ML23214A343

IMC 0612 Appendix E, Examples of Minor Issues

ML23214A343
Person / Time
Issue date:	10/26/2023
From:	Cauffman C, Kim Lawson-Jenkins NRC/NRR/DRO/IRAB, NRC/NSIR/DPCP/CSB
To:
References
CN 23-031
Download: ML23214A343 (1)

Text

NRC INSPECTION MANUAL IRAB

INSPECTION MANUAL CHAPTER 0612 APPENDIX E

EXAMPLES OF MINOR ISSUES

Effective Date: 11/01/2023

This guidance applies to thresholds for the minor and more-than-minor (MTM) determination in Inspection Manual Chapter (IMC) 0612.

Minor findings and violations are below the significance of that associated with G reen SDP findings and are not the subject of formal enforcement action or normal documentation. Failures to implement requirements that have insignificant safety or regulatory impact or findings that have no more than minimal risk should normally be categorized as minor. While licensees must correct minor violations, minor violations or other minor findings do not normally warrant documentation in inspection reports and do not warrant enforcement action.

NRC IMC 0612 Appendix B, Issue Screening,provides guidance for determining if a finding should be documented and whether the finding can be analyzed using an SDP. When determining whether identified issues can be considered MTM, inspectors shall compare the issue to the examples and guidance in this appendix. Inspector should understand that equipment inoperability is not a pre-requisite for the PD to be MTM.

The purpose of the following examples is not to create a completely mechanistic determination process but is to provide direction that would allow the agency as a whole to screen performance deficiencies in a reasonably consistent manner. T here may be instances where a performance deficiency is judged more than minor notwithstanding the example guidance due to impacts or circumstances not listed in the examples. When applicable, the finding documentation should describe the impact. It should be noted the performance deficiencies are written in this guidance are at a generic level and do not include the actual regulatory requirement or self-imposed standard. When writing PDs, please follow the guidance in IMC 0611.

1. Record Keeping Issues.........................................................................................................2

2. Licensee Administrative Requirement/Limit Issues..............................................................3

3. Dimensional, Time, Calculation, or Drawing Discrepancies.................................................7

4. Procedural Errors................................................................................................................ 18

5. Work in Progress Findings.................................................................................................. 25

6. Health Physics.................................................................................................................... 27

7. Part 37 - Physical Protection of Cat 1/Cat 2 Quantities of Radioactive Material................ 36

8. Maintenance Rule............................................................................................................... 39

9. Thermal Power Limits......................................................................................................... 42

10. Worker Fatigue................................................................................................................... 44

11. Cybers ecurity...................................................................................................................... 45

12. External Events................................................................................................................... 50

13. Service life.......................................................................................................................... 52

14. Security............................................................................................................................... 55 : Revision History for IMC 0612 Appendix E.................................................... Att1-1

Issue Date: 10/26/23 1 0612 App E

1. Record Keeping Issues

Example 1.a Post-maintenance testing was performed on ten glycol air handling units during an outage of a Westinghouse ice condenser facility.All the required tests were performed, based on statements from licensee workers, but there was no record that an actual air flow test was conducted on two of the units.

The performance The licensee failed to document and evaluate test results in accordance deficiency (PD): with regulatory requirements or self -imposed standards.

Minor if: Even though the record keeping issue is associated with the mitigating systems cornerstone attributes of equipment performance and procedure quality it did not adversely affect the associated cornerstone objective.

Specifically, there was reasonable assurance of operability that test requirements were met as evidenced by actual air flow being satisfactory and technical specification temperatures being within limits, or the licensee subsequently performed the required testing with no issues.

Based on indication in the control room, both air handling units had comparable air flow to those that had documented test results, and the ice condenser technical specification required air temperatures were all well-within specification.

MTMif: The PD adversely affected the mitigating systems cornerstone attributes of equipment performance and procedure quality and adversely impacted the cornerstone objective. Specifically, during subsequent testing the air flow was reduced such that reasonable assurance of operability was called into question, or a significant number of records associated with the air handling units was missing such that reasonable assurance of operability was called into question.

Example 1.b The licensees surveillance test records were not complete for a safety-related pump because the operators skipped a page of the surveillance procedure and failed to record one section of the test.

The PD: The licensee failed to follow the surveillance procedure as written which is contrary to a regulatory requirement or self-imposed standard.

Minor if: Even though the failure to complete all sections of the surveillance test procedure is associated with the mitigating systems cornerstone attribute of human performance it did not adversely affect the associated cornerstone objective. Specifically, the portion of the test documented, the last completed surveillance test, and the licensees justification to wait to perform the surveillance test revealed that the equipment performed its safety function (or the licensee performed the completed surveillance test satisfactorily once the issue was identified).

Issue Date: 10/26/23 2 0612 App E MTMif: The PD adversely affected the mitigating systems cornerstone attribute of human performance and adversely impacted the cornerstone objective.

Specifically, the subsequent surveillance test showed that the equipment would not perform some safety-related function, or the licensee was unable to provide adequate justification to wait to perform the surveillance test, or some test acceptance criteria was not met.

Example 1.c The inspector noted that the licensee did not establish and maintain MOV program documents such that they adequately described how the design-basis capability of the MOVs was developed. Specifically, MOV program documents and procedures were out-of-date, or contained contradictory or conflicting information, regarding how load sensitive behavior was applied, how lubricant degradation margin was determined, or how test data was extrapolated.

The PD: The licensee failed to establish and maintain MOV program documents which is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did adversely affect the mitigating systems cornerstone attributes of procedure quality but did not adversely impact the cornerstone objective. Specifically, the incorrect information did not involve methodology errors or incorrect assumptions. The issue centers on administrative vulnerability but had not impacted the site.

MTM if: The PD adversely affected the mitigating systems cornerstone attributes of procedure quality and adversely impacted the cornerstone objective.

Updating MOV program documents and procedures adversely impacted design margins of effected MOVs and resulted in reasonable doubt with respect to the availability, reliability, or capability of an MOV.

Note: Since the inspector identified an impact on equipment resulting from the outdated procedures, the inspector is encouraged to focus the PD on the equipment issues (see sections 3 and 4 of this document for examples which address calculational errors/design inconsistencies or procedure issues) and consider using the outdated procedures as the cross-cutting aspect.

2. Licensee Administrative Requirement/Limit Issues

Example 2.a While performing a review of a completed surveillance test, the system engineer determines that operators performing the test had recorded information incorrectly when determining the leak rate of a power operated relief valve' s nitrogen accumulators. When corrected, the actual check valve leakage exceeded the surveillance leakage rate' s acceptance criterion in the surveillance procedures. The surveillance had been completed a week earlier and the system had been returned to service.

Issue Date: 10/26/23 3 0612 App E The PD: The licensee failed to correctly determine the check valve leakage rates were within the surveillance test acceptance criterion prior to returning the system to service. This failure is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the error was identified prior to required actions specified in the procedure. For example, not meeting the acceptance criterion required additional monthly testing - the error was caught before missing the additional testing.

MTMif: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the as-left leakage was such that the licensee had to initiate actions as required by the procedure and the time period specified had been exceeded. For example, the as-left leakage resulted in increased testing frequency to weekly, but the issue was identified after a month.

Example 2.b During a refueling outage, the licensee tested a charging pump at full flow conditions as required every 18 months. Vibration data taken during this test indicated vibration of 0.324 inches per second (ips), which exceeded the test procedure administrative limit of 0.320 ips. The procedure required the surveillance frequency to be increased to every nine months after exceeding the administrative limit. The licensee failed to identify that the test result exceeded the administrative limit, so the test frequency was not increased. Subsequent vibration testing revealed no further vibration degradation. The acceptance criterion for vibration measurements is 0.325 ips.

The PD: The licensee failed to perform an in-service test in accordance with the prescribed procedure, contrary to regulatory requirements or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective. Specifically, the limit was an optional licensee administrative limit. Alternatively, the problem was identified less than 9 months after exceeding the administrative limit and the pump was subsequently tested at the required frequency.

MTMif: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the problem was identified greater than nine months later and testing to ensure continued reliability of the degrading pump was not performed at the required frequency.

Issue Date: 10/26/23 4 0612 App E Example 2.c The licensee missed an hourly update of a state agency during a declared Unusual Event because of an oversight by the Shift Manager.

The PD: The licensee failed to perform an hourly update of state agencies during declared emergencies which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the emergency preparedness cornerstone objective. Specifically, there was no impact on public health and safety, and it did not affect the state agencys ability to function during the emergency.

MTMif: The PD was associated with the ERO performance attribute of the emergency preparedness cornerstone and adversely affected the cornerstone objective to ensure that the licensee is capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency. Specifically, there was a failure in the communication functions committed to in the emergency plan which affected the state agencys ability to respond to the emergency.

Example 2.d During an inspection of silicon foam penetration seals, an inspector noted that foam extrusion (3/8 inch) from repaired seals was less than the amount specified in the seal repair procedure ( 1/2 inch). However, the silicon foam vendor' s instructions permit extrusions as little as 1/41/4 inch.

The PD: The licensee failed to perform the seal repair in accordance with the licensees procedure which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the seal was still functional, and the flood or fire barriers functionality was not affected. Specifically, the silicon foam vendor' s instructions permit extrusions as little as 1/41/4 inch.

MTMif: The PD was associated with the protection against external factors (i.e.,

fire) attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, both the licensee and vendor procedure requirements were not met, and the as left condition would have impacted the ability of the seal to perform its function which affected the flood or fire barriers functionality.

Issue Date: 10/26/23 5 0612 App E Example 2.e The licensee' s procedure required that heat tracing be energized in the diesel fire pump room from September 30 to April 30. In December, an inspector observed that the heat tracing was de-energized. The room temperature was 68 degrees, maintained by the steam boiler (50 degrees was the minimum temperature for operations).

The PD: The licensee did not maintain heat tracing energized as required by a licensee procedure. This is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the temperature had not dropped below the minimum temperature for operations. Specifically, although heat trace was not energized, room temperature was not less than 50 degrees during the exposure period.

MTMif: The PD was associated with the protection against external factors (i.e.,

weather) attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the room temperature fell below the minimum temperature of 50 degrees and stayed below 50 degrees for enough time where it would have resulted in a measurable reduction in the equipments ability to function when called upon.

Example 2.f An operating procedure requires the shift supervisor to advise the station manager prior to making any mode changes. A mode change is made without this notification due to an oversight by the shift supervisor.

The PD: The shift supervisor did not advise the station manager prior to making a mode change as required by the licensees operating procedure, contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective as this notification was purely administrative in nature and had no impact on safety equipment and no safety consequences.

MTMif: The PD was not purely administrative in nature and adversely affected the mitigating systems cornerstone objective by impacting safety equipment. If the inspector identifies an issue of concern beyond this missed notification, the inspector should consider pursuing a different PD.

Issue Date: 10/26/23 6 0612 App E

3. Dimensional, Time, Calculation, or Drawing Discrepancies

Example 3.a A temporary modification was installed on one of two redundant component cooling water system surge tanks to restore seismic qualification. The calculations were found to contain technical errors, such as incorrect assumptions regarding length of piping.

The PD: The licensee failed to ensure the calculation supporting a temporary modification accurately reflected the design which is contrary to a standard or regulation.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The errors were non-significant or non-consequential. Seismic qualification was not in question since the error in length was small and the available margin easily compensated for the error. (i.e., the conditions described in the MTM description below were not applicable.)

MTM if: The PD adversely affected the mitigating systems cornerstone objectives.

Specifically, regardless of the conclusion of the operability or functionality determination, the calculation errors resulted in reasonable doubt about the equipments seismic qualifications, which reduced assurance in the equipments availability and reliability and required the licensee to revise the calculation (see below) or revise or rework the modification to resolve the seismic concerns.

For example, if the calculation was revised there would be reasonable doubt if, the licensee: (a) used a different calculation/approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin fe ll outside the licensees design process acceptance criteria.

Example 3.b A controlled design drawing shows a plug valve where a ball valve is actually installed. The service water valve design was changed to a ball valve to support FLEX to a ball valve, but the licensee failed to update the drawing.

The PD: The licensees failure to ensure the design of service water system was correctly translated into drawings which is contrary to regulatory requirements or a self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems

Issue Date: 10/26/23 7 0612 App E that respond to initiating events to prevent undesirable consequences.

The correct valve type (ball) was installed, and the error only involves the drawing and did not have an adverse impact on other structures, systems, and components (SSCs).

MTM if: The PD adversely affected the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, this drawing was used to support another modification or calculation such that the assumption (char acteristics) of a plug valve were carried through to other applications.

Note: If the drawing was correct (that is, a plug valve should have been installed), the PD should address the incorrect installation - not that the drawing had an error.

Example 3.c A licensee procedure required that all valves specified on a locked valve list be indicated as locked on the plant drawings. The inspectors identified safety-related valves on the locked valve list that were not indicated as locked on the plant drawings.

The PD: Activities were not performed in accordance with procedures.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

This is a non-significant drawing discrepancy and this oversight (valves not indicated as locked on the drawing) only involved the drawing and did not adversely affectthe mitigating systems cornerstone objective by adversely impacting other SSCs.

MTM if: The PD adversely affected the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems.

Specifically, this drawing was used to support another modification, calculation, or procedure, and in those applications, the failure to indicate a locked requirement impacted the reliability of the valve. For example, during an emergency, this valve may need to be open. Since the drawing does not indicate the valve is locked, additional time may be needed to open the valve (obtain a key). In other words, the assumption (characteristics) of an unlocked valve was carried through to other applications.

Example 3.d Technical specifications require that a primary sample to be taken and analyzed within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of a power change in excess of 20 percent. A chemistry sample was taken and analyzed within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 35 minutes after a recent power increase from 60 to 85 percent.

Issue Date: 10/26/23 8 0612 App E The PD: The licensee failed to take and analyze a primary sample as required by TS.

Minor if: This is a failure to implement a requirement that has no safety impact; therefore, did not adversely impact the barrier integrity cornerstone objectives. The delayed sample did not impact the validity of the sample when taken. The licensees analysis accounted for the delay and results remained in specification.

MTM if: The PD impacted the barrier i ntegrity cornerstone objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events.Specifically,

the sample was delayed to the extent that the sample results were not reliable. The licensees analysis could not account for the delay.

Example 3.e During construction of a safety-related concrete wall, an imbedded structural insert is cocked at an angle of 6 degrees. The specification required plus-or-minus 3 degrees. The worker who placed the insert failed to use a level as required.

The PD: The licensee failed to install a structural insert in accordance with licensee procedures.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The misoriented insert had no safety impact. The licensee determined (without other action) that the insert could be abandoned in place or that the as-found condition of the insert is acceptable(i.e., the conditions described in the MTM description below were not applicable.)

MTM if: The PD adversely affected the mitigating systems cornerstone objective.

Specifically, a safety-related attachment had been made to an out-of-specification insert and placed in service and:

1. T he resulting condition was unacceptable, and the licensee had to perform a modification or maintenance to compensate for the mis -

aligned insert,

-or-

2. R egardless of the final operability or functionality, the as -found condition resulted in reasonable doubt about the equipments seismic qualifications, which reduced assurance in the equipments availability and reliability and required the licensee to revise the calculation (see below) or revise or rework the modification to resolve the seismic concerns.

For example, there would be reasonable doubt if when revising the calculation, the licensee (a) used a different calculation/approach

Issue Date: 10/26/23 9 0612 App E because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin fe ll outside the licensees design process acceptance criteria.

Example 3.f The licensee's flood wall is required to be 12 feet tall. The NRC discovers that, in one section, the wall is only 11 feet, 10.5 inches tall.

The PD: The licensee failed to maintain the flood wall as described in the UFSAR (or Physical Security Plan), which states that the height is required to be 12 feet tall.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The height discrepancy is insignificant. The as-found height, though less than specified, still meets its function of avoiding spill over or meets security needs. (Note: In making this determination, the conditions described in the MTM if section below are not applicable.)

MTM if: The PD adversely affected the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. For example, in order to justify the as -found condition, the licensee (a) use d a different calculation/approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification ); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin fe ll outside the licensees design process acceptance criteria.

Example 3.g The final safety analysis report (FSAR) states the volume of the refueling water storage tank is 250,000 gallons. The actual volume is 248,000 gallons.

The PD: The facility was not consistent with the FSAR which is contrary to a required regulation or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

This is a non -significant dimensional discrepancy. Assuming the accident analysis calculations used a smaller volume, the as -found volume meets its function.

Issue Date: 10/26/23 10 0612 App E MTM if: 1) The PD adversely affected the mitigating systems cornerstone objective. Specifically, regardless of the conclusion of the operability or functionality determination, the as -found condition resulted in reasonable doubt with respect to the availability, reliability, or capability of systems reliant on this volume. For example:

• The accident analysis assumed a value higher than the as -found and the actual volume required the licensee to re-perform accident analysis calculations to assure the accident analysis requirements were met.

-or-

• The accident analysis assumed a value below the as -found; however, calculations supporting other SSCs or functions requires a higher value; thus, requiring the licensee to re-perform calculations to demonstrate operability or functionality.

In these cases, when the calculation is revised to restore operability, there would be reasonable doubt if the licensee: (a) revised assumptions solely to obtain favorable results; or (b) revised other calculations in order to establish operability or functionality; or (c) determined the remaining margin fe ll outside the licensees design process acceptance criteria; or (d) used a different calculation/approach because the original approach resulted in unfavorable margin, meaning that had the correct values been used originally, the licensees design process would not have accepted the modification.

-or-

(2) The PD if left uncorrected, would have the potential to lead to a more significant safety concern. Although the as-found volume was above that assumed in the accident analysis, the licensee did not have procedural controls to maintain the level above that required in the accident analysis and absent NRC intervention the licensee may not have maintained the capability of the RWST to mitigate a large break loss of coolant accident.

Example 3.h The licensee used a non-conservative value for condensate storage tank temperature as an input to an accident analysis calculation. The value used was 118 degrees Fahrenheit where the actual value can be as high as 120 degrees Fahrenheit. As a result of this error, there was a slight reduction in the net positive suction head (NPSH) available to the safety injection pumps under accident conditions.

The PD: The licensee failed to ensure design requirements were correctly translated into calculations in accordance with regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems

Issue Date: 10/26/23 11 0612 App E that respond to initiating events to prevent undesirable consequences.

The reduction in available NPSH was only a few percent of the available margin and there was no reasonable doubt of operability or functionality.

(i.e., the conditions described in the MTM description below were not applicable.)

MTM if: (1) The PD adversely affected the mitigating systems cornerstone objective. Specifically, regardless of the final operability or functionality, the as-found condition was such that there was reasonable doubt with respect to the capability of systems that take suction from this tank.

For example, in evaluating the as -found condition, there would be reasonable doubt with respect to the capability of systems if the licensee:

(a) used a different calculation/approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin fe ll outside the licensees design process acceptance criteria.

-or-

(2) The PD if left uncorrected, would have the potential to lead to a more significant safety concern. To use this question, the inspector would need to assess whether there is a declining trend in pump performance such that adequate NPSH would not be maintained prior to an action level to address pump performance. In other words, if left uncorrected, the pump would reach a condition such that it may not be able to maintain adequate NPSH to support accident mitigation before the licensee identified the issue.

Example 3.i In the procedure for safe shutdown of the plant from the alternate control panel, the licensee annotated that the operators could complete a time critical task within 10 minutes. It is later determined that the validation tests showed that completing the required tasks could take as long as eleven minutes.

The PD: The licensee failed to ensure procedures met design requirements.

Minor if: The PD did not adversely affect the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. This was a non-significant error. The licensees accident analysis assumed the actions were completed in 15 minutes.

MTMif: The PD adversely affected the mitigating systems cornerstone objective.

Specifically, regardless of the results of the final operability or functionality determination, the discrepancy for the time-critical action resulted in a

Issue Date: 10/26/23 12 0612 App E condition where there was a reasonable doubt of operability or functionality of a system or component.

For example, in evaluating the as -found condition, there would have been reasonable doubt with respect to the capability of system or component if:

10 minutes was assumed in the accident analyses and the licensee was unable to justify using 11 minutes or greater.

-or-

The licensee was able to justify the additional time, but, in evaluating the as-found condition, the licensee: (a) used a different calculation/approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin fell outside the licensees design process acceptance criteria.

Example 3.k A previously identified body-to-bonnet leak on an RHR valve was increasing in leak rate. A check valve, downstream of the valve, separated the cool, low pressure RHR system from the high temperature, high pressure feedwater system. The check valve also had a known leakage and was being monitored. In their operability determination, the licensee addressed the potential impact of leakage outside of containment and monitored and tracked the quantity to ensure it remained under the established administrative limits identified in the operability determination. The inspector raised question on the impact of the shutdown cooling (SDC) mode of RHR.

The PD: The licensee failed to assess the impact on the SDC mode of RHR in operability determination x which is contrary to self-imposed standards.

(Note: There are no regulatory requirements to adequately document operability determinations.)

(Note: In this case, potential PDs include failure to identify a condition adverse to quality or failure to follow the licensees procedure for documenting operability determinations. In this example, the PD associated with the licensees procedures was selected to demonstrate conditions for minor or MTM.)

Minor if: The PD did not adversely affect the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Although the licensee did not have a lot of detail to justify operability associated with the SDC mode (causing the inspector to question), the licensee did address the mode. In the end, the system remained operable. Essentially, this issue of concern

Issue Date: 10/26/23 13 0612 App E is really focused on the paperwork and not on the status of the equipment.

MTM if: The PD adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspector identified the licensee had not addressed the SDC mode such that the operability conclusion was truly challenged, and the licensee had to perform actions to continue to demonstrate operability. The outcome of this evaluation is not a factor in minor or MTM.

Example 3.l During a review of a licensees power operated valve activities, the inspectors found that the licensee only incorporated test data from their site when establishing design assumptions and did not include applicable data from other plants within their fleet or from the nuclear industry. The inspectors noted the licensees procedure stated a suitable testing program included the results of a minimum population of 15 valves and that, when available, test results across the fleet would be used in establishing valve factors. The inspectors noted that the valve factors used at the site were lower than what was used at other plant sites that utilized industry data. This led to the inspector to question the valve factor.

The PD: The licensee did not implement activities that would provide assurance that specific POVs would meet their design basis functions which is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the licensee was able to demonstrate that the site test data population was sufficiently large to represent the performance characteristics of the plant POVs. No changes to the POV testing and maintenance programs for the subject valves were necessary per the site POV program documents.

MTM if: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensee was unable to demonstrate that the site test data population was sufficiently large to represent the performance characteristics of the plant POVs. As a result,(for example), (1) f actoring in the fleet data resulted in a reasonable doubt with respect to the availability, reliability, or capability of plant POVs and the licensee had to re-perform a number of valve design calculations to demonstrate that they could meet their design basis functions. or (2) several valves required additional testing and maintenance per the site POV program documents because of a loss of margin.

Issue Date: 10/26/23 14 0612 App E Example 3.m While reviewing program documents associated with power operated valves, the inspector noted that the licensee was not applying justified differential pressure assumptions in calculating the design bases limits for certain safety-related valves. Specifically, the licensee did not account for design leakage past pressure isolation valves, which could increase the differential pressure across several valves. Further review identified five potentially impacted valves. (Note: at least one valve needs to be identified.)

The PD: The licensee did not assume pressure isolation valve leakage when calculating the design basis limits for several safety -related POVs which is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective. The differential pressure assumption had a small effect on the design calculations. Although margin was reduced, the valves did not need additional testing or preventive maintenance per the licensees POV program documents. In performing the analysis, the conditions described in the MTM section are not applicable.

MTM if: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective. Specifically,

(1) the final operability determination concluded a valve was inoperable or nonfunctional; or needed additional maintenance and testing per the site POV documents; or required interim compensatory actions to maintain operability/functionality.

-or-

(2) through the process of performing the operability/functionality determination, there was reasonable doubt regarding the availability, reliability, or capability of the valves. For example, i n evaluating the as-found condition, there would be reasonable doubt with respect to the capability of the valves if: the licensee (a) used a different calculation/approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revise d other calculations in order to establish operability or functionality; or (d) determined the remaining margin fe ll outside the licensees design process acceptance criteria.

Example 3.n While examining the degraded grid voltage calculations for a risk-important, safety -related valve, the inspector noted that the licensee did not have electrical calculations or test data that would support the settings for thermal overloads protective devices for several safety -related MOVs. As a result, it was not clear whether these valves would fulfill their

Issue Date: 10/26/23 15 0612 App E risk-important or safety -related functions during a range of postulated events. The licensee performed an analysis for each affected valve.

The PD: The licensee failed to ensure the thermal overload protection settings on safety-related MOVs were adequate to ensure the valves would perform their function(s) which is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the subject breaker was subsequently found to be in specification. In performing the analysis, the conditions described in the MTM section are not applicable or the current MOV testing program did not need to be modified to address the issue (i.e., the current valve testing and maintenance program is acceptable, as is.)

MTM if: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective. Specifically,

(1) the final operability determination concluded a valve was inoperable or nonfunctional; or needed additional maintenance and testing per the site MOV documents; or required interim compensatory actions to maintain operability/functionality.

-or-

(2) through the process of performing the operability/functionality determination, there was reasonable doubt regarding the availability, reliability, or capability of the valves. For example, i n evaluating the as-found condition, there would be reasonable doubt with respect to the capability of the valves if: the licensee (a) used a different calculation/approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revise d other calculations in order to establish operability or functionality; or (d) d etermined the remaining margin fe ll outside the licensees design process acceptance criteria.

Example 3.o The inspectors noted the licensees safe shutdown analysis credited the RCIC system for reactor water makeup and decay heat removal for the alternate shutdown method from the remote shutdown panel (RSP). In the event of a fire requiring control room evacuation, procedures directed operators to place RCIC Remote Shutdown Transfer Switches in the EMERGENCY position at the RSP. This isolated the control circuits for the RCIC valves from the control room and connected a different set of control fuses at the RSP for each valve.The new set of control fuses was fed from a separate 250 volt d irect current (VDC ) power source.

Issue Date: 10/26/23 16 0612 App E During the review of MOV 1E51-F022, RCIC Test Bypass to Condensate Storage Tank, the inspectors noted the main breaker supplied from 250 Vdc Motor Control Center (MCC) 121Y was a 7-Amp breaker, while the control circuit fuse associated with the valves control room circuits was 10 Amp. The inspectors were concerned that in the event of a control room fire, fire-induced faults on the control circuits could cause the associated 7 Amp, 250 V DC breaker to trip upstream of the 10 Amp protective fuse. If the feed breaker tripped before the control room protective fuse opened, the associated MOV would lose power for operation from the RSP until the breaker was reset.

The PD: The licensee failed to ensure that the alternate shutdown capability was independent of the control room which was contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD was minor because it did not affect the availability, reliability, and capability of RCIC in the event of a fire. Specifically,

(1) existing procedures directed operators to reset the affected breakers if tripped during the transfer and the licensee had demonstrated that the action to reset the breakers could be performed in a timely manner.

-or -

(2) the licensee verified by walkdown that the breaker was replaced with a higher rating. As a result, this PD is an administrative error with no consequence. (Note: Inspector could pursue a PD related to configuration control.)

MTM if: The PD was associated with the Mitigating Systems Cornerstone attribute of Protection Against External Events (Fire), and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, in the event of a fire in the control room, fire-induced failures could result in tripping the valves power supply breaker prior to tripping the control power fuse which could impair the operation of RCIC from the RSP. Actions to reset the associated breakers were not contained in alternate shutdown procedures or the licensee could not demonstrate that the action could be performed in a timely manner.

Issue Date: 10/26/23 17 0612 App E

4. Procedural Errors

Example 4.a A scaffold erected between safety -related plant service water strainers was wedged tightly between the system piping. No engineering evaluation was performed to assess the seismic impact of the scaffold.

The PD: The licensee failed to perform an engineering evaluation to assess the seismic impact of an installed scaffold, contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because a later engineering evaluation determined that there is no safety concern. Specifically, this is a procedural error that has no safety impact.

MTMif: The PD was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the subsequent engineering evaluation confirmed that the affected pipe would be subject to seismic induced pipe loads that had not been considered in the original analysis and increased the probability of pipe failure during accident mitigation.

Example 4.b While performing a reactor protection system test procedure, an operator inadvertently operated the bypass switch which caused a single channel trip condition.

The PD: The operator failed to follow the procedure and adequately self-check to ensure the right switch was manipulated. This is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the initiating events cornerstone objective because this was an insignificant procedural error and there were no safety consequences.

MTMif: The PD was associated with the human performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the error caused a reactor trip or other transient.

Issue Date: 10/26/23 18 0612 App E Example 4.c A valve motor operator was test wired for reading operating current during testing performed in accordance with Generic Letter 89-10. The valve was successfully cycled, the data recorded and determined to be within the acceptable range, and the valve was returned to service. However, the ammeter used a 0-100 amp scale instead of a 0-10 amp scale as required by the procedure.

The PD: The licensee failed to follow a test procedure which was contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because subsequent retest with the proper meter resulted in satisfactory amperage readings. Specifically, this was a procedural error that had no impact on safety equipment. The mistake did not result in an actual equipment problem.

MTMif: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the retest revealed that the valve was returned to service and because of the inadequate measurement, the licensee did not identify that the thrust data for the affected MOV was inadequate to perform the valve function under the limiting design basis event.

Example 4.d During a review of the emergency lighting in the safety injection pump room, an inspector identified that the lighting was less than FSAR design levels for operator action.

The PD: The licensee failed to ensure the emergency lighting in the safety injection pump room was less than the FSAR design levels for operator action. This is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because operators are procedurally required to carry flashlights and would have no problems functioning in this light condition.

MTMif: The PD was associated with the human performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the degraded lighting condition would significantly impact the operators ability to operate equipment within the safety injection pump room during implementation of procedures that required manual operator actions within this room for accident mitigation.

Issue Date: 10/26/23 19 0612 App E Example 4.e The inspector identified a valve with a missing name-plate; a violation of plant procedures requiring that all equipment be labeled. This valve needs to be manipulated as part of an operator time-critical action.

The PD: The licensee did not label plant equipment as required by plant procedures which is contrary to regulatory requirements or self-imposed standards. Plant procedures required that equipment be labeled.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because operators referred to the plant drawings and routinely train on this time-critical action. Specifically, this is a failure to meet procedural requirements that had no safety impact. The operators used the drawings and had no trouble identifying the valve location in time to perform the necessary operator time-critical action.

MTMif: The PD was associated with the human performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, because of the lack of label an improper valve manipulation occurred that resulted in a plant transient or that rendered a mitigating system incapable of responding to an initiating event.

Example 4.f A small leak occurs on a welded connection in the diesel generator day tank causing a slow drip of fuel oil onto the floor in the diesel room.

Maintenance used a sealant to temporarily repair the leak and wrote a work order for a permanent repair, which was scheduled for the next outage. Later, the seal failed, and additional leakage occurred, which dripped on a safety-related solenoid. The licensee subsequently determined that the wrong sealant was used in the temporary repair.

The PD: The licensee failed to adequately correct a condition adverse to quality which is contrary to a regulatory requirement or self-imposed standard.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because this is a failure to correct a condition adverse to quality that had no adverse impact on both the solenoid valve and the diesel generator.

MTM if: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the inadequate repair led to additional leakage from the day tank and a safety-related solenoid valve was soaked in fuel oil preventing the valve from performing its safety function.

Issue Date: 10/26/23 20 0612 App E Example 4.g The reach rod for a safety-related valve was jammed and could not be used. However, the valve could be operated manually one level down.

This condition existed for 2 years and, despite complaints from the operators, it was not fixed. The NRC inspector noted that this work-around cost about 1 minute in operator response time and recognized that manual manipulation of this valve was required by certain off-normal procedures.

The PD: The licensee failed to promptly correct a condition adverse to quality as required by regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because this is a failure to implement a corrective action that had little to no safety impact. The valve was accessible during all these off-normal events and could still be operated and the extra time requirement would not affect recovery operations.

MTMif: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, there are credible scenarios within the current abnormal/emergency procedures where access to the effected valve would be restricted for environmental reasons (heat, radiation, oxygen, etc.), or a time critical action could not be performed within the timeline credited in the design basis.

Example 4.h An inspector discovered that 3 of 150 emergency response organization (ERO) members who are on the duty roster in different functional areas were not current in their training. The licensees emergency plan required that all members be trained annually.

The PD: The licensee failed to follow and maintain the effectiveness of their emergency plan which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the emergency preparedness cornerstone objective because there are others on the duty roster in each functional area whose qualifications are current.

MTM if: The PD was associated with the ERO readiness attribute of the emergency preparedness cornerstone and adversely affected the cornerstone objective to ensure that the licensee is capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency. Specifically, emergency response personnel qualification lapses occur in such a manner that ERO minimum staffing positions cannot be staffed by qualified individuals.

Issue Date: 10/26/23 21 0612 App E Example 4.i An inspector found that the evaluation of the adequacy of emergency preparedness procedures in the annual audit was not in sufficient depth in one functional area.

The PD: The licensee did not evaluate the adequacy of EP procedures which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the emergency preparedness cornerstone objective because the licensee reviewed the areas insufficiently covered and found no problems. Specifically, no problems were identified and the revisions of the procedures that were not audited addressed improvements identified in drills.

MTMif: The PD was associated with the procedure quality attribute of the emergency preparedness cornerstone and adversely affected the cornerstone objective to ensure that the licensee is capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency. Specifically, the procedures that were not evaluated were in a condition that would adversely affect the licensees response to an emergency.

Example 4.j NRC inspectors identified three 10-foot lengths of wood left from a scaffold disassembled the previous week in the auxiliary feedwater pump room. The licensee had not completed an engineering evaluation approving this temporary storage location for transient combustible materials as required by the fire protection plan.

The PD: The licensee failed to complete an engineering evaluation to compensate for all transient combustibles in an area which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because this is a failure to implement a fire protection program requirement that has little or no safety impact. Specifically, the transient combustibles could not affect equipment important to safety and did not exceed any licensing basis requirements. The licensee was able to show that the transient combustibles were well below the fire hazards analysis limits.

MTMif: The PD was associated with the protection against external factors (i.e.,

fire) attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, one of the following occurred:

(a) the fire loading was not within the fire hazard analysis limits; (b) a credible fire scenario involving the identified transient combustibles could affect equipment important to safety; (c) the identified transient combustibles were in excess of those permitted by an NRC safety evaluation report which formed the licensing basis for the plant; or (d) the identified transient combustibles adversely affected a combustible free

Issue Date: 10/26/23 22 0612 App E zone's function to prevent fire spread (e.g., a large fire on one side might propagate to the other side).

Example 4.k The TS require that one-third of all safety-related molded case circuit breakers be tested each refueling outage (such that all are tested every three outages) and that the instantaneous trip currents be recorded for trending purposes. The NRC inspector found that two outages ago during testing, the instantaneous trip current for a breaker was not tested due to the breaker not being listed for the instantaneous trip current test. The last recorded trip current for this breaker was five outages a go.

The PD: The licensee failed to perform required breaker testing within three outages as specified by regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the subject breaker was subsequently found to be in specification. Specifically, this is a failure to implement a procedural requirement that has no safety impact. All other tests on the breaker were satisfactory at the time of testing and the trip current was subsequently found to be in specification.

MTMif: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the subject breaker was out of specification and adversely affected the equipments availability, reliability, and/or capability.

Example 4.l The TS require that 10 percent of all safety -related snubbers be tested each refueling outage and that if one failure occurs, an additional 10 percent sample be tested during the same outage. One snubber in the original population of 17 snubbers (there are a total of 168 snubbers) fails, necessitating an additional sample of 17 snubbers. However, because of an oversight by the licensee, only 16 additional snubbers are tested with no failures.

The PD: The licensee failed to perform the snubber testing as required by regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because this is a failure to implement a procedural requirement that has no safety impact since none of the additional snubbers tested failed.

MTMif: The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, a failure had occurred in the additional (missed) sample,

Issue Date: 10/26/23 23 0612 App E necessitating yet another expansion of the sample, and this expansion of the sample did not occur.

Example 4.m The inspector identified a motor operated valve (MOV) torque switch was not installed properly. Specifically, the licensees procedure to re-install MOV RH-6833 did not include a step to reset the MOV torque switch to previously installed torque switch settings. Once identified, the licensee had to enter an unplanned maintenance window to reset the toque switch.

The PD: The licensee failed to ensure torque switch settings were included in installation procedures which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because the inadequate procedure would not have resulted in equipment damage. Specifically,

• although not required by the procedure, maintenance worker training would have the worker set the torque switch to the prior setting

-or-

• the licensee analysis confirmed the worst -case torque switch setting would not have damaged the valve subcomponents had the valve actuated.

MTM if: The PD was associated with the procedure quality attribute of the mitigating systems cornerstone, and it adversely affected the cornerstone objective. Specifically, regardless of the final operability or functionality, the as-found condition was such that there was reasonable doubt whether the valve would have been capable of performing its function had it been called upon. For example, in evaluating the as -found condition, the licensee (a) used a different approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); (b) revised assumptions solely to obtain favorable results; (c) revised other calculations in order to establish operability or functionality; (d) determined the remaining margin falls outside the licensees design process acceptance criteria; (e) had to replace equipment because of damage or licensee was unable to demonstrate operability.

Issue Date: 10/26/23 24 0612 App E

5. Work in Progress Findings

Example 5.a Prior to system restoration following a modification, the NRC inspectors identified that the modification package that replaced the spent fuel pool cooling system suction piping did not include the siphon because the engineers failed to identify the requirements of the original design. The siphon hole was not installed. Due to the location of the piping, a siphoning event would lower spent fuel pool level below the TS limit, but not to the point where fuel would have been uncovered.

The PD: The pipe design was not correctly translated into work instructions and drawings, in accordance with regulatory requirements or self-imposed standards.

Minor if: The PD, if left uncorrected, would not have led to a more significant safety concern. Work was still in progress, and it is reasonable to conclude the PD would have been identified through the post modification testing or licensee processes prior to the return to service. Therefore, it would not have been left uncorrected nor would it have adversely affected the associated cornerstone objectives since the system was would have been fully restored and able to perform/support any safety function.

MTM if: Work was still in progress; however, it is reasonable to conclude the PD would not have been identified prior to return to service. The PD, if left uncorrected, would have the potential to lead to a more significant safety concern. Specifically, the condition wasnt identified during post modification testing or during restoration activities. The performance deficiency was identified at a point in the process where there were no more licensee review or approval barriers that could reasonably prec lude the systems return to service with this design error present. If left uncorrected, the lack of siphon hole would have the potential to lead to a more significant safety concern, i.e., could allow the licensee to reach a condition outside of that allowed by its TS.

The PD if left uncorrected, would have the potential to lead to a more significant safety concern. Absent NRC intervention the licensee would not have identified the condition until the spent fuel level decreased to a point that resulted in an increase in radiation levels in areas frequented by outage workers and cause unnecessary radiation exposure (e.g., not ALARA).

Example 5.b During installation of a modification, the licensee failed to follow the installation procedures and a check valve required for the system to perform its function is installed backward.

The PD: The licensee failed to install a check valve correctly in accordance with licensee procedures which is contrary to regulatory requirements or self-imposed standards.

Issue Date: 10/26/23 25 0612 App E Minor if: The PD was identified through a planned post modification test, or other process-driven review, without causing any actual adverse effects to other operating systems. Therefore, the degraded condition did not adversely affect the associated cornerstone objectives since the system caused no adverse interactions and was itself out of service and not being relied upon at the time of discovery.

MTMif: Prior to system restoration (for example, during the post modification test), the PD results in an event that adversely affects one of the cornerstone objectives, such as: impacting the capability of another SSC or causing an initiating event (e.g., a feedwater transient resulting in a rapid downpower or reactor scram; or causing an unanticipated occupational radiation safety hazard by overfilling a tank that creates a contaminated spill).

Example 5.c A solenoid that did not meet its safety -related procurement specifications was inadvertently screened through receipt inspection and placed in the warehouse. When the solenoid was about to be installed during the maintenance window, an electrician noted that it was not the correct type called out in the work order instructions.

The PD: The licensee failed to assure that purchased equipment conformed to the procurement documents in accordance with 10 CFR 50, App B, Criterion VII, Control of Purchased Material, Equipment, and Services.

Minor if: The discrepant solenoid was not installed in the plant and an extent of condition review confirms the discrepant solenoid was not installed in any system in the plant. The licensees process (last barrier) worked. The PD had no effect on the associated cornerstone objectives since no SSC in the plant was impacted.

MTMif: An extent of condition review revealed that this incorrect model solenoid had already been installed in other trains or systems currently in operation at the plant, thereby adversely impacting the associated cornerstone objectives of ensuring the reli ability, capability, or availability of an SSC.

Note: If the extent of condition review indicated a systemic problem in the procurement area, each case would need to be evaluated for significance. If the discrepant equipment was not installed in the plant, this trend would not be more than minor as long as other barriers via the licensees procurement, work management process, or both still existed to prevent installation of the unqualified material parts into the plant.

Example 5.d The licensee identified indications on the reactor vessel weld RPV -1 while performing an examination required the ASME Code Section XI. T he licensee detected indications by ultrasonic examination (UT) to be of acceptable size and returned the reactor vessel weld to service.

Issue Date: 10/26/23 26 0612 App E Subsequently, the inspectors identified errors in calibration of the UT examination equipment used by the licensee to size these indications and were concerned that the indications may not be acceptable.

The PD: The licensee failed to perform an adequate calibration of UT equipment used to size flaws in on the reactor vessel weld RPV -1 which is contrary to regulatory requirements or self-imposed standards.

Minor if: The PD did not adversely affect the Initiating Events cornerstone attribute of equipment performance because when the licensee repeated the UT examination with appropriate calibrated UT instruments, the verified flaws met ASME Code Section XI acceptance criteria.

MTM if: The PD adversely affected the Initiating Events cornerstone attribute of equipment performance and adversely affected the cornerstone objective because when the licensee repeated the UT examination with appropriate calibrated UT instruments, the flaws did not meet ASME Code Section XI and required further analysis or repairs to be accepted for continued service. The PD adversely affected the Initiating Events cornerstone attribute of equipment performance and adversely affected the cornerstone objective because absent NRC intervention, the licensees incorrect application of UT would have likely been repeated and continued incorrect application of UT would result in missed flaws in the reactor coolant system resulting in increased likelihood for inservice failures (e.g., a LOCA).

6. Health Physics

General Screening Criteria: A radiation protection program is composed of several barriers to ensure adequate protection of occupational and public health and safety through defense-in -depth. A radiation protection barrier is program element that serves a specific radiation safety function. For example, procedures provide a barrier whose main function is to provide employees with sufficient instruction, so they can safely perform their duties as radiation workers. Other examples of barriers include ALARA plans and controls, radiological surveys and monitoring, labeling and posting, access controls, and respiratory protection programs.

A minor PD in the implementation of a single radiation protection barrier results in a minimal reduction in the protection of health and safety. However, a PD that renders a radiation protection program barrier ineffective, or indicates that a barrier is ineffective, would be appropriately classified as a more-t han-minor PD.

When determining if a PD could reasonably be viewed as a precursor to a significant event, inspection staff should evaluate whether the PD could have resulted in, or did result in, an overexposure to a real individual (i.e., a significant event is viewed as an exposure beyond the dose limits contained in 10 CFR Part 20 or other radiation safety-related criteria in section 04.05 of IMC 0309). To determine if an overexposure was a reasonable potential outcome, inspection staff should consider whether events, as they occurred, or with a minor, realistic alteration of circumstances (e.g., timing, source strength, distance and shielding), would have resulted in an

Issue Date: 10/26/23 27 0612 App E over-exposure to a real individual, and not merely whether a series of events could be postulated that could result in an over -exposure.

When determining if a PD would have the potential to lead to a more significant safety concern, inspection staff should evaluate if events, as they occurred, or with a minor, realistic alteration of circumstances, were indicative of a failure of a radiation protection program bar rier, or if the PD resulted in an actual personnel safety concern (e.g., faulty respiratory protection equipment). In applying this guidance, inspection staff can consider mitigating measures for the deficient barrier that were in place at the time of occurrence (e.g., use of electronic alarming dosimeter with appropriately conservative dose rate alarm set points), and (2) the actual radiological risk introduced by the PD. The radiological risk consists of resultant doses, or doses that could have reasonably occurred with minor, realistic adjustments to events as they occurred. In general, the radiological risk is expressed in terms of dose to real individuals; however, in certain circumstances the risk to health and safety is not adequately reflected in the resulting dose and thus other factors must be considered in determining the level of radiological risk (e.g.,

magnitude of radiological hazards).

When determining if a PD adversely affected the associated cornerstone objective, inspection staff should consider whether the PD impacted the effectiveness of a radiation protection program barrier such that the licensees ability to provide adequate protection to a worker or a member of the public was challenged. These PDs generally result in actual unplanned or uncontrolled doses to workers or members of the public, or actual unplanned or uncontrolled releases of radioactive material to the unrestricted area.

Example 6.a A licensee performed a required radiation survey, but the survey was not documented properly, or a mistake occurred in the documentation of the survey.

The PD: The licensee failed to document a radiation survey as required by regulations and/or licensee procedures.

Minor if: The required survey was actually performed, AND the lack of a survey record did not result in the licensee failing to establish appropriate radiological controls (e.g., access controls, dosimetry, and respiratory protection); failing to properly inform workers of the radiation hazard; or failing to adequately control the release of radioactive material from the site.

MTMif: The PD had the potential to lead to a more significant radiation safety concern because of an ineffective radiation program barrier. Specifically, the lack of a survey record resulted in the licensee not establishing appropriate radiological controls ; not properly informing workers of the radiation hazard; or not adequately controlling the release of radioactive material from the site.

Example 6.b Radiation detection instruments (e.g., portable instruments or installed area radiation monitors) were not calibrated properly, or not response checked prior to use in accordance with site procedures.

Issue Date: 10/26/23 28 0612 App E The PD: The licensee did not calibrate or response check radiations protection instrumentation as required by regulatory requirements or self-imposed standards.

Minor if: When recalibrated or response checked, the as -found condition of the instrument was within acceptance criteria for the calibration or response check, or the instrument provided conservative measurement (i.e.,

over-response), or if the installed area radiation monitor would still have adequately performed its alarm function.

MTMif: The PD had the potential to lead to a more significant radiation safety concern because of an ineffective radiation program barrier. Specifically, when recalibrated or response checked, the as -found condition of the instrument was not within acceptance criteria for the calibration, or response check, or if the installed area radiation monitor would not have adequately performed its alarm function.

Example 6.c Licensee personnel missed a step in the procedure for setting alarm set points for effluent control/monitoring equipment associated with normal operations (i.e., non-emergency planning (EP) program activities) resulting in incorrect set points.

The PD: Licensee personnel did not comply with the procedure for establishing set points for equipment used for effluent control/monitoring as required by regulatory requirements or self-imposed standards.

Minor if: The effluent monitor alarm set point would have allowed the instrumentation to perform its intended function (e.g., trip or alarm function) to prevent an instantaneous effluent release in excess of the applicable technical specification instantaneous concentration limit for liquids or dose rate limits for gases.

MTMif: The PD was associated with the plant facilities/equipment and instrumentation attribute of the public radiation safety c ornerstone and adversely affected the cornerstone objective to ensure adequate protection of public health and safety from exposure to radioactive materials released into the public domain as a result of routine civilian reactor operation. Specifically, the effluent monitor with its alarm set point would have failed to perform its intended function (i.e., trip or isolation function) to prevent an effluent release in excess of the applicable technical specification instantaneous concentration limit for liquids or dose rate limits for gases.

Example 6.d A health physics technician provided job coverage or performed a task that the technician was not fully qualified to perform.

The PD: The licensee did not utilize qualified health physics technicians as required by regulatory requirements or self-imposed standards.

Issue Date: 10/26/23 29 0612 App E Minor if: The work performed by the technician (e.g., radiological surveys and monitoring) provided an adequate level of radiological protection.

MTMif: The PD had the potential to lead to a more significant radiation safety concern because of an ineffective radiation program barrier. Specifically, one or more errors of consequence to radiological safety were made by the technician such that the work performed by the technician did not provide an adequate level of radiological protection.

Example 6.e An item (e.g., tool, dirt, secondary resin) containing detectable licensed radioactive material (RAM) was inadequately released from further radiological control (e.g., item was inadequately surveyed).

The PD: Licensee did not control licensed material as required by regulatory requirements or self-imposed standards.

Minor if: The follow-up survey concludes that the item contained radioactive material with a measured dose rate that is indistinguishable from background (as measured in a low background area, at a distance of 30 cm from the item with a micro-rem per hour -type instrument that typically uses a 1 inch by 1 inch scintillation detector) and the calculated dose using a realistic exposure scenario is less than or equal to 1 percent of applicable public dose limits.

MTMif: The PD is associated with the program and process attribute of the public radiation safety cornerstone and adversely affected the objective to ensure adequate protection of public health and safety from exposure to radioactive materials released into the public domain as a result of routine civilian nuclear reactor operation. Specifically, an uncontrolled release of RAM occurred as determined by a follow-up survey with measured dose rate that is distinguishable from background (as measured in a low background area, at a distance of 30 cm from the item with a micro-rem per hour-type instrument that typically uses a 1 inch by 1 inch scintillation detector) or the calculated dose using a realistic exposure scenario is in excess of 1 percent of applicable public dose limits.

Note: A PD does not occur in the situation where an item with RAM has been properly surveyed using appropriate survey techniques, is evaluated as not having detectable RAM and released, and is later discovered as containing RAM when surveyed using a more sensitive survey method.

Example 6.f A radiation survey did not identify a radiation area, high radiation area (HRA) or locked high radiation area (LHRA).

The PD: The licensee did not perform an adequate survey to appropriately post a radiation area, HRA or LHRA.

Issue Date: 10/26/23 30 0612 App E Minor if: Radiological conditions existed in the previously unknown radiation area such that the dose to an uninformed worker (e.g., a worker who had not been briefed on or reviewed radiological conditions) was unlikely to exceed an unplanned dose of 10 mrem, OR

For deficiencies occurring in HRAs, all the following conditions were met:

• the accessible dose rate did not exceed 1,000 mrem/hr at 30 centimeters

• all workers with access to the dose rate were wearing electronic alarming dosimeters (EADs) with dose rate alarm setpoints sufficiently low to allow workers to take appropriate actions before encountering dose rates exceeding 100 mrem/hr

• the accessible dose rate was identified by an EAD dose rate alarm

• all affected workers responded to the alarm per licensee procedures

MTMif: The PD had the potential to lead to a more significant safety concern because of an ineffective radiation program barrier. Specifically, any of the following occurred:

• the inadequate survey, or failure to survey, resulted in an accessible dose rate that exceed 1,000 mrem/hr at 30 centimeters (i.e., area was an unposted LHRA).

• an unknown radiation area existed, and the dose to an uninformed worker (e.g., a worker who had not been briefed on or reviewed radiological conditions) was likely to exceed an unplanned dose of 10 mrem

• The inadequate survey, or failure to survey, resulted in an unposted HRA and any of the following conditions were met:

• a worker with access to the dose rate was not wearing an EAD

• the EAD dose rate alarm setpoint was not sufficiently low to allow workers to take appropriate action before encountering dose rates exceeding 100 mrem/hr

• A worker was aware of an EAD alarm and did not respond per licensee procedures

Note 1: For the purposes of this appendix, HRAs are defined as areas with accessible dose rates that are greater than 100 mrem/hour at 30 centimeters but that do not exceed 1,000 mrem/hr at 30 centimeters. Locked high radiation areas (LHRA) are defined as areas with accessible dose rates greater than 1,000 mrem/hr at 30 centimeters.

Example 6.g A worker improperly entered a posted HRA or LHRA (i.e., not in accordance with Technical Specifications and plant procedures).

The PD: Licensee personnel did not comply with procedures for entry into an HRA or LHRA.

Issue Date: 10/26/23 31 0612 App E Minor if: The improper entry occurred in a conservatively posted HRA (i.e., the highest actual radiation level in the posted area was less than or equal to 100 mrem/hr at 30 cm), OR

The improper entry occurred in an actual HRA (i.e., highest actual radiation level in the posted area exceeded 100 mrem/hr at 30 cm, but did not exceed 1000 mrem/hr at 30 cm) and all the following conditions were met:

• the worker was wearing an EAD

• the EAD dose rate alarm setpoint was sufficiently low to alert workers before encountering dose rates exceeding 100 mrem/hr

• if an EAD alarm was received the worker responded to the alarm per licensee procedures

MTMif: The PD had the potential to lead to a more significant safety concern because of an ineffective radiation program barrier. Specifically, an improper entry was made into an LHRA, OR

The improper entry was made into an HRA and any of the following conditions were met:

• the worker was not wearing an EAD

• the EAD alarm setpoint was not sufficiently low to alert workers before encountering dose rates exceeding 100 mrem/hr

• A worker was aware of an EAD alarm and did not respond per licensee procedures

Note 1: For the purposes of this appendix, HRAs are defined as areas with accessible dose rates that are greater than 100 mrem/hour at 30 centimeters but that do not exceed 1,000 mrem/hr at 30 centimeters.

Locked high radiation areas (LHRA) are defined as areas with accessible dose rates greater than 1,000 mrem/hr at 30 centimeters.

Example 6.h Radiological controls were not established or utilized such that an unplanned internal exposure occurred or was likely to occur with a minor alteration of circumstances. The failure may have involved an inadequate radiological survey, improper ventilation controls, or an individuals failure to follow RWP requirements.

The PD: The licensee failed to adequately survey (or implement ventilation controls or follow licensee procedures) in an area that in a reasonable exposure scenario could have been the source of internal exposure.

Minor if: The worker did not receive or was unlikely to receive greater than 10 mrem committed effective dose equivalent (CEDE ).

MTM if: The PD is associated with the program and process attri bute of the occupational radiation safety cornerstone and adversely affected the cornerstone objective to ensure adequate protection of the worker health

Issue Date: 10/26/23 32 0612 App E and safety from exposure to radiation from radioactive material during routine civilian nuclear reactor operation. Specifically, the PD resulted in inadequately controlled radiological conditions such that the worker received or was likely to receive greater than 10 mrem CEDE.

Example 6.i PDs occurred in ALARA planning and/or job execution that resulted in the actual collective dose exceeding the planned (or adequately re-planned),

intended dose for a work activity.

The PD: The licensees ALARA planning or radiological controls did not prevent unplanned, unintended dose for a work activity per regulatory requirements or self-imposed standards.

Minor if: The actual collective dose was 5 person-rem, OR the actual collective dose was greater than 5 rem but did not exceed the planned (or adequately re-planned), intended dose by more than 50 percent.

MTMif: The PD is associated with the program and process attribute of the occupational radiation safety cornerstone and adversely affected the cornerstone objective to ensure the adequate protection of the worker health and safety from exposure to radiation from radioactive material during routine civilian nuclear reactor operation. Specifically, the licensee did not effectively implement procedures or engineering controls to achieve doses that are ALARA as indicated by actual collective dose exceeding 5 person-rem AND exceeding the planned (or adequately re-planned), intended dose by more than 50 percent (e.g., a task planned for 4 person-rem received 6.1 person -rem, or a task re-planned for 14 person-rem received 22 person-rem).

Note 1: The 10 CFR 20.1101 regulations establish a regulatory requirement to use, to the extent practical, procedures and engineering controls to achieve doses that are ALARA. Licensees that establish and maintain ALARA programs and procedural controls will normally meet this regulatory requirement and will not be in violation of 10 CFR 20.1101 for not reducing doses to an absolute minimum. However, a PD meeting the MTM criteria can still be dispositioned as inspection finding without an associated violation.

Note 2: In cases where the licensee arbitrarily divides the radiological work into very small work activities, or dose estimates were over-estimated for the purpose of avoiding inspection findings, the criteria can apply to a reasonable grouping of work and reasonable dose estimates as determined by NRC inspection staff (i.e., consistent with prior history or industry norms).

Note 3: The expanded work scope could have resulted from several factors related to additional maintenance or repair that the licensee would not have been reasonably expected to have foreseen before the work began. Once a work activity is started, and the expanded work scope is fully understood, it may be necessary to re-plan the activity and revise the dose estimate. The revised dose estimate should be based on the full scope of the work had it been known at the time of the initial planning.

Issue Date: 10/26/23 33 0612 App E Example 6.j A licensee failed to perform environmental monitoring for a significant liquid or gaseous effluent exposure pathway due to several missed sample collections or erroneous analyses.

The PD: A licensee failed to conduct adequate environmental monitoring sufficient to evaluate the relationship between effluent releases and radiation doses to individuals from principal pathways of exposure.

Minor if: The exposure pathway did not contain radioactivity or radiation levels that exceeded 10 percent of the 10 CFR 50, Appendix I, s ection II ALARA objectives.

MTMif: The PD was associated with the program and process attribute of the public radiation safety cornerstone and adversely affected the cornerstone objective to ensure adequate protection of public health and safety from exposure to radioactive materials released into the public domain as a result of routine civilian nuclear reactor operation.

Specifically, an inadequately monitored exposure pathway contained radioactivity or radiation levels that exceeded 10percent of the 10 CFR 50, Appendix I, s ection II ALARA objectives (excluding C-14).

Note 1: Per NUREG-1301 and NUREG -1302, the significant liquid effluent exposure pathways are potable water, aquatic foods, shoreline deposits, and irrigated foods; and the significant gaseous effluent exposure pathways are noble gas submersion, inhalation, ingestion and external (direct) radiation. For the purposes of environmental monitoring programs, the terminology significant effluent exposure pathway and principal effluent exposure pathway is interchangeable.

Example 6.k A licensee failed to label a container of licensed material being stored within the restricted area, as required.

The PD: The licensee failed to ensure that each container of licensed material bears a label that includes sufficient information to permit individuals handling or using the containers, or working in the vicinity of the containers, to take precautions to avoid or minimize exposures.

Minor if: The radiation level from the unlabeled containers did not exceed 5 mrem/hr at 30 centimeters, OR the unlabeled container was in an adequately posted area and subject to plant procedures to verify adequate labelling before removal from the posted area.

MTMif: The PD had the potential to lead to a more significant safety concern because of an ineffective radiation program barrier. Specifically, the radiation level from the unlabeled container exceeded 5 mrem/hr at 30 centimeters, AND the unlabeled container was not in an adequately posted area and subject to plant procedures to verify adequate labelling before removal from the posted area.

Issue Date: 10/26/23 34 0612 App E Example 6.l A licensee ships radioactive material in correct packaging but with an error in the shipping papers.

The PD: The licensee did not adequately describe hazardous material in shipping papers as required by regulatory requirements or self-imposed standards.

Minor if: The error does not impact the emergency telephone number; exclusive use status; consignee address; identification number; proper shipping name; hazard class; label (as applicable); physical/chemical form of the material; the name of each radionuclide; and the error did not exceed 20 percent of the mass, volume or activity of the material.

MTMif: The PD is associated with the program and process attribute of the public radiation safety cornerstone and adversely affected the cornerstone objective to ensure adequate protection of public health and safety from exposure to radioactive materials released into the public domain as a result of routine civilian nuclear reactor operation. Specifically, the licensee committed an error in the shipping papers for radioactive material that impacted the emergency telephone number; exclusive use status; consignee address; identification number; proper shipping name; hazard class; label (as applicable); physical/chemical form of the material; the name of each radionuclide shipped, or the error exceeded 20 percent of the mass, volume or activity of the material.

Example 6.m The licensee established by procedure an administrative limit of occupational exposure of 2 rem per year. Documented approval from the site radiation protection manager (RPM) was required for any individual to exceed the procedural limit. Contrary to the licensees program, an individual received 2.7 rem in one year without documented approval.

The PD: Licensee personnel did not comply with procedures for personnel monitoring as required by regulatory requirements or self-imposed standards.

Minor if: The failure was administrative in nature in that the RPM was involved in the planning and decision-making associated with exceeding the administrative limit (i.e., the PD is limited to the documentation associated with the approval).

MTM if: The PD is associated with the program and process attribute of the occupational radiation safety cornerstone and adversely affected the cornerstone objective to ensure adequate protection of worker health and safety from exposure to radiation from radioactive material during routine civilian nuclear reactor operation. Specifically, the licensee did not effectively implement procedures to monitor and control radiation exposure to workers resulting in an unplanned and uncontrolled exposure of a worker over the administrative limit.

Issue Date: 10/26/23 35 0612 App E Example 6.n A licensee intends to use respiratory protection to limit intakes of radioactive material (i.e., the respiratory protection will not be used to protect workers from occupational hazards other than airborne radioactive contamination) and conducts respirator fit testing using a different type of harness than that which is assigned to workers for use in the field.

The PD: The licensee did not conduct respirator fit testing with the same make, model, style, and size of respirator that will be used in the field as required by regulatory requirements or self-imposed standards.

Minor if: The PD does not result in a personnel safety issue resulting from the use of equipment whose purpose is to limit intakes of radioactive material, AND the performance deficiency did not impact the required fit factor of the respirator issued to the worker for use in the field.

MTMif: The PD had the potential to lead to a more significant safety concern because of an ineffective radiation protection program barrier.

Specifically, the PD resulted in a personnel safety concern resulting from the use of equipment whose purpose is to limit intakes of radioactive material, OR the PD adversely impacted the required fit factor of the respirator issued to the worker for use in the field.

7. Part 37 - Physical Protection of Category 1/Category 2 Quantities of Radioactive Material

General Guidance: Licensee programs to protect category 1 and category 2 radioactive material, or Part 37 material, from theft and diversion consist of several barriers (e.g., access authorization programs and multiple security provisions), which provide defense-in -depth. An isolated performance deficiency in the implementation of an element of the licensees program can be considered a minor violation because the existence of multiple barriers would provide adequate protection of the material. A missing or ineffective element would be considered more-than-minor because this condition represents a reduction in defense-in -depth.

Administrative issues (e.g., not meeting training documentation requirements) are minor provided they do not result in the failure of a program element.

Because material in transit is at a higher risk of theft or diversion than material stored at a site in general, PDs which occur during the transport of category 1 or category 2 material are more-than-minor unless they are of a purely administrative nature (e.g., failure to document preplanning or coordination provided such efforts did occur) or they result in a minor impact on the security of the shipment (e.g., temporary loss of redundant form of communication, temporary loss of telemetric position monitoring).

Performance deficiencies that are within the scope of EGM -2014-001 are considered minor violations. However, these performance deficiencies shall be documented in inspection reports in accordance with IMC 0611, section 0611-12 and, for tracking purposes, issued a new enforcement action number each time enforcement discretion is granted. In these cases, the

Issue Date: 10/26/23 36 0612 App E justification for the issue being dispositioned as minor is the very low risk of theft and diversion associated with large components and robust structures as described in EGM -2014-001.

Note: A PD associated with a licensees Part 73 security plan used to provide equivalent protection for Part 37 materials should be dispositioned using section 14 by a qualified security inspector.

Example 7.a A licensee allows unescorted access to a category 2, or greater, quantity of radioactive material to a person whose background investigation was deficient.

The PD: The licensees access authorization program did not ensure that an individual whose assigned duties require unescorted access to category 1 or category 2 quantities of radioactive material are trustworthy and reliable.

Minor if: The deficiency did not impact information that was relevant to access approval and thus would not have changed the licensees trustworthiness and reliability determination.

MTM if: The PD had the potential to lead to a more significant safety concern because of an ineffective program barrier. Specifically, an unauthorized person who would not have been granted unescorted access had they completed the licensees access authorization program requirements was granted unescorted access to category 2, or greater material.

Example 7.b A licensee established a temporary security zone, outside of the Protected Area (PA) but inside a continuous physical barrier, and the licensee failed to establish and maintain adequate means of monitoring and detection.

The PD: The licensee failed to maintain the capability to continuously monitor and detect without delay all unauthorized entries into its security zones which was contrary to a regulatory requirement or a licensee standard.

Minor if: The following conditions were met:

• The licensees security force regularly surveils (e.g., several times per day), either through direct line of sight or remote visual surveillance the location of the temporary security zone.

• Per the licensees procedures, security would be alerted to and respond to an individual who trespasses into temporary security zones, and

• The licensee recognizes and responds to the failure in a timely manner (i.e., within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery).

MTM if: The PD had the potential to lead to a more significant safety concern because of an ineffective program barrier. Specifically, category 1 or

Issue Date: 10/26/23 37 0612 App E category 2 material was left unsecured and any of the following conditions were met:

• The deficient temporary security zone was established in an area not regularly surveilled by the licensees security force,

• Security would not be alerted to or respond to a trespasser of the temporary security zone, or

• The licensee does not recognize or respond to the failure in a timely manner (i.e., within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

Example 7.c The licensees Part 37 plan does not describe a physical protection measure used to protect Part 37 material from theft and diversion, or the licensees Part 37 plan does not describe how a Part 73 measure is used to provide a level of protection equivalent to Part 37 requirements.

The PD: The security plan failed to describe the measures and strategies used to satisfy requirements which was contrary to a regulatory requirement or a licensee standard.

Minor if: The physical protection measure was in place and functional.

MTM if: The PD had the potential to lead to a more significant safety concern because of an ineffective program barrier. Specifically, the physical protection measure was not in place or functional.

Example 7.d The licensee did not coordinate with the local law enforcement agency (LLEA) regarding the protection of category 1 or category 2 material within the 12 -month limits.

The PD: The licensee failed to coordinate with the LLEA at least every 12 months which was contrary to a regulatory requirement or a licensee standard.

Minor if: The licensee had an existing relationship with the LLEA and coordinated with the LLEA within an 18-month period.

MTM if: The PD had the potential to lead to a more significant safety concern because of an ineffective program barrier. Specifically, the licensee had not coordinated with the LLEA for responding to threats to the licensees facility in over 18 months.

Issue Date: 10/26/23 38 0612 App E

8. Maintenance Rule

Example 8.a During an inspectors review of the licensees 10 CFR 50.65a(3) periodic evaluations of the site maintenance program, the inspector noted that two evaluations exceeded the 24 month interval by approximately 2 and 6 months, respectively.

The PD: The licensee did not perform periodic maintenance evaluations with a periodicity specified in regulatory requirements or self-imposed standards.

Minor if: The objectives of the mitigating systems cornerstone were not adversely affected because the failure to perform the periodic 50.65(a)(3) evaluation within the required interval did not adversely affect the balance of reliability and unavailability and no adjustments to the maintenance program were warranted.

MTMif: The objectives of the mitigating systems cornerstone were adversely affected because the failure to perform the periodic 50.65(a)(3) evaluation within the required interval affected the balance between reliability and unavailability and adjustments to the maintenance program were warranted but not completed.

Example 8.b The inspectors identified that during an (a)(3) periodic evaluation, the licensee failed to include the system unavailability time during TS required surveillance testing of the emergency diesel generators (EDG).

Although the licensee conducts monthly EDG testing, the EDGs are unavailable to perform their intended safety function during TS surveillance testing for a few minutes during each monthly test.

The PD: The licensee failed to consider all unavailability when conducting the (a)(3) evaluation which was contrary to a regulatory requirement or a licensee standard.

Minor if: The mitigating systems cornerstone objectives were not adversely affected since the contribution to unavailability due to the surveillance testing was insignificant when compared to total unavailability, and it did not impact the balancing of availability and reliability.

MTMif: The mitigating systems cornerstone objectives were adversely affected because the contribution to unavailability due to the surveillance testing was significant enough to affect the balancing determination such that a change in the maintenance program was warranted.

Example 8.c The inspectors identified that the licensee had not included some components of the augmented off-gas system within the scope of its program for implementation of the Maintenance Rule. Failure of these

Issue Date: 10/26/23 39 0612 App E components could result in a plant transient or scram and are therefore required to be in scope.

The PD: The licensee failed to scope certain components of the augmented off-gas system which could have caused a plant transient or scram if failed, which was contrary to a regulatory requirement or a licensee standard.

Minor if: Cornerstone objectives were not adversely affected since the licensee had been performing appropriate preventive maintenance and there were no equipment performance problems. Had the components been scoped, the preventive maintenance being performed would demonstrate effective control of equipment performance and condition as provided in paragraph (a)(2) of the Maintenance Rule.

MTMif: Cornerstone objectives were adversely affected because effective control of equipment performance or condition for equipment that should have been scoped was not demonstrated, for example through perfor mance criteria that were not met.

Example 8.d In accordance with the guidance of IP 71111.13, inspectors reviewed the plants maintenance risk assessment performed pursuant to 10 CFR 50.65(a)(4) for in progress maintenance activities and identified that the risk assessment was inadequate. Specifically, one or more of the following were identified: (a) not all ongoing maintenance activities affecting SSCs within the licensees established (a)(4) scope had been taken into account; (b) one of the maintenance activities was taking longer than a ssumed in the risk assessment; (c) plant conditions/operations, including TS requirements, were not consistent with the assumptions used in the risk assessment; or (d) relevant information provided to the risk assessment tool/process was inaccurate/incomplete.

The PD: The licensee failed to perform an adequate risk assessment when required by regulatory requirements or self-imposed standards.

Minor if: The mitigating systems c ornerstone objectives were not adversely affected because the overall corrected risk assessment would not result in a higher licensee-established risk category and would not require additional risk management actions (RMAs) under licensee procedures*.

MTMif: The mitigating systems cornerstone objectives were adversely affected because either: (1) the overall corrected risk assessment would result in a higher licensee-established risk category or would require additional RMAs under plant procedures*; (2) the risk assessment failed to correctly account for (at least qualitatively) the loss or significant uncompensated impairment of a key operating or shutdown safety or probabilistic risk assessment function; or (3) the credited function would not have been maintained due to the failure to identify or implement RMAs.

Issue Date: 10/26/23 40 0612 App E

• Note: Under certain circumstances regarding an assessed risk level, the inspector may identify RMAs that should be taken which could be contrary to the required RMAs in accordance with licensee procedures. In such cases, management review is required for more-than-minor determination, including consultation with the regional Maintenance Rule subject matter expert and then the Maintenance Rule lead in NRR if necessary.

Example 8.e In accordance with the guidance of IP 71111.13, inspectors reviewed the plants maintenance risk assessment for in progress maintenance activities required by 10 CFR 50.65(a)(4) and identified that a risk assessment had not been performed prior to commencing maintenance activities or maintenance support activities that increased plant risk.

The PD: The licensees failure to perform a risk assessment when required is contrary to a regulatory requirement or self-imposed standard.

Minor if: The mitigating systems cornerstone objectives were not adversely affected since the overall elevated plant risk would not put the plant into a higher licensee-established risk category and would not require RMAs or additional RMAs under licensee procedures*.

MTMif: The mitigating systems cornerstone objectives were adversely affected since (1) overall elevated plant risk would put the plant into a higher licensee-established risk category or would require RMAs or additional RMAs under plant procedures*, (2) the risk assessment failed to cor rectly account for (at least qualitatively) the loss or significant, uncompensated impairment of a key operating or shutdown safety or probabilistic risk assessment function, or (3) the credited function would not have been maintained due to the failure to identify or implement RMAs.

Example 8.f In accordance with the guidance of IP 71111.13, the inspectors reviewed the plants maintenance risk assessment for in progress maintenance activities required by 10 CFR 50.65(a)(4) and determined that a risk assessment had been performed when required and was adequate. Upon inspection of the plant, the inspectors identified that one of the RMAs prescribed by the licensee, the hanging of protected equipment signs on entry doors to the 1A EDG room, had not been effectively implemented in that the signs were not hung.

The PD: The licensee failed to manage risk which was contrary to a regulatory requirement or a licensee standard.

Minor if: The mitigating systems cornerstone objectives were not adversely affected. There were no unauthorized individuals in the room, no work was ongoing and, while protected equipment signs were not hung, Operations was aware that the 1A EDG was considered protected equipment as an RMA. Thus, the work control center would have known

Issue Date: 10/26/23 41 0612 App E the actual protected equipment status of the 1A EDG when determining whether to authorize activities in the room.

MTMif: The mitigating systems cornerstone objectives were adversely affected.

There were unauthorized individuals in the room, work ongoing in the vicinity of protected equipment that was not specifically authorized to be conducted in the vicinity of protected equipment, or Operations was unaware that the 1A EDG should have been considered protected and thus may have authorized inappropriate work in the area.

Example 8.g The inspectors identified that the licensee did not properly identify or process a Maintenance Rule functional failure of an SSC scoped into the licensees Maintenance Rule program and currently in 10 CFR 50.65(a)(2) status.

The PD: The licensees failure to properly identify or process a Maintenance R ule functional failure of an SSC scoped into the Maintenance R ule is contrary to regulatory requirements or self-imposed standards.

Minor if: The mitigating systems cornerstone objectives were not adversely affected because, when the Maintenance R ule functional failure is considered, it is still demonstrated that performance of the SSC was being effectively controlled through appropriate preventive maintenance such that the SSC remained capable of performing its intended function (i.e., the requirements of 10 CFR 50.65(a)(1)/(a)(2) were always met).

MTMif: The mitigating systems cornerstone objectives were adversely affected because, when the Maintenance Rule functional failure is considered, performance indicates that the SSC was is not being effectively controlled through appropriate preventive maintenance, and that the SSC was not moved to 10 CFR 50.65(a)(1) (i.e., the requirements of 10 CFR 50.65(a)(1)/(a)(2) were not met).

9. Thermal Power Limits

Example 9.a While operating at 99.9 percent rated thermal power (RTP), operators conducted a pre-planned evolution to swap operating feed pumps.

Operators did not comply with a licensee procedure prerequisite to reduce thermal power 0.5% below RTP prior to the pre-planned feed pump swap; which is in place to account for the anticipated 0.2 percent to 0.4 percent increase in thermal power. Upon starting the second feed pump, thermal power increased to 100.2 percent RTP.

The PD: The licensee did not comply with procedural requirements for reducing power prior to swapping the feed pumps.

Issue Date: 10/26/23 42 0612 App E Minor if: The PD was associated with the human performance attribute of the Barrier Integrity Cornerstone but did not adversely affect the cornerstone objective of providing reasonable assurance that the fuel cladding protects the public from radionuclide releases caused by accidents or events because operators, after realizing that thermal power had exceeded RTP, promptly decreased thermal power below or at RTP and thermal power remained bounded by the reactor safety analysis (i.e.

thermal power did not enter an unanalyzed region) and no safety limits were exceeded.

MTMif: The PD was associated with the human performance attribute of the Barrier Integrity Cornerstone and adversely affected the cornerstone objective of providing reasonable assurance that the fuel cladding protects the public from radionuclide releases caused by accidents or events because either operators did not recognize that they had exceeded RTP; operators recognized they exceeded RTP, but did not did not take adequate or timely action to lower thermal power to or below RTP due to actions that were not considered willful; fuel integrity limits were exceeded; or maximum thermal power entered an unanalyzed region. See Nuclear Energy Institute (NEI) Position Statement, referenced in RIS 2007-21, Revision 1 (ML090220365) for more guidance.

Example 9.b Following several days of steady state operation at or below RTP, operators operated the unit in excess of RTP as indicated by the 1-hour core thermal power (CTP) indication.

To monitor and control reactor power in accordance with the operating license, operators rely on computer-generated time-averaged indications of CTP that are updated every 10 seconds, providing running averages for 15-minute, 1-hour, 2-hour, and 8-hour CTP. A licensee procedure requires operators to review 15-minute average CTP and make necessary adjustments to maintain the 1-hour average CTP at or below RTP. Similarly, it requires operators to review 1-hour average CTP and make necessary adjustments to maintain the 2-hour average CTP at or below RTP.

Contrary to this guidance and license RTP requirements, when the 15-minute average CTP indication exceeded RTP, operators did not make necessary adjustments to maintain 1-hour CTP at or below RTP.

The PD: The licensee did not comply with procedure requirement to monitor 15-minute-, 1-hour -, and 2-hour average CTP and to make timely CTP adjustments as necessary to maintain 1-hour average CTP within the RTP limit as required by regulatory requirements or self-imposed standards.

Minor if: The PD was associated with the human performance attribute of the Barrier Integrity Cornerstone but did not adversely affect the cornerstone objective of providing reasonable assurance that the fuel cladding

Issue Date: 10/26/23 43 0612 App E protects the public from radionuclide releases caused by accidents or events because even though the 1-hour average CTP exceeded RTP, the operators completed adequate and timely action to re-establish compliance with procedure and license RTP requirements.

MTMif: The PD was associated with the human performance attribute of the Barrier Integrity Cornerstone and adversely affected the cornerstone objective of providing reasonable assurance that the fuel cladding protects the public from radionuclide releases caused by accidents or events. Specifically, one of the following occurred: after the 1-hour average CTP exceeded the RTP, operators did not take adequate or timely action to prevent exceeding the 2-hour average CTP from exceeding RTP; fuel integrity limits were exceeded; or maximum thermal power entered an unanalyzed region. See NEI Position Statement, referenced in RIS 2007-21, Revision 1 (ML090220365) for more guidance.

10. Worker Fatigue

Example 10.a Failure to Limit Work Hour Waivers for Covered Workers As Necessary For Safety or Security.The licensee is required by regulation or standard to manage fatigue for covered workers. This includes the number of work hours, waivers and exceptions, self-declarations, and fatigue assessments.

The PD: The licensee failed to provide individual waivers when individuals exceeded working hour guidance which was contrary to a regulatory requirement or a licensee standard.

Minor if: This incident did not adversely affect a cornerstone objective because it was reasonably determined not to have demonstrated the potential to erode the effectiveness of work hour controls.

MTMif: The licensees inappropriate use of a waiver adversely impacted a cornerstone objective. Various cornerstones could become impacted depending upon the waiver, the work performed, and the consequence of the issue. For example, the inappropriate use of waivers allowed workers to become fatigued. Because of the workers fatigue, a maintenance error was introduced which adversely impacted the function of a safety -related or risk significant SSC. This adversely affected the equipment performance and human pe rformance attributes of the mitigating systems cornerstone objective. Specifically, the configuration error resulted in a challenge to a critical safety functions and fatigue could not be ruled out as a contributor.

Issue Date: 10/26/23 44 0612 App E Example 10.b Failure to Assess Individuals Competency to Perform Duties Prior to Granting Work Hour Waivers. The licensee is required by regulation or standard to manage fatigue for covered workers. This includes the number of work hours, waivers and exceptions, self-declarations, and fatigue assessments.

The PD: The licensee failed to evaluate fatigue on an individual basis which was contrary to a regulatory requirement or a licensee standard.

Minor if: The failure to assess a covered worker face to face prior to granting work hour waivers did not adversely affect a cornerstone objective because it was reasonably determined not to have demonstrated the potential to erode the effectiveness of work hour controls.

MTMif: The licensees inappropriate use of a waiver adversely impacted a cornerstone objective. Various cornerstones could become impacted depending upon the waiver, the work performed, and the co nsequence of the issue. For example, a licensed operator, working under a waiver, without having received a face-to-face assessment, incorrectly reconfigured a safety-related structure, system, or component. The failure to assess covered workers face-to-face prior to granting work hour waivers was associated with the equipment performance and human performance attribute of the i nitiating events cornerstone objective.

Specifically, the configuration error resulted in an at-power event that upset plant stability and challenged critical safety functions and fatigue could not be ruled out as a contributor.

11. Cybers ecurity

Example 11.a NEI 08-09, Appendix A, Section 3.1.6 - Mitigation of Vulnerabilities and Application of Cyber Security Controls

A critical digital asset (CDA) was classified by the licensee as a direct CDA and the inspectors discovered that the licensee had inadequately implemented some of the technical controls in Appendix D of NEI 08-09, Cyber Security Plan for Nuclear Reactors.

The PD: The licensees failure to implement the required controls for a direct CDA as required by regulatory requirements or self-imposed standards.

Minor if: Upon reassessment, the CDA met the criteria for an indirect CDA in accordance with NEI 13-10 and all the required baseline controls were in place for an indirect CDA. The PD can also be minor if the CDA met the criteria for an indirect CDA in accordance with NEI 13-10 and alternate controls were in place that were commensurate to the required baseline controls.

MTMif: If the required baseline controls for an indirect CDA were not in place, or the required Appendix D & E security controls were not in place for a

Issue Date: 10/26/23 45 0612 App E direct CDA, or adequate alternate security controls were not in place for either indirect or direct CDA.

Example 11.b NEI 08-09, Appendix D, Section 1.17 - Wireless Access Restrictions

The CSP requires that scans are conducted every 31 days for unauthorized wireless access points in accessible areas. Inspectors found that the licensee had missed a scan as required by site procedures,

the scan was required within 31 days, but was not performed until 35 days.

The PD: The licensee failed to follow procedures which was contrary to a regulatory requirement or a licensee standard.

Minor if: Once the scan was completed, no wireless access points were identified.

This is a failure to implement a requirement that had no safety, security, or emergency preparedness impact. The scanning delay was not significant (e.g., less than 25 percent of the required frequency - in this case less than 7 days) and review of logs indicates that no rogue connections occurred during the delay period.

MTMif: The PD adversely affected the security cornerstone objective because multiple scans were being routinely missed or significantly delayed (e.g.,

more than 25 percent of the required frequency - in this case more than 7 days), or because rogue wireless access points were identified after the scan was conducted or logs were reviewed.

Example 11.c NEI 08-09, Appendix D, Section 4.3 - Password Requirements

The inspector performed an initial review of the cybersecurity control assessment that was completed for an auxiliary feedwater control system which was determined to be a direct CDA. During the review, the inspector observed that the evaluation for the password security control stated that a password was not required and there was not an alternate control evaluation performed. The digital device had the capability to store a password in order to provide protective measures for access control and multiple threat vectors existed. All other security controls had been properly evaluated and implemented.

The PD: Failure to implement the required password security control for a direct CDA as required by regulatory requirements or self-imposed standard.

Minor if: This is an isolated incident and alternate controls were implemented (e.g.,

component was in a locked vital area and had a locked cover protecting the device from being reconfigured) even though the alternate control evaluation was not performed and documented in the cybersecurity control assessment. However, the licensee was able to provide an

Issue Date: 10/26/23 46 0612 App E evaluation that demonstrated that alternate controls/countermeasures mitigate the consequences of the threat/attack vectors.

MTMif: The PD adversely affected the security cornerstone objective because alternate controls were not implemented to protect this device. While the device was located in a vital area, the device could be reconfigured, or alternate controls were implemented to protect this device, but the licensee was not able to provide an evaluation demonstrating that the alternate controls/countermeasures mitigate the consequences of the threat/attack vector(s) (mitigated the consequences of an attack the control was designed to protect).

Example 11.d NEI 08-09, Appendix E, Section 10.3 - Baseline Configuration

The inspector performed a review of the cybersecurity control assessment for a CDA. The licensee failed to implement the cybersecurity control E10.3 Baseline Configuration which requires licensees to document and maintain an up-to-date, complete, accurate, and readily-available baseline for each CDA. When the inspector asked for the running configuration of software on the CDA, a discrepancy between the documented baseline configuration and the running configuration was identified.

The PD: Failure to implement baseline configurations of digital devices within the scope of 10 CFR 73.54 as required by regulatory requirements or self-imposed standard.

Minor if: This is an isolated incident and the discrepancy between the baseline and running configuration was an incorrect parameter - such as a version number - related to software that did not impact the effectiveness of other security measures (e.g., vulnerability management). Missing attributes did not introduce a new vulnerability or an unmitigated vulnerability.

MTM if: The baseline configuration did not list software identified in the running configuration, the gap was not an isolated incident, or an incorrect version impacted the effectiveness of other security measures.

Example 11.e NEI 08-09, 4.4 Ongoing Monitoring and Assessment

The inspector performed a review of the cybersecurity control assessment for a digital device within the scope of 10 CFR 73.54. When performing verification of implemented security controls, the inspector identified a security control that should have been implemented on the digital device but was not. The inspector also determined that the licensee had provided no documented evidence verifying ongoing monitoring of the controls for the selected digital device.

Issue Date: 10/26/23 47 0612 App E The PD: Failure to implement the required verification of the security controls for a digital device within the scope of 10 CFR 73.54 as required by regulatory requirements or self-imposed standard. NEI 08-09 4.4 Ongoing Monitoring and Assessment states Ongoing assessments to verify that the cybersecurity controls implemented for CDAs remain in place throughout the life cycle of the CDA.

Minor if: If an undetected or unauthorized change to a single security control would not result in a reduction in the effectiveness in the defense in depth protective strategy or there are no unmitigated vulnerabilities. An example would be a reboot of a CDA that resulted in an unneeded application or service running that had previously been disabled. If the running application or service did not introduce any known vulnerabilities required to be assessed per the vulnerability management policy, and other defense in depth measures - such as a security information and event management (SIEM) identifying new traffic from a port used by the application - could mitigate the effect of the change, then the violation would be minor.

MTM if: The PD adversely affected the security cornerstone objective because failure to perform ongoing assessments of implemented cybersecurity controls does not provide adequate protection by not verifying that the cybersecurity controls implemented for CDAs remain in place throughout the life cycle of the CDA. Failure to perform ongoing assessments of cybersecurity controls also does not provide adequate protection for detecting unauthorized changes to data or software that could adversely affect safety, security, and emergency preparedness (SSEP) functions.

Example 11.f NEI 08-09, Appendix D, Section 5.1 Removal of Unnecessary Services and Programs

The inspector performed an initial review of the cybersecurity control assessment of an engineering workstation between security levels 3 and 4. The review found numerous unnecessary services installed and not disabled on the workstation.

The PD: The licensee failed to remove and/or disable software components that are not required for the operation and maintenance of the device which was contrary to a regulatory requirement or a licensee standard.

Minor if: If the service or program does not introduce an unmitigated vulnerability on the device. An example would be Server Message Block (SMB) on a device where the operating system has been patched for the vulnerability.

MTM if: If the licensee has an unnecessary service or program and failure to implement this control would result in a reduction of the defense-in -depth protective strategy - such as not establishing an accurate baseline configuration, not adequately screening vulnerability notices or having the ability to detect an exploitable vulnerability, not having the ability to

Issue Date: 10/26/23 48 0612 App E determine that the unnecessary service has been enabled or an unnecessary port in processing unidentified or unauthorized traffic, etc.

Example 11.g NEI 08-09, Appendix E, Section 5.5 Physical Access Control

The inspector performed a review of the cybersecurity control assessment and a walkdown of an x -ray machine located in a warehouse outside of the protected area. The review determined that insufficient physical security controls were implemented for the x -ray machine.

The PD: Failure to implement controls for CDAs as required by the licensee's Cybers ecurity Plan. Specifically, the licensee failed to implement all necessary controls for CDAs located outside the protected area.

Minor if: The licensee can demonstrate functionality and adequate defense in depth protections to determine if the security function provided by the x-ray machine has been compromised prior to operation. Adequate alternate controls for a real-time intrusion protection (i.e., automated detection capabilities) to immediately facilitate dispatching security personnel to investigate and/or remediate a potential cybersecurity concern include a combination of the followingphysically protecting the x-ray machine with serialized tamper seal tape, random security guard patrols, cameras monitored by Site Security 24/7 and/or testing to verify operability prior to use of searching packages/materials for contraband.

See NEI 08- 09 Appendix E.3.6 for the security control Security Functionality Verification.

MTM if: The licensee failed to implement or implemented inadequate alternate controls to prevent and detect a compromise of near real time detection of compromise of the security function of the x -ray machine.

Example 11.h NEI 08-09, appendix E, section 12, Evaluate and Manage Cyber Risk, (Vulnerability Management).

The inspector performed a review of the cybersecurity control assessment for a device within the scope of 10 CFR 73.54. The licensee stated that they were following NEI 08-09 Addendum 5 for their vulnerability management process. The inspector determined that the licensee had not adequately implemented vulnerability assessments.

The PD: Failure to implement a vulnerability management process as required by regulatory requirements or self-imposed standard.

Minor if: Vulnerability notices for applicable CDA software or firmware are tracked in the licensees vulnerability management process using the periodicity specified in their cybersecurity plan but the inspection identified an isolated vulnerability not identified by the licensee.

Issue Date: 10/26/23 49 0612 App E MTM if: Review of vulnerability notices was based on limited input (i.e., not based on multiple credible sources) or incorrectly performing vulnerability assessments using the Common Vulnerability Scoring System (CVSS ) as specified in NEI 08-09 Addendum 5.

12. External Events

Example 12.a During the inspectors review of the ignition sources in a given fire area, the inspectors discovered that the licensees fire PRA failed to identify and evaluate all targets within an ignition sources zone of influence that could potentially contribute to the risk analysis of fire scenarios.

The PD: Failure to address the risk contribution associated with all potentially risk significant fire scenarios for a given fire compartment/area, in the fire PRA is contrary to regulatory requirements or self-imposed standard.

Minor if: When corrected, the risk significance of fire scenarios in the fire compartment/area did not increase. The initiating events cornerstone objective was not adversely affected since the fire protection strategies for the area/zone remained sufficient even with the error.

MTMif: The fire PRA and the safe shutdown strategy had to be revised to address the risk contribution associated with the fire scenarios. The initiating events cornerstone objective was adversely affected because the actual risk of fire scenarios was not known, and sufficient prevention and mitigation measures were not in place (i.e., revisions to fire response procedures or detection or suppression equipment were necessary).

Example 12.b The licensee relocated FLEX equipment as part of refueling outage preparations because the normal haul path was impacted by outage equipment staging. The inspectors identified that pre-outage staging and relocation of FLEX equipment resulted in N and N+1 FLEX equipment being stored in an unprotected manner, though still functional, for 23 days without appropriate compensatory protective measures being taken.

The PD: Failure to meet NEI 12-06, Revision 4, which the licensee is committed to for pre-staging FLEX equipment, is contrary to regulatory requirements or self-imposed standards.

Minor if: The mitigating systems cornerstone objectives were not adversely affected. N FLEX capability was met with unprotected equipment that lacked appropriate compensatory measures for less than or equal to 14 days as allowed by NEI 12-06, Revision 4, or N FLEX capability was met though with unprotected equipment with appropriate compensatory measures that were implemented for less than or equal to 90 days, as allowed by NEI 12-06, Revision 4.

Issue Date: 10/26/23 50 0612 App E MTMif: The mitigating systems cornerstone objectives were adversely affected since equipment unavailability exceeded previously approved limitations in NEI 12-06, Revision 4. The FLEX equipment was unprotected without compensatory protective measures for greater than 14 days, was unprotected with appropriate compensatory protective measures for greater than 90 days, or both trains were non-functional or unavailable for greater than 7 days.

Example 12.c The inspectors identified that licensee procedures for FLEX equipment storage did not ensure that FLEX equipment would be maintained at a temperature that ensured its likely function when called upon. Specifically, licensee procedures did not address protection of FLEX equipment from cold weather in the event of a power loss to the FLEX storage buildings.

NEI 12-06, Section 8.3.1.2, states, in part, Storage of FLEX equipment should account for the fact that the equipment will need to function in a timely manner.

The PD: The licensee did not provide direction on ensuring FLEX equipment remained protected from cold weather upon a loss of power to the FLEX storage buildings which was contrary to a regulatory requirement or a licensee standard.

Minor if: The mitigating systems cornerstone objectives were not adversely affected since cold weather conditions severe enough to impair the likely ability of FLEX equipment to function never occurred and are not expected to occur. A review of meteorological data from the site show that typical cold weather experienced by the site would not drop FLEX storage building temperature below the temperature range at which the equipment would be likely to function when called upon (i.e., the typical duration for low temperatures would not adversely affect the functionality of the equipment).

MTMif: The mitigating systems cornerstone objectives were adversely affected since cold weather conditions sufficient to impair the likely ability of FLEX equipment to function had occurred, was occurring, or is known to occur occasionally at the site. Actual FLEX storage building temperatures dropped below the temperature at which FLEX equipment would be likely to function when called upon, or typical cold weather experienced by the site would be cold enough for a sufficient duration to raise reasonable doubts about the likeliness that FLEX equipment would function when called upon.

Example 12.d The inspectors identified that cabling associated with two independent channels of spent fuel pool level instrumentation installed as part of post-Fukushima requirements, were routed in such a way that they came into physical contact with each other. The licensee is committed to a design in which there are two fully independent and redundant spent fuel pool level

Issue Date: 10/26/23 51 0612 App E monitoring systems that will provide continuous wide range water level indication.

The PD: The licensee did not maintain two independent spent fuel pool level monitoring channels in accordance with self-imposed standards.

Minor if: The barrier integrity cornerstone objective was not adversely affected.

The minor contact of the shielded jackets of the coaxial signal cables at a single point did not impair the function of the spent fuel pool level instruments. Further, the minor contact would not be expected to significantly increase the likelihood of a common mode failure due to the flexible nature of the cables and outer protective layer of the coaxial cables being resistant to abrasion.

MTMif: The barrier integrity cornerstone objective was adversely affected. The function of one or more of the spent fuel pool level instrumentation channels was impaired or there were indications of ongoing damage to the cables that did not yet impair the function of the spent fuel pool level instrumentation but would be expected to had the condition not been identified and corrected. Incorrect or unreliable spent fuel pool level indication can impair the ability to ensure adequate spent fuel pool cooling.

13. Service life

Example 13.a In 2005, the licensee assessed (as required by regulatory requirements or self-imposed standards) a Vendor Bulletin which stated the period of time that a Molded-Case Circuit Breakers (MCCBs) can be installed without refurbishment or replacement is 20 years for mild environment applications. Vendor Bulletin stated that this time interval could be extended through preventive maintenance, testing, and aging analysis based on operational usage (number of demands or cycles) and actual plant conditions. The licensees engineering evaluation of the Bulletin concluded that based on the environmental conditions and usage of the affected MCCBs, the MCCBs should either be refurbished or replaced before exceeding 20 years of service. T he licensee planned to revise their MCCB preventive maintenance procedures by 2008 to require refurbishment or replacement of all MCCBs in safety -related systems prior to exceeding 20 years of service.

During this inspection (2016), the preventive maintenance procedures had not been updated thus the affected MCCBs remained in service for 26 to 28 years, well beyond their 20 year refurbishment or replacement interval. To date, no MCCBs failures have occurred at the licensees site.

The PD: The licensee failed to translate MCCB refurbishment/replacement schedules into maintenance instructions contrary to regulatory requirements or self-imposed standards.

Issue Date: 10/26/23 52 0612 App E Minor if: If left uncorrected, it is not reasonable to conclude the PD would have the potential to lead to a more significant safety concern. Specifically,

• the licensee re-evaluated existing preventive maintenance procedures and determined the intent of the Vendor Bulletin was met,

-or-

• the licensee re-analyzed the existing engineering evaluation (or performed a new one after NRC identification of the issue) and determined the newly calculated time period extended beyond the expiration of the operating license. In performing the new engineering evaluation, the conditions in MTM below did not apply.

MTM if: If left uncorrected, the PD has the potential to lead to a more significant safety concern. Specifically, absent NRCs intervention, the licenses failure to establish and perform appropriate preventative maintenance refurbishments or replacements can lead to in-service component deterioration and resultant failures of MCCBs to perform their safety-related functions.

-or-

The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, exceeding the previously analyzed time period for replacement or refurbishment caused reasonable doubt on the continual ability of the MCCBs to perform their safety -related functions. In re-analyzing the existing engineering evaluation (or in performing a new one after NRC identification of the issue), the licensee (a) used a different approach because the original approach resulted in unfavorable margin; or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin falls outside the licensees design process acceptance criteria. Unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification.

Example 13.b The inspectors noted that for the nuclear grade valve actuators, Limitorque only specified a life expectancy of 40 years or 2000 cycles, whichever came first.With implementation of extended 20-year plant licenses, EPRI conducted Limitorque actuator testing to develop a methodology that may be applied to justify extension of the life of an actuator to 60 years and 4000 c ycles. Licensees referencing this methodology must implement the conditions specified in the EPRI report to extend the life of their actuators. The Limitorque actuator fatigue life extension process requires additional engineering review, analysis, and

Issue Date: 10/26/23 53 0612 App E thrust evaluation of each actuator to justify the life e xtension. Limitorque has approved the use of the EPRI methodology for actuator fatigue life extension. While reviewing MOV program documents, the inspector noted that the licensee had extended the service life of its Limitorque MOVs without a corresponding engineering analysis. The inspector noted the licensee already entered their period of extended plant operation.

The PD: The licensee failed to analyze the acceptability of extending the service life of MOV (specific name(s)) which is contrary to 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, (or for MOVs, 10 CFR Part 50.55a(b)(3)(ii))

Minor if: The PD did not adversely affect the mitigating systems cornerstone objective because once performed, the additional engineering review, analysis, and thrust evaluation of each actuator demonstrated the actuators met their design basis functions for their extended design life and the subject valves do not need additional testing or maintenance as a result of the verification per the site MOV program documents. In performing the reviews and analysis, the conditions in MTM below did not apply (i.e., for minor, design assumptions were not changed to obtain favorable results).

MTM if: (Assuming an actuator exceeded 40 years or 2000 cycles) The PD was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, (1) the licensee was unable to verify that the valves were operable based on the assessment of the conditions in the EPRI report; or (2) as a result of this issue, the licensee now needs to conduct maintenance or testing of the subject valves per the site MOV program documents; or (3) regardless of the final operability or functionality, the as -found condition was such that there was reasonable doubt with respect to the assurance of availability and reliability. For example, to ensure qualification, the licensee (a) used a different approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin falls outside the licensees design process acceptance criteria.

(Use if the actuator did not exceed 40 years or 2000 cycles) If left uncorrected, the valves actuator would have been installed beyond its demonstrated life - challenging the capability and reliability of thevalve to perform its safety function when called upon in a harsh environment during a design basis accident. Specifically, without NRC identification, the actuator would likely have exceeded its demonstrated life because the licensee had not scheduled a replacement prior to the identification and (1) the licensee was unable to verify that the valves would remain

Issue Date: 10/26/23 54 0612 App E operable based on the assessment of the conditions in the EPRI report; or (2) to ensure qualification beyond the 40 years/2000 cycles, the licensee (a) used a different approach because the original approach resulted in unfavorable margin (where unfavorable margin means that had the correct values been used originally, the licensees design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin falls outside the licensees design process acceptance criteria.

14. Security

Example 14.a The licensee revised their target set(s) by removing a common element from multiple sets but failed to provide training to security personnel for the changes.

The PD: The licensee failed to train security personnel on site specific target sets as required by 10 CFR Part 73, Appendix B, requirements (Section VI, C.2(c)(10)).

Minor if: Removal of the target set elements did not affect the defense-in-depth approach used in the licensees strategy to protect against design basis threats nor would it have reduced the assurance of protection.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, the licensees protective strategy could deploy or potentially redirect security personnel to protect the removed target set elements, leaving other target set equipment unprotected.The defense in depth approach and assurance of protection against design basis threats was adversely affected.

Example 14.b The location(s) to disable target set equipment were not identified.

The PD: The licensee failed to document and maintain an adequate process to develop and identify target sets, to include the site-specific analyses and methodologies used to determine and group the target set equipment or elements as required by 10 CFR Part 73.55(f)(1).

Minor if: The location missed was collocated with other target set locations already considered.

MTMif: The inadequate process to identify target set element locations could lead to a more significant safety concern. Specifically, if the licensees process does not have guidance to identify alternate locations, as evident through multiple identified examples, it could result in locations not being adequately protected, impacting the physical protection programs ability to prevent significant core damage and/or spent fuel sabotage.

Issue Date: 10/26/23 55 0612 App E Example 14.c Target set elements were not identified.

The PD: (a) If the target set element is not currently protected by the protective strategy:

The licensee failed to analyze and identify site-specific conditions, including target sets, that may affect the specific measures needed to implement the requirements of this section and account for these conditions in the design of the physical protection program as required by 10 CFR Part 73.55(b)(4).

(b) If the target set element(s) is currently protected by the protective strategy:

The licensee failed to document and maintain an adequate process to develop and identify target sets, to include the site-specific analyses and methodologies used to determine and group the target set equipment or elements.

Minor if: (a) The element of a target set that was missed is currently being protected by the protective strategy (i.e., by virtue of proximity to other target set equipment) and the element is being appropriately considered in the insider mitigation program (i.e., by virtue of proximity of other target set equipment).

(b) The target set element was not a standalone target set and it was an isolated incident.

MTMif: (a) The PD adversely affected the security cornerstone objective.

Specifically, the licensees target set process did not identify the target set element, or a standalone target set, to inform the sites physical protection program, thereby compromising the protection of target set equipment.

The defense in depth approach and assurance of protection against design basis threats was adversely affected.

(b) The inadequate process to identify target set elements could lead to a more significant safety concern. Specifically, if the licensees process does not have guidance to identify target set elements, as evident through multiple identified examples, it could result in target set elements not being adequately protected, impacting the physical protection programs ability to prevent significant core damage and/or spent fuel sabotage.

Example 14.d Cyberattacks were not considered in the identification of target sets.

The PD: The licensee failed to consider cyberattacks in the development and identification of target sets, as required by 10 CFR Part 73.55(f)(2).

Issue Date: 10/26/23 56 0612 App E Minor if: The licensees assessment showed that any identified critical digital assets not already included in target sets are protected (i.e., by virtue of proximity to other target set equipment already identified).

MTM if: The PD adversely affected the security cornerstone objective.

Specifically, the licensees process to identify and develop target sets did not identify critical digital assets that would compromise the ability of a target set element to perform its function of preventing significant core damage or radiological sabotage. The defense in depth approach and assurance of protection against design basis threats was adversely affected.

Example 14.e Security personnel were not properly suited, trained, equipped, or qualified to perform their assigned duties and responsibilities in accordance with their Commission-approved training and qualification plan.

The PD: The licensee failed to implement required training requirements for security personnel in accordance with Part 73, Appendix App B (section VI.A.2).

Minor if: Security personnel did not receive all the required training; however, they did not work at a post that required the missed training.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, security personnel were not trained in accordance with training requirements and performed duties associated with the missed training.

Example 14.f Licensee did not perform testing of perimeter intrusion detection system (IDS) using the most likely penetration methods as required by the security plan.

The PD: The licensee failed to test and verify that security systems and equipment remained capable of performing their intended security function as required by 10 CFR 73.55(n)(i).

Minor if: The IDS zone was retested with the most likely penetration method, and it detected in accordance with requirements.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, the IDS zone failed to detect when using the most likely penetration method.

Issue Date: 10/26/23 57 0612 App E Example 14.g Licensee failed to add critical personnel to the critical group.This resulted in critical personnel not receiving periodic clinical interviews and reinvestigations.

The PD: The licensee failed to ensure critical personnel would receive periodic clinical interviews as part of their psychological reassessments and periodic reinvestigations as required by 10 CFR 73.56.

Minor if: None of the affected personnel exceeded the critical group reinvestigation/reassessment period.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, personnel exceeded the critical group reinvestigation/reassessment period.

Example 14.h Licensee security personnel, in a ready room or staging area, do not have all required contingency equipment readily available.

The PD: The licensee failed to ensure that all firearms, ammunition, and equipment necessary to implement the site security plans and protective strategy are in sufficient supply, are in working condition, and are readily available for use as required by 10 CFR 73.55(k)(2).

Minor if: All responders were aware of the location of the equipment and would be able to retrieve the necessary security equipment in-route to the response position without exceeding the response timeline as described in the licensees protective strategy.

Not minor if: The PD adversely affected the security cornerstone objective.

Specifically, the responders would not be able to retrieve the necessary security equipment within the predetermined timeline and the time difference between the responder timeline and the adversary timeline precludes the ability to intercede (as determined by the training timelines to open port, ready weapon, and engage).

Example 14.i Responders predetermined timelines were not analyzed or identified.

The PD: The licensee failed to analyze and identify site-specific conditions, including target sets, that may affect the specific measures needed to implement the requirements of 10 CFR 73.55 and account for these conditions in the design of the physical protection program as required by 10 CFR 73.55(b)(4). 10 CFR 73.55(k)(4) requires measures to provide armed response personnel consisting of armed responders which may be augmented with armed security officers to carry out armed response duties within predetermined timelines specified by the site protective strategy.

Issue Date: 10/26/23 58 0612 App E Minor if: Upon identification, the licensee was able to demonstrate that the timeline for the responder to arrive at their defense position would not have exceeded the adversary timeline and provided adequate time to intercede (as determined by the training timelines to open port, ready weapon, and engage).

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, the responders timeline could exceed the potential adversary time or did not provide enough time to intercede.

Example 14.j The tactical weapons course of fire did not include all the elements required by the Commission-approved training and qualification plan. For example, the licensee did not require tactical reloading while conducting specific maneuvers, and this was not included in the handgun or rifle course of fire.

The PD: The licensee failed to conduct weapons training and qualification in accordance with 10 CFR Part 73, Appendix B, requirements; the licensees training and qualification plan; and associated implementing procedures.

Minor if: The elements are contained in another course of fire used for qualification and officers are trained at the same periodicity and proficiency standards as the tactical weapons training course of fire.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, security personnel are not trained on all the elements required by the Commission approved training and qualification plan.

Example 14.k Vehicle left unattended/unsecured inside the protected area (PA).

The PD: The l icensee failed to exercise control over all vehicles inside the PA to ensure that they are used only by authorized persons and for authorized purposes as required by 10 CFR 73.55(g)(3)(i).

Minor if: The vehicle could not reasonably be assumed to have the capability and opportunity to damage target set or vital equipment.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, the vehicle was a large vehicle (i.e., larger than a standard passenger car or truck that consumers might purchase at a dealership) and could reasonably be assumed to have the capability and opportunity to damage target set equipment.

Issue Date: 10/26/23 59 0612 App E Example 14.l Tours or observations associated with unattended openings or compensatory measures are not being conducted at the frequency required by the security plan, procedures, or analyses.

The PD: The licensee failed to conduct tours or observations at the frequency required by their security plan.

Minor if: The frequency at which tours or observations were being conducted was sufficient to prevent an adversary from exploiting a vulnerability even though the frequency did not meet the requirement imposed by the sites security plan or procedures.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, the frequency at which tours or observations were being conducted was insufficient to prevent an adversary from exploiting a vulnerability.

Example 14.m Training program did not simulate the specific conditions of the protective strategy.

The PD: The training program fails to simulate, as closely as practicable, the specific conditions under which the individual shall be required to perform assigned duties and responsibilities as required by 10 CFR 73, Appendix B, Section VI.A.5.

Minor if: The failure does not reasonably impact the implementation of the protective strategy, or the training inadequacy has existed for less than 6 months.

MTM if: The PD adversely affected the security cornerstone objective.

Specifically, the failure reasonably impacts the implementation of the protective strategy and has existed for more than 6 months.

Example 14.n Vital area (VA) access was not limited to only those who need access.

The PD: The licensee fails to limit access to vital areas to only those individuals who have a continued need for access to specific vital areas as documented on their VA access list required by 10 CFR 73.56(j).

Minor if: The issue was an isolated human error that did not adversely affect the security cornerstone objective.

MTMif: The PD adversely affected the security cornerstone objective.

Specifically, the failure provided VA access to populations of people that did not actually need it or failed to distinguish access to specific vital areas.

Issue Date: 10/26/23 60 0612 App E Example 14.o A document labeled as safeguards information was discovered in an unsecured location.

The PD: The licensee failed to secure unattended safeguards information in a locked security storage container in accordance with the requirements.

Minor if: A subsequent review of the document determined that it did not contain safeguards information or that the information contained in the document no longer needed to be protected as safeguards. Specifically, the information was determined to be generic in nature or no longer reflects the current configuration of the licensees physical protection program.

MTM if: The PD adversely affected the security cornerstone objective to provide assurance that the licensees security program used a defense-in -depth approach and could protect against the design basis threat of radiological sabotage from external and internal threats. Specifically, a subsequent review of the document confirmed the presence of current and accurate safeguards information and the licensees failure to properly secure that safeguards information increased the potential that physical protecti on program information associated with the design basis threat common to all power reactor licensees or associated with site specific considerations could be compromised.

END

Issue Date: 10/26/23 61 0612 App E Attachment 1: Revision History for IMC 0612 Appendix E

Commitment Accession Description of Change Description of Comment Resolution and Tracking Number Training Closed Feedback Forms Number Issue Date Required and Accession Number (Pre-Change Notice Completion Decisional, Non-Public Date Information)

N/A ML031610641 Initial issuance of Appendix E to IMC-0612 which N/A N/A 06/24/2003 provided numerous new examples of minor CN 03-021 violations in Appendix E.

N/A ML051400260 Appendix E was revised to add minor issue N/A N/A 05/19/2005 examples pertaining to maintenance risk CN 05-014 assessments and risk management issues resulting from baseline inspection procedure IP 71111.13, Maintenance Risk Assessments and Emergent Work Evaluation. In addition, additional clarifications have been made to the existing maintenance rule minor issues examples.

N/A ML052700276 Appendix E was revised to provide additional N/A N/A 09/30/2005 examples of cross-cutting aspects and additional CN 05-028 examples of minor findings were added.

N/A 02/10/2006 Revision history reviewed for the last four years. N/A N/A N/A ML0607301310 Appendix E was revised to remove discussion of Yes N/A 6/22/06 cross-cutting aspects of inspection findings. A new 07/01/2006 CN 06-015 appendix, Appendix F, was created to provide examples of cross-cutting aspects of inspection findings which reflected the work by the safety culture working group.

NA ML070720202 Appendix E Section 4, Example k (fire loading) was N/A ML071560246 09/20/07 revised to provide more detail in aid of a minor CN 07-029 versus more-than-minor determination.

N/A ML083040261 Appendix E was revised to add Health Physics, N/A ML083040254 07/08/09 Thermal Power, Maintenance Rule, and Worker CN 09-017 Fatigue Examples.

Issue Date: 10/26/23 Att1-1 0612 App E Commitment Accession Description of Change Description of Comment Resolution and Tracking Number Training Closed Feedback Forms Number Issue Date Required and Accession Number (Pre-Change Notice Completion Decisional, Non-Public Date Information)

NA ML092190386 Appendix E, Section 6, Example e: was revised to N/A N/A 08/11/09 correct a logic error in the Minor because CN 09-020 paragraph. The example is minor only if both the activity is indistinguishable from background, and the dose to an individual was less than 1% of the occupational or public dose limit.

N/A ML18093B550 Appendix E, Section 10 was added to provide N/A ML18093B551 10/01/18 minor and more than minor examples for Cyber CN 18-033 Security Violations

ML19247C385 Appendix E went through a major revision to ML19247C919 12/23/19 address feedback forms, OIG 16-A-21 CN 19-042 recommendation 2, and Browns Ferry Lessons FBF 0612E-1379 Learned Recommendation 13. The examples were ML19226A028 revised to mirror the language in the more-than-FBF 0612E-1 431 minor screening questions in IMC 0612 Appendix B ML19316A007 to illustrate when the examples in Appendix E were FBF 0612E-1470 more than minor. ML19226A030 FBF 0612E-1473 New examples were added in the areas of physical ML19226A032 security, worker fatigue, service life, Part 37 and FBF 0612E-1546 external events. ML19226A033 FBF 0612E-1582 ML19316A020 FBF 0612E-1613 ML19226A034

Issue Date: 10/26/23 Att1-2 0612 App E Commitment Accession Description of Change Description of Comment Resolution and Tracking Number Training Closed Feedback Forms Number Issue Date Required and Accession Number (Pre-Change Notice Completion Decisional, Non-Public Date Information)

FBF 0612E-1615 ML19226A035 FBF 0612E-1644 ML19226A036 FBF 0612E-1687 ML19226A037 FBF 0612E-1695 ML19226A038 FBF 0612E-1705 ML19226A039 FBF 0612E-1784 ML19226A040 FBF 0612E-1789 ML19226A041 FBF 0612E-1913 ML19226A042 FBF 0612E-1931 ML19226A043 FBF 0612E-2036 ML19226A044 FBF 0612E-2037 ML19226A045 FBF 0612E-2139 ML19226A057 FBF 0612E-2140 ML19226A046 FBF 0612E-2150 ML19316A029 FBF 0612E-2195 ML19226A047 FBF 0612E-2213 ML19226A048 FBF 0612E-2252 ML19316A074

Issue Date: 10/26/23 Att1-3 0612 App E Commitment Accession Description of Change Description of Comment Resolution and Tracking Number Training Closed Feedback Forms Number Issue Date Required and Accession Number (Pre-Change Notice Completion Decisional, Non-Public Date Information)

ML20274A210 Incorporated recommendations from two feedback ML20275A011 12/10/20 forms.Removed the abc and xyz in the PDs from the CN 20-070 last revision. Removed the programmatic issue FBF 0612E-1526 reference in example 10.b. Revised example 13.a. ML19316A015 Added examples for POV, fire protection, service life FBF 0612E-1723 and security. Improved the consistency of the MTM if ML20275A204 statements.

ML23214A343 Updated section 11 minor examples for cybersecurity. N/A 10/26/23 Example 11.a was changed to address a violation CN 23-031 relating to security control application because of incorrect classification of a CDA. New minor examples were added in the areas of baseline configurations, ongoing monitoring and assessment, removal of unnecessary services and programs, physical access control, and vulnerability management. See ML23227A094 for regional working group comment resolution. Clarified note regarding example 5.c.

Issue Date: 10/26/23 Att1-4 0612 App E