the SERP fully appreciated the key assumptions and uncertainties associated with the original DRE, nor the role that programmatic weaknesses could (or should) play in adjusting these assumptions and uncertainties.
12. While neither the DRE analyst nor the DPO Panel performed risk assessments that explicitly considered programmatic issues (i.e., through qualitative "adjustments" to quantitative risk model results), which arguably should have been done given the specific language in IMC 0308 and IMC 0609 cited by Mr. Pruett, it is clear that certain Human Error Probabilities (HEPs) and other modelling factors were increased above their nominal values to account for operator performance issues known at Grand Gulf at the time of the assessed performance deficiency. While these subjective adjustments from nominal values did increase the quantitative risk result, it is not clear that they fully address or bound what a SERP might otherwise conclude had they conducted a more systematic (though likely more subjective) IMC 0609 Appendix M assessment.
13. Given Items 1-12 above, it seems clear that reasonable, well-intentioned NRC staff can identify more than one approach by which to assess a licensee performance deficiency, particularly when an issue, and the processes by which to assess it, are complex. As such, it is not entirely surprising that in this case the SERP members were not able to achieve consensus. Again, that is why I believe the matter should have been elevated to a higher level of management for review.
14. I am concerned that, because SERP members are not systematically trained (and therefore potentially not well-versed) in the complexities and nuances of the NRC's significance determination process, some SERP members' ability to fully appreciate and apply the principles of risk-informed decision-making may be challenged. I suspect that such may have been the case when the significance determination for the Grand Gulf finding was made.
15. I believe that another independent panel review of all the facts of this case should be conducted, not to re-adjudicate the risk significance of the now 2 % year old Grand Gulf finding, but rather to determine if the significance determination methodology as applied in this case fully adhered to the governing procedures and bases documents. If this panel identifies deviations in the manner the original analyst and decision-makers applied the established process, particularly as they apply to the consideration of licensee programmatic weaknesses, the program office (NRR/DIRS) should consider how to clarify the existing process to improve the likelihood that future assessments will be completed more consistently. A systematic approach to training SERP decision-makers should also be considered.
16. As a final note, I would offer that some degree of judgement is always a factor when applying the significance determination process, irrespective of whether or not IMC 0609 Appendix M is employed. I believe that risk model input assumptions and other modelling uncertainties should be explicitly identified, evaluated and dispositioned in an auditable manner. SERP members should, as a matter of due diligence, apply additional judgement when a quantitative risk assessment (i.e., PRA model) yields a result that is "close" to a performance threshold (e.g., GREEN/WHITE), given that the model result is really a statistical distribution around a mean (i.e., it is not a single point result). Such judgement should also be applied in cases where small variations in input assumptions

M. Doane 4 or modelling uncertainty factors create large variations in model results. In these cases, I believe well understood (and documented) licensee programmatic issues should be considered and applied when rendering a final performance deficiency risk assessment decision. Particularly in cases such as these, the basis for the final risk determination should be well documented.

cc: G. Wilson, OE I. Gifford, OE H. Nieh, NRR D. Dorman, OEDO R. Lorson, RI F. Arner, RI S. Freeman, RII M. Shaffer, RIV

Document 7: DPO Appeal Decision Those on the UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 8, 2019 MEMORANDUM TO: Troy W. Pruett, Director Division of Nuclear Materials Safety Region IV FROM: Margaret M. Doane /RA/

Executive Director for Operations

SUBJECT:

DIFFERING PROFESSIONAL OPINION APPEAL DECISION INVOLVING A GRAND GULF INSPECTION FINDING (DPO-2017-009)

The purpose of this memorandum is to inform you of my considerations and conclusions regarding the Differing Professional Opinion (DPO) appeal you submitted on January 23, 2019.

This appeal raised concerns with the decision issued by the Regional Administrator of Region IV on December 31, 2018, regarding DPO-2017-2009. The issues you raised were evaluated using the process in Management Directive 10.159, NRC Differing Professional Opinion Program, to ensure appropriate agency action on this matter.

After careful consideration of your appeal, I have decided the original significance determination finding for the September 2016 Alternate Decay Heat Removal (ADHR) system at the Grand Gulf Nuclear Station (Grand Gulf) should be upheld. My review of your appeal also identified a new task that I will soon initiate to improve participant accountability related to timeliness and communication throughout the various stages within the DPO Program. In addition, as part of the ongoing Reactor Oversight Process (ROP) Enhancement Project, the Office of Nuclear Reactor Regulation (NRR) will be conducting an effectiveness review of the cross-cutting issues program in the ROP to gain insights on the NRCs regulatory actions in response to observed performance trends at NRC-licensed facilities, including observations that may be indicative of program weaknesses.

EXECUTIVE DIRECTOR FOR OPERATIONS REVIEW AND DECISION PROCESS In reviewing your DPO appeal and Case File DPO-2017-009, I found these documents to be well-researched and representative of your deep technical knowledge and personal investment in safety issues. As the agency strives to increase the use of risk information in decision-making, it remains important we do so in a manner consistent with the Principles of Good Regulation and the NRC Mission. In doing so, a questioning attitude will ensure that the NRC remains an effective and safety-focused regulator.

On April 1, 2019, we held a phone call so I could more fully understand your written concerns, and I used that information as part of my decision-making process. Several weeks prior to our call, I tasked Mr. Ho Nieh, Director of NRR, to review your DPO appeal, including the background documents, and to prepare an independent response for my use. Since the date of our phone call, Mr. Nieh submitted that response (NRR Response) for my consideration as I made my determination on your appeal. The NRR Response is attached as Enclosure 1. This

T. Pruett DPO appeal decision memo also benefitted from input by Dr. Christopher Cook, Executive Technical Assistant in the Office of the Executive Director for Operations.

The following sections document my decision on this appeal.

DPO Appeal Concern: Treatment of Programmatic Failures at Grand Gulf As described in your DPO appeal and discussed during our phone call, you stated that if staff had correctly assessed the issue, the final significance determination for the loss of ADHR would not be Green. You described how the DPO Panel erred when it ignored the qualitative assessment of risk from programmatic failures at Grand Gulf. Because the DPO Panel relied on only the quantitative results, it is your view that the Panel did not properly evaluate the application of evacuation credit or whether Quantitative Health Objective (QHO) standards were met.

In evaluating these concerns, I considered the Region IV Administrators Statement of Views associated with your DPO appeal. The Administrator describes how at the time of the original performance deficiency there were programmatic issues affecting licensee performance, particularly in the Grand Gulf operations department. These and other issues resulted in an extended shutdown of the facility by the licensee while the operations department underwent extensive re-training. Since the performance deficiency occurred, there has been a nearly wholesale change-out of senior and mid-level managers at Grand Gulf who (among other significant actions) have committed to, conveyed, and enforced elevated standards of their employees' performance. Further, there has been increased NRC oversight of Grand Gulf since 2016 as the station has been in the Regulatory Response Column of the ROP Action Matrix for the majority of that time.

I considered the independent views contained in the NRR Response. That response discusses NRCs evaluation of these programmatic and cross-cutting issues. Specifically, the response addresses various aspects of your appeal regarding the Significance and Enforcement Review Panel decision-making process, the NRC staffs use of Inspection Manual Chapter 0609 (IMC 0609) Appendix G1, the applicability of IMC 0609 Appendix M, and the potential use of the Action Matrix deviation process. The NRR Response also concludes that the Grand Gulf significance determination for the ADHR issue should be upheld.

Based on this information, I have found that the determination performed by the NRC staff followed the current Inspection and Enforcement manuals. The NRC staff selected and then appropriately applied IMC 0609 Appendix G; the use of IMC 0609 Appendix M was not appropriate in this case. The significance of the ADHR issue was appropriately determined using standard-practice application of risk assessment models by technically-qualified NRC risk analysists. Given this, the final determination should be upheld. Because I find that the significance determination is correct, I also find that additional staff evaluation of the issues specific to this appeal and associated with large early release frequency values and the NRC QHOs is not necessary.

Although I decided the final Grand Gulf significance determination for the ADHR issue should be maintained, I agree with the conclusion within the NRR Response that your DPO appeal highlights a known and intentional characteristic of the ROP. The ROP was designed to be an objective program that results in a predictable NRC response, commensurate to the determined 1

Reference citations for the NRC Inspection Manual Chapters are contained in the NRR Response

T. Pruett safety-significance of individual findings and performance indicators. The NRRs planned activity to conduct an effectiveness review of the cross-cutting issues program in the ROP will provide insights related to NRCs regulatory actions in response to observed performance trends at NRC-licensed facilities, including observations that may be indicative of programmatic weaknesses. The NRR Response states that insights from this DPO appeal will be considered as part of that review.

DPO Appeal Concern: Timeliness and Communication of the DPO Program Your DPO appeal documents concerns regarding timely execution of the NRCs DPO program.

The NRR Response discusses this aspect of your appeal, and it documents the communication of key milestone dates associated with processing of your DPO. In particular, I noted the time spent waiting for issuance of the DPO decision significantly exceeds the timeliness goals of the Management Directive (i.e., MD 10.159). Although I consider your case to be complex, and perhaps expect that its review could exceed the MDs timeliness goals, I agree with your appeals assessment that the review of your DPO was not timely.

Proper communication is one of my top priorities for the agency since I assumed my position as EDO. In response to your appeal, I will task the Office of Enforcement (OE), who is responsible for execution of the NRCs DPO program, to improve accountability related to timeliness and communication throughout the various stages within the DPO program. Improving accountability throughout the DPO program will enhance the agencys participative decision-making and align resources commensurate with the safety significance of an issue.

CONCLUSION I want to thank you for bringing your concerns to my attention and for using the DPO appeal process. Our agency relies on dedicated professionals, such as yourself, who are willing to raise safety-related concerns that could impact the NRC mission.

I should note that while not definitive of the issues you raise, I have given the Grand Gulf Station much attention. I visited Grand Gulf on December 7, 2018, where I toured the plant with the Senior Resident Inspector and discussed programmatic issues associated with licensee performance. During my tour, I observed the licensee taking actions to address programmatic issues at the site. I also raised these issues when I met with the licensees management team at the site. The day before the site visit, I held a pre-brief with the Division of Reactor Projects staff and management in the Region IV office to review plant performance and discuss issues I should emphasize during my site visit. Although the licensee has not solved the programmatic issues and remains in the Regulatory Response Column of the ROP Action Matrix, I am confident the Grand Gulf licensee is aware of the issues and is actively addressing them. I continue to have assurance that Grand Gulf is operated safely by the licensee, and additional regulatory measures are not necessary.

After careful consideration of your appeal, I have decided that the original significance determination finding for the September 2016 ADHR system at Grand Gulf should be upheld.

As described in this memorandum, the NRR Director is conducting an effectiveness review of the cross-cutting issues program in the ROP and will consider insights from this DPO as part of that process.

T. Pruett The decision regarding your DPO submittal was not timely. As a result, I will task the OE to improve participant accountability related to timeliness and communication throughout the various stages within the DPO program.

In accordance with MD 10.159, a summary of this appeal decision will be included in the Weekly Information Report posted on the NRCs public Web site to advise interested employees and members of the public of the outcome.

Enclosure:

Memorandum transmitting the Office of Nuclear Reactor Regulations Independent Response (DPO-2017-009)

ML19109A168 OFFICE EDO/AO EDO NAME CCook MDoane DATE 05/06/19 05/08/19

ENCLOSURE 1 Memorandum to the Executive Director for Operations transmitting the Office of Nuclear Reactor Regulations Independent Response to a Differing Professional Opinion Appeal Involving a Grand Gulf Inspection Finding (DPO-2017-009)

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 6, 2019 MEMORANDUM TO: Margaret M. Doane Executive Director for Operations FROM: Ho K. Nieh, Director /RA/

Office of Nuclear Reactor Regulation

SUBJECT:

INDEPENDENT RESPONSE REGARDING DIFFERING PROFESSIONAL OPINION APPEAL INVOLVING A GRAND GULF INSPECTION FINDING (DPO-2017-009)

The purpose of this memorandum is to provide the results of my independent review of the Differing Professional Opinion (DPO) appeal submitted on January 23, 2019. This appeal raised concerns with the decision issued by the Regional Administrator of Region IV on December 31, 2018, regarding DPO-2017-2009.

BACKGROUND On October 31, 2017, the submitter filed a DPO that identified several issues related to the Alternate Decay Heat Removal (ADHR) system at Grand Gulf as discussed in Special Inspection Report 05000416/20160085. The focus of the DPO was on the application of the Significance Determination Process (SDP), which resulted in a final significance determination of Green in this instance.

On November 29, 2017, the DPO Program Manager appointed members to serve on a DPO Ad Hoc Review Panel (DPO Panel). The DPO Panel summarized the issues raised into four assertions:

1. The agency did not follow its own guidance (i.e., the Significance and Enforcement Review Panel (SERP) process and Inspection Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria) when evaluating this finding.
2. The large early release frequency (LERF) determination for this finding was inadequate.
3. The SDP in this finding did not meet the Qualitative Safety Goal.
4. As related to this issue, the Non-Concurrence Process (NCP) was not implemented appropriately.

In addition to the DPO submittal, the DPO Panel also had the benefit of reviewing the issues that the submitter raised on the same subject within the non-concurrence process (NCP) NCP-2017-010; (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17304A014).

In December 2017, the DPO Panel met with the submitter by phone to understand his concerns and to obtain his approval on the summary of issues. The DPO Panel then performed a detailed review of the concerns and issues, reviewed the detailed risk evaluation for the issue,

M. Doane evaluated the risk tools used to conduct the evaluation, and interviewed U.S. Nuclear Regulatory Commission (NRC) staff associated with the special inspection and non-concurrence.

Regarding the submitters concern that the NCP was not implemented appropriately, the DPO Panel determined that assigning the DPO to the Region IV Administrator (who was also the decision authority on the non-concurrence) was within the guidance provided in Management Directive 10.159, NRC Differing Professional Opinion Program,Section III.I.5. However, the DPO Panel did acknowledge the submitters valid concern because the DPO and NCP officials were not independent.

Regarding the other concerns raised, the DPO Panel concluded that the Grand Gulf ADHR issue is best characterized as Green, that adequate risk tools existed to complete the SDP, the proper risk metrics were used, and the Quantitative Health Objectives (QHOs) were addressed.

The DPO Panel further concluded that the SERP process was implemented informally after one member opted for a different position. In its report dated April 23, 2018, the DPO Panel recommended the following actions:

1. Document all actions post-SERP on the Enforcement Action Tracking Sheet (EATS)

Strategy form for enforcement action (EA)-16-277.

2. Consider adding explicit guidance to the Enforcement Manual and IMC 0609 that, if a SERP member disagrees with the outcome after reviewing the EATS strategy form (provided its within a set time limit), the SERP must take action to resolve the disagreement or escalate to the RA.
3. The significance of the ADHR issue remain at Green, but that the region consider ROP actions to address some of the programmatic concerns raised in the DPO and NCP.

Examples included emphasizing programmatic issues during plant status tours and adding this issue to the next Problem Identification and Resolution team inspection.

4. Consider actions to make the SERP process more formal.
5. Consider actions to improve public confidence of the incident investigation process.
6. Consider the need to request additional clarification within IMC 0609, Appendix H; IMC 0609, Appendix G; and applicable sections of the RASP handbook.

In a memorandum dated December 31, 2018 (DPO Decision), the Region IV Administrator discussed the DPO Panels conclusions and recommendations regarding the issues raised.

The Region IV Administrator ultimately concurred with the DPO Panels conclusion that the Grand Gulf inspection finding associated with the ADHR issue is best characterized as Green, that adequate risk tools existed to complete the SDP, the proper risk metrics were used, the QHOs were addressed, and that assigning this DPO to the Region IV Administrator followed the guidance in MD 10.159. The DPO Decision discussed that appropriate Office Directors would receive a copy of the DPO Decision and should consider the recommendations for actions as deemed appropriate. Lastly, the Region IV Administrator indicated that Region IV management would evaluate the recommendations specific to Region IV and take actions as appropriate.

In an appeal submitted on January 23, 2019 (DPO appeal), the submitter raised several issues regarding the objectives of the DPO Program (DPO Appeal Concern 1):

M. Doane

  • The submitter was not kept informed of milestones or delays in milestones throughout the process.
  • The DPO deciding official was not independent.
  • The DPO review was not timely.

In addition to those concerns, the submitter raised several concerns regarding the DPO Panels review (DPO Appeal Concern 2):

  • The DPO Panel erred when they ignored the qualitative assessment of risk from programmatic failures. Therefore, the final significance determination reached by the DPO Panel is incorrect.
  • Because the DPO Panel relied only on quantitative results, the Panel did not evaluate concerns with the application of evacuation credit or concerns with not meeting the QHOs.

In a February 11, 2019, Statement of Views, the Region IV Administrator1 provided views on the DPO appeal, noting that his views are not entirely consistent with those my predecessor who has since retired from the NRC and therefore not available to comment. The Region IV Administrator provided several views, including:

1. Since the performance deficiency occurred, there has been a nearly wholesale change-out of senior and mid-level managers at the station whohave committed to, conveyed and enforced elevated standards of their employees performance.
2. There has been increased NRC oversight of Grand Gulf since 2017 as the station has been in the Regulatory Response Column of the Reactor Oversight Process (ROP)

Action Matrix.

3. The SERP should not have categorically rejected at least some qualitative assessment of the impact of programmatic issues on the quantitative detailed risk evaluation.
4. Because SERP members are not systematically trained in the complexities and nuances of the significance determination process, some SERP members ability to fully appreciate and apply the principles of risk-informed decision-making may be challenged.
5. Another independent panel review of all the facts of this case should be conducted, not to re-adjudicate the risk significance of the now 2.5 year old Grand Gulf finding, but rather to determine if the significance determination methodology as applied in this case fully adhered to the governing procedures and bases documents.
6. SERP members should, as a matter of due diligence, apply additional judgment when a quantitative risk assessment yields a result that is close to a performance threshold, given that the model result is really a statistical distribution around a mean.

RESULTS OF MY INDEPENDENT REVIEW AND RECOMMENDATIONS On February 25, 2019, you requested my assistance in your review of this DPO appeal.

Specifically, you asked me to independently review the case file and provide a written response, which you could consider in reaching your final decision. In reviewing this appeal, I considered the DPO-related documents referenced above, as well as NRC guidance and other documents related to the subject at hand, including:

1 The Region IV Administrator that provided this Statement of Views was NOT the same individual that served as the decision-maker on the DPO Decision. The DPO decision-maker retired. However, the Region IV Administrator that issued this Statement of Views did complete Section B of NCP-2017-10, since he was the submitters immediate supervisor at that time.

M. Doane

  • IMC 0609, Attachment 1, Significance and Enforcement Review Panel Process, dated January 2019 (ADAMS Accession No. ML18187A177)
  • Nuclear Regulatory Commission Enforcement Manual, dated August 2014 (ADAMS Accession No. ML102630150)
  • Risk Assessment Standardization Project (RASP) Manual, Volume 4, Shutdown Events, dated January 2013 (ADAMS Accession No. ML13030A049)

In addition, I met with the submitter by Skype on March 15, 2019, to better understand his concerns. In the course of my review, I also met by phone with the Region IV Administrator and the DPO Panel Chair.

Considering the information I obtained during my review, I recommend that it is appropriate to uphold the December 31, 2018 DPO decision made by the Region IV Administrator. The remainder of this memorandum provides my evaluation of the concerns raised and the bases for my conclusions and recommendations.

DPO Appeal Concern 1: DPO Program Objectives Were Not Met In the DPO Appeal, the submitter indicated that he was not kept informed of milestones or delays in milestones throughout the DPO process. I can imagine that a lack of updates would be frustrating given the amount of effort that the submitter invested in these issues. In my research, I learned that the Office of Enforcement (OE) is emphasizing the importance of routine, frequent updates to the submitter when tasking senior managers with DPO and DPO appeal reviews. This should help improve DPO process communications with submitters.

The submitter also described his concern that the DPO deciding official was not independent and that assigning the DPO review to an individual that issued the nonconcurrence determination was not appropriate. I reviewed MD 10.159, particularly Section II, The DPO Process, and agree with the DPO Panel that assigning this DPO to the Region IV Administrator followed the guidance. In discussing this issue with OE, OE made the determination to assign

M. Doane this DPO to the Region IV administrator because, since Region IV had the authority for the issue, assigning another individual to be the decision-maker could be interpreted as in conflict with MD 10.159. Also, OE explored this nuance during its recent Differing View Program Improvement Project, and ultimately determined that the ability to appeal a DPO decision to the EDO remained the preferred way of addressing concerns such as this one.

Lastly, the submitter indicated that the DPO review was not timely and that the completion of tasks was not commensurate with the safety significance of the concerns brought forward.

Management Directive 10.159 provides a timeliness goal for the disposition of a DPO: 120 days from the day a DPO is submitted until the day the DPO Decision is issued. For DPO-2017-009:

  • The submitter filed the DPO on October 31, 2017.
  • The DPO was accepted on November 7, 2017.
  • The DPO Panel was formed on November 29, 2017.
  • The DPO Panel issued its report on April 23, 2018.
  • The Region IV Administrator issued his DPO Decision on December 31, 2018.

I note that this 14 month timeline significantly exceeds the 120 day timeliness goal within MD 10.159. However, I also note that MD 10.159,Section I.F.5, states: Because the scope and complexity of DPOs can vary widely, the timeliness expectations for dispositioning DPOs and DPO appeals are expressed as goals. It is important to ensure that issues receive a thorough and credible review. Schedules should factor in a number of circumstances, including the importance of prompt action on the issue, the safety significance of the issue, the complexity of the issue, and the priority of other work activities affecting the availability of DPO participants.

In its review, the DPO Panel reviewed all relevant documentation to determine whether processes (e.g., NCP, SERP, SDP) were followed and accurate results were obtained. In addition, the DPO Panel reviewed the DRE and the large early release frequency (LERF) calculations and interviewed staff that were involved in the analyses of all issues. This independent review, while critical to dispositioning the DPO, did require a significant amount of time (approximately 5 months) and resources to complete due the technical nature of a DRE. I recommend that the Office of Enforcement interview the DPO Panel chair to identify any relevant insights that may help improve the overall timeliness for highly technical DPOs, such as in this case.

Since the DPO decision-maker has retired from the NRC, I was unable to receive his perspectives on the 10-month exceedance of the 120-day goal. That said, 10-months seems like an excessive delay absent any convincing details otherwise. I am sympathetic to the submitters concerns, and believe that OEs recent efforts to keep DPO submitters apprised of any scheduling delays would have at least kept the submitter informed of the status of the DPO in between key milestones.

DPO Appeal Concern 2:

In his DPO Appeal, the submitter noted that, if assessed correctly, the final significance determination for the ADHR issue should be White or Yellow (not Green). He described that he did not have concerns with how the initial risk analysts or the DPO Panel derived the quantitative results, but that he believed the DPO Panel erred when it ignored the qualitative assessment of risk from programmatic failures. It the submitters view that, because the DPO

M. Doane Panel relied on just the quantitative results, the Panel did not evaluate concerns with the application of evacuation credit or not meeting the QHO standards.

Conclusion Regarding Whether to Re-Assess the Significance of the ADHR Issue I recommend that the NRC should not expend additional resources to re-assess that determination. This recommendation is consistent with the Region IV Administrators Statement of Views, which stated:

The original licensee performance deficiency at issue dates back to September 2016, nearly 2 1/2 years ago. As such, I do not recommend any re-assessment of the significance of this issue (to the extent you decide to direct one be conducted), be included as a performance input for the Grand Gulf licensee. The original GREEN finding should stand.

The Statement of Views also listed several actions that Grand Gulf took to address programmatic issues affecting performance (e.g., extensive re-training, change-out of senior and mid-level managers at the station). I note that, based on my discussions with the submitter, his view is that the Grand Gulf licensee has taken similar actions in the past and that he does not consider these actions to have been effective. Based on my discussions with the Region IV Administrator and the results of the 2018 ROP End-of-Cycle discussion for Grand Gulf, I consider that the current level of NRC oversight (ROP Action Matrix Column 2) at Grand Gulf is appropriate. I am confident in RIVs implementation of the ROP and regulatory judgment for Grand Gulf.

SERP Decision-making Inspection Manual Chapter 0609 and its Attachment 1, as well as the Enforcement Manual, provide the process for conducting the Significance and Enforcement Review Panel (SERP).

SERPs are used for any finding with a pending significance of White, Yellow, Red, or greater than Green. The purpose of the SERP is to discuss, review, and arrive at a consensus decision regarding the significance determination of the inspection finding and the appropriate enforcement actions to be taken. If consensus is reached, then the preliminary determination is also reached. If the SERP concludes that the preliminary significance determination of the finding is Green, the SERPs conclusion represents a final determination and is characterized as such in the inspection report.

I reviewed the SERP decision-making process for the Grand Gulf ADHR issue, as described in the nonconcurrence and in the DPO Panel report. In October 2016, the NRC began a special inspection on the ADHR issue at Grand Gulf; the special inspection concluded in November 2016. Inspection finding review board (IFRB) meetings were conducted between December 2016 - February 2017. While the IFRB process was in a pilot phase at that time, the purpose of the IFRB, as described in IMC 0609, is to ensure alignment on the performance deficiency, the inspection finding, any proposed violation(s), and the actions and timeframes to determine the preliminary significance. The IFRB is a part of the overall Inspection Finding Resolution Management (IFRM) process, which has a goal of improving management oversight, resource planning, and communication of potentially greater than Green inspection findings.

An initial SERP was conducted on February 16, 2017; the SERP reached consensus that a White finding should be issued. On February 23, 2017, prompted by probabilistic risk assessment (PRA) calculations provided by the licensee, NRR staff began to re-evaluate the

M. Doane significance. A subsequent SERP, on which the submitter served, was conducted on April 13, 2017. The panel members reassessed the significance to Green. On April 21, 2017, the submitter raised his concern to the panel members that the finding should be White. A Regional Enforcement Panel was conducted on April 26, 2017, and the Green determination was upheld.

The special inspection team exited on May 31, 2017.

On July 14, 2017, the submitter provided an options paper to NRR and the Region IV Administrator. The options paper, which was included as part of the submitters non-concurrence, described three options:

1. Maintain the Green finding and determine whether additional SDP tools are needed to evaluate performance deficiencies.
2. Use IMC 0609, Appendix M, to further evaluate the significance of the performance deficiency.
3. Use an Action Matrix deviation, which would treat the performance deficiency as a White input for the purposes of assigning appropriate regulatory actions. The submitter included his view that the use of a deviation for a Green performance may not be consistent with IMC 0305.

The submitters preferred option was Option 2 (evaluate the significance using Appendix M).

Two divisions in NRR, the Division of Inspection and Regional Support and the Division of Risk Assessment, provided their views by e-mail that the Green significance should be upheld.

On August 4, 2017, the submitter provided a nonconcurrence on this issue, which stated that the final significance does not reflect the actual performance of the facility and programmatic breakdown in the operations department at Grand Gulf. The submitters immediate supervisor, the deputy Region IV Administrator, recommended that the issue be remanded back to the SERP for an Appendix M review. On October 27, 2017, the Region IV Administrator (who was the decision authority for the non-concurrence) determined that the risk associated with the finding was appropriately characterized as Green. The inspection report was issued on October 27, 2017. The submitter filed a DPO on October 31, 2017.

The NRC spent a full year in a somewhat convoluted decision-making process for this issue. In my view, this was not consistent with the NRCs Principles of Good Regulation, particularly the principles of Efficiency and Reliability. As I reviewed the guidance documents, I found that the SERP process has continued to evolve since the time of this issue, consistent with the recommendations of the DPO panel to improve the process. As applied to this case, the revised guidance would have prescribed that a follow-on SERP to be conducted within 2 weeks when alignment was not obtained, with particular focus on the areas of disagreement. Each voting member would have provided a one-page document summarizing their position. If that SERP did not reach consensus, an office-level SERP would have been held. Guidance now states that, if the second SERP does not reach consensus, a SERP at the office director level will be held, and if consensus is still not reached, then the issue is raised to the Deputy Executive Director for resolution. This new process significantly advances notification of the Deputy Executive Director when SERP alignment is not obtained. It is my view that these process revisions will enhance the SERP decision-making process, consistent with the NRC Principles of Good Regulation.

M. Doane Applicability of Appendix M and Action Matrix Deviations The nonconcurrence advocated for the use of IMC 0609, Appendix M, to account for programmatic failures in the SDP for this issue. In the DPO, the submitter stated that application of Appendix M is appropriate when SDP tools are not applicable or involves extensive study or analysis that cannot be completed within established SDP timeliness goals.

When assessing a finding with Appendix M, the intent is not to develop new models, perform experiments, or seek in-depth expert elicitation. Findings should be assessed using engineering judgment relying upon in-house engineering knowledge and expertise and regulatory oversight experience.Had Appendix M been utilized, several attributes which relate directly to the significance of the finding would have warranted an increase in the SDP determination.

The DPO Panel reviewed this concern, and concluded that the use of Appendix M would not be appropriate for the finding. Applying IMC 0609 Appendix G (SDP for shutdown operations) would lead the staff to perform a Phase 1 screening and a Phase 2 review prior to performing the DRE.2 The DPO Panel noted that Phase 2 reviews are often very conservative. (See IMC 0609 Appendix G, Figure 1, Roadmap for Shutdown Findings for steps prescribed by Appendix G.)

The Region IV Administrator, in his Statement of Views, provided the following with respect to Appendix M: I would offer that some degree of judgment is always a factor when applying the significance determination process, irrespective of whether or not IMC 0609 Appendix M is employed. I believe that the risk model input assumptions and other modeling uncertainties should be explicitly identified, evaluated, and dispositioned in an auditable manner. SERP members should, as a matter of due diligence, apply additional judgement when a quantitative risk assessment (i.e., [probabilistic risk assessment] model) yields a result that is close to a performance threshold.

In my review, I noted that IMC 0609, Appendix M was recently revised by the staff (January 2019). This new version includes clarified Appendix M entry criteria, which are now stated upfront:

o As specifically directed by other IMC 0609 appendices, or o When the cognizant NRC staff determine that no other SDP appendix is compatible for use with the specific circumstances associated with the inspection finding and the degraded condition (e.g., readily-available information is insufficient to support a reliable and efficient evaluation), subject to confirmation by a planning SERP.

These criteria complement existing text that Appendix M should not be used by decision makers when the results of another SDP appendix do not appear to be appropriate (i.e., the significance is perceived as too high or too low). In these cases, the appropriate SDP appendix should be used and a deviation from the ROP Action Matrix should be pursued in accordance with IMC 0305.

2 Phase 1 is used to characterize the important attributes of the inspection finding and to initially screen the finding to identify those with very low significance (Green) or greater than very low safety significance.

Phase 2 is used to approximate the risk significance of the finding and develop the basis for the determination for those findings that are not screened out in Phase 1.

M. Doane From my review, I agree with the DPO panel that Appendix M was not appropriate in this instance. I also do not consider the circumstances of this case to be indicative of a problem with the SDP and Appendix M. When appropriate, the staff has used Appendix M effectively in the past. As such, I do not recommend any action related to the use of Appendix M.

The nonconcurrence included an option, which was not recommended, to pursue an Action Matrix deviation. The Action Matrix deviation process, as described in IMC 0305, can be used in rare instances when regulatory actions dictated by the Action Matrix may not be appropriate.

As described in IMC 0305, in these instances, the NRC may deviate from the Action Matrix to either increase or decrease NRC action. An Action Matrix deviation may be considered for a situation such as a type of finding unanticipated by the SDP that results in an inappropriate level of regulatory attention when entered into the Action Matrix. The process for pursuing an Action Matrix deviation is:

  • The applicable regional office develops a draft memorandum requesting an Action Matrix deviation. The Regional Administrator sends the memo to the Director of the NRR for concurrence. NRR then forwards the memorandum to the Executive Director for Operations.
  • The EDO is the approving authority for all Action Matrix deviations, and informs the Commission when he/she approves deviations. The deviations are then briefed at the annual Agency Action Review Meeting Commission meeting.
  • The staff communicates Action Matrix deviations to the licensee in an assessment follow-up letter or an annual assessment letter.

A summary of historical Action Matrix deviations is provided on the NRCs public Web site (see https://www.nrc.gov/reactors/operating/oversight/deviations.html). In the noncocurrence, the submitter noted that the use of a deviation for a Green performance deficiency may not be consistent with the language provided in IMC 0305. However, IMC 0305 does not explicitly place such limitations on the use of the process.

Based on a review of the historical use of the deviation process, it is evident that deviations have been used in cases where additional oversight was determined to be necessary to address longstanding issues at NRC-licensed facilities. I believe that a deviation could have been considered by the RIV Administrator if additional regulatory oversight was deemed appropriate. I consider the Action Matrix deviation process to be sound and do not recommend any action in this area at this time.

Treatment of Programmatic Issues in the ROP In talking with the submitter and reading his nonconcurrence, DPO, and DPO Appeal on this issue, it is clear that his driving concern is that the final significance of the ADHR issue did not reflect the actual human performance of Grand Gulf at that time. He believes that the SERP and DPO Panel erred when they ignored the qualitative assessment of risk from programmatic failures.

IMC 0308, Attachment 3, states that:

A risk-informed approach should consider other (unspecified) factors. Historically, such other factors included those listed in Regulatory Guide 1.174 such as maintaining defense-in-depth, compliance with regulations, engineering safety margins, and prevention of over-reliance on human operators for rapid decisions. However, it might

M. Doane be argued that these factors are all already represented, in various ways, in probabilistic risk models. Other factors such as NRC management assessment of the general quality of licensee programs, had historically involved significant subjectivity into reactor oversight decision-making. Given the ROP objective to improve objectivity, the risk-informed approach used with the ROP fundamentally views the use of a probabilistic framework as a decision-framework which may lend greater discipline and objectivity to the ROP decision process and less reliance on subjectivity.

By design, the ROP treats each inspection finding as an isolated issue and does not consider site-specific performance in human error probabilities. Identifying thresholds for when site-specific performance would trigger a unique human error probability would be very challenging.

Instead, human error probabilities are scenario-based. That said, I do note that the initial senior risk analysts that developed the DRE, as well as the senior risk analysts on the DPO Panel that independently confirmed the results of the DRE, did apply additional conservatisms to human error probabilities for the circumstances at Grand Gulf. Examples include failure to establish shutdown cooling or suppression pool cooling and failure to establish low pressure or high pressure injection. This practice is consistent with existing SDP guidance. Therefore, I do not recommend any specific changes to the SDP at this time.

The Region IV Administrators Statement of Views highlights steps that Grand Gulf was taking in parallel with the timing of the SERP decision-making:

  • It is clear that at the time of the original performance deficiency there were programmatic issues affecting licensee performance, particularly in the Grand Gulf operations department. These and other issues resulted in an extended shutdown of the facility while the operations department underwent extensive re-training. Licensee management oversight of plant operations was also clearly culpable in this weak performance.
  • Since the performance deficiency occurred, there has been a nearly wholesale change-out of senior and mid-level managers at the station who (among other significant actions) have committed to, conveyed and enforced elevated standards of their employees performance.

These actions taken by the licensee, particularly an extended shutdown for the primary purpose of re-training, are by no means standard measures and are indicative of the programmatic issues that the submitter suggested were not factored into the SDP. However, I am aware that Region IV also increased its inspection activity at Grand Gulf and, over the past five years, has conducted maximum samples of various inspection procedures each year. This increased NRC oversight activity using sample size flexibility in the ROP was appropriate and supports my recommendation that the significance determination should be upheld.

CONCLUSION Based on my independent review, I concluded that the significance determination of the 2016 ADHR issue at Grand Gulf was appropriately characterized using the guidance in the SDP and recommend that the significance determination should remain at Green. Notwithstanding, this DPO appeal highlights a known and intentional characteristic of the ROP. Specifically, the ROP was designed to be an objective program that results in a predictable NRC response, commensurate to the determined safety-significance of individual findings and performance indicators. While patterns of multiple lower safety significant findings may lead one to conclude that programmatic breakdowns may exist, it would be challenging to establish thresholds and

M. Doane measures to assist the staff in identifying when a programmatic problem exists that would signal a declining performance trend. Consistent with Commission direction, and as described in IMC 0308, the ROP does not analyze the risk significance of numerous problems of lower safety significance in the aggregate.

Over 20 years ago, the NRC took a significant and deliberate action to eliminate the Systematic Assessment of Licensee Performance (SALP) process and its associated watch list due to the embedded subjectivity of that process. I consider the ROP to be a superior oversight and assessment program to SALP and recommend extreme caution to guard against forgetting the lessons learned by the NRC at the end of the twentieth century. Staff studies from that time highlighted that cross-cutting issues generally manifest themselves as root causes of performance problems, which in turn, can be identified through safety significant performance indicators and findings. Without additional evaluation, I cannot conclude based on the insights from this DPO that there is a gap in the current ROP that needs to be immediately addressed.

NRR is currently engaging on an ROP enhancement initiative, which aims to further enhance the effectiveness and efficiency of the ROP. NRR will be conducting an effectiveness review of the cross-cutting issues program in the ROP to gain insights on the NRCs regulatory actions in response to observed performance trends at NRC-licensed facilities, including observations that may be indicative of programmatic weaknesses. As part of that review, NRR will consider insights from this DPO appeal.

ML19109A168 *via e-mail OFFICE NRR/DIRS* NRR NAME TInverso HNieh DATE 04/22/19 05/06/19