ML17271A431

NRC Supplemental Inspection Report and Assessment Follow-Up Letter; 05000275/2017008 and 05000323/2017008

ML17271A431
Person / Time
Site:	Diablo Canyon
Issue date:	09/27/2017
From:	Troy Pruett NRC/RGN-IV/DRP
To:	Halpin E Pacific Gas & Electric Co
T. PRUETT
References
EA-16-168 IR 2017008
Download: ML17271A431 (22)

See also: IR 05000275/2017008

Text

UNITED STATES

NUCLEAR REGULATORY COMMISSION

REGION IV

1600 E. LAMAR BLVD.

ARLINGTON, TX 76011-4511

September 27, 2017

EA-16-168

Mr. Edward D. Halpin

Senior Vice President

and Chief Nuclear Officer

Pacific Gas and Electric Company

Diablo Canyon Power Plant

P.O. Box 56, Mail Code 104/6

Avila Beach, CA 93424

SUBJECT: DIABLO CANYON POWER PLANT - NRC SUPPLEMENTAL INSPECTION

REPORT AND ASSESSMENT FOLLOW-UP LETTER; 05000275/2017008 AND

05000323/2017008

Dear Mr. Halpin:

On June 15, 2017, the NRC completed the on-site portion of a supplemental inspection using

Inspection Procedure 95001, Supplemental Inspection Response to Action Matrix Column 2

Inputs. On September 21, 2017, the NRC inspection team discussed the results of this

inspection with Mr. J. Welsch and other members of your staff. The results of this inspection

are documented in the enclosed report.

The NRC performed this inspection to review your stations actions in response to a White

finding in the Mitigating Systems cornerstone which was documented in NRC Inspection

Reports 05000275/2016010 and 05000323/2016010, dated October 3, 2016, (Agencywide

Documents Access and Management System (ADAMS) Accession No. ML16277A340), and

finalized in a letter to you from Kriss Kennedy, Regional Administrator, dated December 28,

2016 (ADAMS Accession No. ML16363A429).

On May 3, 2017, you informed the NRC that your station was ready for the supplemental

inspection.

The NRC inspectors did not identify any finding or violation of more than minor significance.

The NRC determined that your staffs cause evaluations were not performed to the depth and

breadth described in Inspection Procedure 95001, Supplemental Inspection Response to

Action Matrix Column 2 Inputs. Your staff did not perform root cause evaluations to a level of

detail commensurate with the significance of the problem (White finding). In particular, the

questioning process concluded prior to the causes identified being beyond your control as

described in Section 03.03.b of Inspection Procedure 95001, Supplemental Inspection

Response to Action Matrix Column 2 Inputs. Had continued questioning occurred, additional

organizational and programmatic causes associated with the failure to provide supervisory

oversight and the failure to provide adequate guidance for developing work instructions would

E. Halpin 2

likely have been identified. The additional organizational and programmatic causes would also

require the development of corrective actions and effectiveness measures. Therefore, the

adequacy of the extent of cause, extent of condition, and corrective actions required to prevent

recurrence cannot be assessed until the depth and breadth of the root cause evaluation is fully

developed.

After reviewing your performance in addressing the White finding, the NRC concluded your

actions did not meet the objectives of Inspection Procedure 95001, Supplemental Inspection

Response to Action Matrix Column 2 Inputs. As a result, in accordance with the guidance in

Inspection Manual Chapter (IMC) 0305, Operating Reactor Assessment Program, the White

finding will be held open and will continue to be considered in assessing plant performance until

you notify the NRC of your readiness for additional inspection on this issue and the NRC

concludes, by inspection, that the objectives of the inspection procedure have been met.

This letter, its enclosure, and your response (if any) will be made available for public inspection

and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document

Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for

Withholding.

Sincerely,

/RA/

Troy W. Pruett, Director

Division of Reactor Projects

Docket Nos. 50-275 and 50-323

License Nos. DPR-80 and DPR-82

Enclosure:

Inspection Report 05000275/2017008 and

05000323/2017008

w/ Attachment: Supplemental Information

ML17271A431 ADAMS PACKAGE NUMBER: ML17271A447

SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive

By: MSH2/dll Yes No Publicly Available Sensitive

OFFICE RIV/PBD RIV/PE BC:DRP/A RIV/DRP

NAME CPeabody CJewett MHaire TPruett

SIGNATURE NON-CONCUR /RA/ /RA/ /RA/

DATE 08/15/17 08/24/17 08/23/17 9/26/17

SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive

By: MSH2/dll Yes No Publicly Available Sensitive

OFFICE RIV/PBD RIV/PE BC:DRP/A RIV/DRP

NAME CPeabody CJewett MHaire TPruett

SIGNATURE NON-CONCUR /RA/ /RA/ /RA/

DATE 09/26/17 09/25/17 09/22/17 09/26/17

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000275; 05000323

License: DPR-80; DPR-82

Report: 05000275/2017008; 05000323/2017008

Licensee: Pacific Gas and Electric Company

Facility: Diablo Canyon Power Plant, Units 1 and 2

Location: 7 1/2 miles NW of Avila Beach

Avila Beach, CA

Dates: June 12 through September 21, 2017

Inspectors: C. Peabody, Senior Resident Inspector

C. Jewett, Project Engineer

Approved Troy W. Pruett

By: Director, Division of Reactor Projects

Enclosure

SUMMARY

IR 05000275/2017008, 05000323/2017008; 06/07/2017 - 09/21/2017; Diablo Canyon Power

Plant; Supplemental Inspection - Inspection Procedure 95001

This supplemental inspection was conducted by a senior resident inspector from the Palo Verde

Generating Station and a project engineer from NRCs Region IV office. The NRCs program for

overseeing the safe operation of commercial nuclear power reactors is described in NUREG-

1649, Reactor Oversight Process.

No findings were identified.

Cornerstone: Mitigating Systems

The NRC determined that the licensees cause evaluations were not performed to the depth and

breadth described in Inspection Procedure 95001, Supplemental Inspection Response to

Action Matrix Column 2 Inputs. The licensee did not perform root cause evaluations to a level

of detail commensurate with the significance of the problem (White finding). In particular, the

questioning process concluded prior to the causes identified being beyond the licensees control

as described in Section 03.03.b of Inspection Procedure 95001, Supplemental Inspection

Response to Action Matrix Column 2 Inputs. Had continued questioning occurred, additional

organizational and programmatic causes associated with the failure to provide supervisory

oversight and the failure to provide adequate guidance for developing work instructions would

likely have been identified. The additional organizational and programmatic causes would also

require the development of corrective actions and effectiveness measures. Therefore, the

adequacy of the extent of cause, extent of condition, and corrective actions required to prevent

recurrence cannot be assessed until the depth and breadth of the root cause evaluation is fully

developed.

After reviewing the licensees performance in addressing the White finding, the NRC concluded

the licensees actions did not meet the objectives of Inspection Procedure 95001,

Supplemental Inspection Response to Action Matrix Column 2 Inputs. As a result, in

accordance with the guidance in Inspection Manual Chapter (IMC) 0305, Operating Reactor

Assessment Program, the White finding will be held open and will continue to be considered in

assessing plant performance until the licensee notifies the NRC of its readiness for additional

inspection on this issue and the NRC concludes, by inspection, that the objectives of the

inspection procedure have been met.

2

REPORT DETAILS

4. OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency

Preparedness, Public Radiation Safety, Occupational Radiation Safety, and

Security

4OA4 Supplemental Inspection (95001)

.01 Inspection Scope

This inspection was conducted in accordance with Inspection Procedure 95001,

Supplemental Inspection Response to Action Matrix Column 2 Inputs, to assess the

licensees evaluation of a White finding, which affected the Mitigating Systems

Cornerstone in the Reactor Safety Strategic Performance Area. The inspection

objectives included the following:

• Assure that the root causes and contributing causes of the significant performance

issues are understood.

• Independently assess and assure that the extent of condition and extent of cause of

significant performance issues are identified.

• Assure that corrective actions taken to address and preclude repetition of significant

performance issues are prompt and effective.

• Assure that corrective plans direct prompt actions to effectively address and preclude

repetition of significant performance issues.

The licensee remained in the Regulatory Response Column (Column 2) of the NRCs

Action Matrix in the second quarter of 2017 as a result of one inspection finding of low to

moderate safety significance (White). The finding was associated with the failure to

establish adequate work instructions for installation of Namco' Snap Lock limit

switches. Specifically, the licensee failed to provide site-specific instructions for limiting

the travel of these external limit switches when installed on safety-related motor

operated valves (MOVs). Consequently, the lever switch actuator for valve

RHR-2-8700B, residual heat removal pump 2-2 suction from the refueling water storage

tank, was operated repeatedly in an over-travel condition resulting in a sheared internal

roll pin that ultimately caused the limit switch to fail. The NRC staff characterized this

issue as having low to moderate safety significance (White), as documented in NRC

Inspection Report 05000275; 05000323/2016010, dated October 3, 2016, (ADAMS

Accession No. ML16277A340), and updated in a letter to E. Halpin from K. Kennedy,

dated December 28, 2016, (ADAMS Accession No. ML16363A429). On May 3, 2017,

the licensee informed the NRC that they were ready for the supplemental inspection.

In preparation for the inspection, the licensee performed root cause evaluation (RCE)

50886801 to address the performance deficiency associated with the White finding. The

licensee provided revision 1A of the report, completed in April 2017, to the inspectors for

review. This evaluation determined two root causes for the White finding. The first root

cause identified that Electrical Maintenance leadership was not ensuring that workers

perform procedures as written. The second root cause identified that guidance for

3

determining Maintenance Verification Testing work instructions in the electrical

maintenance procedures writing process was not sufficient.

In addition, the licensee performed RCE 50870357 to address why a probabilistic risk

assessment (PRA)-significant component failure was not recognized in a timely manner.

The licensee provided revision 2 of RCE 50870357, completed in October 2016, to the

inspectors for review. There were two root causes and one contributing cause identified

for RCE 50870357. The first root cause involved a non-industry standard design feature

of the emergency core cooling system (ECCS) interlocks which resulted in a failure

mechanism that was not immediately recognizable. Specifically, Diablo Canyon utilizes

external limit switches to provide feedback to the ECCS pump suction interlocks,

whereas it is more common for nuclear power plants to use the limit switches internal to

the valves motor operator. Having a separate external limit switch provides additional

separation and redundancy in the design, but warrants additional testing and verification

beyond the normal MOV testing to ensure that the external limit switch is functioning

properly. The second root cause identifieded that the external limit switch was not

identified as requiring additional post-maintenance testing to verify proper operation. A

similar contributing cause identified that the external limit switches were not identified as

requiring additional monitoring which could eliminate missed opportunities to identify

degraded conditions.

The inspectors reviewed the licensees two RCE reports and supporting evaluations.

The inspectors reviewed corrective actions that were taken or planned to address the

identified causes. The inspectors also interviewed licensee personnel to determine

whether the root and contributing causes were understood, and whether corrective

actions taken or planned were appropriate to address the causes and preclude

repetition.

.02 Evaluation of the Inspection Requirements

02.01 Problem Identification

a. Determine that the evaluation documented who identified the issue and under what

conditions the issue was identified.

The RHR-2-8700B valve failure event of May 16, 2016, was self-revealing. The initial

licensee corrective actions in response to the event failed to identify the performance

deficiencies associated with the inadequate level of guidance provided by the

maintenance work instructions that constituted the White finding. The NRC inspection

effort identified the performance deficiency independently of the efforts of the licensees

corrective action program.

This 95001 inspection requirement is closed.

b. Determine the evaluation documented how long the issue existed and prior opportunities

for identification.

The limit switch failed sometime after the last successful stroke test of interlocked valves

2-RHR-8982A and 2-RHR-8982B during the Unit 2, fall 2014 refueling outage. The

condition can be reasonably determined to have been introduced at the last

maintenance interval during the Unit 2, spring refueling outage of 2013. The

misalignment which caused the limit switch to over-travel was not detected during the

4

post-maintenance testing of 2-RHR-8700B. The misaligned switch repeatedly over-

traveled during quarterly stroke testing.

RCE 50886801 determined that the quarterly stroke testing and other maintenance

activities performed on 2-RHR-8700B were missed opportunities to visually identify the

misaligned external limit switch. In recognition of the safety significance of the interlocks

associated with the external limit switch, involved personnel missed the opportunity to

visually inspect the valve and limit switch travel during quarterly stroke testing as a

means of validating proper switch alignment. The inspectors noted the licensee also

missed opportunities to confirm interlock circuit continuity during valve testing. However,

since there was not adequate guidance to include additional procedural direction to

check this separate external limit switch or the ECCS interlock circuitry, the deficiency

was not identified. The licensees corrective actions included direction to visually inspect

the valve and limit switch travel and circuit continuity during quarterly stroke testing as a

means of validating proper switch alignment. Both RCE 50886801 and RCE 50870357

concluded that the physical positioning of the switch adjacent to the building wall,

combined with the lack of indication of switch position for the external limit switch and

ECCS interlock, made the degradation and failure of the switch unlikely to be identified

during quarterly testing of 2-RHR-8700B without the additional guidance to specifically

observe operation.

This 95001 inspection requirement is closed.

c. Determine that the evaluation documented significant plant-specific consequence, as

applicable, and compliance concerns associated with the issue.

The licensee conducted RCE 50886801 to address the White finding and

RCE 50870357 to address their failure to timely recognize a PRA-signficant component

failure. RCE 50870357 addressed plant specific consequences by using PRA

information to compile a list of components with elevated failure consequences. These

components were flagged in the corrective action program system so that future

conditions adverse to quality identified on these components will prompt automated

notifications, instructing the initiators to take corrective action in the timeliest manner

possible.

RCE 50886801 addressed the White finding and restoration of compliance. RCE

50886801 corrective actions (as outlined in Section 02.03.a below) added procedural

guidance to ensure the external limit switches are operating correctly and surveillance

monitoring of the ECCS interlock circuitry.

This 95001 inspection requirement is closed.

02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation

a. Determine that the problem was evaluated using a systematic methodology to identify

the root and contributing causes.

The White finding RCE 50886801 used Comparative Timeline©, Event and Causal

Factors Analysis, and a Barrier Analysis. The undetected failure RCE 50870357 used

Factor Tree Analysis and ABS Consulting Root Cause MapTM. These cause evaluation

tools provided a systematic methodology that can be used to identify the root and

contributing causes of the event.

5

No deficiencies were noted with the licensees selection of root cause methods. This

95001 inspection requirement is closed.

b. Determine that the root cause evaluation was conducted to a level of detail

commensurate with the significance of the problem.

The NRC determined that the licensees cause evaluations were not performed to the

depth and breadth described in Inspection Procedure 95001, Supplemental Inspection

Response to Action Matrix Column 2 Inputs. The licensee did not perform root cause

evaluations to a level of detail commensurate with the significance of the problem (White

finding). In particular, the questioning process concluded prior to the causes identified

being beyond the licensees control as described in Section 03.03.b of Inspection

Procedure 95001, Supplemental Inspection Response to Action Matrix Column 2

Inputs.

This 95001 inspection requirement will remain open.

c. Determine that the root cause evaluation included a consideration of prior occurrences

of the problem and knowledge of prior operating experience.

Both RCEs included a thorough review of internal and external operating experience to

search for previous occurrences. No identical failures of ECCS interlocks resulting from

external limit switches were identified. There were two instances from early refueling

outages in the fall of 1988 and fall of 1989 that identified maintenance difficulties in

setting the external limit switches, but no identical service failures were identified. There

were six industry operating experience events for over-travel failure of Namco' external

limit switches in low safety applications such as plant process systems or alarm and

indication functions, but none in applications related to safety system interlocks. As a

result of the low safety significance of these operating experience items, the six industry

events were characterized as broke/fix conditions rather than formally evaluated under

the respective licensees corrective action program.

This 95001 inspection requirement will remain remain open pending completion of a re-

assessment of the licensees root cause to satisfy Section 02.02.b, above. In particular,

the licensee should consider whether there are organizational and programmatic

concerns associated with how the licensee dispositions low risk operating experience

from other sites that may have risk significance at Diablo Canyon.

d. Determine that the root cause evaluation addressed the extent of condition and the

extent of cause of the problem.

Both RCEs identified the extent of condition as the population of risk significant valves

containing Namco' external limit switches which provided input into ECCS or other

engineered safety features actuation system (ESFAS) interlocks. The extent of

condition identified 8 ECCS valves on each unit, 16 in total, that met this criteria.

Extent of condition and extent of cause cannot be fully evaluated at this time because of

the determination that the root cause evaluations were not conducted to sufficient depth

and breadth. Of particular concern is whether or not organizational and programmatic

deficiencies involving management oversight of work activities, operating experience,

and guidance documents existed and corrective actions that may be warranted. This

95001 inspection requirement will remain open.

6

e. Determine that the root cause, extent of condition, and extent of cause evaluation

appropriately considered the safety culture traits in NUREG-2165, Safety Culture

Common Language, referenced in IMC 0310, Aspects within Cross-Cutting Areas.

Both RCEs contained a safety culture analysis. The White finding RCE 50886801

identified seven safety culture attributes associated with the White Finding. The RCE

identified H.2 Field Presence and H.8 Procedure Adherences as safety culture attributes

associated with the leadership oversight root cause. RCE 50886801 also identified X.5

Leader Behaviors, X.6 Standards, and X.10 Expectations as supplemental cross cutting

aspects associated with the leadership oversight root cause. In addition,

RCE 50886801identified H.1 Resources and H.7 Documentation as safety culture

attributes associated with the inadequate work instructions root cause. The undetected

failure RCE 50870357 identified the H.1 and H.7 assafety culture attributes associated

with the inadequate test requirements root cause and the inadequate monitoring

contributing cause.

No deficiencies were noted in this area, however further revisions of the RCEs could

introduce additional safety culture attributes that would require NRC review. This 95001

inspection requirement will remain remain open.

f. Examine the common cause analyses for potential programmatic weaknesses in

performance when a licensee has a second white input in the same cornerstone.

Not applicable; there was not a second White input in the affected cornerstone.

02.03 Corrective Actions Taken

a. Determine that appropriate corrective actions are specified for each root and contributing

cause or that the licensee has an adequate evaluation for why no corrective actions are

necessary.

Immediate corrective actions were taken under Notification 50852345 to walk down and

visually inspect all of the accessible affected MOVs in the extent of condition population

for physical signs of damage to the external limit switch assemblies.

Corrective actions taken in response to the White finding RCE 50886801 included the

following actions:

(1) Establishment of supervisory observation signoffs for maintenance verification

testing on Namco' external limit switches.

(2) Revision of the Nuclear Procedure Writers Manual to include specific guidance for

establishing maintenance verification testing in electrical procedures.

(3) Revision of MOV maintenance procedures that set and test external limit switches to

provide explicit instructions for switch configuration control, as well as switch travel

setting and testing.

(4) Development and implementation of a dynamic learning activity for Electrical

Maintenance MOV crews. Revision of the Pre-outage Just in Time Training module

offered to MOV technicians to include operating experience on this event.

7

(5) Revision of the MOV Sizing, Switch Setpoint Determination and Test Evaluation

procedure to include the Namco' vendor total travel limits and parameters, as well

as associated testing criteria.

(6) Education of the Diablo Canyon Power Plants extended leadership team on this

event and recent related human performance events in accordance with the Diablo

Canyon Power Plants Human Performance Reinforcement policy.

Corrective actions taken in response to the undetected failure RCE 50870357 included

the following actions:

(1) Development of a routine check to verify interlock circuit continuity for the

RHR 8700A/B valves and their associated external limit switches on a quarterly basis

in conjunction with the quarterly valve stroke surveillance.

(2) Revision of applicable maintenance procedures to specify direction as appropriate:

(a) Inclusion of external limit switch operation data.

(b) Specific evaluation of external limit switch and geared limit switch settings.

(c) Provide instructions for standardized assembly, configuration, and adjustment of

external limit switches.

(d) Provide inspection of external limit switch configuration against a set of

standardized criteria.

(e) Perform visual inspections of the external limit switch with each quarterly valve

stroke surveillance test.

(f) Apply position indication lamacoids on the 16 extent of condition valves.

The actions taken have restored compliance. The revised maintenance procedure work

instructions contain adequate and specific guidance to ensure confidence of operability

to the affected extent of condition valve population. Subsequent visual inspections and

electrical testing of the affected ECCS interlocks has confirmed operability.

No deficiencies were noted in this area, however further revisions of the RCEs could

introduce additional corrective action items that would require NRC review. This 95001

inspection requirement will remain open.

b. Determine that the corrective actions have been prioritized with consideration of

significance and regulatory compliance.

The licensees corrective actions have been prioritized with consideration of significance

and regulatory compliance. All corrective actions for the White finding RCE 50886801

are completed.

There is one remaining corrective action planned for the undetected failure

RCE 50870357. This action is to implement a design change to remove the external

limit switches associated with the ECCS MOV interlocks. Plans to modify the system to

remove the external limit switches will take until Spring 2019 to analyze and implement

in order to ensure the modification is conducted in accordance with 10 CFR 50.59 and

8

50.90. In the interim, the licensee added test requirements to electrically verify the

condition of the ECCS interlock when valves are stroked quarterly for surveillance

testing. During the quarterly stroke tests, the licensee also added visual field inspections

of the valve stroke by qualified MOV engineers. As the actions were implemented at the

first reasonable opportunity following the White finding, the inspector concluded that the

actions were prioritized.

No deficiencies were noted in this area, however further revisions of the RCEs could

introduce additional corrective action items that would require NRC review to assess

prioritization. This 95001 inspection requirement will remain remain open.

c. Determine that corrective actions taken to address and preclude repetition of significant

performance issues are prompt and effective.

Corrective actions to prevent recurrence (CAPR) of the White finding RCE 50886801

included the following:

(1) Establishment of supervisory observation signoffs for maintenance verification

testing on Namco' external limit switches.

(2) Revision of the Nuclear Procedure Writers Manual to include specific guidance for

establishing maintenance verification testing in electrical procedures.

(3) Revision of MOV maintenance procedures that set and test external limit switches to

provide explicit instructions for switch figure configuration control and switch travel

setting and testing.

Corrective actions to prevent recurrence of the undetected failure RCE 50870357

included the following actions:

(1) Development of a routine check to verify interlock circuit continuity for the

RHR 8700A/B valves and their associated external limit switches on a quarterly

basis; which was performed concurrent with the quarterly valve stroke surveillance.

(2) Revision of applicable maintenance procedures to specify direction as appropriate:

(a) Inclusion of external limit switch operation data.

(b) Specific evaluation of external limit switch and geared limit switch settings.

(c) Provide instructions for standardized assembly, configuration, and adjustment of

external limit switches.

The corrective actions taken to address and preclude repetition of significant

performance issues were prompt and effective. All but one CAPR is completed, and that

action has a corresponiding interim CAPR to monitor the interlock directly. The CAPRs

implemented have restored regulatory compliance and demonstrated operability for the

affected ECCS interlocks.

No deficiencies were noted in this area, however further revisions of the RCEs could

introduce additional CAPR items that would require NRC review to assess effectiveness.

This 95001 inspection requirement will remain remain open.

9

d. Determine that each Notice of Violation (NOV) related to the supplemental inspection is

adequately addressed, either in corrective actions taken or planned.

Corrective actions taken thus far have restored compliance with Technical

Specification 5.4.1.a., Procedures. The licensee has made applicable and appropriate

revisions to the maintenance procedures pertaining to VIO 05000323/2016010-01. The

licensee has taken steps to ensure that there are no additional failures in the extent of

condition valve population. As outlined above, surveillance testing of the affected valves

has been enhanced to provide additional means of verification, including visual testing of

proper external limit switch operation and electrical circuit verification of the associated

ECCS interlock function.

This 95001 inspection requirement is closed.

02.04 Corrective Action Plans

a. Determine that appropriate corrective action plans are specified for each root and

contributing cause or that the licensee has an adequate evaluation for why no corrective

actions are necessary. Determine that the corrective action plans have been prioritized

with consideration of significance and regulatory compliance.

All corrective actions for the White finding RCE 50886801 are completed.

There is one remaining corrective action planned for the undetected failure

RCE 50870357. This action is to implement a design change to remove the external

limit switches associated with the ECCS MOV interlocks. This design change is

expected to be implemented during the respective unit refueling outages in the

spring 2018 and the spring 2019.

Corrective actions taken thus far have been appropriate. Corrective actions taken and

planned have been prioritized with consideration of safety significance and regulatory

compliance. The interim actions to verify the design basis of the ECCS interlocks and

Namco' external limit switches provide a reliable means of maintaining safety and

regulatory compliance.

This 95001 inspection requirement will remain remain open pending completion of a re-

assessment of the licensees root cause to satisfy Section 02.02.b, above.

b. Determine that corrective plans direct prompt actions to effectively address and preclude

repetition of significant performance issue.

All corrective actions to prevent recurrence under White finding RCE 50886801 are

completed. The remaining actions planned for the undetected failure RCE 50870357 to

modify the system by removing the external limit switches have corresponding interim

actions in place to verify the ECCS interlocks associated with the Namco' external limit

switches are functioning properly.

This 95001 inspection requirement will remain remain open pending completion of a re-

assessment of the licensees root cause to satisfy Section 02.02.b, above.

10

c. Determine that appropriate quantitative or qualitative measures of success have been

developed for determining the effectiveness of planned and completed corrective

actions.

The White finding RCE 50886801 specified the following effectiveness evaluations:

(1) Procedure use and adherence - Targeted supervisory observations during outages

and online; review of station and department level events for procedure use and

adherence as a causal factor; and quick hit self-assessments.

(2) Procedure writers guide changes - 100 percent review of maintenance procedure

revisions, as well as interviews with maintenance procedure writers to confirm

understanding of the writers guide changes.

The undetected failure RCE 50870357 specified the following effectiveness evaluations:

(1) Design verification testing and return to service following the design change

modification to remove the external limit switches from the ECCS interlocks.

(2) During outages 1R20 and 2R20, satisfactory verifications of the setting, testing, and

adjustment of affected Namco' external limit switches.

(3) Satisfactory testing of the interlock circuit continuity testing during the quarterly

surveillance testing.

The success measures for RCE 50886801 were appropriate and provide qualitative

measures of success of the corrective actions taken. RCE 50870357 effectiveness

measures are satisfactory; the second and third criteria provide appropriate

effectiveness measures until the modifications associated with the first criteria are

implemented.

This 95001 inspection requirement will remain remain open pending completion of a re-

assessment of the licensees root cause to satisfy Section 02.02.b, above.

d. Determine that each Notice of Violation (NOV) related to the supplemental inspection is

adequately addressed in corrective actions taken or planned.

As discussed in Section 02.03.d (above), the corrective actions have restored

compliance with Technical Specification 5.4.1.a., Procedures. for which the NOV was

issued associated with the White finding.

This 95001 inspection requirement is closed.

02.05 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues.

Not applicable; the performance deficiency associated with the White finding does not

warrant treatment as an old design issue.

This 95001 inspection requirement is closed.

11

03.00 Inspection Results Summary

The NRC determined that the licensees cause evaluations were not performed to the

depth and breadth described in Inspection Procedure 95001, Supplemental Inspection

Response to Action Matrix Column 2 Inputs. The licensee did not perform root cause

evaluations to a level of detail commensurate with the significance of the problem (White

finding). In particular, the questioning process concluded prior to the causes identified

being beyond the licensees control as described in Section 03.03.b of Inspection

Procedure 95001, Supplemental Inspection Response to Action Matrix Column 2

Inputs. Had continued questioning occurred, additional organizational and

programmatic causes associated with the failure to provide supervisory oversight and

the failure to provide adequate guidance for developing work instructions would likely

have been identified. The additional organizational and programmatic causes would

also require the development of corrective actions and effectiveness measures.

Therefore, the adequacy of the extent of cause, extent of condition, and corrective

actions required to prevent recurrence cannot be assessed until the depth and breadth

of the root cause evaluation is fully developed.

The status of the inspection requirements of Inspection Procedure 95001 have been

categorized below. Requirements held open in entirety by this inspection will require a

full re-evaluation by NRC inspectors at a later date. Requirements held open for

changes only are those for which no deficiencies were noted during this inspection but

may be impacted, and therefore require additional review, as a result of revisions to the

licensees RCEs. In this instance, only the changes added by future revisions of the

RCEs will have to be evaluated by NRC inspectors at a later date. Requirements closed

by this inspection effort will require no additional inspection effort.

03.01 Inspection Requirements Held Open in Entirety

02.02b Determine that the root cause evaluation was conducted to a level of detail

commensurate with the significance of the problem

02.02d Determine that the root cause evaluation addressed the extent of condition

and the extent of cause of the problem

03.02 Inspection Requirements Held Open for Changes Only

02.02c Determine that the root cause evaluation included a consideration of prior

occurrences of the problem and knowledge of prior operating experience

02.02e Determine that the root cause, extent of condition, and extent of cause

evaluation appropriately considered the safety culture traits in NUREG-

2165, Safety Culture Common Language, referenced in IMC 0310,

Aspects within Cross-Cutting Areas

02.03a Determine that appropriate corrective actions are specified for each root and

contributing cause or that the licensee has an adequate evaluation for why

no corrective actions are necessary

02.03b Determine that the corrective actions have been prioritized with

consideration of significance and regulatory compliance

12

02.03c Determine that corrective actions taken to address and preclude repetition

of significant performance issues are prompt and effective

02.04a Determine that appropriate corrective action plans are specified for each

root and contributing cause or that the licensee has an adequate evaluation

for why no corrective actions are necessary. Determine that the corrective

action plans have been prioritized with consideration of significance and

regulatory compliance

02.04b Determine that corrective plans direct prompt actions to effectively address

and preclude repetition of significant performance issue

02.04c Determine that appropriate quantitative or qualitative measures of success

have been developed for determining the effectiveness of planned and

completed corrective actions

03.03 Inspection Requirements Closed

02.01a Determine that the evaluation documented who identified the issue and

under what conditions the issue was identified

02.01b Determine the evaluation documented how long the issue existed and prior

opportunities for identification

02.01c Determine that the evaluation documented significant plant-specific

consequence, as applicable, and compliance concerns associated with the

issue

02.02a Determine that the problem was evaluated using a systematic methodology

to identify the root and contributing causes

02.02f Examine the common cause analyses for potential programmatic

weaknesses in performance when a licensee has a second white input in

the same cornerstone

02.03d Determine that each Notice of Violation (NOV) related to the supplemental

inspection is adequately addressed, either in corrective actions taken or

planned

02.04d Determine that each Notice of Violation (NOV) related to the supplemental

inspection is adequately addressed in corrective actions taken or planned

02.05 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues

13

4OA6 Meetings, Including Exit

Exit Meeting Summary

On September 21, 2017, the inspectors presented the inspection results to Mr. J. Welsch, Site

Vice President, and other members of the licensee staff. The licensee acknowledged the issues

presented. The licensee confirmed that any proprietary information reviewed by the inspectors

had been returned or destroyed.

14

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

T. Baldwin, Director, Nuclear Site Services

J. Cheek, MOV Program Engineer

D. Evans, Director, Security & Emergency Services

M. Fraunheim, Manager Nuclear Performance Improvement

P. Gerfen, Senior Director Plant Manager

M. Ginn, Manager, Emergency Planning

E. Halpin, Sr. Vice President, Chief Nuclear Officer Generation

H. Hamzehee, Manager, Regulatory Services

A. Heffner, NRC Interface, Regulatory Services

J. Hinds, Director, Quality Verification

L. Hopson, Director Maintenance Services

T. Irving, Manager, Radiation Protection

K. Johnston, Director of Operations

M. McCoy, NRC Interface, Regulatory Services

J. Morris, Senior Advising Engineer

C. Murry, Director Nuclear Work Management

J. Nimick, Senior Director Nuclear Services

A. Peck, Director, Nuclear Engineering

R. Walthos, Nuclear Engineering Specialist, Principal

J. Welsch, Site Vice President

NRC Personnel

C. Newport, Senior Resident Inspector

J. Reynoso, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Discussed

Failure to Establish Adequate Work Instructions for Installation

05000323/2016010-01 VIO

of Namco' Snap Lock Limit Switches (Section 4OA4)

LIST OF DOCUMENTS REVIEWED

Section 4OA4: Supplemental Inspection (95001)

Procedures

Number Title Revision

AD1 Administrative Controls Program 17

AD1.ID1 Nuclear Generation Procedure Writers Manual 30

Attachment

Procedures

Number Title Revision

AD7.ID12 Work Management Process 6

AD7.ID15 On-Line Maintenance Outrage Window Execution 3

AD7.ID16 Tool Pouch and Minor Maintenance 4

AD7.ID2 Daily Notification Review Team (DRT) & Standard Plant 27

Priority Assignment Scheme

AD7.ID4 On-line Maintenance Scheduling 25

AWP E-027 Motor Operated Valve Sizing, Switch Setpoint Determination 4

and Test evaluation

MA1.DC58 Troubleshooting Evidence Preservation and Forensic 1

Analysis

MP E-53.10A Preventive Maintenance of Limitorque Motor Operators 41

MP E-53.10A1 Low Impact External Inspections of Limitorque Motor 2

Operators

MP E-53.10R Augmented Stem Lubrication for Limitorque Operated 9

Valves

MP E-53.10S Limitorque Swap-Out and Switch Settings 14

MP-E-53.10V1 MOV Diagnostic Testing 18

OM15.ID8 Human Performance Error Prevention Tools 7

OM7.ID1 Problem Identification and Resolution 49A

OM7.ID3 Root Cause Evaluation 45

OM7.ID4 Cause Determinations 36

OM7.ID7 Emerging Issue and Event Investigations 18A

OP1.DC18 Authorization of Test Equipment Operation, Maintenance, 11

and Testing

OP2.ID1 Clearances 39

PEP V-7B Test of ECCS Valve Interlocks 10

PRA 17-02 Probabilistic Risk Assessment 1

STP V-2B2 Exercising and Position Verification of Valves 9003A and 0

9003B Unit 2

STP V-2B2 Exercising and Position Verification of Valves 9003A and 16

9003B Unit 1

STP V-2D2A Exercising and Position Verification of Valve 8700A Unit 2 0

STP V-2D2A Exercising and Position Verification of Valve 8700A Unit 1 3

A-2

Procedures

Number Title Revision

STP V-2D2B Exercising and Position Verification of Valve 8700B Unit 2 0

STP V-2D2B Exercising and Position Verification of Valve 8700B Unit 1 3

STP V-2O6 Exercising and Position Verification of Valves 8982A and 1

8982B Unit 2

STP V-2O6 Exercising and Position Verification of Valves 8982A and 10

8982B Unit 1

STP V-2V1 Exercising and Position Verification of Valves 8804A and 0

8804B Unit 2

STP V-2V1 Exercising and Position Verification of Valves 8804A and 11

8804B Unit 1

TP V-3M5 Exercising Valves RHR-8701 and RHR-8702, Reactor 16

Coolant Loop 4 to RHR Pump Suction

Notifications

50852345 50870357 50923338 50923339 50857553

50874911 50886801 50871499 50910294 50908100

50915340 50891772 50906150 50906119 50915775

50893249 50874463 50875300 50866497 50872919

50913951 50891005 50910293 50891005

Miscellaneous Documents

Number Title Revision /

Date

Cause Determination Manual May 18, 2017

2016 Maintenance Audit November 7, 2016

HUJITDC055 JITT Validating Assumptions April 20, 2017

HUJITDC050 Confined Space DLA February 16, 2017

HUJITIS041 Human Performance Training March 29, 2016

JITTEM1604 JITT Pre-Outage MOV Training April 19, 2017

1R20 Supervisor Stand Down May 1, 2017

R165C11 Task Training: Nuclear Operators 0

Program and Process Codes May 2, 2013

Cause Codes

A-3

Miscellaneous Documents

Number Title Revision /

Date

Site Standards Handbook

WG-24 NRC Administrative Support 7

WG-7 Reportability Reviews 8

2017-S009-001 Undetected ECCS Interlock Failure April 18, 2017

50870357 Root Cause Evaluation Report Undetected ECCS 2

Interlock Failure

50886801 Root Cause Evaluation Report DCPP Inadequate 1A

NAMCO Procedure

50913375 95-001 Pre-Inspection Assessment May 3, 2017

130100011 Work Order Preparation January 28, 2013

150360043 Assessment of 1Y19 February 5, 2015

163620001 2017 Fire Protection Audit 1

9000035423 Motor Operated Valve Sizing and Switch Setting September 30, 2013

Calculations

Work Orders

60098575 60098576 60098577 60098578 60094730

60094731 60090383 64090172 60100131 64065079

LIST OF ACRONYMS

ADAMS Agencywide Document Access and Management System

CAPR corrective action to prevent recurrence

CFR Code of Federal Regulations

ECCS emergency core cooling system

ESFAS engineered safety features actuation system

MOV motor-operated valve

PRA probabilistic risk assessment

RCE Root Cause Evaluation

RCS reactor coolant system

RHR residual heat removal

A-4