ML24023A620

Independent Nuclear Safety Consultant Assessment of the Root Cause Analysis Performed by NCNR Into the February 3, 2021 Event at the NIST Center for Neutron Research, Revision 1

ML24023A620
Person / Time
Site:	National Bureau of Standards Reactor
Issue date:	07/11/2023
From:	US Dept of Commerce, National Institute of Standards & Technology (NIST)
To:	Office of Nuclear Reactor Regulation
Shared Package
ML24023A617	List: ML24023A618 ML24023A619 ML24023A620 ML24023A621 ML24023A622 ML24023A623
References
Download: ML24023A620 (1)

Text

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 1 of 48 Independent Nuclear Safety Consultant Assessment of the Root Cause Analysis Performed by NCNR into the February 3, 2021 Event at the NIST Center for Neutron Research Revision: 1 July 11, 2023

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 2 of 48 Contents Executive Summary...................................................................................................................... 3 Background Information............................................................................................................... 5 The Event.................................................................................................................................. 5 The Evolution of Root Cause Efforts......................................................................................... 6 The Assessment........................................................................................................................... 6 The Team.................................................................................................................................. 7 Objectives and Methodology..................................................................................................... 7 Acknowledgements................................................................................................................... 8 The Assessment Results.............................................................................................................. 8 Objective 1 Results - Review of Event Root Cause................................................................. 8 Objective 2 Results - Review of Set of Corrective Actions..................................................... 14 Objective 3 Results - Review of NCNRs Internal Self-Assessment...................................... 15 Objective 4 Results - Period of Interest Timeline................................................................... 16 Objective 5 Results - Review of Correction Action Closures.................................................. 16 Recommendations...................................................................................................................... 16 Short Term Recommended Actions to Address AFIs:............................................................ 16 Attachments................................................................................................................................ 19 : Root Cause Evaluation Review Criteria........................................................... 20 : Corrective Action Review................................................................................. 32 : Period of Interest Timeline............................................................................... 35 : Perspectives on Contributing Causes.............................................................. 36 : Assessment Team............................................................................................ 46 : Contacts and Interviews.................................................................................. 47 : Reference Documents..................................................................................... 48 Revision Summary:

Revision 1:

Resolution of comments received after Revision 0 issued: Editorial changes; removal of reference to IMC 0310-06; Clarifications in Attachment 4.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 3 of 48 Executive Summary This report provides the conclusions of an independent and comprehensive assessment of the root cause analysis (the event root cause) performed by NCNR into the event occurring February 3, 2021, at the NIST Center for Neutron Research (the assessment). The assessment was commissioned by NCNR in accordance with the August 1, 2022, Confirmatory Order Modifying License No. TR-5 to assess the rigor, criticality, and overall quality of the event root cause, and to identify gaps in meeting associated inspection criteria. The assessment identified areas for improvement and corrective actions, and other improvement opportunities related to the event root cause.

The assessment was performed by a team of five independent root cause analysis consultants, with engineering, maintenance, operations, and performance improvement (specifically human and organization performance) experience. The team members experience includes leading and participating in the cause analyses and corrective actions for significant events to prevent recurrence and support the clearing of performance issue with the NRC.

The primary objectives of the assessment were to:

1. Determine if the event root cause analysis was complete and comprehensive, and whether additional causal factors may exist that should be further investigated.

2. Determine if the prescribed corrective actions were aligned with the event root cause conclusions, consistent with industry standards and best practices, sustainable, and likely to be effective in resolving the root cause conclusions.

3. Review the rigor, criticality, transparency, and overall quality of NCNRs internal self-assessment activities related to the event root cause.

4. Develop a Period of Interest Timeline to include historical changes, previous related events, organizational changes, demographic changes, funding factors, and function changes over the past 10-years that may have influenced the event.

5. Evaluate corrective actions, both completed and currently in progress, to determine they are being completed with rigor, adequately documented, and tracked by NCNR Management.

The assessment team reviewed the event root cause against industry standards for the conduct and documentation of root cause analysis to gauge alignment with those standards. The team then conducted collegial reviews of the individual results to determine final conclusions and recommend actions to correct the identified findings.

The assessment team found that NCNR and NIST staff have expended a considerable level of effort evaluating the accident and prescribing corrective actions to fix the identified root causes.

The efforts resulted in a total of seven (7) root causes and ten (10) contributing factors, and prescribed actions to correct the identified issues, many of which are currently in the process of implementation.

The overall assessment conclusion is that, while the event root cause provides sufficient actions such that they can be reasonably expected to prevent another undetected latching event, there are significant structural evaluation issues indicating that the root cause conclusions are not at the appropriate depth to ensure underlying organizational or cultural drivers are identified and actions prescribed. The likely result is an adverse impact on the effectiveness of the root cause in the long-term prevention of recurrence of this event, and similar events, that can challenge sustained organizational improvement. This presents a vulnerability to NCNR from a rigor of evaluation, effectiveness, and inspection perspective.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 4 of 48 Four Areas for Improvement1 (AFI) were identified:

Area for Improvement (AFI) #1: There are structural evaluation issues that indicate that root cause conclusions are not at the appropriate depth to ensure underlying organizational or cultural drivers are identified and actions prescribed.

Area for Improvement (AFI) #2: Corrective Actions specified for each root cause were not, in all cases, specific enough to implement reliably, measurable to ensure the organization can determine when adequately completed, or relevant (i.e., tied logically with the stated root cause).

Area for Improvement (AFI) #3: NCNR staff need additional training to improve skills and knowledge related to conduct and oversight of root cause analysis for significant events.

Area for Improvement (AFI) #4: There are significant gaps in closure documentation for the corrective actions prescribed by the event root cause due to not having a fully effective Closure Review Board and Closure Notebooks with complete closure documentation to support review.

AFIs #1 and #2 warrant a re-write/integration of the root cause reports and additional evaluation to analyze, in aggregate and using a more rigorous structure, the existing root causes to determine if they can be explained by more fundamental underlying factors. This should be completed as soon as practicable.

Additional actions are recommended in the report to provide training to root cause evaluators and oversight personnel in the standard and conduct for performing a root cause analysis (AFI

1. 3) and to strengthen corrective action closure documentation and oversight for actions prescribed in the root cause analysis (AFI #4).

1 Area for Improvement (AFI): A performance, program, or process element that requires significant improvement to obtain desired results in a consistent and effective manner.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 5 of 48 Background Information The National Institute of Standards and Technology (NIST) Center for Neutron Research (NCNR) owns and operates a heavy water-moderated nuclear test reactor and associated neutron beam research facility. The NCNRs reactor is licensed by the Nuclear Regulatory Commission (NRC) under the name National Bureau of Standards Reactor (NBSR).

On February 3, 2021, the Chief of NCNR Reactor Operations and Engineering notified the NRC (event notification EN 55094) of an alert concerning elevated radiation levels at the NBSR.

Pursuant to the event notification received from NCNR staff on February 3, 2021, the NRC initiated a special inspection at the NBSR. On April 14, 2021, the NRC staff issued an interim special inspection report to provide an initial assessment of their understanding of the event sequence, consequences, and the NCNRs response to the event (ADAMS Accession No. ML21077A094).

On March 16, 2022, the NRC released a final report of its initial conclusion from its special inspection report. The NRCs final report confirms and expands on many aspects of NISTs analysis of the incident, pointing to deficiencies in policies, procedures, training, and safety culture as contributing to the incident.

On August 1, 2022, a Confirmatory Order Modifying License No. TR-5 was issued by the NRC.

The issued Confirmatory Order documents action completed and planned by NCNR as well as the commitments made by NIST to enable the safe operation of the NBSR. As required by the Confirmatory Order, NCNR has engaged third-party, independent nuclear consultants to conduct an independent assessment of the event root cause.

The Event On February 3, 2021, the NBSR reactor was conducting a normal start up after completing a refueling on January 4, 2021. Upon approach to full power, the plant experienced a sudden drop in power level and rapid increases on several radiation monitors, including fission products monitor (RM 3-2) and the stack monitor (RM 4-1). A major scram was automatically initiated when the stack monitor reached its setpoint of 50,000 counts per minute, and an immediate activation of the confinement isolation system sealed off confinement to prevent or limit release of radioactive material from the facility. NCNR and NIST staff took emergency actions, including declaring an Alert condition, notifying the Nuclear Regulatory Commission (NRC) as required by regulations, and stabilizing the plant. The Alert declaration was subsequently downgraded based on analysis of radiological sampling revealed that the radiological conditions at the Site Boundary and at the reactor confinement exhaust stack did not meet the conditions for the Alert declaration. The emergency was terminated later that day and the staff began recovery actions.

A post-incident in-core video inspection revealed that one fuel element, that was thought to be secured, had lifted out of its secured position in the lower core grid plate and was skewed in an apparent unlatched condition.2 This resulted in a lack of cooling to the element and fuel failure as reactor power level was raised. The consequences of the accident included significant fuel damage and resultant release of radioactive fission products, violation of plant Technical Specifications, increased radioactive dose exposure to NCNR personnel, long-term loss of facility use, and considerable costs associated with cleanup and recovery. A root cause analysis was subsequently performed to identify the cause of the fuel failure and prescribe corrective actions to prevent recurrence.

2 It was surmised that this fuel element was unlatched prior to the February 3rd startup.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 6 of 48 The Evolution of Root Cause Efforts Overall, NCNR and NIST expended a considerable level of effort in the conduct of the event root cause. A Technical Working Group (TWG), consisting of members from across the NCNR organization, was commissioned on March 10, 2021, by the NCNR Director to gather facts and evidence, and to determine the root cause and contributing factors. The TWG identified a total of five (5) root causes and ten (10) contributing factors and recommended corrective actions to address each factor. Corrective actions were provided for each of the identified causal factors and the teams observation is that NCNR is actively working implementation of the prescribed corrective actions. The TWG root cause was revised twice, and an addendum added upon identification of additional discoveries related to fuel element unlatching. Revision 2 of the TWG Report was issued on September 13, 2021.

On May 13, 2021, the NCNR Director directed that a subcommittee of the NCNR Safety Evaluation Committee review the circumstances of the accident and measures planned to preclude a recurrence. This included an evaluation of the NCNR response to the incident, an independent review of the cause(s) and any contributing factors and corrective/preventative actions and provide recommendations for actions by the Director to ensure safe NBSR operations. The conclusions of this review were provided in a report dated August 12, 2021.

The SEC Subcommittee report (ERCAS) concurred with the five (5) root causes and prescribed actions and provided an additional two (2) root causes with recommended actions to resolve.

On December 2, 2021, NCNR requested an independent assessment of the conditions that allowed the accident, NCNRs emergency response, NCNRs organizational response, and the efficacy and completeness of the proposed corrective actions. Four independent reviewers provided their individual responses in early 2022.

As part of this assessment teams review, the TWG and ERCAS Reports, as well as the four independent review letters were the event root cause under assessment.

The Assessment The purpose of this assessment is to provide an independent and comprehensive review of the root cause analysis performed by NCNR into the event occurring February 3, 2021, at the NIST Center for Neutron Research. The assessment was performed in accordance with the requirements of the August 1, 2022, Confirmatory Order Modifying License No. TR-5. The assessment reviewed the root cause for rigor, criticality, and overall quality and identified areas for improvement and corrective actions to be implemented by NCNR.

The standards used in conduct of this assessment included the NRC Inspection Procedure 95001 guidance and related industry established criteria. The assessment does not include reviews of root cause analyses beyond those associated with the February 3, 2021, event, nor does it include an in-depth review of the Corrective Action Program or Root Cause Analysis Processes at NCNR. A detailed assessment of these items is included in Task 03, Problem Identification and Resolution Assessment.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 7 of 48 The Team The team was comprised of five independent consultants with industry experience in engineering, maintenance, operations, and performance improvement and specifically human, program and organization performance. This includes leading and participating in the cause analyses and corrective actions for significant events to prevent recurrence and support the clearing of performance issue with the NRC. A description of the team members background and experience is included in Attachment 5.

Objectives and Methodology Objective 1 Review the event root cause to determine if the NIST Analysis was complete and comprehensive, and whether additional causal factors may exist that should be further investigated.

Objective 2 Review the defined set of correction actions to determine alignment with the event root cause conclusions, consistency with industry standards and best practices, sustainability, and likely effectiveness is being implemented and resolving the root cause conclusions.

Objective 3 Review the rigor, criticality, transparency, and overall quality of NCNRs internal self-assessment activities related to the event root cause.

Objective 4 Develop a Period of Interest Timeline to include historical changes, previous related events, organizational changes, demographic changes, funding factors, and function changes over the past 10-years that may have influenced the event.

Objective 5 Evaluate corrective actions, both completed and currently in progress, to determine they are being completed with rigor, adequately documented, and tracked by NCNR Management. For completed actions, perform a preliminary assessment of their effectiveness at correcting issues and behaviors identified as causal factors in the event root cause.

Methodology Objective 1: The team reviewed industry standards for the conduct and documentation of root cause analysis and documentation. The results were factored into a Root Cause Evaluation Review Criteria Table with defined criteria for the identification of gaps in the conduct and/or documentation in meeting standards. Each team member participated in all or part of the review of the TWG RC, ERCAS Final Report and 4 Independent Assessment against criteria and the Root Cause Analysis table. There were collegial reviews of the individual results, resulting in the aggregate results as shown in the Root Cause Evaluation Review Criteria table that laid the foundation for the results identified in this Assessment. Reference Attachment 1.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 8 of 48 Objective 2, 3, 4 and 5: One or more team members conducted the evaluation/review and developed their conclusions. The more salient conclusions were factored into the body of this report with team review and concurrence.

Acknowledgements The team received excellent support from NCNR staff, particularly in identifying information for the Period of Interest Timeline and in determining the status of corrective actions.

Meetings and presentations related to the equipment and tool issues were extremely valuable in the teams understanding of the event and actions taken by NCNR since the event.

NCNR staff questioning and openness to understand the team perspective is a strength.

The Assessment Results The NCNR and NIST staff have expended a considerable level of effort evaluating the accident and prescribing corrective actions to fix the identified root causes. This is reflected in the documentation, interviews, and interactions with NCNR and NIST staff. The efforts resulted in a total of seven (7) root causes and ten (10) contributing factors, and prescribed actions to correct the identified issues. The four independent reviews provided a critical review of the root cause effort and identified several insights for NCNRs consideration.

The overall assessment conclusion is that, while the event root cause provides sufficient actions such that they can be reasonably expected to prevent another undetected latching event, there are structural evaluation issues that indicate the root cause conclusions are not at the appropriate depth to ensure underlying organizational or cultural drivers are identified and actions prescribed. This may adversely impact the effectiveness of the root cause in the long-term prevention of recurrence of this event, and similar events, and can challenge sustained organizational improvement. This presents a vulnerability to NCNR from a rigor, effectiveness, and inspection perspective.

The following summarize the team conclusions by objective:

Objective 1 Results - Review of Event Root Cause The Objective: Review of the event root cause to determine if the NIST Analysis was complete and comprehensive, and whether additional causal factors may exist that should be further investigated.

1. The event root cause is fragmented with no clear description of the evolution of the analysis or incorporation of the independent review insights.

Current Status: Significant efforts have been made by NCNR to evaluate the accident, determine its root and contributing causes, and define corrective actions to correct the identified causes.

The Gap: These efforts have each been documented separately which has resulted in the overall event root cause being fragmented without a roadmap or narrative describing the evolution of the analysis or incorporation of independent assessment insights. Independent insights have the potential to impact the current analysis into causal factors and underlying causes. Reference Attachment 4 and the four independent assessments of the TWG RC and ERCAS reports.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 9 of 48 Vulnerability: Inspection vulnerability - It is difficult for reviewers to validate completeness in the overall scope of analysis and the adequacy of conclusions and will result in extensive questioning to understand the scope and adequacy.

2. The evaluation does not address significant plant-specific consequences of the accident.

Current Status: Significant efforts have been made addressing the root causes with corrective actions that are sufficient to reasonably prevent a repeat event.

The Gap: The problem statement scope of consequences lacks 1) a quantitative or qualitative assessment of the accident risk based on past events, 2) Technical Specification non-compliance (TS 2.1 Safety Limit Violation and TS 3.9.2.1 Fuel Element Latching Violation), and 3) all the real and potential significant consequences of the event.

There were at least two unlatching events since the start of reactor operations and other latching near misses. The root cause efforts lack a quantitative or qualitative assessment of the risk posed by the previous events, nor why the elevated risk was not recognized and resolved prior to the accident. The risk included a high probability of a failure to properly latch an assembly, and that an improper latching to go undetected due to difficulties in positively verifying proper latching.

The TS non-compliance involved exceeding the reactor fuel cladding temperature of 842 degrees F for any operating conditions or power and flow. The root cause efforts are lacking an analysis of reactor start-up and monitoring, or actions that could have been taken to avoid the TS violation. This can be characterized as the need to restore/maintain TS compliance for future operations.

The consequences were extensive and beyond the reactor fuel damage and release.

The root cause efforts lack clear identification of some actual and potential consequences, such as the regulatory implications, long-term loss of facility use, potential loss of facility viability, and reputational consequences.

Vulnerability: Inspection, rigor, and effectiveness vulnerability - NRC expectation that the consequences be addressed in the root cause evaluation, including either quantitative or qualitative assessment methods. From a rigor perspective, not clearly stating the consequences of fuel temperature non-compliance minimizes the need to overtly analyze or fix the deltas in fuel monitoring during startup. This also presents an effectiveness vulnerability because understanding the actual and potential consequences of the accident aids in ensuring that corrective actions will prevent recurrence of the consequences and is essential in assessing extent of condition and extent of cause. Future leaders, not present and engaged today with the event and its resolution, may not fully appreciate the impact of the event as to elevate their due diligence in event prevention.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 10 of 48

3. Extent of Condition was not formally or systematically evaluated at a level commensurate with the safety significance or consequence of the event.

Current Status: It is clear by interviews and document reviews that NCNR did considerable work to examine the extent of the latching failure (i.e., were other bundles latched upon removal, other tool issues, etc.) and the extent of downstream effects (where did the debris go), which address Same-Same extent of condition factors.

The Gap: The condition leading to the accident occurred during refueling activities.

Therefore, the extent of condition can reasonably extend to similar activities beyond fuel latching and similar hazards beyond the fuel unlatching. The extent of condition analysis should reasonably include other possible hazards such as fuel movements in and out of the core, drop of heavy loads including irradiated fuel, debris and flow plugging events, and other reactor internals manipulations. The extent of condition evaluation could also have reasonably included similar indications, such as neutronics anomalies or power perturbations during reactivity changes.

The Vulnerability: Inspection and rigor - The root cause standard is that the evaluation provides for proper consideration of the extent to which the condition is currently impacting, or has the potential to impact other plant processes, equipment, or human performance. This includes defining how extent of condition was determined, how a reasonable boundary was established, and actions taken to address identified vulnerabilities. The vulnerability related to the lack of rigor is that a same or similar consequential event could occur while the accident is being evaluated and before corrective actions have been completed to prevent recurrence.

4. There is no structured methodology such as FMEA, Fault Tree, or Support-Refute to determine the equipment failure cause (Direct Cause).

Current Status: NCNR has expended a lot of effort to evaluate the equipment issue, and related human performance issues, and to implement actions to correct the identified issues related to direct cause.

The Gap: There was a lack of structured methodology. It is not clear that the analysis for direct cause fully considered all other credible/possible causes for correction or elimination.

Vulnerability: Effectiveness, Inspection and Rigor - Unclear resolution of a potential factor that could have adversely impacted the latching or latch verification function and may recur with an adverse consequence. Missing or unclear line of sight from the event consequence to the cause makes it difficult during inspection for the inspector to see the relationship and may raise additional questions. Absent of a structured methodology it is difficult to validate or invalidate that assumption made that a downward impulse from dropping the pickup tool pushed the latch out of the notch and may have caused the unlatched element.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 11 of 48

5. There is no formal evaluation or exploration of the human performance and human factors aspects of latching and verifying latched assemblies.

Current Status: The existing root cause efforts identify human performance related causes, such as inadequate procedures, training and qualification, compliance with procedures, and fidelity of latch determination equipment and tools. The corrective action for these causes and others will result in improvement.

The Gap: The above causes were identified in a reactionary mode following the event and are related to human Error Precursors that should have been corrected or mitigated within the facilities Human Performance System prior to the event. The existing root cause efforts did not systematically/adequately explore the breakdown in the Human Performance System that allowed the latching work to proceed with multiple Error Precursors.

An industry recognized TWIN tool exist that is used during work planning and execution processes to focus planners, workers, and supervision on identification of Error Precursors, and elimination or mitigation of those identified, in support of error free performance. As an example, the below table shows the Error Precursors (based on factors discussed in the event root cause) that are related to Task Demands, Work Environment, Individual Capabilities, and Human Nature.

Task Demands Individual Capabilities Interpretation Requirements Lack of/Unclear Standards Confusing Procedure/Vague Guidance Unclear goals, roles, or responsibilities Task unfamiliarity Lack of knowledge (Mental Model)

Lack of proficiency/inexperience Indistinct problem-solving skills Imprecise communication habits Unsafe attitudes toward critical tasks Work Environment Human Nature Confusing displays/controls Hidden System Response Unexpected equipment condition Lack of alternative indication Poor equipment layout/accessibility Lack of procedure placekeeping Equipment sensitivity Complacency/overconfidence Inaccurate risk perception As can be seen, prior to the event, there were elements of interpretation requirements, confusing procedure, lack of alternative indication, poor equipment layout, lack of procedure place keeping, task unfamiliarity, lack of proficiency/inexperience, unsafe attitudes toward critical tasks, complacency, and inaccurate risk perception. Many of these elements should have been identified and corrected in the upfront planning of the work, or identified in the pre-job brief, resulting in a stop work until correction and mitigation of the more significant Error Precursors.

Vulnerability: Rigor and Effectiveness - Not fully understanding and closing the gaps in the Human Performance System for the identification and correction of Error Precursors that were causal to this event will allow other similar events of the same or lesser consequence to occur in the future.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 12 of 48

6. There is an inadequate structured methodology in the analyses for cause.

Current Status: Significant effort has been made by NCNR to determine the causes of the accident. This effort identified reasonable factors that, based on actions taken and planned, are likely to reduce the likelihood of another unlatching event.

The Gap: Diverse analytical techniques were not used to identify and validate cause, and to show the line of sight from the root and contributing causes to the event consequences. In addition to lacking a structured methodology to determine the equipment failure cause, the root cause would benefit from:

An Events and Causal Factor Analysis to demonstrate clear line of sight from the events to equipment issues and inappropriate actions and to the drill down into causal factors, and then underlying causes.

A Barrier Analysis to identify the defenses that should have been in place, or were in place but not effective, that allowed the accident to occur. This approach allows focus on the primary barriers to prevent the event and focus on the highest value corrective actions.

Vulnerability: Rigor and Inspection -The lack of a structured methodology, using diverse methods, increases the potential for a gap in the analyses that fails to consider an important cause, that ultimately leads to event recurrence. In addition, NRC inspection criteria (NRC IP 95001) requires use of a systematic methodology, using complementary methods that provide different perspectives of the problem.

7. There is no evidence that the chosen root causes were analyzed in aggregate to determine if there is/are more underlying organizational and cultural factor(s).

Current Status: The TWG and the ERCAS evaluation identified seven root causes for the accident and assigned actions to correct. There is no evidence that the causes were reviewed in aggregate to identify a more fundamental, deeper root cause.

The Gap: The independent reviewers provided additional insight that indicates one or more fundamental causal factors that may explain the previously identified seven root causes. It is not clear if the insights were adequately evaluated for impact on the existing root causes.

The TWG or the ERCAS Reports were not updated to reflect incorporation and/or resolution of the same. Example of the insights provided include:

Operations Staffing and Capacity: All four independent reviewers discussed staffing and capacity issues. This is a potential underlying factor (i.e., potential RC) for inadequate oversight of refueling activities and less than adequate training and qualification root causes.

NIST/NCNR Relationship: A lack of NIST enterprise level risk assessment of NCNR operations. This is a potential underlying causal factor (i.e., potential RC) for Change Management, operations staffing and capacity, and training and qualification root causes.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 13 of 48 HR/Recruiting/Compensation: These are potential underlying causes for less than adequate training and qualification, operations shift staffing issues, and culture of complacency.

Other Factors: A flat management structure that leads to reduced level of oversight, normalization of deviance (from standards), inability of staff to see and adjust to staffing market changes, sliding regarding latching and latch check tools, operations department, and engineering interface issues, punishing culture, and risk management and assessment.

In addition, an aggregate analysis is necessary to provide more insights into the safety culture aspects underlying events. The event root cause also does not provide proof testing to validate that the chosen root causes satisfy the standard or definition of a root cause.

Vulnerability: Effectiveness and Inspection - Failure to analyze the causes in aggregate to determine if more underlying organizational or cultural drivers exist can adversely impact the effectiveness related to long-term prevention of recurrence of the event, and similar events, and can challenge sustained organizational improvement. In addition, there is no proof testing of the root cause(s) for validation to prevent recurrence.

8. Extent of Cause was not evaluated to ensure that the identified root causes were not prevalent in other NCNR or NIST processes, programs, or equipment.

Current Status: Indeterminate The Gap: The report identified seven (7) root causes that led to the accident and provides corrective actions to address the causes. However, there is no evaluation of the extent to which the identified root causes have impacted, or has the potential to impact, other NCNR processes, equipment, or human performance. This is a missed opportunity to identify where else the root causes exist at NCNR, and to take necessary management action to avoid a future event. For example, if Change Management is the root cause related to staffing and attrition, where else at NCNR are we vulnerable because NCNR/NIST didnt manage the staffing and attrition? If management oversight of refueling activities was deficient, then where else does NCNR have vulnerability due to inadequate oversight? If Operator training and qualifications are deficient for refueling, then where else does NCNR have vulnerability related to training and qualification? Etc.

Vulnerability: Effectiveness and Inspection vulnerability - Not performing an extent of cause evaluation for the identified root causes leaves NCNR vulnerable to a future event, not necessarily in latching fuel bundles, but driven by the same or similar causes. The root cause standard is that the evaluation provides for proper consideration of the extent to which the root cause has impacted or has a significant potential to impact other plant processes, equipment, or human performance. This includes defining how extent of cause was determined, how a reasonable boundary was established, and actions taken to address identified vulnerabilities.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 14 of 48

9. The event root cause did not provide for a determination whether the root cause(s), extent of condition, and extent of cause appropriately considered the Safety Culture traits in NUREG-2165, Safety Culture Common Language.

Current Status: The ERCAS Team reviewed NUREG-2165 traits as part of deliberation and discussions (Interviews), however this review is not documented in the report.

The Gap: A documented review of nuclear safety culture traits to determine if any identified root cause indicated a safety culture weakness, or any safety culture attribute could have indicated a root cause missed during the evaluation was not performed.

Vulnerability: Effectiveness and Inspection - Failure to identify underlying safety culture weaknesses related to the root cause can result in not correcting underlying behaviors that would impede prevention of recurrence efforts. In addition, this represents an inspection risk since consideration of the safety culture traits in the root cause report is an NRC inspection attribute.

The factors identified above lead to the following Area for Improvement (AFI):

Area for Improvement (AFI) #1: There are structural evaluation issues that indicate that root cause conclusions are not at the appropriate depth to ensure underlying organizational or cultural drivers are identified and actions prescribed.

Objective 2 Results - Review of Set of Corrective Actions Objective: Review the defined set of correction actions to determine alignment with the event root cause conclusions, consistency with industry standards and best practices, sustainability, and likely effectiveness is being implemented and resolving the root cause conclusions.

Reference Attachment 2.

Results Current Status: NCNR has taken much time, resources, and effort to address the root causes to the level necessary that actions taken can be reasonably expected to prevent another undetected latching event.

The Gap: Several issues were found that adversely impact implementation or can lessen the effectiveness of corrective actions to resolve the root causes. These include:

Corrective actions that are not, in all cases, written as SMART (Specific, Measurable, Achievable, Relevant, Timely) actions that closely link to the cause statements.

No differentiation between actions to prevent recurrence and other actions to restore compliance or correct deficiencies.

Unclear line of sight between cause and corrective action. One example: Actions to correct the root cause related to fidelity of latch check tools do not fix the issue of fidelity.

The actions provided address control of the tools and validation of latching, but not the fidelity of the tools to design requirements. If the specified actions are taken, they still will not fix tool fidelity.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 15 of 48 The RC report would benefit if the tool fidelity root cause was changed to something like inadequate methods for definitive indication of latch status, that would improve the line of sight to the CAPR actions taken to discontinue height checks, augment the rotational latch check with the use of a keyed alignment cup at each fuel position, and the procedure visual latch check via camera via the Tech Spec change.

Actions taken include discontinuing height checks (with or without flow) and augmenting the rotational latch check with the use of a keyed alignment cup at each fuel position. While these actions mitigate the potential for an unlatched condition, the is a lack of discussion or planned actions assigned to evaluate effectiveness of the corrective action commensurate with significance in preventing recurrence.

Vulnerability: Rigor, Effectiveness, and Inspection - Failure to provide actions that meet SMART criteria and are sustainable presents risk that the corrective action will not fix or completely fix a cause and thus increase the potential for a repeat same or similar event. This also presents an inspection risk due to inadequate line of sight, sustainability, and rigor.

The factors identified above lead to the following Area for Improvement (AFI):

Area for Improvement (AFI) #2: Corrective Actions specified for each root cause were not, in all cases, specific enough to implement reliably, measurable to ensure the organization can determine when adequately completed, or relevant (i.e., tied logically with the stated root cause).

Objective 3 Results - Review of NCNRs Internal Self-Assessment Objective: Review the rigor, criticality, transparency, and overall quality of NCNRs internal self-assessment activities related to the event root cause.

Results Current Status: NCNR and NIST have been and are actively engaged in event resolution, and overall organizational improvement. This is evident in the TWG RC, ERCAS Report, and other documents as well as conversations with the Independent Nuclear Safety Consultant and commitment in seeking to understand and improve performance.

The Gap: While the NCNR and NIST leadership team have extensive experience, skills, knowledge and capability, the conduct of root cause evaluations for a significant event was outside their experience and knowledge. This lack of experience and knowledge contributed to delays in determining root causes and implementing actions over time.

Vulnerability: The lack of an overall awareness of root cause standards and concepts will hinder the prompt performance of future evaluations as well as limit the ability to foresee and address NRC cause related questions and inquiries.

The factors identified above lead to the following Area for Improvement (AFI):

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 16 of 48 Area for Improvement (AFI) #3: NCNR staff has inadequate experience and knowledge related to conduct and oversight of root cause analysis for significant events.

Objective 4 Results - Period of Interest Timeline Objective: Develop a Period of Interest Timeline to include historical changes, previous related events, organizational changes, demographic changes, funding factors, and function changes over the past 10-years that may have influenced the event.

Results: The Point of Interest Timeline identified performance issues that warrant further review within the context of TWG RC and ERCAS Report conclusion. The performance should be factored, based on risk and being indicative of current performance, in ongoing event evaluation efforts or included in a rewrite/integration of the current root cause.

Reference:

Attachment 3 There are no AFIs or ANAs identified for this Objective.

Objective 5 Results - Review of Correction Action Closures Objective: Evaluate corrective actions, both completed and currently in progress, to determine they are being completed with rigor, adequately documented, and tracked by NCNR Management. For completed actions, perform a preliminary assessment of their effectiveness at correcting issues and behaviors identified as causal factors in the event root cause.

Reference:

Attachment 2.

Results Some actions provided to prevent recurrence are not sustainable. For example, the action for the culture of complacency root cause is to develop a plan. This action has no implementation component and is not a sustainable action that is appropriate as a prevent recurrence action.

While the root cause actions are being tracked and closures are being monitored by the SEC sub-committee, the assessment found gaps in closures and documentation. Also, there are issues with clear alignment of the SEC Corrective Action Table and the NRC Confirmatory Order actions. It is difficult to understand cross-linkage without a more in-depth review or discussions with owners. In addition, there are issues with Corrective Action Program standards and implementation to be addressed within the Independent Nuclear Safety Consultant, Problem Identification and Resolution (Task 03).

The factors identified above lead to the following Area for Improvement (AFI):

Area for Improvement (AFI) #4: There are significant gaps in closure documentation for the corrective actions prescribed by the event root cause due to not having a fully effective Closure Review Board and Closure Notebooks with complete closure documentation to support review.

Recommendations Recommended Actions to Address AFIs:

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 17 of 48 Area for Improvement (AFI) #1: There are structural evaluation issues that indicate that root cause conclusions are not at the appropriate depth to ensure underlying organizational or cultural drivers are identified and actions prescribed.

1. Conduct and Document an Integrated Root Cause Analysis (IRCA) building on the extensive existing efforts across the multiple reports. The intent is to provide a comprehensive analysis that aligns with industry standards, and to close the identified gaps and any other substantive gaps discovered during the conduct of IRCA. The IRCA to include as a minimum:

1. Problem Identification and Consequences: Define a more comprehensive Problem Statement and consequences to include a quantitative and/or qualitative assessment of past and current risk.

2. Direct Cause Determination: Conduct a Fault Tree, Failure Modes Analysis or Support and Refute Analysis to verify the existing direct cause or identify a more likely direct cause. This includes systematic documentation of facts supporting and refuting the direct cause as well as other credible causes.

3. Extent of Condition: Conduct a systematic extent of condition review building off existing efforts (taken and documented and taken and not documented) and identify any new extent of conditions. Define actions to correct or mitigate the extent or provide a risk basis for no action necessary.

4. Human Performance: Conduct an analysis of the existing systematic approach to human performance during refueling activities - job preparations (procedure and training/qualifications), execution (job preparations, pre-job brief, conduct of work, and supervision), and review (post-job critique) support organizational performance - the ability to get consistently acceptable results. This analysis includes the aspects of the TWIN Model (Task Demands, Work Environment, Individual Capabilities, and Human Nature) in identifying error precursors for elimination or mitigation in support of error free performance.

5. Analysis for Cause: Conduct an Event and Causal Factors Analysis and Barrier Analysis to validate the breadth and depth of the existing analysis, explore and identify missing causes, and improve the line-of-sight from equipment issues and inappropriate actions to causal factors, the root cause(s), and contributing causes.

6. Aggregate Analysis: Conduct an aggregate analysis of identified causes (existing prior to IRCA and via the IRCA) to understand and identify the underlying drivers and root cause(s) for the event. This includes a systematic review of all safety culture aspects and providing the direct linkage to the root cause(s) and more significant contributing causes.

7. Extent of Cause: Conduct an extent of cause review for other organizational and programmatic impacts due to the root cause(s). Define actions to correct or mitigate the extent or provide a risk basis for no action necessary.

8. Nuclear Safety Culture: Document a review of nuclear safety culture traits to determine if any identified root cause indicated a safety culture weakness, or any safety culture

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 18 of 48 attribute could have indicated a root cause missed during the evaluation was not performed.

9. Corrective Actions: Define corrective actions with direct linkage to the root cause(s) and contributing cause(s). Define actions that are specific and measurable and sustain the root cause related actions to prevent recurrence. This action includes defining effectiveness reviews for root cause related actions.

10. Other: Close any other substantive causal analysis gaps in the existing root cause efforts identified during the conduct of the IRCA.

Area for Improvement (AFI) #2: Corrective Actions specified for each root cause were not, in all cases, specific enough to implement reliably, measurable to ensure the organization can determine when adequately completed, or relevant (i.e., tied logically with the stated root cause).

1. As part of the root cause report activity to resolve AFI #1, ensure that defined corrective actions have a direct linkage to the root cause(s) and contributing cause(s). In addition, ensure the actions meet SMART criteria and that CAPRs are sustainable to prevent recurrence.

2. As part of the root cause report activity to resolve AFI #1, ensure that effectiveness reviews are specified for root cause recurrence related actions.

3. As part of the root cause report activity to resolve AFI#1, develop a cross-reference table to 1) show all corrective actions identified during NCNRs activities following the event, and 2) show their linkage to the root and contributing causes identified during the root cause integration/revision.

Area for Improvement (AFI) #3: NCNR staff need additional training to improve skills and knowledge related to conduct and oversight of root cause analysis for significant events.

1. As an interim action, prior to conducting root cause analysis for significant events, provide just-in-time training for root cause team members and key involved managers to provide what good looks like regarding cause analysis and cause analysis oversight.

2. Provide formalized root cause training on the standards and methods related to the conduct of root cause analysis for significant events to all root cause team leaders.

3. Provide training to NCNR leaders involved in oversight of root cause activities on the standard for conduct and oversight of root cause analysis.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 19 of 48 Area for Improvement (AFI) #4: There are significant gaps in closure documentation for the corrective actions prescribed by the event root cause due to not having a fully effective Closure Review Board and Closure Notebooks with complete closure documentation to support review.

1. Redefine/tighten-up standards for completing and validating closure of corrective actions, particularly those associated with the event root cause and the NRC Confirmatory Order.

This should include:

a. Rigor in completion of the assigned action

b. Written closure statements that provide detailed discussions capturing what actions were taken to complete the corrective action.

c. Objective evidence that provides documentation that the action was completed and that it fully addresses the problem.

d. Establish single point accountability (review and approval signatures) for the accuracy and completeness of the Action Tracking Table and the Closure Notebook for each action. Note: The notebooks are key to effectively and efficiently demonstrating the completeness of each action taken to support clearing the Confirmatory Order.

Consider the use of an independent third party to either review or validate the closure reviews for corrective actions related to the root cause and NRC Confirmatory Order.

Attachments

Root Cause Report Review Criteria : Corrective Action Review : Period of Interest Timeline : Perspectives on Contributing Causes : Assessment Team : Contacts and Interviews : Documents Note: Attachment 1, 2, 3 and 4 represent team and/or individual efforts without substantive editing to maintain independence in thoughts and results, as well as reduce the potential for group thinking and limiting mindsets in reaching conclusions. The efforts should be considered as tools to support overall conclusions within this report. Specifically, the more salient points and conclusions have been factored into the body of the report and executive summary and are the basis for the AFIs and Recommendations.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 20 of 48 : Root Cause Evaluation Review Criteria Reviewer Name: The Task 2: Event Root Cause Assessment Team - 5 Consultants Conclusion*:

A = Acceptable AWC = Acceptable with Comments D = Deficient Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments A: Problem Identification: The report should provide a description/statement of the problem/performance under evaluation (gap), plant specific consequences and compliance concerns, who identified the issue, how and under what conditions the problem/performance was discovered, how long the problem/performance has existed, and prior opportunities for identification.

1.

A succinct, objective statement of the specific problem under evaluation (Problem Statement) is provided:

a.

Describes the performance gap.

b.

Factual with no causes identified.

c.

Description of the unacceptable actual

& potential consequence(s)

TWG Section Executive Summary ERCAS Section 1 D

Narrative description of the event and consequences but no succinct Problem Statement Missing all substantial consequences, such as the loss of two years of reactor use, potential loss of viability of the facility, and the trust of clients in scheduling use of the reactor, regulatory implications, and reputational harm.

Lacks clear identification of the TS non-compliance -

safety - exceeding temperature limits - to support the analyses and actions demonstrating restoring/maintaining compliance.

2.

The evaluation states how and by whom the issue was identified TWG Executive Summary and ERCAS Section 1 A

Issue identified on startup due to power anomaly

3.

If the issue was not identified at a precursor level, the evaluation provides a determination as to why it was not identified.

Examples may include failure to 1) Recognize the issue, 2) Enter the issue into CAP, 3)

Recognize the safety risk or regulatory importance of the issue, 4) Raise safety concerns to management, or 5) Complete corrective actions for a previously identified event or condition.

TWG Section 1.3 D

The issue was not effectively addressed at the precursor level. There were past instances of unlatched fuel assemblies (1981 and 1993) discussed in TWG report with a corrective action to add a second redundant latch check after cycling pumps on and off. The latch check was not done after the last pump cycle.

4.

The evaluation states when the problem was identified.

TWG Report Section 1.8 and page 20-21 timeline A

Identified on 2/3/2021 during a reactor startup

5.

The evaluation states how long the condition(s) existed.

TWG Report Section 1.8 and page 20-21 timeline A

The evaluation bounds when the condition existed

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 21 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

6.

The evaluation states whether there were prior opportunities for correction.

TWG Report Section 1.3 and ERCAS D

Discusses two prior opportunities to identify and correct unlatched fuel assemblies. Further review by assessment team members found 21 examples of unlatched fuel assemblies. These were not identified or reviewed as part of the root cause.

7.

The evaluation addresses significant plant-specific consequences of the issue.

For conditions that are not easily assessed quantitatively, a qualitative assessment should be completed.

ERCAS Report p8 A

Some discussion of accident actual consequences and E-Plan implementation.

8.

The evaluation includes an assessment of compliance.

None D

No discussion of compliance issues or the return to compliance.

B: Extent of Condition: The report should provide proper consideration of the extent to which the identified problem/condition is currently impacting, or has the potential to impact other plant processes, equipment, or human performance. As part of this consideration, the report should define how extent of condition was determined, how a reasonable boundary was established, and the actions taken to address identified vulnerabilities.

1.

The report evaluated extent of condition in a logical manner.

None D

The report did not contain a formal/systematic evaluation of the extent of condition. NCNR did perform efforts to determine if other elements were unlatched during recovery, if other elements were damaged or impacted by debris, and performed extensive cleanup of the damaged assembly and reactor internals. This addressed same-same and the downstream effects aspects of extent of condition. For an event of this magnitude, NRC expectation related to level of detail commensurate with the significance and complexity of the event (#2 below) is not easily verifiable and is likely not met.

There is a lack of documentation explaining the defined scope of the extent of condition, the actions taken to correct at risk conditions, and the risk basis for conditions with no action necessary. Potential extent of conditions include reactor tools, procedures, training/qualifications,

2.

The level of detail of the extent of condition review is commensurate with the significance and complexity of the performance issue.

None D

See #1 Above

3.

The report evaluated extent of condition to the degree that corrective actions will bound the risk consequences and significance.

None D

See #1 Above

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 22 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

4.

The evaluation discusses other locations or areas that were considered, but ruled out, along with the risk basis for this ruling.

None D

Not contained in the root cause report.

5.

Interim or Corrective Actions are assigned, and are appropriately prioritized, to address identified vulnerabilities.

None D

NCNR took significant action in the response to the event to improve areas identified in the root cause and vulnerabilities discovered during diagnosis of the unlatching event; however, there is no documentation in the report of the interim actions or actions taken/planned for extent of condition.

C: Causal Analysis: The causal analysis was performed using a systematic methodology, at a level of detail commensurate with the significance and complexity of the issue, and with a level of depth to ensure that correcting the cause(s) will preclude repetition of the same and similar problems.

1.

The root cause analysis was performed by a multi-disciplinary team comprised of individuals with appropriate organizational background and expertise needed to effectively evaluate the issue.

D The analysis (TWGZ and ERCAS) was performed by a multi-disciplinary team with appropriate organizational background and technical expertise. There was no root cause analysis subject matter expertise.

2.

The cause analysis was performed using a systematic methodology to yield the most basic reason for the failure, problem, or deficiency which, if corrected, would preclude repetition.

Common methods include:

Events and Causal Factors Analysis Fault Tree Analysis Barrier Analysis Change Analysis Management Oversight and Risk Tree (MORT)

Critical Incident Techniques Why Staircase Pareto Analysis TWG Report ERCAS Report D

The TWG report used causal factor analysis and timeline.

Causal factor analysis chart in Appendix A.

The ERCAS performed an independent review of the TWG report using TapRoot and National Safety Council investigation methods to determine categories of potential root causes and contributing factors. Interviews were conducted and the team considered NRC Safety Culture Common Language insights in developing conclusions.

1)

No structured methodology, such as FMEA/FTA or Support-refute used to determine the equipment failure mechanism. (Direct Cause). Although much was done to troubleshoot and determine the equipment issue, and to put actions in place to correct those issues, there was no structured methodology used.

2)

There is no formal evaluation of the human performance/human factors aspects of the latching and latch verifications. The task of latching and verification is difficult and involves a high level of skill

- and the latching is not easily verified. From an error precursor perspective, task demands, and work environment could easily exceed individual capabilities and human nature.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 23 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

3)

There is inadequate structured methodology to 1) identify the inappropriate action(s), 2) ensure that all factors directly leading to the consequence were examined, and to 3) show the logical line of sight from the chosen causes to the unacceptable consequences.

3.

Complimentary methods, appropriate for the issue being evaluated, were used to provide different perspectives of the problem and to ensure thoroughness of the evaluation.

TWG Report ERCAS Report D

Methods such as Fault Tree, Event & Causal Factors, and/or Barrier Analysis would have provided clearer insight into the barriers that should have made the job or latching go correctly, or changes at NCNR that adversely affected the task (i.e., what was different between this unlatching event vs. all other times we did latching and latch check verifications correctly - Change Analysis).

4.

The method(s) provided for a clear identification of the performance issue, condition, or problem and the assumptions made as part of the analysis.

TWG Report ERCAS Report A

None

5.

The method(s) provided for prompt collection and verification of data and preservation of evidence.

TWG Report ERCAS Report A

None

6.

The analysis is documented such that the progression of the problem is clearly understood, any missing information or inconsistencies are identified, and the problem can be easily understood by others.

TWG Report ERCAS Report D

There is a lack of analysis on the actions taken by operations, or should have been taken, during reactor start-up that led to or contributed to the event, such as the availability of instrumentation and indications, and the prompt response to indications - the ability of operators to see and trip the reactor prior to the auto shutdown.

7.

The method(s) provides for a determination of cause-and-effect relationships resulting in an identification of the direct, root and contributing causes that consider potential hardware, process, and human performance issues. The analysis does not stop at the identification of symptoms for correction but rather the underlying causes. For example, stopping at an inadequate procedure or training without identifying why there was inadequate procedures or training - in other words not identifying the underlying Organizational & Programmatic causes.

TWG Report ERCAS Report D

The chosen root causes are not at the fundamental underlying causal factors and several of the identified root causes appear to be at a symptom level that can be explained by more underlying factors.

Both the TWG and ERCAS reports identified factors that led to the event and assigned actions to correct; however, the independent reviewers provided insight that indicate deeper or more fundamental causal factors that approach an appropriate root cause level of depth. This indicates that neither the TWG nor ERCAS reports drove down past the symptoms into a RC level of depth. For example:

1)

Operations staffing and capacity: All four independent reviewers discussed staffing and capacity issues. This is a potential underlying factor

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 24 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments (i.e., potential RC) for inadequate oversight or refueling activities and less than adequate training and qualification root causes.

2)

NIST/NCNR Relationship and lack of NIST enterprise level risk assessment of NCNR operations. This is a potential underlying causal factor (i.e., potential RC) for Change Management, operations staffing and capacity, and training and qualification root causes.

3)

HR/Recruiting/Compensation: These are potential underlying causes for less than adequate training and qualification, operations shift staffing issues, and culture of complacency.

Other factors identified in the independent reviews included: Flat management structure that leads to reduced level of oversight, normalization of deviance (standards), inability of staff to see and adjust to staffing market changes, sliding regarding latching and latch check tools, operations, and engineering interface issues, punishing culture, and risk management and assessment.

Could find no evidence that these additional factors were evaluated for the impact on the root causes determined by TWG and ERCAS.

A review of all the identify causes and potential causes raises questions as to the potential for an underlying cause related to less than adequate risk awareness and management, that should be explored in-depth.

8.

The report provides a complete, transparent, and chronological sequence of events.

ERCAS Report TWG Report A

None

9.

The analysis yielded a root cause(s) that satisfies the following criteria:

a.

The problem would not have occurred had the root cause not been present.

b.

The problem will not recur if the root cause is corrected or eliminated.

c.

Correction or elimination of the root cause will preclude repetition of similar conditions.

TWG Report ERCAS Report D

There are no root cause criteria specified and no root cause test (Proof Test) to validate that the analysis yielded a root cause satisfying the criteria.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 25 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

d.

The root cause can realistically be corrected by the organization.

10. The questioning process was conducted until the cause(s) were beyond the organizations control (then bounded to factors that are in organizational control to correct).

TWG Report ERCAS Report D

All the causes identified were within NCNR/NIST control; however, it is unclear that the questioning process extended out to factors beyond organizational control -

then was drawn back to factors within NIST/NCNR control. The independent reviews did identify factors that would be considered beyond organizational control, but these insights were not drawn into the formal root cause determination.

11. The problem was evaluated to ensure that other root and contributing causes were not inappropriately ruled out due to assumptions made as part of the analysis.

TWG Report ERCAS Report D

There were no discussions of other causes that were ruled out or assumptions made.

12. The evaluation collectively reviewed all root and contributing causes for indications of more fundamental problems with a process or system.

ERCAS Report D

The ERCAS Report conducted a collective review of the TWG Report and identified an additional 2 RCs.

However, there is no evidence that the team examined the seven root causes identified from the perspective of was there a more fundamental underlying causal factor?

that was driving the identified causes. Underlying causal factors could potentially encompass risk management (how NIST assessed and mitigated the production, operational, regulatory, and accident risk of the NCNR operation), Organizational Oversight such as SAC or QA (identification and enforcement of standards such that nuclear safety was an overriding priority), Inaccurate mental picture of what was required to safely operate a nuclear facility, or Corrective Action Program failure to identify and fix significance issues at NCNR. It will require additional analysis to evaluate the next level of underlying causal factors.

13. The evaluation properly ensured that correcting the causes will preclude repetition of the same or similar problems. This includes ensuring a process was used to verify that corrective actions for the identified root causes do not rely on unstated assumptions or conditions that are not controlled or ensured.

TWG Report ERCAS Report D

No process was described that validated that correcting the causes will prevent recurrence or that actions do not rely on unstated assumptions. There was no proof testing of the identified root causes.

14. The evaluation appropriately considered other possible root causes and provided a rationale for ruling out alternative possible cause(s).

TWG Report ERCAS Report D

The evaluation did not describe consideration of other possible root causes and the rationale for ruling them out.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 26 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

15. The evaluation broadly questioned the applicability of other similar events or issues with related root or contributing causes.

TWG Report ERCAS Report D

The reports identify two similar unlatching events over the plants operating life but do not broadly question their applicability, the rigor or effectiveness of previous efforts to correct them, or their applicability to the root/contributing causes. After the report, NCNR staff and Assessment Team members have discovered documentation of numerous instances of unlatched fuel assemblies.

16. The evaluation determined whether previous causal evaluations, corrective actions, or both missed or inappropriately characterized the issues and determined those aspects of the corrective actions that did not preclude repetition of the problem.

TWG Report ERCAS Report D

No evaluation of previous cause analysis or corrective actions was provided.

17. The evaluation specifically addressed those aspects of prior causal evaluations or corrective actions that were not successfully resolved.

TWG Report ERCAS Report D

No evaluation of previous cause analysis or corrective actions was provided.

18. The evaluation reviewed previous internal occurrences or findings and associated corrective actions to determine if similar incidents occurred in the past. This includes previous root causes, self-assessments, maintenance histories, or oversight findings.

TWG Report ERCAS Report D

No evaluation of previous cause analysis or corrective actions was provided.

19. The evaluation reviewed relevant external operating experience including NRC information notices and generic letters, vendor communications, and other sources.

TWG Report ERCAS Report D

No evaluation of previous cause analysis or corrective actions was provided.

D: Extent of Cause: The report should provide proper consideration of the extent to which the root cause of the identified problem/ condition has impacted or has a significant potential to impact other plant processes, equipment, or human performance. As part of this consideration, the report should define how extent of cause was determined, how a reasonable boundary was established, and the actions taken to address identified vulnerabilities.

1.

The report evaluated extent of cause in a logical manner.

None D

Extent of cause reviews were not performed or documented for the root causes identified in the report.

The vulnerability of not performing EOCa for the identified root causes is a missed opportunity to identify where else the root causes exist at NCNR that may lead to a future event. For example, If Change Management is the root cause related to staffing and attrition, where else at NCNR are we vulnerable because we didnt manage the staffing and attrition? If management oversight of RF activities was deficient, then where else does NCNR have

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 27 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments vulnerability due to inadequate oversight? If Operator training and qualifications are deficient for refueling, then where else does NCNR have vulnerability related to training and qualification? Etc.

In addition, there are questions with the existing identified root causes and more fundamental questions regarding the potential for a noteworthy underlying cause(s). A new underlying root cause would require an extent of cause review.

2.

The report assessed the applicability of the root cause(s) across disciplines or departments for different programmatic activities, human performance, or different types of equipment.

None D

See #1

3.

The evaluation discusses other locations or areas that were considered, but ruled out, along with the risk basis for this ruling.

None D

See #1

4.

Corrective Actions are assigned, and are appropriately prioritized, to correct or mitigate identified vulnerabilities.

None D

See #1 E: Safety Culture Considerations: The report should determine whether the root cause(s), extent of condition, and extent of cause evaluations appropriately considered the safety culture traits in NUREG-2165, Safety Culture Common Language, referenced in NRC IMC 0310-06.

1.

The report includes a proper consideration of whether a weakness in any safety culture component could reasonably have been a root cause or a significant contributing cause of the performance issue.

TWG Report ERCAS Report D

The TWG and ERCAS Team reports did not fully consider safety culture weaknesses.

The TWG report did not identify safety culture weaknesses.

The ERCAS report did identify complacency characterized by a lack of staff ownership of continuous improvement.

An interview with the ERCAS team leader and a Memorandum from E. Mackey to R. Dimeo dated 4/18/2022 identified additional safety culture weaknesses, such as Leadership Values and Actions, PI&R, and Questioning Attitude.

The 4 independent assessments of RC efforts directly and indirectly provide additional insights into safety culture weaknesses.

The RC Reports do not contain a structured review of either the NRC IMC 0310 or the NUREG-2165 safety culture attributes to determine if 1) any identified root

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 28 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments cause indicated a safety culture weakness or 2) any safety culture attribute could have indicated a root cause missed during the evaluation.

A review of the event and existing 7 root causes provide indications of the potential for safety culture aspects in the areas of not fully recognizing that Nuclear is Special and Unique, a lack of Questioning Attitude, and inadequate Decision Making. Specifically, proceeding with reactor latching activities with questionable tools and methods, inadequate procedures, and inexperience personnel.

2.

The report appropriately considered safety culture traits in the evaluation of extent of condition and extent of cause.

TWG Report ERCAS Report D

See #1

3.

The report provided corrective actions to address identified safety culture weaknesses.

TWG Report ERCAS Report D

See #1 F: Corrective Actions (CA): The report should identify the primary immediate actions taken, and corrective actions for each root cause and contributing cause(s). The CAs should differentiate between actions to preclude repetition and those to address contributing cause(s). At least one sustainable Corrective Action to Preclude Repetition (CAPR) should be identified for each root cause. CAs should be prioritized commensurate with their significance and regulatory consequence, tracked to ensure completion, and documented per applicable quality assurance requirements. Appropriate qualitative or quantitative measures of effectiveness should be defined for determining the effectiveness of specified actions in resolving the problem/ performance issue.

1.

The report specifies at least one CAPR action for each root cause, and at least one corrective action for each contributing cause.

TWG Report ERCAS Report D

The report does not distinguish between corrective actions to prevent recurrence (CAPR) and other corrective actions (Process Issue). A review of the documented corrective actions shows that there were, in some cases, sustainable actions assigned that could be viewed as CAPRs. For example:

RC1: Change Management - action is to develop and implement a change management program. This is a reasonable CAPR.

RC2: Management Oversight - action is to develop a program for robust qualification of supervisors. This could be a CAPR if the program addresses management oversight. However, it is unclear to the reviewer how this action fixes the oversight issue.

RC3: Culture of Complacency - Action is to develop a plan. This action has no implementation component and development if a plan is not a sustainable action that can serve as a CAPR.

RC4: Training and Qualification - Implementing a Program for robust qualification of operators is a sustainable action that could serve as a CAPR.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 29 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments RC5: Procedure did not contain necessary steps - the action to rewrite the procedure could serve as the CAPR for this root cause.

RC6: Procedural compliance not enforced - The action to conduct training could be a CAPR provided it had a continuing training component.

RC7: Inadequacies in the Fidelity of Latch Check Tools -

The report lacks sufficient discussion for a reviewer to fully understand and concur with actions taken to address tool fidelity. Specifically, a lack of clarity that the actions to discontinue height checks, augmenting the rotational latch check with the use of a keyed alignment cup at each fuel position, and a procedure visual latch check via camera are designed to prevent recurrence are a CAPR and address (bound) the previous inadequacies in latch determination equipment and tools.

2.

Designated CAPR and Corrective Actions aligned with the root cause.

TWG Report ERCAS Report D

The actions for RC1, RC4, and RC5 appear to be aligned with the root cause as stated. However, clear alignment and line of sight from the root cause to the prescribed actions is not apparent for the other root causes. The corrective action to correct the culture of complacency (RC3) by developing a plan for involving staff in continuous improvement is not likely to be effective since a single action will rarely, if ever, fix cultural issues and the action simply requires the development of a plan.

Plans will not fix ownership! The same comment can be made for RC6, procedural compliance not enforced.

Updating procedures and training may address the impact of procedure burden on staff compliance but will not likely improve behavioral factors associated with procedural compliance such as task risk perception and observation (supervision) factors. The actions for RC7, tool fidelity, do not align with the stated root cause.

3.

Corrective Action(s) restore the condition to compliance with the licensing basis or other applicable standards.

TWG Report ERCAS Report AWC Not explicitly documented in the report but a review of the actions appear that they will restore compliance.

4.

All CAPR and Contributing Cause CAs should be Specific, Measurable, Actionable, Relevant, and Timely (SMART)

TWG Report ERCAS Report D

Several example where actions are not Specific, Measurable, or Relevant.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 30 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

5.

The designated CAPR actions are sustainable and anchored in facility processes such that they cannot be removed or changed without appropriate evaluation.

Examples of sustainable actions plant modifications, procedure changes, inspections, testing, or formalized training.

TWG Report ERCAS Report D

Several examples where CAPRs are not sustainable (See comment in #1 above).

6.

The CAs defined in the report should be reasonably achievable and should not create new or different problems.

TWG Report ERCAS Report A

None

7.

If the report contains causes where no corrective actions are determined to be necessary, then the report provides the basis for that decision.

N/A N/A N/A

8.

All CAPR and Contributing Cause actions should include planned implementation dates and the group/individual responsible for completion.

TWG Report ERCAS Report D

The reports do not contain this level of detail

9.

The CAPR and Contributing Cause actions should be formally tracked.

ERCAS SEC Sub-Committee A

The actions from the root causes are being formally tracked by the SEC.

10. The report should define corrective action effectiveness review(s) that establish quantitative or qualitative measures to evaluate the effectiveness of completed actions to address and preclude repetition of the problem/performance issue.

These methods can include assessments, audits, inspections, tests, trending of data, or follow-up discussions with plant staff.

TWG Report ERCAS Report D

Effectiveness Review is not provided.

11. Schedules for planned actions should be resource allocated and should align with the prioritization of planned corrective actions.

ERCAS SEC Sub-Committee A

Not in the report, however, actions have been planned and prioritized.

G: Other Report Considerations:

1.

The report is easily readable and provides a logical line of sight from the problem statement to cause and corrective action, with the salient facts that support each cause.

ERCAS Report TWG Report Independent Review Letters D

Report is fragmented and difficult to determine what constitutes the entirety of the root cause effort.

The individual reports do not provide a logical line of sight from the problem statement - cause - corrective action.

ERCAS Report does provide salient facts supporting each cause.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 31 of 48 Root Cause Report Evaluation Criteria Criterion RC Report Section Conclusion

• Reviewer Comments

2.

The report is formatted such that reviewers can readily identify and review the problem statement, chronology of events, analysis for cause, extent of condition, extent of cause, past operating experience, safety culture considerations, risk significance, corrective actions taken and planned, and effectiveness reviews.

ERCAS Report TWG Report D

No extent of condition, extent of cause, safety culture considerations, or effectiveness review provided.

The reports lack similarity in the formatting of a root cause analysis report and thus the expectations for an NRC review for closure of a Confirmatory Order.

3.

The report clearly defines ownership for each corrective action and due dates for completion including the closure documentation. The timeline for completion of actions factors in the competing priorities of the organization, as to balance risk.

ERCAS Report TWG Report D

This level of detail is not included in the reports.

4.

Responsible management/stakeholders have been briefed on the problem statement, cause(s), extent of condition and cause, and corrective actions, and has had the opportunity to review and comment on the draft report prior to finalizing.

Dont know when this was reviewed

5.

The report is Transparent: it is easy for reviewers and other stakeholders to determine if they agree or disagree with the underlying logic, the extent to which evidence supports conclusions, the extent to which the identified causes fully explain the event and major consequences thereof, and the degree to which corrective actions address the identified causes.

There is a high level of transparency in the areas evaluated, however, the shortcomings in the TWG RC and ERCAS Report as discussed previously in this checklist raise many questions regarding completeness (concerns with some of the logic and causes being somewhat symptoms of an unidentified underlying cause.

6.

The report meets specified QA Documentation requirements.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 32 of 48 : Corrective Action Review This attachment supports the write-up in the body of this assessment report for Objective 2 and Objective 5.

Objective 2: Review the defined set of correction actions to determine alignment with the event root cause conclusions, consistency with industry standards and best practices, sustainability, and likely effectiveness is being implemented and resolving the root cause conclusions.

Results Current Status: NCNR has been working on an extensive set of corrective actions both completed and planned that supported approval of restart. Management is aware of the need to improve the Corrective Action Program and there is an assessment underway to review and improve Problem Identification and Resolution (PI&R).

Scope of Review and Criteria: The scope included a sampling of corrective actions for root causes and the Confirmatory Order and reviewing for completion. In summary, the review was to ensure corrective action statements were specific, measurable, and sustainable commensurate with significance in closing performance gaps and preventing recurrence.

Secondly, reviewing to ensure the physical action was taken, and that there was an adequate closure statement with supporting objective evidence and with elements to ensure sustainability (i.e., the action taken being built into equipment changes, procedures, processes, administrative controls/signage etc. as to minimize elimination or changes without management review).

The Gap: Corrective actions specified for each root cause were not, in all cases, specific enough to implement reliably, measurable to verify completeness, or with adequate linkage into a root cause or other conditions for correction. The closure of actions for root causes requires a higher level of rigor in completion and scrutiny in closures than other lessor actions.

Closure statements were sometimes too terse for a reviewer to know the actions were taken and objective evidence exists to support closure. In addition, actions for root causes and to prevent a repeat event should undergo an effectiveness review to verify completion and that the intent of the action is being met to prevent a repeat event. There were no effectiveness reviews.

Vulnerability: Effectiveness and Inspection - A lack of detail in describing a corrective action and/or robust implementation can result in deficiencies in fixing conditions and causes and a repeat significant or lesser event. The lack of effectiveness reviews can be a missed opportunity for management to identify problematic actions and perform a check and adjust prior to an event and/or NRC inspections. The inability to clearly understand the action that was to be taken and the action taken via documentation with direct linkage to causal factors and conditions opens NRC inspectors to asking questions and challenging completeness and a loss of potential confidence in resolutions. In aggregate, questions over corrective actions impact and delay closure of a Confirmatory Order.

Objective 5: Evaluate corrective actions, both completed and currently in progress, to determine they are being completed with rigor, adequately documented, and tracked by NCNR Management. For completed actions, perform a preliminary assessment of their effectiveness at correcting issues and behaviors identified as causal factors in the event root cause.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 33 of 48 Specific Results Summary of RCA Actions A review of 15 closed corrective actions identified the below issues with some of the actions having multiple issues:

(5) 33% of CA Descriptions were too Terse or not SMART enough to determine the actual intent of action such as: Revamp CAP, Rework SRTs (7) 47% had various closure weaknesses, 1) Lack of Objective Evidence, 2) Closure statement was too short to completely understand corrective actions completed, and 3) the closure actions did not fully address original issue.

(4) 27% Closed to a promise of a future action.

(5) 33% of CA Descriptions were not accurate in reference to the RC or document it was set to address.

Summary of CAP as compared to the NRC Confirmatory Letter Seven (7) apparent violations

1. Apparent Violation of Technical Specification 2.1, Safety Limit, licensee exceeded the fuel temperature safety limit.

2. Apparent Violation of Technical Specification 3.1.3, Core Configuration, - fuel element S-1175 was not latched, was raised approximately 3-4 inches above the upper grid plate, and was angled out of its proper position, causing it to rest on the lower grid plate surface.

3. Apparent Violation of Technical Specification 6.4, Procedures, which states, in part, that [w]ritten procedures shall be prepared, reviewed and approved prior to initiating any of the activities listed in this section [including] [f]uel loading, unloading, procedure for fuel handling activities was not suitable for the circumstances and did not contain necessary information to ensure that the fuel elements were latched prior to startup.

4. Apparent Violation of Technical Specification 6.4, Procedures, which states, in part, that [w]ritten procedures shall be prepared, reviewed and approved prior to initiating any of the activities listed in this section [including] The reactor startup procedure instructs the operators to monitor for abnormal fluctuations or oscillations on nuclear channel indications.

However, the NRC inspectors found that the procedure does not provide amplifying guidance for operators to use when conducting this monitoring.

5. Apparent Violation of Technical Specification 6.4, Procedures, which states, in part, that [w]ritten procedures shall be prepared, review - NCNR emergency response procedures were not suitable for the circumstances and caused NCNR to unnecessarily (although still within the required timeframe) delay their response to the event.

6. Apparent Violation of Technical Specification 3.9.2.1, Fuel Handling; Within the Reactor Vessel, - NCNR operators failed to implement one of the methods required by the technical specifications to ensure that fuel element S-1175 was adequately latched.

7. Apparent violation of 10 CFR 50.59, Changes, tests and experiments, - NCNR made changes to the refueling tooling that should have required a change to the technical specifications because dimensional differences of the new tooling invalidated the capability of operators to verify that a fuel element was adequately latched.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 34 of 48 There are no less than (32) Corrective Actions and an Additional (22) future CAs being taken credit for in the text of the NRC Confirmatory Letter.

Reviewer Findings:

We are taking credit for actions that are not clearly found in the SEC Tracking Table (CATS)

Spreadsheet:

o Examples:

o Under the NRC Report Section CAP credit is being taken for: Established a Eng Chg Mgmt Program, however, no corresponding CA could be found that has a CA Description that matches this action o Under the NRC Procedures Heading credit is being taken for: Modified Administrative Requirement (AR) 5.0 Procedure Use and Adherence, there is no corresponding CA Description found that prescribes this action.

o Under the NRC Procedures Heading credit is being taken for: Drafted and approved AR 5.1, Procedure Writers Guide, there is no Corresponding CA Description found that prescribes this action.

Many of the CA Descriptions are not SMART, therefore are not easily completed or measured as to being appropriately addressed.

o Examples of CA Descriptions found in the CATS Spreadsheet:

o CA 21-044 simply reads Revamp CAP o CA-047 has only a t in the Corrective action description block and in the Recommendation block it states: The NRC conducted a safety culture assessment of NIST and identified several problem areas including benchmarking, sustainability of corrective actions, procedure use and resources available. This document did not have specific recommended corrective actions but alternatively presented action the NCNR will take to improve the overall safety culture at the NCNR. These are divided amongst several categories.

- Either column you select to use is very hard to do a satisfactory review to determine completion is adequate based off of the Description provided.

The SEC Tracking Table (CATS Spreadsheet) as it is entitled is only as useful as the accuracy and integrity of the information being controlled and documented in this spreadsheet.

o Some of the columns of information are inaccurate and thereby make it difficult when reviewing for alignment with the Originating document.

§ When assessing how the Root Causes from the TWG or ER reports are married up with corrective actions in the SEC Table, it was discovered that the RC referenced in the CA Description was incorrect:

EX: 21-031 The statement states: PR-RC1: Procedures as written do not capture necessary steps in assuring elements are latched. However, that is RC2. Please revise this action to accurately align with Root Cause 2.

§ Not sure who controls, on who has access to modify this table but many closure statements lack detailed closure descriptions and Objective Evidence.

§ When completing Closure Reviews, the best source to understand the completeness of the closure was the SEC Form.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 35 of 48 : Period of Interest Timeline As part of the assessment, the team developed a Period of Interest Timeline. Separate timelines were plotted for each of the following:

A = Previous Related Events B = Historical Changes C = Form, Fit, or Function Changes D = Organizational Changes E = Funding Factors During the week the team was on-site, NIST personnel were invited to provide insights directly on the timeline into any factors which might have set up or allowed the February 2021 incident.

Formal interviews were conducted with the Chief, Reactor Operations, and the Chief, Reactor Engineering. The Chief, Reactor Operations and Engineering, provided information regarding NIST leadership changes. Informal interviews were conducted with several personnel when they stopped to view the posted Timeline or as they were writing on the posted Timeline.

The team reached the following conclusions about the information plotted on the Period of Interest Timeline regarding behaviors/culture based on the Unusual Occurrence Reports (UORs), the documents on the NRC Docket, the NIST Investigation Reports from 1967-2021, and interviews:

1. Documentation of problems on UORs is minimal.

2. Investigation depth for problems is shallow.

3. Restore to compliance is the most common corrective action.

4. Beyond restoring compliance, other corrective actions are promises of action with no documentation of implementation.

5. Most of the UORs received were from 1967 through the mid-1970s. (see timeline)

6. The last UOR reviewed was from 2006.

7. There was possible precursor* events in the 1967 through 2001 (not recent) timeframe regarding:

A. Pick-up tool issues and

b. Experience of workers

• But minimal documentation of a helpful/learning nature.

8. The loss of 15 operators since 2015 had a significant organizational impact.

9. From interviews, the team determined that the height check introduced around the time of the 2009 Tech Spec change was informal.

10. Starting in early 2017, dimensional differences were introduced to the refueling tooling that invalidated the capability of operators to verify that a fuel element was adequately latched.

11. The team did not find any information to plot on the Funding Factors timeline.

Assessment of Results: The Period of Interest Timeline identified performance issues that warrant further review within the context of TWG RC and ERCAS Report conclusion. The performance should be factored, based on risk and being indicative of current performance, in ongoing event evaluation efforts or included in a rewrite/integration of the current root cause.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 36 of 48 : Perspectives on Contributing Causes Perspectives on contributing causes related to hardware, tools, and other operational and procedural issues of NCNR Fuel Unlatch Event on 2/03/2021.

1. Purpose The objective of this portion of the assessment is to supplement the main RCA (Root Cause Analysis) which was focused on Safety Culture (SC) by evaluating the other contributing causes against established industry practices for root cause analysis and corrective action activities for significant events at nuclear power facilities. This will include:

1. Identifying the hardware, design, tools, and procedural issues that contributed to the event (Section 3).

2. Identifying how the event adverse impact could have been neutralized by testing and checks, and why did they fail (Section 4).

3. Past experiences with fuel latch failure and the effectiveness of the checks and testing, at the time of event, to detect or prevent them (Section 5).

4. Review of the set of corrective actions in-place for the root and contributing causes to determine if they are complete and comprehensive, without being overlapping and burdensome (Section 6).

5. Conclusion and recommendations (Section 7).

2. Review Process 2.1 Pre-Assessment Document Review The following documents were reviewed prior to onsite assessment.

1. NRC ML21274A022, Root Cause Response Rev 1, 09/20/2021.

2. NRC ML21274A020, Addendum to Root Cause Investigation of February 2021 Fuel Failure (Addendum 5 of 18)

NCNR Technical Working Group (TWG), 06/03/2021.

3. NRC ML21274A019, Root Cause Investigation of February 2021 Fuel Failure Rev 2 NCNR Technical Working Group (TWG), 09/13/2021.

4. NCNR SEC Report, NRC ML21274A021, FINAL Report SEC Subcommittee Report: Review of the NCNR Event Response and Technical Working Group Cause Analysis and Corrective Action Plan, 08/12/2021.

5. All Unusual event reports regarding unlatched fuel events (a total of 12 per refueling involving 19 unlatched fuel element failures). This is discussed in Section 5.

6. Letters from four experts on independent review and assessment of the NCNR event

[Alexander Adams, Erik W. Kahler, Julia M. Philips, and Thomas Mason.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 37 of 48

7. Report from Elizabeth Mackey, Event Response and Corrective Action Subcommittee (ERCAS) Chair, April 18, 2022.

2.2 Onsite (Virtual) Assessment A two-hour virtual meeting was held on May 25, 2023, with NCNR engineering staff. The purpose of this meeting was to discuss the design and function of the vessel and refueling equipment, and the root cause analysis that went into diagnosing issues. The following participants attended the meeting:

1. Mattes, Daniel A. (Fed)

2. Liposky, Paul J. (Fed)

3. Hix, David C. (Fed)

4. Lake Fred (Independent Consultant)

5. Azarm, Mohamad Ali (Independent Consultant)

Azarm and Mattes led the discussion.

a. Post-Assessment Document Review

1. Memorandum from Mattes, Daniel A. (Fed), Report to management documenting a review of the efficacy of a refueling tool wear and replacement program, 8/15/2022.

2. Addendum to Root Cause Investigation of February 2021 Fuel Failure NCNR Technical Working Group (TWG), June 3, 2021.

3. Element Latching System Overview and Tolerance Analysis, Power Point Presentation, Hix David, Revision 0, 4/9/2021.

4. CARRI Team 3 Metrology, progress on the precise measurements made to the refueling system and associated equipment, No date.

5. CARRI Team 4, using measurements taken by CAPRI 3, determine if the index plate requires replacement or reconditioning.

3. Observations and Assessment 3.1 Introduction Refueling is a routine operation at NCNR which takes place in an average of 7 cycles per year with 30 elements locked in each cycle. Refueling operation at NCNR is done remotely (with vessel head in place) to avoid any contamination of the primary system or adverse impact on crew. It is done at an elevation about 20 feet above the vessel flange using an index plate as a guide. The refueling operation appears to be quite demanding on the crew and requires a high level of precision and comprehensive post operation checks to ensure no error has occurred.

Due to high linear heat generation of the NCNR fuel, unlatching of the fuel during 20 MW operation will result in loss of cooling flow and lead to the melting of the affected fuel element in a very short period (in order of one minute). We understand that the offsite dose consequence of such an event is evaluated in the final Safety Analysis report (FSAR) for the closest location at site boundary (~400 meters). However, we did not review the FSAR and considered that to be out of scope for this task.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 38 of 48 Observation-1 Refueling is a routine operation that occurs frequently; however, it is quite complex, requires very precise equipment. Routine operations tend to cause complacency when past errors are perceived to be non-consequential. To prevent complacency the consequence of possible errors should be highlighted during the job brief.

3.2 Main Hardware A. Index Plate: This assembly consists of a thin plate that contains the slots used by pick up tools/tool extensions, and a set of marking that facilitate the fuel latching by proper rotation index. This thin plate sits on a thicker plate that serves as shielding. The index plate should be precisely aligned with the vessel flange to assure proper alignment and prevent any excessive friction or drag during refueling operation.

Observation-2 Proper alignment of the index plate is necessary for ease of refueling. There are two sets of Torque Wrenches used for this purpose. This could complicate the alignment of the index plate.

It is stated that the slots show signs of wear. Out of position bores could create increased tool drag as well, which can reduce operator feel. The original index plate alignment system reached the end of life in the mid-1990s and was replaced with a T-handle based alignment system. The condition of index plate including the ageing and wear could be a contributing cause to unlatched fuel.

Observation-3 Not all fiducial marks are clearly shown on the index plate to help with the proper rotation and latching of the fuels. This complicate the latching process and could be a contributing cause.

Observation-4 Due to the important role of the index plate in fuel latching, and the possibility of its wear and corrosion (last replaced in 1990), its replacement and ageing management should be considered.

B. Pickup Tool, Extension, Transfer Arm Pickup tool assemblies can introduce tool pointing vector errors, latching angle errors, and latching elevation errors. Pickup tool extensions lock into the top end of the pickup tool through a keyed interface (possibly susceptible to wear). The tool shaft has a collar with an oriented pin that interfaces with the index plate. The location and orientation of the collar plays an important role in proper fuel latching. There is a counterweight system to assist the staff in performing the refueling.

Observation-5 Problems with pickup/and extension tools and wear in the pickup tool interface could cause angular errors and may have to be investigated.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 39 of 48 C. Fuel Upper Arm, Latch and Spring The latching of a fuel element employs a latching bar that is rotated to lock the fuel element in the upper grid plate. A spring generated force maintain the fuel in latched position.

Observation-6 NCNR staff determined that when the latch is moved to the fully latched position, the spring on the element head, in addition to elastic compression, stores torsional energy. This could potentially result in unlatching of the fuel with a small compression/downward force such as dropping the pickup tool on the fuel end.

D. In-core assembly The collection of the lower and upper grid plate attached to the reactor vessel weldment is referred to as the in-core assembly. These nuclear grade components appear to be in good condition. The only concern could be with the surface wear of the latching slots.

Observation-7 The latching slots in the Upper Grid Plate could be susceptible to surface wear so it is possible that their geometry has been altered over time due to usage. This was extensively evaluated by NCNR.

Observations and Initial Assessment of Testing and Checks Prior to the event, the following checks and tests were performed prior to reactor startup:

First height check/reference check: this checks whether that the head of the element height corresponds to that of an element whose latch is in the slot in the upper grid plate.

2nd height check: this check confirms that the height of the tool collar is flush with the index plate.

Rotational check: This check verifies that the fuel is fully latched using the marks on the tool to the fiduciary marks on the index plate. This check must be performed after the last flow test.

The original height checks were performed with coolant flow. In about 2009 the station mainly focused on rotational check rather than height check with flow. However, the reactor performed the height checks without coolant flow to meet the intent of the 1993 corrective action for redundant verification, though only the initial rotational check is required by the technical specification. After several years of study, a go/no-go gauge was built to more easily verify that the height of the tool (attached to the element) was at the appropriate position.

Observation-8 The success of height checks without flow or go/no-go gauge are dependent on the tolerances of the index plate as well as the refueling tool. The required precision for no flow height check may not be practical. So, the current height check with no flow may not be considered as a redundant verification method.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 40 of 48 Observation-9 The rotational checks success depends on at least two factors; clear marking on the tool and the index plate, and operator following the procedure to ensure it is performed after the last flow test. OI 6.1 Fueling and Defueling Procedures, section 4.3.1, requires that rotation checks are to be performed after starting the primary pumps for the last time before reactor startup. In 2/03/2021 event, the reactor pump started 44 times prior to reactor start up but the rotation check was not performed.

The following check is performed during the reactor startup.

During the reactor startup and power ascension, the operator is supposed to pause at several different power levels and check for any channel oscillation (neutron flux). A pause at 10 MW for channel oscillation is a part of the procedure followed by the operator during startup. Channel oscillation could be an indication of boiling due to retarded flow. A full understanding of neutron noise is necessary to determine what magnitude of oscillation constitutes the threshold for boiling. This has been studied extensively by NCNR; however, it is complex, dependent on core position, power level, and geometry of an out-of-position fuel element.

Observation-10 It currently appears that the channel oscillation is checked by pausing at 10 MW. However, no specific threshold is specified. The anomaly threshold for neutron oscillation at 10 MW power level should be studied and the right threshold be specified.

It is the reviewers opinion that the channel oscillation at any power level is indicative of an anomaly (above 10 MW or below 10 MW). It is important to explore the possibility of continued monitoring of channel oscillations in an automated fashion with an alarm and auto reactor scram if needed.

General Observation-1 (Systematic and Integrated evaluation)

1. The refueling operation is a complex and demanding action. There are many opportunities that an error could occur (many scenarios). A complete identification and prioritization of these scenarios can provide evidence that the root cause analysis is covering all important scenarios with high likelihood. A formal fault tree analysis (FTA) supported by formal FMEA driven by engineering evaluation can achieve this goal. Furthermore, such an analysis will help to evaluate the effectiveness of the corrective actions taken in terms of reduction in fuel melt probability.

2. The refueling operation includes tasks beyond fuel latching and hazards beyond the fuel unlatching. A simplified risk analysis that address all possible hazards (e.g., drop of heavy loads including irradiated fuels, debris and flow plugging events) during refueling and fuel transfer can prioritize different mishaps.

3. Checks and tests are designed to detect an error during or after it occurs. For the most demanding operations where the occurrence of errors may have reasonable probability, emphasis generally is made on post operation testing and checks. The effectiveness of checks could be dependent on the details of failure scenario. An integrated and systematic evaluation could use the FTA models developed under 1.

4. Channel oscillation is the last line of defense. The channel oscillation at any power level is indicative of an anomaly (above 10 MW or below 10 MW). It is important to explore the

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 41 of 48 possibility of continued monitoring of channel oscillations in an automated fashion equipped with alarm and reactor scram if needed.

5. Lessons from Past Events The following lists all unlatching events at NCNR. The total number of refueling cycles prior to accident is estimated at 378 cycles (7cycles per year multiplied by 54 years). A total of 18 element unlatching failures occurred during this period. Note that multiple unlatching failures were detected within one cycle. These are shown in Bold. Multiple failures of fuel elements within one refueling cycle if not detected can result in more severe consequences and are generally referred to as a Common Cause Failure (CCF). All CCF events were detected either during the flow test or channel oscillation at 10 MW. Only two events were detected during the no flow test (both post 2001).

10/08/81 Element 320 in position L3 was *detected unlatched during flow test.

10/14/81 Element 308 in position I6 was detected unlatched at 10 MW.

03/12/84 Element xxx in position L3 was detected unlatched during flow test.

03/19/86 Element xxx in position K2 was detected unlatched during flow test.

03/21 /86 Elements xxx in positions C2, A4, M4, H7 indicated problems during flow test.

12/08/87 Element xxx in position H7 was detected unlatched during flow test.

09/10/93 Element 574 in position J7 was detected unlatched at 10 MW.

10/10/02 Element 739 in position E6 was detected partially unlatched during no-flow test.

02/06/03 Element 748 in position I6 was detected partially unlatched during no-flow test.

08/28/03 Element 777 in position C2 was detected unlatched during flow test.

03/09/04 Element 790 in position K2 was detected unlatched during flow test.

04/30/04 Element 792 in position L3 was detected unlatched during flow test.

04/30/04 Element 788 in position K6 was detected unlatched during flow test.

08/29/06 Element 841 in position F7 was detected unlatched during flow test.

10/ 19/06 Element 854 in position K2 was detected unlatched during flow test.

02/03/21 Element 1175, a second cycle element in core position J-7 was unlatched but not detected.

Observation-11 Monitoring and anomaly detection of risk significant events to trigger corrective action is a cornerstone of facility safe operation. Anomaly detection is triggered by both degrading trends and the magnitude threshold. Monitoring is the cornerstone of station risk management.

The following discussion highlights the importance of risk management in general and monitoring task in specific, as a means to possibly prevent the event on February 3, 2021, at NCNR. It is necessary to clarify that the conclusions and the estimated probabilities for unlatching events and the detection failures would only apply to the past (prior to 02/03/21) and not to the future after fixes goes into effect (e.g., discontinuing height checks, visual latch bar checks, NI: Nuclear Instrument, channel monitoring). The probabilities noted below are expected to be significantly reduced when the corrective measures noted above are implemented.

From a pre-event perspective, prior to the implementation of the extensive corrective actions related to latching and latch verifications, the unlatching events based on the historical data shown earlier is about 0.03 per refueling cycle (12 events in 378 cycles). If the plant continued to operate another 10 years (~70 cycles), without any fixes such that the historical performance

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 42 of 48 can be extrapolated, we should expect about two more unlatching events. It should be noted that some of the failures per cycle involved multiple fuel elements (about 25% of them). There is about 95% probability (estimated based on the past experience) that the unlatched fuel be detected and not lead to any fuel melt. Therefore, the chance of a single element melting in the next 10 years if the past trend would have continued would be about 10% (or 0.01 probability element melting per year). A typical estimate for minor core damage in research and test reactors is about one order of magnitude less (Probability threshold of 1.0E-3 per year). A monitoring system with a proper threshold could have helped to detect and correct the degraded performance prior to the occurrence of the fuel melt on February 3, 2021.

General Observation-2 (Monitoring and Risk Management Program)

1. Limited review of the historical events indicates the occurrence of repeated errors. This is indicative of non-effective fixes. Prolonged existence of such a condition for the risk significant failures is not safe. Monitoring and anomaly detection of risk significant events to trigger corrective action is a cornerstone of facility safe operation. Anomaly detection is triggered by both degrading trends or magnitude threshold and it is a corner stone of risk management. Lack of a risk informed monitoring program could have contributed to the NCNR fuel melt event.

2. Risk management is a closed loop process starting with identifying the degrading performance trends, evaluating their associated risk significance, triggering an alert, taking corrective actions, and monitoring the effectiveness of those actions. Lack of risk management process for the most risk significant events could have contributed to the NCNR fuel melt event.

3. Risk as defined in risk management may go beyond the off-site dose values. It could include worker exposure, and other consequences such as economical, regulatory, public acceptance, and potential for plant decommissioning. Appreciation for all the risk contributors when defined by a risk index can support risk management strategy.

4. There are several factors that can make the consequences of unlatching event more severe (e.g., highly irradiated fuel, multiple unlatched fuel, occurrence of other complications during startup). A simplified investigation of what can impact the severity of such an accident could be beneficial to better understand the station defenses (e.g.,

the possibility of multiple fuel left unlatched after refueling may not result in higher risk since the probability of such events are expected to be lower, the detection probability higher, but the consequence could be more severe).

6. Corrective Action Program The NCNR proposed corrective actions as a part of NRC ML21274A022, Root Cause Response Rev 1, 09/20/2021. This document was reviewed to ensure that all the hardware issues and observations discussed above are covered. The following summarizes the relevant corrective actions.

MS-CA MS-CA1 Process:

o An enhanced Aging Reactor Management (ARM) program is being developed.

See also MS-CA-4.

Procedures:

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 43 of 48 o Complete overhaul of procedure process, including procedure use and adherence, writing, and consistency with industry best practices. See also PR CAs.

Tools and Equipment:

o Managing the life cycle of tools and equipment through Engineering Change Notices, Trouble Tickets and the ARM program. See also IE CAs.

MS-CA3 The NCNR is in the process of fully evaluating the tools used in managing fuel in the reactor.

This includes a more formal methodology for assessing changes in tool design. The NCNR is also assessing the precision of tools currently in use for fuel manipulation. This includes the index plate, pickup tools, and pickup extension tools.

MS-SPI-7 Develop a process to communicate SAC recommendations and NCNR actions taken to address recommendations; consider establishing an SEC subcommittee to track corrective and preventive actions implemented in response to recommendations from SAC and other external review committees.

PR-CA PR-CA-1: Rewrite OI 6.1 and OI 6.2 to capture detail of fuel and latch movements to align with training.

PR-CA-2: Reinstitute requirement for latch checks prior to final pump restart and modify OI 2.1.

PR-CA-3: Institute method of visual checks prior to reactor restart.

PR-CA-4: Institute a redundant rotation latch check, performed by a second individual.

IE-CA IE-CA-1 Institute a method of visual checks (ERCAS clarification: Specify use of a camera or video camera to provide indisputable proof that each element is fully latched).

IE-CA-2 Document that improved latching and latch check processes provide adequate defense against unlatching.

IE-CA-3 Modify index plate so that it is consistently positioned in the same place and rotational fiduciary marks are clear.

IE-CA-4 Consider discontinuing use of height checks to verify latching.

IE-SPI-1 Explore NI signal analysis tools capable of providing early detection/alarm of abnormal behavior. Condition-based monitoring systems (CBMS) that could predict mechanical anomalies like a partially latched fuel element have been investigated. NCNR have identified three technological routes capable of detecting an unlatched element: 1) noise gates on the NC channels, 2) software analyses of I&C signals, and 3) acoustic monitoring of the vessel.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 44 of 48 IE-SPI-2 Require tool manufacturer to provide accurate dimensional inspection reports for comparison of as-built condition to drawing specifications.

Observation-12 We found the proposed corrective action plan is comprehensive, addressing most of the issues identified, and when completed could significantly reduce the probability of an unlatched fuel element. We also have identified a few areas that NCNR may consider for their corrective action programs. These are discussed in Section 7 and they could be beneficial and complementary to the current program.

7. Conclusions, Limitations, and Recommendations We found the NCNR determination of contributing causes for the event of 02/03/2021 as relates to hardware, tools, procedures, and checks to be comprehensive. We have also identified a few additional areas that are to be further examined. They are discussed under general observation and duplicated at the end.

We also found the proposed corrective action plan is comprehensive, addressing all root causes already identified, and when completed could significantly reduce the probability of an unlatched fuel element and the potential for the ensuing fuel melt. We have also identified a few supplemental corrective actions for NCNR to consider to further reduce this probability. These will be discussed next.

It is also important to note that this was a limited review by the independent consultant which significantly benefited from the discussion with experts at NCNR and reviewing previous reports and investigations by NRC/NCNR. Furthermore, this review did not include reactor building, confinement, filters, and emergency planning. As such we did not review the CO2 issue or other issues during the event.

The following lists our recommendations that may be considered by NCNR as a longer-term safety assurance program. These are duplicated from the general observations (1 and 2) in the report.

1. The refueling operation is a complex and demanding action. There are many opportunities that an error could occur (many scenarios). A complete identification and prioritization of these scenarios can provide evidence that the root cause analysis is covering all important scenarios with high likelihood. A formal fault tree analysis (FTA) supported by formal FMEA driven by engineering evaluation can achieve this goal. Furthermore, such an analysis will help to evaluate the effectiveness of the corrective actions taken in terms of reduction in fuel melt probability.

2. The refueling operation includes tasks beyond fuel latching and hazards beyond the fuel unlatching. A simplified risk analysis that addresses all possible hazards (e.g., drop of heavy loads including irradiated fuels, debris and flow plugging events) during refueling and fuel transfer can prioritize different mishaps.

3. Checks and tests are designed to detect an error during or after it occurs. For the most demanding operations where the occurrence of errors may have reasonable probability, emphasis generally is made on post operation testing and checks. The effectiveness of checks

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 45 of 48 could be dependent on the details of failure scenario. An integrated and systematic evaluation could use the FTA models developed under 1.

4. Channel oscillation is the last line of defense. The channel oscillation at any power level is indicative of an anomaly (above 10 MW or below 10 MW). It is important to explore the possibility of continued monitoring of channel oscillations in an automated fashion equipped with alarm and reactor scram if needed.

5. Limited review of the historical events indicates the occurrence of repeated errors. This is indicative of non-effective fixes. Prolonged existence of such a condition for the risk significant failures is not safe. Monitoring and anomaly detection of risk significant events to trigger corrective action is a cornerstone of facility safe operation. Anomaly detection is triggered by both degrading trends or magnitude threshold and it is a corner stone of risk management. Lack of a risk informed monitoring program could have contributed to the NCNR fuel melt event.

6. Risk management is a closed loop process starting with identifying the degrading performance trends, evaluating their associated risk significance, triggering an alert, taking corrective actions, and monitoring the effectiveness of those actions. Lack of risk management process for the most risk significant events could have contributed to the NCNR fuel melt event.

7. Risk as defined in risk management may go beyond the off-site dose values. It could include worker exposure, and other consequences such as economical, regulatory, public acceptance, and potential for plant decommissioning. Appreciation for all the risk contributors when defined by a risk index can support risk management strategy.

8. There are several factors that can make the consequences of unlatching event more severe (e.g., highly irradiated fuel, multiple unlatched fuel, occurrence of other complications during startup). A simplified investigation of what can impact the severity of such an accident could be beneficial to better understand the station defenses (e.g., the possibility of multiple fuel left unlatched after refueling may not result in higher risk since the probability of such events are expected to be lower, the detection probability higher, but the consequence could be more severe).

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 46 of 48 : Assessment Team Frederic Lake Over 40 years of experience root cause analysis and leadership experience covering operations, maintenance, engineering, licensing, and performance improvement. NRC recovery experience at numerous nuclear plants; Senior organizational leader guiding implementation of 95003 recovery at the Palo Verde Nuclear Station.

Team Leader John Osborne, P.E.

Over 35 years nuclear experience in the oversight and conduct of Root Cause Analysis addressing significant equipment, human, programmatic, organizational, and cultural performance issues; Significant experience in analyzing and resolution of NRC 95001/95002/95003 Issues.

Analyst - Cause Analysis Rigor and Quality Russell Titus Over 34 years nuclear experience including performance improvement, operating experience, corrective action programs, and emergency preparedness. Significant NRC 95003 recovery experience.

Analyst -

Corrective Action Implementation Frederick Forck Over 38 years of commercial nuclear experience in the areas of Performance Improvement, Cause Analysis, Quality Assurance, and Training. Certified Performance Technologist (CPT) in accordance with the International Society of Performance Improvement (ISPI) standards; supported 95003 recovery teams at five sites in the areas of Collective Evaluation and Causal Analysis:

Period of Interest Timeline Dr. Ali Azarm Over 41 years of experience in nuclear safety; developing and applying probabilistic risk assessments (PRAs); Risk-informed decision making, reliability assurance programs; NRC Reactor Oversight Process.

Analyst - Event consequence &

significance, Bruce OBrien Over 46 years of experience in commercial nuclear power production, naval submarine operations and shipyard work.

Engagements include direct Management and Consulting.

Bruce has been a principal participant and driver in oversight of recovery strategy and activities, project governance, project controls, subcontractor control and staffing, leadership indoctrination, conduct and oversight of assessment activities, cause analysis oversight, action plan development, implementation oversight, regulatory interface, and senior leadership mentoring through the process.

Advisor, reviewer, and interface with NSC Assessment and NCNR management.

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 47 of 48 : Contacts and Interviews Dr. Elizabeth Mackey, NIST Chief Safety Officer Andrew Gahan, Chief of Aging Reactor Management Tom Newton, Deputy Director Don Pierce, SEC Chair Paul Brand, Chief of Reactor Engineering Randy Strader, Chief of Reactor Operations.

Paul Liposky, Mechanical Engineer, Reactor Engineering Daniel Mattes, Mechanical Engineer, Reactor Engineering David Hix, Mechanical Engineer, Reactor Engineering

Independent Nuclear Safety Consultant Task 02: Event Root Cause Independent Assessment Report Page 48 of 48 : Reference Documents NIST/NCNR Documents

1. Event Notification Reports, 55094 and 55120

2. Technical Working Group (TWG) Root Cause

3. Addendum to Root Cause Investigation of February 2021 Fuel Failure NCNR Technical Working Group (TWG), June 3, 2021.

4. TWG Root Cause Revision 2

5. SEC ERCAS Final Report

6. SEC ERCAS Root Cause Response Revision 1

7. Independent Assessment: Eric Kaler 02/03/2021 Event

8. Independent Assessment: Julia Phillips 02/03/2021 Event

9. Independent Assessment: Alexander Adams Jr. 02/03/2021 Event

10. Independent Assessment: Thomas Mason 02/03/2021 Event

11. Incident Report 21-IG-0017, Evaluation for Exposure to Hazardous Environment

12. Memorandum from Mattes, Daniel A. (Fed), Report to management documenting a review of the efficacy of a refueling tool wear and replacement program, 8/15/2022.

13. Element Latching System Overview and Tolerance Analysis, Power Point Presentation, Hix David, Revision 0, 4/9/2021.

14. CAPRI Team 3 Metrology, progress on the precise measurements made to the refueling system and associated equipment, No date.

15. CAPRI Team 4, using measurements taken by CAPRI 3, determine if the index plate requires replacement or reconditioning.

16. Memorandum from E. Mackey to R. Dimeo,

Subject:

ERCAS Consideration of Safety Culture Causal Factors and Corrective Actions, 4/18/2022 NRC Documents

1. NRC Interim Special Inspection Report

2. NRC Special Inspection Report

3. NRC Confirmatory Order

4. NRC Regulatory Audit Re: Restart Request

5. NRC Technical Evaluation Report

6. NRC Authorizes Restart of NIST Reactor Note: This Root Cause Assessment effort did not utilize the NRC documentation to identify gaps and draw conclusions, as to eliminate the potential for complacency and group think in the conduct of the assessment and documentation of results.

Industry Documents US NRC Inspection Procedure 95001, Supplemental Inspection Response to Action Matrix Column 2 (Regulatory Response) Inputs, Revision Effective Date 8/19/2021.

1. US NRC Inspection Procedure 71152, Problem Identification and Resolution

2. INPO 12-011, A Framework to Significantly Improve Plant Performance

3. INPO 14-004, Conduct of Performance Improvement (This reference incorporates and supersedes INPO 09-011, Achieving Excellence in Performance Improvement, and INPO 05-005, Guidelines for Performance Improvement at Nuclear Power Stations.

4. NEI 16-07, Improving the Effectiveness of Issue Resolution to Enhance Safety and Efficiency.

5. NRC Training Course G-204, Root Cause Report Evaluation