IR 05000263/2014009

IR 05000263/2014009; 10/27/2014-12/02/2014; Monticello Nuclear Generating Plant; Supplemental Inspection-IP 95002, Supplemental Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area

ML15016A338
Person / Time
Site:	Monticello
Issue date:	01/16/2015
From:	Boland A Division Reactor Projects III
To:	Fili K Northern States Power Co
References
EA-13-096, EA-14-232 IR 2014009
Download: ML15016A338 (74)

Text

UNITED STATES ary 16, 2015

SUBJECT:

MONTICELLO NUCLEAR GENERATING PLANT-NRC 95002 SUPPLEMENTAL INSPECTION REPORT 05000263/2014009 AND EXERCISE OF ENFORCEMENT DISCRETION

Dear Ms. Fili:

On December 2, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a supplemental inspection pursuant to Inspection Procedure (IP) 95002, Supplemental Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area, at your Monticello Nuclear Generating Plant (MNGP). The enclosed report documents the results of this inspection, which were discussed at the exit meeting on December 2, 2014, with you and other members of your staff.

In accordance with the NRC Reactor Oversight Process (ROP), this supplemental inspection was performed to review your evaluation of the root and contributing causes and corrective actions for a finding of substantial safety significance (yellow) at the MNGP, which was discussed in NRC Inspection Report 05000263/2013009. The finding and associated Notice of Violation (NOV) was associated with your failure to maintain a procedure addressing all of the effects of an external flooding scenario at the MNGP. Specifically, Procedure A.6, Acts of Nature, was inadequate to support the timely implementation of flood protection activities within the 12-day timeframe credited in the design basis as stated in the Updated Safety Analysis Report (USAR). The yellow finding was in the Mitigating Systems Cornerstone and placed the MNGP in a degraded cornerstone as of the second quarter of 2013.

The NRC staff was informed on July 18, 2014, of your readiness, as of that date, for us to conduct this supplemental inspection. The NRC performed this supplemental inspection to determine if: (1) the root and contributing causes for the risk-significant finding were understood; (2) the extent of condition and extent of cause for the finding were understood; and (3) your completed or planned corrective actions for the finding were sufficient to address and preclude repetition of the root and contributing causes. The NRC also conducted an independent review of the extent of condition and extent of cause associated with the yellow finding and an assessment of whether any of the safety culture components caused or significantly contributed to the performance issues.

Based on the results of the inspection, the NRC determined the MNGP had performed an acceptable evaluation of the yellow finding and associated NOV. The evaluation identified the root cause of the issue was MNGP management did not ensure proper validation of the external flooding mitigation plan design basis commensurate with its safety significance, which led to non-conservative decisions. To correct this issue and prevent recurrence, MNGP implemented corrective actions including changes to your external flooding mitigation plan to satisfy your current licensing basis (CLB), creation of an engineering program for external flooding protection, and communicating and training plant personnel on the importance of validation of the design basis in decision-making.

After reviewing your actions to address the risk-significant performance issue using IP 95002, the NRC concluded that completed or planned corrective actions were sufficient to address the performance that led to the finding. Therefore, in accordance with Inspection Manual Chapter 0305, Operating Reactor Assessment Program, the yellow finding and associated NOV that was being held open pending completion of a supplemental inspection and effective corrective actions, is closed, and will only be considered in assessing plant performance until the end of the fourth quarter of 2014.

While the NRC has concluded that you have taken appropriate actions in response to the risk-significant performance issue, the inspection identified continued management attention and focus is needed to address the human performance problems that were prevalent at the MNGP and resulted in the yellow finding. Specifically, in your root cause evaluation you identified the use of non-conservative decision-making as a contributing cause of the finding.

During the course of this supplemental inspection, the inspectors noted multiple low-level issues that potentially had contributing cause attributes related to non-conservative decisions. These are discussed in more detail in Section 4OA4.02.04.b of the enclosed report.

A separate follow-up letter will communicate the NRC's assessment of MNGP's performance and subsequent placement in the ROP Action Matrix. Additionally, that letter, or the End of Cycle Assessment Letter, will communicate any changes to the baseline inspection schedule that will be made for the NRC to evaluate the long-term effectiveness of your corrective actions for the risk-significant issue that is the subject of this inspection report and your actions to address the low-level issues that were identified. Based on the results of this inspection, two NRC-identified findings of very low safety significance (green), one of which involved a violation of NRC requirements were identified.

The NRC identified two additional performance deficiencies that were associated with Severity Level IV Violations of NRC requirements evaluated through the traditional enforcement process.

Because of their very low safety significance and because these issues were entered into your corrective action program, the NRC is treating these violations as Non-Cited Violations in accordance with Section 2.3.2 of the NRC Enforcement Policy.

If you contest the subject or severity of these Non-Cited Violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission-Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector Office at the MNGP. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III, and the NRC Resident Inspector at the MNGP.

In addition, two licensee-identified findings that were associated with Severity Level III Violations of NRC requirements were evaluated through the traditional enforcement process. The first one was a violation of Title 10 of the Code of Federal Regulations (10 CFR) Section 50.71, Maintenance of records, making of reports, for your failure to update the USAR to correctly describe your mitigation strategy for the design basis external flooding event prior to January 31, 2014. The second one was a violation of 10 CFR 50.59, Changes, tests and experiments, for your failure to perform a written safety evaluation to demonstrate the change to your mitigation strategy for the design basis external flooding event on February 28, 2012 did not require a license amendment. Both of the violations were associated with the underlying performance issue that resulted in the yellow finding. Therefore, based on the results of the NRC's inspection and assessment of the violations, I have been authorized, after consultation with the Director of the Office of Enforcement and the Region III Regional Administrator, to exercise enforcement discretion in accordance with Section 3.3 of the NRC Enforcement Policy, Use of Enforcement Discretion, and refrain from issuing enforcement action for the violations.

In accordance with the NRCs ROP, the findings and associated violations will not be considered in the assessment process or the NRCs Action Matrix.

In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter and its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS) component of NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA John Giessner Acting for/

Anne T. Boland, Director Division of Reactor Projects Docket No. 50-263 License No. DPR-22

Enclosure:

IR 05000263/2014009 w/Attachment: Supplemental Information

REGION III==

Docket No: 50-263 License No: DPR-22 Report No: 05000263/2014009 Licensee: Northern States Power Company, Minnesota Facility: Monticello Nuclear Generating Plant Location: Monticello, MN Dates: October 27 through December 2, 2014 Inspectors: B. Kemker, Senior Resident Inspector, Team Leader P. Chaput, Hydrologist J. Corujo-Sandín, Reactor Inspector R. Edwards, Reactor Inspector G. Hansen, Security Specialist J. Rutkowski, Project Engineer P. Voss, Resident Inspector W. Wang, Senior Geotechnical Engineer M. Ziolkowski, Reactor Engineer-Observer Approved by: K. Riemer, Chief Branch 2 Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

Inspection Report 05000263/2014009; 10/27/2014-12/02/2014; Monticello Nuclear Generating

Plant; Supplemental Inspection-IP 95002, Supplemental Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area.

This inspection was conducted by nine inspectors and specialists from the NRC Region III and Headquarters offices. Two Green findings, one of which had an associated Non-Cited Violation (NCV) of NRC requirements, were identified. In addition, two Severity Level IV NCVs of NRC requirements were identified. The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, dated June 2, 2011. Cross-cutting aspects are determined using IMC 0310, Components Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy dated July 9, 2013. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5, dated February 2014.

Cornerstone: Mitigating Systems

The NRC staff performed this supplemental inspection in accordance with Inspection Procedure (IP) 95002, Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area, to assess the licensees evaluation of one yellow inspection finding that affected the Mitigating Systems Cornerstone.

The inspection team determined the licensees evaluation of the risk-significant inspection finding met the inspection procedure objectives. The inspection team determined the root cause evaluation (RCE) for the yellow inspection finding appropriately evaluated the root and contributing causes, adequately addressed the extent of condition and cause, assessed safety culture, and established corrective actions for the performance issues. In addition to assessing the licensees evaluations, the inspection team independently performed an extent of condition and extent of cause review of the finding and a review of the site safety culture as it related to the RCE. The team concluded the licensees RCE and corrective actions, both completed and planned, were sufficient to address the causes and prevent recurrence of the violation.

Cornerstone: Mitigating Systems

• Severity Level IV. The inspectors identified a NCV of the NRCs reporting requirements in 10 CFR 50.73, Licensee Event Report System. The licensee failed to submit a required Licensee Event Report (LER) within 60 days after the discovery of a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety, a condition that could have prevented the fulfillment of the safety function of structures or systems needed to mitigate the consequences of an accident, and a condition prohibited by the plants Technical Specifications (TSs). Specifically, the licensee failed to either make a separate LER or further revise an existing LER with additional information to fully describe a known unanalyzed condition affecting its ability to mitigate a design basis external flooding event based on additional problems it had discovered, the corrective actions taken to correct the condition, the safety significance, and the date when full compliance was restored. The licensee initiated a corrective action to supplement an existing LER to describe the additional issues it identified that affected its external flooding mitigation plan and to specify the noncompliance window as February 29, 2012 through January 31, 2014.

Consistent with the guidance in IMC 0612, Power Reactor Inspection Reports, Appendix B,

Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was not of more than minor significance based on No answers to the more-than-minor screening questions. In accordance with Section 6.9.d.9 of the NRC Enforcement Policy, this violation was categorized as Severity Level IV because the licensee failed to report as required by 10 CFR 50.73(a)(1). No cross-cutting aspect is associated with this traditional enforcement violation because the associated performance deficiency was determined to be of minor significance and therefore not a finding.

(Section 4OA4.02.01.d.1)

• Severity Level IV. The inspectors identified a Severity Level IV NCV of the NRCs reporting requirements in 10 CFR 50.72(a)(1), Immediate Notification Requirements for Operating Nuclear Power Reactors, and 10 CFR 50.73(a)(1), Licensee Event Report System. The licensee failed to make a required 8-hour non-emergency notification call to the NRC Operations Center and also failed to submit a required LER within 60 days after discovery in November 2012 of a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety, a condition that could have prevented the fulfillment of the safety function of structures or systems needed to mitigate the consequences of an accident, and a condition prohibited by the plants TSs. The licensee subsequently made an 8-hour notification call to the NRC Operations Center via the Emergency Notification System to report the event on August 29, 2013 (Event Notice 49314) and subsequently submitted LER 05000263/2013-007-00, Unanalyzed Condition Due to Inadequate Flooding Procedures, on October 28, 2013.

Consistent with the guidance in IMC 0612, Power Reactor Inspection Reports, Appendix B,

Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was not of more than minor significance based on No answers to the more-than-minor screening questions. In accordance with Section 6.9.d.9 of the NRC Enforcement Policy, this violation was categorized as Severity Level IV because the licensee failed to report as required by 10 CFR 50.72(a)(1)(ii) and 10 CFR 50.73(a)(1). No cross-cutting aspect is associated with this traditional enforcement violation because the associated performance deficiency was determined to be of minor significance and therefore not a finding. (Section 4OA4.02.01.d.2)

Green.

The inspectors identified a finding of very low safety significance with an associated NCV of Technical Specification 5.4.1.a for the licensees failure to maintain adequate procedures to protect the plant from external flooding events. Specifically, the licensee failed to maintain Procedure 8300-02, External Flooding Protection Implementation to Support A.6 Acts of Nature, in that it lacked sufficient instructions to ensure testing of materials necessary to its external flooding mitigation plan were adequately controlled. The licensee entered this violation into its corrective action program (CAP) to evaluate changes to its procedures to correct the problem.

The finding was of more than minor significance because it was associated with the Protection Against External Factors and Procedure Quality attributes and adversely affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the instructions for constructing the flood control levee lacked specific details on how the licensee would ensure it was constructed, compacted, and tested to at least 90 percent compaction. The finding was a licensee performance deficiency of very low safety significance because it did not involve a loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event (e.g., seismic snubbers, flooding barriers, tornado doors). This determination was based on reasonable assurance the licensee could construct and compact the levee to at least 90 percent compaction. The inspectors determined this finding affected the cross-cutting area of human performance and the work management aspect due to the licensees failure to implement a process of planning, controlling, and executing work activities such that safety is the overriding priority. Specifically, the licensees process for developing and validating the work instructions for construction of the levee did not ensure appropriate quality control steps were incorporated for critical design attributes.

(IMC 0310, H.5) (Section 4OA4.02.03.f.1)

Green.

The inspectors identified a finding of very low security significance for the licensees failure to adequately assess and manage the potential for adverse effects on safety and security associated with the development and planned implementation of its external flooding mitigation plan. Specifically, 10 CFR 73.58(b)(3)(i) requires the licensee to have the capabilities to detect, assess, interdict and neutralize threats up to and including the design basis threat of radiological sabotage at all times. The failure to adequately review and evaluate the security measures and changes that would be implemented in response to a flooding event would have resulted in the requirements of 10 CFR 73.58(b)(3)(i) not being adequately maintained. This finding is not a violation of the regulatory requirements since the licensee had not actually implemented the changes that could have adversely impacted the sites security equipment, systems, and protective measures. The licensee entered the issue into its CAP to perform and document the assessments required to manage the planned changes, and to evaluate and develop potential corrective actions.

The finding was of more than minor significance because it adversely affected the Security Cornerstone objective to provide high assurance that the licensee's security system uses a defense-in-depth approach and can protect against the design basis threat of radiological sabotage from external and internal threats. Specifically, the licensee failed to assess and manage changes to security equipment, systems, and protective measures that would be required in the event of the implementation of its external flooding mitigation plan to determine whether these changes could adversely impact its ability to implement the sites protective plan, which could potentially lead to a loss of defense-in-depth. The finding was of very low security significance because the total point value of this performance issue was determined to be one (1) when it was screened using the guidance provided in IMC 0609,

Significance Determination Process, Appendix E, Part 1, Baseline Security Significance Determination Process (SDP) for Power Reactors, dated January 15, 2014. The inspectors determined this finding affected the cross-cutting area of human performance with a cross-cutting aspect of change management due to the licensees failure to use a systematic process for evaluating and implementing change so that nuclear safety remains the overriding priority. Specifically, the licensee did not provide validation of the security plan by conducting integrated tabletops and reviews and perform additional assessment based on feedback from its external reviewers to determine whether these changes could adversely impact its ability to implement the sites protective plan. (IMC 0310, H.3)

(Section 4OA4.02.04.c.1)

REPORT DETAILS

4OA3 Follow-Up of Events and Notices of Enforcement Discretion

.1 (Closed) Licensee Event Report 05000263/2013-003-00, Inadequate External Flooding

Procedure (Closed) Licensee Event Report 05000263/2013-003-01, Inadequate External Flooding Procedure, Supplement 1 (Closed) Licensee Event Report 05000263/2013-003-02, Inadequate External Flooding Procedure, Supplement 2 On May 31, 2013, the licensee identified its procedure for protecting the Monticello Nuclear Generating Plant (MNGP) from a design basis probable maximum flooding (PMF) event was inadequate to support the timely implementation of external flooding protection activities within the 12-day timeframe credited in the design basis as stated in the Updated Safety Analysis Report (USFAR). The licensee submitted LER 05000263/2013-003-00 on July 30, 2013, to report this event in accordance with 10 CFR 50.73(a)(2)(ii)(B) as a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.

On September 26, 2013, the licensee submitted Supplement 1 to the original LER to address the root cause and corrective actions for the event. In addition, the licensee determined the event was also reportable in accordance with 10 CFR 50.73(a)(2)(v) (A-D) as a condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident; 10 CFR 50.73(a)(2)(vii) as an event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident; and, 10 CFR 50.73(a)(2)(ix)(A) as a condition that as a result of a single cause could have prevented fulfillment of a safety function for two or more trains or channels in different systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

On January 28, 2014, the licensee submitted Supplement 2 to the original LER to provide additional information describing the event and to make corrections.

The performance issues related to this event are discussed in Section 4OA4.02.01.d.1 of this inspection report. LER 05000263/2013-003-00, LER 05000263/2013-003-01, and LER 05000263/2013-003-02 are closed.

.2 (Closed) Licensee Event Report 05000263/2013-007-00, Unanalyzed Condition Due to

Inadequate Flooding Procedures (Closed) Licensee Event Report 05000263/2013-007-01, Unanalyzed Condition Due to Inadequate Flooding Procedures, Supplement 1 On August 28, 2013, the licensee was notified of the NRCs final significance determination for a finding of substantial safety significance (yellow) involving the failure to maintain an adequate procedure addressing all of the effects of an external flooding scenario at the MNGP. The issue is the subject of this supplemental inspection. The licensee submitted LER 05000263/2013-007-00 on October 28, 2013, to report this event in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition which was prohibited by the plants Technical Specifications (TSs); 10 CFR 50.73(a)(2)(ii)(B) as a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety; 10 CFR 50.73(a)(2)(v)(A-D) as a condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident; 10 CFR 50.73(a)(2)(vii) as an event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident; and, 10 CFR 50.73(a)(2)(ix)(A) as a condition that as a result of a single cause could have prevented fulfillment of a safety function for two or more trains or channels in different systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

On March 28, 2014, the licensee submitted Supplement 1 to the original LER to provide additional information describing the cause of event and to make corrections.

The performance issues related to this event are discussed in Section 4OA4.02.01.d.2 of this inspection report. LER 05000263/2013-007-00 and LER 05000263/2013-007-01 are closed.

4OA4 Supplemental Inspection

a. Inspection Scope

The NRC staff performed this supplemental inspection in accordance with IP 95002, Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area, to assess an inspection finding of substantial safety significance (yellow) at the MNGP (Violation [VIO] 05000263/2013008-01, Failure to Maintain an Adequate Flood Plan Consistent with Design Requirements). The finding was associated with the licensees failure to maintain a procedure addressing all of the effects of an external flooding scenario at the plant. Specifically, Procedure A.6, Acts of Nature, was inadequate to support the timely implementation of external flooding protection activities within the 12-day timeframe credited in the design basis as stated in the USAR.

The objectives of the supplemental inspection included:

• To provide assurance that the licensee understands any and all issues associated with the risk-significant performance issue;

• To determine if the root and contributing causes of the risk-significant performance issue are understood and to ensure the licensees evaluation addresses extent of condition and extent of cause;

• To independently assess the extent of condition and the extent of cause for the risk-significant performance issue;

• To independently determine if safety culture components caused or significantly contributed to the risk-significant performance issue; and

• To determine if the licensees corrective actions for the risk-significant performance issue are sufficient to address the root and contributing causes and prevent recurrence.

The inspectors reviewed the RCE, in addition to other assessments, evaluations, and CAP documentation completed in support of and, as a result of, the RCE. The inspectors reviewed corrective actions that were taken or planned to address the identified causes. The inspectors interviewed selected MNGP, corporate, and contractor personnel, and held discussions with these individuals to verify the root and contributing causes and the contribution of safety culture components were understood and corrective actions taken or planned were appropriate to address the causes and preclude repetition.

b. Inspection Results The attributes of IP 95002 were reviewed for the risk-significant finding. The inspectors concluded the licensee completed a thorough RCE, understood the root and contributing causes, identified and implemented appropriate corrective actions, adequately evaluated the extent of condition and extent of cause, and appropriately addressed the safety culture aspects. In addition, the inspectors performed independent extent of condition, extent of cause, and safety culture reviews and found no significant issues. The inspectors concluded the licensees actions met the inspection objectives.

Evaluation of the Inspection Requirements 02.01 Problem Identification a. Determine that the evaluation documented who identified the issue (i.e.,

licensee-identified, self-revealing, or Nuclear Regulatory Commission-identified) and under what conditions the issue was identified.

The inspectors determined the RCE specifically stated the issue was identified by the NRC resident inspectors. The evaluation established the issue was identified by the resident inspectors while performing Temporary Instruction 2515/187, Inspection of Near-Term Task Force Recommendation 2.3 Flooding Walk Downs, and in subsequent plant external flooding protection walkdowns.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

b. Determine that the evaluation documented how long the issues existed and prior opportunities for identification.

The licensees RCE stated a specific time period when the issue existed. The specified timeframe was February 29, 2012 to February 15, 2013. The inspectors had questions regarding the accuracy of this timeframe. Refer to Section 4OA4.02.01.c for further discussion of this topic.

The licensee identified prior opportunities for identification. In particular, the licensees RCE recognized there where several missed opportunities during the review of industry operating experience. Two examples cited by the licensee in the RCE were the industry operating experience reviews of the Fort Calhoun external flooding event and the Fukushima Dai-ichi event. The licensee recognized for both of these operating experience reviews, it did not evaluate them in enough detail to recognize potential MNGP weaknesses such as Current Licensing Basis (CLB) compliance and/or quality issues with the MNGPs external flooding protection procedures. In addition, during review of the RCE, review of CAP documents, and discussions with MNGP personnel, the inspectors noted previous opportunities for identification of the issue existed when the licensee recognized the USAR needed to be updated in October 2012 (CAP 01355853) and when tabletop discussions on how to implement the original earthen ring levee external flooding mitigation plan were performed (CAPs 01277413, 01280496, and 01283470). On both of these occasions, the issues were entered into the licensees CAP; however, the licensees lack of understanding of the design basis external flooding event scenario led it to incorrect conclusions when dispositioning the CAPs.

The inspectors noted there were weaknesses regarding the licensees evaluation of missed opportunities for prior identification of the risk-significant external flooding issue, particularly with respect to the Nuclear Oversight (NOS) Department. The inspectors reviewed NOS Department self-assessments and interviewed selected NOS personnel.

The inspectors identified weaknesses with the NOS Departments limited approach to the self-assessments, the conclusions reached, and the corrective actions. In addition, the inspectors concluded the RCE did not fully explore the various ways that NOS could have identified and prevented the risk-significant issue. These weaknesses are discussed in greater detail in Section 4OA.02.02.b.

Although the inspectors found weaknesses regarding the licensees evaluation of the time period and missed opportunities for prior identification of the risk-significant external flooding issue, the licensee had sufficient actions in place to address those weaknesses as discussed in later sections of this inspection report. The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

c. Determine that the evaluation documented the plant specific risk consequences, as applicable, and compliance concerns with the issue.

The licensees RCE addressed the plant specific risk consequences of the risk-significant issue. In particular, Attachment 12, Significance Determination, of the RCE evaluated the risk consequences of the root cause of the issue. Because there was no existing Probabilistic Risk Assessment model to address external flooding at the MNGP, the licensee performed a qualitative best-estimate assessment of risk by developing event trees. The licensees evaluation determined there were serious potential consequences. Specifically, the licensee recognized a failure to implement the external flooding mitigation plan could directly lead to the inability to add coolant inventory and/or remove decay heat from the reactor core. The inspectors were able to verify, via interviews, that MNGP personnel understood the consequences of failing to implement the external flooding mitigation plan.

The licensees RCE also included a discussion on assessing regulatory compliance related to the risk-significant issue. The evaluation defined the noncompliance time period as February 29, 2012 until February 15, 2013. This period matched the timeframe used in the NRCs original significance evaluation of the yellow finding and associated Notice of Violation (NOV). However, after reviewing the licensees corrective actions in response to the finding and interviewing licensee personnel, the inspectors believed the period of non-concurrence was actually much longer than the one used in the NRCs original significance evaluation and defined in the RCE.

The February 29, 2012 date was selected as the beginning of the noncompliance period because on the day before the licensee issued Engineering Change 19415, Berm Construction for A.6, Acts of Nature, and Procedure A.6, Acts of Nature, Revision 41.

This changed the licensees external flooding mitigation plan from an all earthen ring levee to a horseshoe levee with bin walls. The latter mitigation plan was the subject of the yellow finding. However, the inspectors noted the RCE did not consider if the same or similar conditions, which resulted in the horseshoe/bin wall levee deficiencies also existed in the earthen ring levee plan. Similar to the horseshoe/bin wall levee, the ring levee plan lacked many of the same implementation details (materials onsite, contracts, work orders (WO), levee bypass penetration identification, etc.) as the horseshoe/bin wall levee plan. In addition, the inspectors noted the use of earthen levees for mitigating the design basis external flooding event was not added to the USAR until January 2014.

Until then, the external flooding mitigation plan discussed in the USAR (i.e., using steel plates and sandbags) actually referred to the plan used by the licensee until January 2002 when the earthen ring levee plan was developed. As a result, the licensee had not been in compliance with the design basis as described in the USAR since January 2002.

As discussed in Section 4OA4.02.02.e.1, the inspectors identified a Severity Level III Violation of 10 CFR 50.71(e), Maintenance of Record, Making of Reports, for the licensees failure to update the USAR to correctly describe its mitigation plan for the design basis external flooding event since the licensee failed to fully reflect and incorporate the use of levees as part of its external flooding mitigation plan into the USAR as required. The licensee identified this issue in October 2012 and initiated CAP 01355853. In addition, as discussed in Section 4OA4.02.02.e.2, the inspectors identified a Severity Level III Violation of 10 CFR 50.59, Changes, Tests, and Experiments, for the licensees failure to perform and maintain a written evaluation to demonstrate that changes to its external flooding mitigation plan did not require a license amendment. Specifically, the licensee implemented EC 19415, Berm Construction for A.6, Acts of Nature, and Procedure A.6, Acts of Nature, Revision 41, which changed the external flooding mitigation plan without performing a 10 CFR 50.59 evaluation. The licensee identified this issue while performing the RCE and initiated CAP 01399840.

The date of February 15, 2013 was selected as the date for restoring compliance because by this date the licensees evaluation established that adequate corrective actions had been completed. However, subsequent to this date, the licensee performed additional external flooding walkdowns (in May 2013) in preparation for NRC's 10 CFR 50.54(f) external flooding audit. These walkdowns identified a number of issues with the licensees modified external flooding mitigation plan, including additional levee bypasses unknown to the licensee in February 2013. As a result, the licensee submitted LER 05000263/2013-003 to the NRC for the discovery of an unanalyzed condition.

Although the LER was submitted prior to the issuance of the RCE, the compliance evaluation was not revised. In addition to the issues discussed in the LER, the licensee subsequently identified more levee bypasses and external flooding mitigation plan implementing procedure issues, which would have required additional unplanned mitigating actions had an external flooding event occurred. As discussed in Section 4OA4.02.03.e.2, the inspectors also determined the licensees process and procedure for prediction of the onset of the design basis external flooding event was inadequate to predict the onset of the event with sufficient time for the licensee to implement its external flooding mitigation plan prior to Revision 8 in January 2014.

The inspectors considered the aggregate effects of the issues identified after February 15, 2013 were enough to conclude the licensee was still not in compliance with the CLB. As discussed in Section 4OA4.02.01.d.1, the inspectors identified a Severity Level IV NCV of the NRCs reporting requirements in 10 CFR 50.73, Licensee Event Report System, associated with the licensees failure to either make a separate LER or further revise the existing LER with additional information to fully describe the known unanalyzed condition based on additional problems it had discovered, the corrective actions taken to correct the condition, the safety significance, and the date when full compliance was restored.

In response to the inspectors questions, the licensee determined the period of noncompliance ended on January 31, 2014. This date corresponds to the issuance of Revision 8 to Procedure 1478, External Flood Monthly and Annual Surveillance, and Revision 47 to Procedure A.6, Acts of Nature. These procedure revisions addressed the deficiencies identified with the licensees external flooding mitigation plan to date. In addition, Revision 30 to the USAR, which updated the design basis description from the use of steel plates and sandbags to the all earthen levee, was also implemented on January 31, 2014.

The inspectors were concerned that if the licensee focused its RCE on an incorrect time period:

(1) the licensee might determine an incomplete or incorrect root cause;

(2) necessary corrective actions to prevent recurrence (CAPRs) might not have been implemented and/or;

(3) prior opportunities for identification might have been missed.

As discussed in Section 4OA.02.02.b, the inspectors noted one such example when reviewing the NOS Departments self-assessments in response to the risk-significant finding. The NOS assessments were narrowly focused to the RCE defined noncompliance period. This resulted in missed opportunities that were not identified and questionable corrective actions assigned to the NOS Department. With regards to the root cause identified by the licensee, after careful review and various interviews with MNGP personnel, the inspectors determined the results would not have changed appreciably as a direct effect of the increased noncompliance timeframe.

The inspectors discussed the increased noncompliance timeframe with the Region III Senior Reactor Analyst and determined the additional noncompliance time would not change the result of the risk evaluation performed for the yellow finding and associated NOV. The maximum exposure time used in any significance determination is one year even if the degraded condition exists for a longer period of time. The Senior Reactor Analyst reviewed the completed SDP evaluation for the yellow finding that used an exposure time of 352 days and concluded that using an exposure time of 1 year would not change the final outcome of the process.

While noteworthy weaknesses existed in this area, the inspectors noted the majority of the items of concern had already been identified and corrected by the licensee prior to the arrival of the inspection team. Also, the licensee had sufficient actions in place to address the remaining weaknesses. As a result, the inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

d. Findings

(1) Failure to Satisfy 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition Introduction The inspectors identified a Severity Level IV NCV of the NRCs reporting requirements in 10 CFR 50.73, Licensee Event Report System. The licensee failed to submit a required LER within 60 days after the discovery of a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety, a condition that could have prevented the fulfillment of the safety function of structures or systems needed to mitigate the consequences of an accident, and a condition prohibited by the plants TSs. Specifically, the licensee failed to either make a separate LER or further revise an existing LER with additional information to fully describe a known unanalyzed condition affecting its ability to mitigate a design basis external flooding event based on additional problems it had discovered, the corrective actions taken to correct the condition, the safety significance, and the date when full compliance was restored.

Description In drafting the yellow finding and associated NOV, the NRC considered the noncompliance window to be from February 29, 2012 (i.e., when the licensees mitigation plan was changed from an all earthen ring levee to a horseshoe levee and bin walls) to February 15, 2013 (i.e., when the mitigation plan was changed to an all earthen horseshoe levee) for the purpose of developing the significance determination for the timeframe of greatest safety concern. During this time window, the licensee could not implement its external flooding mitigation plan in sufficient time to protect the plant. The RCE appropriately considered this time as a period of noncompliance with regulatory requirements. The licensee had communicated to the NRC that it had completed corrective actions and restored compliance as of February 15, 2013.

The inspectors found during the inspection, and the licensee was unaware as of February 2013, that the licensee was still not in compliance with its CLB for protecting the plant during an external flooding event well beyond February 2013 as a result of issues the licensee subsequently identified. In hindsight, this was not surprising because the licensee was performing walkdowns and further evaluating actions to address the issues initially identified by the NRC resident inspectors in November 2012 that resulted in the yellow finding. The RCE did not directly evaluate any period of noncompliance after February 2013; however, the licensee did implement appropriate corrective actions to address the issues after they were identified.

The licensee identified in LER 05000263/2013-003-00, Inadequate External Flooding Procedure, dated July 30, 2013, that its procedure for implementing its external flooding mitigation plan was inadequate and resulted in an unanalyzed condition that significantly degraded plant safety and could have prevented the fulfillment of the safety function of structures or systems. During the week of May 21, 2013, in preparation for the NRC's 10 CFR 50.54(f) external flooding audit, the licensee performed an assessment of its external flooding walkdowns. The licensee discovered during the assessment it had not identified and addressed multiple pathways for water to bypass the levee. These pathways allowing water to bypass the levee would have put the external flooding mitigation plan in jeopardy. This was reported to the NRC (Event Notification 49085) on May 31, 2013. In addition, the LER identified several other issues affecting successful completion of the flooding mitigation plan. For example:

• The schedule for completion assumed 2 extra weeks for implementation without an understanding of the design basis requirements.

• The change from ring levee to horseshoe levee design did not identify the time to remove obstacles required to construct the levee and the impact of the weather on working conditions and construction time.

• The horseshoe levee design relied on connection of the levee to the screen house, which was not designed as a flood barrier. The levee design should have been connected to the intake structure.

The LER was subsequently revised on September 26, 2013 (Revision 1) and January 28, 2014 (Revision 2). In total, the LER discussed approximately 23 issues identified by the licensee. The licensee subsequently evaluated these issues and concluded these deficiencies could be managed and it would still have been able to protect the MNGP during an external flooding event, but it did not retract or supplement the event reports with this information.

During additional walkdowns and assessments after May 2013, the licensee identified an additional 140 penetrations that would require sealing and other problems, including implementing procedure issues, which required correcting. The licensee corrected all of these issues and there is no current safety concern with them; however, these additional issues were not evaluated by the licensee in aggregate to determine the impact on the licensees capability to mitigate the design basis external flooding event. Although the LER was supplemented twice, it was not supplemented with the additional information, nor was a separate LER submitted with the additional information. It was apparent to the inspectors that all of these issues in aggregate would have significantly challenged the licensees ability to implement its external flooding mitigation plan well beyond February 2013.

In response to the inspectors questions, the licensee completed an evaluation during the inspection and concluded the collective issues identified after February 2013 did not actually result in an unanalyzed condition that significantly degraded plant safety.

Therefore, the licensee maintained it was in compliance with its CLB after February 15, 2013.

The inspectors did not agree with this conclusion. The evaluation determined a total of 173 penetrations would have had to have been sealed and a significant quantity of additional materials and equipment would have had to have been procured. The licensee assumed in its evaluation it would have been able to seal many of the penetrations or open pathways through the levee while the flood waters were rising.

Most of the 173 penetrations were not known in February 2013 and sealing these penetrations with grout or caulk would be problematic or doubtful since the sealing materials would not be able to be set up with water coming through the penetrations.

Significant amounts of materials (e.g., clay, rip-rap, pumps, sandbags, etc.) needed to implement the flooding mitigation plan were not available on site at the time and would have had to have been delivered to the MNGP. Much of this was unknown to the licensee at the time. Although back in February 2013, the licensee expected it would need to procure some materials from outside suppliers, the additional penetrations and procedure issues would significantly increase the required amounts of materials needed.

Most of these additional materials would not have been recognized as needed until flood waters reached plant grade elevation. While the licensee had contracts with outside vendors to supply materials and equipment, specific quantities were not covered by the contracts. Furthermore, the inspectors noted the licensee would have needed to recognize, plan, and execute the relocation of the sandbag preparation area. This area is located at plant grade elevation, so this operation would have had to have been relocated prior to flood waters reaching plant grade elevation. Additionally, as discussed in Section 4OA4.02.03.e.2, the licensees procedure for predicting the onset of the design basis PMF event was determined to be inadequate until it was revised in January 2014.

Based on additional discussions with the inspectors, the licensee reexamined when full compliance was actually restored, documented it in its CAP, and communicated it to the inspectors. The licensee concluded the compliance restoration date was January 31, 2014, based on the issuance of Revision 8 to Procedure 1478, External Flood Monthly and Annual Surveillance, and Revision 47 to Procedure A.6, Acts of Nature. These procedure revisions addressed the deficiencies identified with the external flooding mitigation plan to date. In addition, Revision 30 to the USAR, which updated the design basis description from the use of steel plates and sandbags to the all earthen levee, was also implemented on January 31, 2014.

The licensee initiated a corrective action to supplement LER 05000263/2013-003 to describe the additional issues it identified that affected its external flooding mitigation plan and to specify the noncompliance window as February 29, 2012 through January 31, 2014.

Analysis The inspectors determined the licensees failure to either make a separate event report or to further revise LER 05000263/2013-003 with additional information to fully describe the unanalyzed condition affecting its mitigation plan for the design basis external flooding event based on additional information it discovered, the corrective actions taken to correct the condition, the safety significance, and the date when full compliance was restored, was a licensee performance deficiency warranting a significance evaluation.

The inspectors reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no examples related to this issue. Consistent with the guidance in IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was not a finding of more than minor significance based on No answers to the more-than-minor screening questions.

Violations of 10 CFR 50.73 are dispositioned using the traditional enforcement process because they are considered to be violations that potentially impede or impact the regulatory process. This violation was also associated with a performance deficiency that has been evaluated as having minor safety significance by the SDP. The SDP, however, does not specifically consider regulatory process impact. Thus, although related to a common regulatory concern, it is necessary to address the violation and performance deficiency using different processes to correctly reflect both the regulatory importance of the violation and the safety significance of the associated performance deficiency. In accordance with Section 6.9.d.9 of the NRC Enforcement Policy, this violation was categorized as Severity Level IV because the licensee failed to make a report to the NRC as required by 10 CFR 50.73(a)(1).

No cross-cutting aspect is associated with this traditional enforcement violation because the associated performance deficiency was determined to be of minor safety significance and therefore not a finding.

Enforcement 10 CFR 50.73(a)(1) required, in part, that the licensee submit an LER for any event of the type described in this paragraph within 60 days after the discovery of the event.

10 CFR 50.73(a)(2)(i)(B) required, in part, that the licensee report any operation or condition which was prohibited by the plants TSs. 10 CFR 50.73(a)(2)(ii)(B)required that the licensee report any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.

10 CFR 50.73(a)(2)(v)(A-D) required that the licensee report any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident. 10 CFR 50.73(a)(2)(vii) required that the licensee report any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident. 10 CFR 50.73(a)(2)(ix)(A)required that the licensee report any event or condition that as a result of a single cause could have prevented fulfillment of a safety function for two or more trains or channels in different systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

Contrary to the above, the licensee failed to submit a required LER within 60 days after discovering conditions between May 21, 2013 and January 31, 2014, that required reporting under 10 CFR 50.73(a)(2)(i)(B), 10 CFR 50.73(a)(2)(ii)(B),10 CFR 50.73(a)(2)(v)(A-D), 10 CFR 50.73(a)(2)(vii), and 10 CFR 50.73(a)(2)(ix)(A).

The conditions involved the discovery of numerous levee bypass penetrations and external flooding protection mitigation procedure deficiencies, which could have negatively affected the ability of the site's external flooding mitigation plan to successfully mitigate a design basis flooding event. These conditions resulted in the plant being in an unanalyzed condition that significantly degraded plant safety and could have prevented the fulfillment of the needed safety function of structures or systems needed to mitigate the consequences of an accident, and also resulted in a condition prohibited by the plants TSs.

In accordance with Section 6.9.d.9 of the Enforcement Policy, this violation was classified as a Severity Level IV Violation. The licensee entered this violation into its corrective action program as CAP 01454733. Because this violation was not repetitive or willful, and was entered into the licensees CAP, it is being treated as a Severity Level IV NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy (NCV 05000263/2014009-01, Failure to Satisfy 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition).

(2) Failure to Satisfy 10 CFR 50.72 and 10 CFR 50.73 Reporting Requirements for an Issue of Substantial Safety Significance Introduction The inspectors identified a Severity Level IV NCV of the NRCs reporting requirements in 10 CFR 50.72(a)(1), Immediate Notification Requirements for Operating Nuclear Power Reactors, and 10 CFR 50.73(a)(1), Licensee Event Report System. The licensee failed to make a required 8-hour non-emergency notification call to the NRC Operations Center and also failed to submit a required LER within 60 days after discovery of a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety, a condition that could have prevented the fulfillment of the safety function of structures or systems needed to mitigate the consequences of an accident, and a condition prohibited by the plants TSs.

Discussion The inspectors reviewed LER 05000263/2013-007-00, Unanalyzed Condition Due to Inadequate Flooding Procedure, which was submitted on October 28, 2013, to report the licensees inability to support the timely implementation of external flooding protection activities within the 12-day timeframe credited in the design basis as stated in the USAR. The inspectors also reviewed Supplement 1 to the original LER, which the licensee submitted on March 28, 2014, to provide additional information describing the cause of the event and to make corrections.

While performing Temporary Instruction 2515/187, Inspection of Near-Term Task Force Recommendation 2.3 Flooding Walk Downs, during the fourth quarter of 2012 for external flooding related plant walkdowns in response to the event at the Fukushima Dai-ichi facility, the NRC resident inspectors identified several issues with the licensees external flooding mitigation plan. On November 12, 2012, the resident inspectors expressed their concerns to MNGP staff, engineering management, and senior MNGP management that the licensee could not implement its external flooding mitigation plan and that the problem was potentially a very significant safety issue. The resident inspectors conveyed their concerns during three separate meetings over the course of the day. The resident inspectors informed licensee management they were concerned the design basis credited 12 days to respond to a PMF event, and with the configuration at the time (i.e., materials not onsite, lack of preplanning activities, lack of specificity in the implementing procedure, etc.), the licensees evaluations stated its external flooding mitigation plan would take approximately 25 days to complete, assuming the best case conditions.

The resident inspectors noted that due to the high PMF level, if the flood barrier was not complete in time or was inadequate, the majority of safety-related and other mitigating system equipment onsite would be negatively impacted. The licensee failed to properly evaluate reportability of the safety issue at the time of discovery.

Between November 2012 and April 2013, the resident inspectors held several meetings with MNGP management during which time the licensee presented information in an attempt to demonstrate its external flooding mitigation plan was in compliance with the regulatory requirements. The resident inspectors continued to convey their concern that the licensees external flooding mitigation plan was inadequate and could not be performed within the required 12-day timeframe. Beginning in late December 2012, the licensee began to take actions to attempt to correct the problem. The licensee made changes to its external flooding mitigation plan and changed procedures in February 2013 and communicated to the NRC that compliance with the CLB was restored as of February 15, 2013. On April 2 and April 9, 2013, the resident inspectors discussed a preliminary greater-than-green finding for this issue with the licensee. On May 15, 2013, the resident inspectors conducted an exit meeting with the licensee and characterized the issue as a preliminary finding of substantial safety significance (yellow). On June 11, 2013, NRC Inspection Report 05000263/2013008 was issued and documented the details of the preliminary yellow finding. On July 11, 2013, the licensee responded to the NRCs Choice Letter, acknowledging its inability to implement the external flooding mitigation plan at the MNGP. Following each of these occasions, the licensee did not reassess the issue with respect to the 10 CFR 50.72 and 10 CFR 50.73 reporting requirements, and no report for this issue was made.

On August 28, 2013, the Final Significance Determination letter for the yellow finding and associated NOV was issued to the licensee. Following the issuance of this letter, the resident inspectors re-engaged licensee management and prompted the licensee through their questions to report the event. The licensee subsequently made an 8-hour notification call to the NRC Operations Center via the Emergency Notification System to report the event on August 29, 2013 (Event Notice 49314) and subsequently submitted LER 05000263/2013-007-00, Unanalyzed Condition Due to Inadequate Flooding Procedures, on October 28, 2013.

Because the condition existed (i.e., it was occurring) at the time of discovery on November 12, 2012, the inspectors concluded the applicable 10 CFR 50.72(b)(3) criteria for an 8-hour notification call to the NRC were met and the licensee should have made the appropriate notification call. In addition, the inspectors concluded the applicable 10 CFR 50.73(a)(2) criteria for a 60-day LER were met and the licensee should have submitted the required LER on or before January 11, 2013.

The inspectors noted the licensee believed it had corrected the issues associated with the risk-significant finding and restored compliance with the CLB on February 15, 2013.

However, as discussed in Section 4OA4.02.01.d.(1), the licensee identified many more deficiencies through additional external flooding protection walkdowns and assessments after the issues associated with the inadequate external flooding mitigation plan were believed to have been corrected. This was the subject of separate event reporting (Event Notification 49085 and LER 05000263/2013-003, Inadequate External Flooding Procedure.)

The inspectors also identified because the licensee had failed to correctly report the condition as required by 10 CFR 50.73, it therefore failed to correctly account for the safety system functional failure (SSFF) associated with the original external flooding deficiencies. The licensee had communicated to the NRC the issues which resulted in the unanalyzed condition associated with the yellow finding were corrected as of February 15, 2013. In essence, this meant the licensee had concluded the MNGPs safety equipment could be protected from a design basis external flooding event and could be considered operable at that time. Subsequently, the licensee identified numerous additional external flooding related deficiencies that resulted in it concluding the plant was once again in an unanalyzed condition. This resulted in a second period of inoperability for the MNGPs safety equipment. The inspectors concluded in accordance with the guidance in Nuclear Energy Institute (NEI) 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, these should be counted as two separate occurrences for the SSFF Performance Indicator.

Specifically, NEI 99-02, Section 2.2 states, under multiple occurrences of a system failure, ...the number of failures to be counted depends upon whether the system was declared operable between occurrences. If the licensee knew that the problem existed, tried to correct it, and considered the system to be operable, but the system was subsequently found to have been inoperable the entire time, multiple failures will be counted whether or not they are reported in the same LER. But if the licensee knew that a potential problem existed and declared the system inoperable, subsequent failures of the system for the same problem would not be counted as long as the system was not declared operable in the interim. The inspectors determined if this issue had been reported correctly under 10 CFR 50.73(a)(2)(v), the licensee would have recognized the need to count two SSFFs, and therefore this was an outcome of the reporting violation.

The inspectors also determined when counted correctly, the SSFF Performance Indicator would not have crossed the green-to-white threshold. Since the threshold was not exceeded, the inspectors concluded the licensees failure to report the additional occurrence under the SSFF Performance Indicator constituted a violation of 10 CFR 50.9, Completeness and Accuracy of Information, of minor significance and is not subject to enforcement action in accordance with the NRC Enforcement Policy. The licensee entered this violation into its corrective action program as CAP 01459553.

Analysis The inspectors determined the licensees failure to report this event in accordance with the requirements in 10 CFR 50.72 and 10 CFR 50.73 was a licensee performance deficiency warranting a significance evaluation. The inspectors reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no examples related to this issue. Consistent with the guidance in IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined that the performance deficiency was not a finding of more than minor significance based on No answers to the more-than-minor screening questions.

Violations of 10 CFR 50.72 and 10 CFR 50.73 are dispositioned using the traditional enforcement process because they are considered to be violations that potentially impede or impact the regulatory process. This violation was also associated with a performance deficiency that has been evaluated as having minor safety significance by the SDP. The SDP, however, does not specifically consider regulatory process impact.

Thus, although related to a common regulatory concern, it is necessary to address the violation and performance deficiency using different processes to correctly reflect both the regulatory importance of the violation and the safety significance of the associated performance deficiency. In accordance with Section 6.9.d.9 of the NRC Enforcement Policy, this violation was categorized as Severity Level IV because the licensee failed to make a report to the NRC as required by 10 CFR 50.72(a)(1)(ii) and 10 CFR 50.73(a)(1).

No cross-cutting aspect is associated with this traditional enforcement violation because the associated performance deficiency was determined to be of minor safety significance and therefore not a finding.

Enforcement 10 CFR 50.72(a)(1)(ii) required, in part, that the licensee shall notify the NRC Operations Center via the Emergency Notification System of those non-emergency events specified in Paragraph

(b) that occurred within three years of the date of discovery.

10 CFR 50.72(b)(3) required, in part, that the licensee shall notify the NRC as soon as practical and in all cases within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of the occurrence of any of the applicable conditions. 10 CFR 50.72(b)(3)(ii)(B) required, in part, that the licensee report any event or condition that results in the nuclear power plant being in an unanalyzed condition that significantly degrades plant safety. 10 CFR 50.72(b)(3)(v)(A-D) required, in part, that the licensee report any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

10 CFR 50.73(a)(1) required, in part, that the licensee submit an LER for any event of the type described in this paragraph within 60 days after the discovery of the event.

10 CFR 50.73(a)(2)(i)(B) required, in part, that the licensee report any operation or condition which was prohibited by the plants TSs. 10 CFR 50.73(a)(2)(ii)(B) required that the licensee report any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.

10 CFR 50.73(a)(2)(v)(A-D) required that the licensee report any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident. 10 CFR 50.73(a)(2)(vii) required that the licensee report any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident. 10 CFR 50.73(a)(2)(ix)(A)required that the licensee report any event or condition that as a result of a single cause could have prevented fulfillment of a safety function for two or more trains or channels in different systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

Contrary to the above:

1. The licensee failed to notify the NRC Operations Center via the Emergency Notification System of a non-emergency event specified in Paragraph

(b) within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after discovery of an event on November 12, 2012. The event involved the discovery of the licensees inability to support the timely implementation of external flooding protection activities within the 12-day timeframe credited in the design basis as stated in the USAR, which resulted in the plant being in an unanalyzed condition that significantly degraded plant safety and at the time of discovery could have prevented fulfillment of the safety function of the structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

2. The licensee failed to submit a required LER within 60 days after discovery of an event on November 12, 2012. The event involved the discovery of the licensees inability to support the timely implementation of external flooding protection activities within the 12-day timeframe credited in the design basis as stated in the USAR.

These conditions resulted in the plant being in an unanalyzed condition that significantly degraded plant safety; could have prevented fulfillment of the safety function of the structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident; and, also resulted in a condition prohibited by the plants TSs.

In accordance with Section 6.9.d.9 of the Enforcement Policy, this violation was classified as a Severity Level IV Violation. The licensee entered this violation into its corrective action program as CAP 01454361. Because this violation was not repetitive or willful, and was entered into the licensees CAP, it is being treated as a Severity Level IV NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy (NCV 05000263/2014009-02, Failure to Satisfy 10 CFR 50.72 and 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition).

02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation a. Determine that the problem was evaluated using a systematic methodology to identify the root and contributing causes.

The inspectors reviewed the RCE and supporting documentation to determine whether a systematic methodology was used to identify the root and contributing causes. The inspectors reviewed the tools used to determine the root and contributing causes and the procedures, WOs, engineering evaluations, and corrective action documents to assess the appropriateness of the licensees conclusions. The inspectors also conducted interviews with approximately 15 individuals that were either involved in the events and actions contributing to the MNGPs external flooding issues, or were involved in determining the root cause of the risk-significant finding.

The inspectors review for this objective was focused on determining the adequacy of several key aspects associated with the licensees RCE methodology. The inspectors evaluated whether there was a clear identification of the problem and whether any assumptions used in the RCE were appropriate. The inspectors assessed whether there was a timely collection of data, verification of data, and preservation of evidence to ensure the information and circumstances surrounding the problem were fully understood. The inspectors reviewed the licensees RCE to determine if it was documented such that the progression of the problem was clearly understood, any missing information or inconsistencies were identified, and the problem could be easily explained or understood by others. The inspectors assessed whether a determination was made of cause and effect relationships resulting in the identification of the root and contributing causes that considered potential hardware, process, and human performance issues.

The licensee identified the following root cause for the risk-significant performance issue:

Management did not ensure proper validation of the external flooding mitigation strategy design basis commensurate with safety significance which led to non-conservative decisions.

The licensee identified the following six contributing causes:

1. Management did not provide adequate guidance for appropriate screening of

modifications and procedure revisions related to infrequent activities planned or anticipated.

2. Management did not ensure self and independent assessments of the stations

external flood mitigation activities to assess performance and to identify areas of improvement.

3. Management did not reinforce corrective action program behaviors required for a low

threshold for identifying issues related to external flood mitigation.

5. Individual contributors did not perform proper verification/validation of external

flooding mitigation strategy design basis commensurate with safety significance which contributed to non-conservative decisions.

6. Management did not provide adequate guidance in fleet procedures for performing

operating experience evaluations for significant regulatory issues such as [industry event reports] and NRC red and yellow findings.

Regarding the use of a systematic method to identify the root and contributing causes, the inspectors noted one of the key evaluation tools used to determine these causes was not fully utilized. Specifically, for the licensees barrier analysis of the problem, the inspectors found at least eight notable errors in the analyses of several inappropriate actions that resulted in a failure to document certain aspects of barriers as broken. An example included a failure to identify management communications as a failed barrier for the post Fukushima Dai-ichi event external flooding walkdown process. To the contrary, the inspectors observed that MNGP senior management had exhibited silo-ed communication behaviors for the NRC-identified issues during the walkdown process rather than seeking collective decision making by discussing them with the larger management team.

The inspectors questioned the examples where barriers were not listed as adversely impacted. The licensee concluded each of these barrier breakdowns were captured in the other evaluation tools used and the information had not been copied over properly to the barrier analysis. The licensee concluded these were editorial errors. The inspectors observed the intent of the evaluation was to use various tools to assess the facts and determine if the same conclusions are reached. The use of various evaluation tools also would be intended to help fully develop the root and contributing causes that were identified. The inspectors noted simply copying and pasting information from a different tool without fully assessing it may leave the RCE vulnerable to missing broken barriers that other evaluation tools did not catch. Overall, the inspectors concluded this had no major impact to the RCE conclusions, but it appeared the tool was not fully utilized to achieve its purpose.

During evaluation of whether the licensees RCE documented the progression of the problem and whether any missing information or inconsistencies were identified, the inspectors noted some key information appeared to be missing from the assembly of facts beginning in late 2012. Specifically, the inspectors noted a set of three meetings where the NRC resident inspectors first fully communicated their concerns with the licensees external flooding mitigation plan on November 12, 2012. The first meeting was with individual contributors and an engineering manager, followed by a meeting with plant management, and then a meeting with plant senior management. During these meetings, the resident inspectors stated, based on their inspection, they did not believe the licensee could implement its external flooding mitigation plan within the 12-day timeframe described in the USAR. In addition, as discussed in more detail in Section 4OA4.02.01.d.2, on August 29, 2013, the licensee made a late event report of the issue that was the subject of the risk-significant finding after prompting from the resident inspectors. The inspectors observed this information was important in terms of recognition and acceptance of the issue, as well as noteworthy for the failure to make a required report. The inspectors noted both of these examples were important pieces of information missing from the RCEs timeline that provided key insights to the problem.

The inspectors reviewed whether there was a clear identification of the problem, and determined there were notable aspects of the problem that were not identified in the RCE. This is also discussed in detail in Section 4OA4.02.01.c of this inspection report.

The inspectors determined the problem was evaluated using a systematic methodology to identify the root and contributing causes. Although several noteworthy observations were identified, the inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

b. Determine that the Root Cause Evaluation was conducted to a level of detail commensurate with the significance of the problem.

The inspectors reviewed the RCE and supporting documentation to determine whether it was conducted to a level of detail commensurate with the significance of the problem.

The inspectors reviewed the analysis and conclusions of the root and contributing causes. The inspectors also reviewed the evidentiary basis for the conclusions including the associated procedures, WOs, engineering evaluations, modification documentation, procedure change packages, and CAP documents to assess the appropriateness of the licensees conclusions. The inspectors conducted interviews with approximately 15 individuals that were either involved in the events and actions contributing to MNGPs external flooding issues, or were involved in determining the root cause of the risk-significant finding. The inspectors combined the interview results with the external flooding related documentation to determine whether the causes were fully developed and properly considered.

The inspectors review for this objective was focused on determining the adequacy of the level of detail and development of the causes identified by the RCE. The inspectors assessed whether the RCE used or considered the use of multi-disciplinary teams or different complimentary analysis methods appropriate to the circumstances. The inspectors also reviewed whether the RCE completely and systematically applied the methods of analysis to achieve adequate depth. The inspectors evaluated whether the RCE repeatedly asked the question Why? to sufficiently develop all of the causes for the problem. They reviewed whether the questioning process appeared to have been conducted until the causes were beyond the licensees control. The inspectors assessed whether the problem was evaluated to ensure that other root and contributing causes were not inappropriately ruled out due to assumptions made as a part of the RCE. The inspectors evaluated whether the RCE collectively reviewed all root and contributing causes for indications of more fundamental problems with a process or system. The inspectors assessed whether the RCE properly ensured that correcting the causes would prevent recurrence of the same and similar problems. They evaluated whether the RCE included a process to verify corrective actions for the identified root causes did not rely on unstated assumptions or conditions that were not controlled or ensured.

The inspectors reviewed whether the licensees RCE appropriately considered other possible root causes and concluded that it had. However, the inspectors pursued concerns associated with whether the root cause statement, which was characterized as a failure to validate the design basis, should have more appropriately been characterized as a failure to understand the design basis. The inspectors interviewed the RCE performers and assessed the impact of other RCEs performed by the licensee relating to external flooding protection and safety culture issues. The inspectors concluded the licensee had appropriately factored the lack of understanding of the design basis into the RCE, despite the fact that it was not included in the root cause statement.

In addition, when evaluating whether other possible root causes were appropriately considered, the inspectors were concerned with whether the licensee had inappropriately excluded individual contributors from the root cause statement.

Specifically, the root cause statement was specific to management behaviors. Individual contributor behaviors were included and addressed separately in a contributing cause.

The inspectors noted several ways in which individual contributors were critical in the activities that resulted in the external flooding protection related deficiencies, and were concerned with whether this was appropriately factored into the root cause statement.

Ultimately, the inspectors concluded the root cause statement was reasonable; however, the inspectors did not see any reason to exclude individual contributors from the root cause statement, given the key role they played in the performance issue. The inspectors concluded despite this observation, the licensees corrective actions, CAPRs, effectiveness reviews (EFRs), and the extent of cause evaluation appeared to address both management and individual contributors, which seemed appropriate.

The inspectors evaluated whether the licensees RCE had achieved adequate depth and determined there was a noteworthy weakness in the development of the contributing cause associated with self and independent assessment. Specifically, the inspectors noted the licensees evaluation with regard to the NOS Departments function of providing oversight to proactively identify performance gaps did not achieve adequate depth to identify deficiencies and broken barriers associated with the organizations failure to identify the external flooding protection issues. The inspectors noted the RCE relied heavily on an Assessment Effectiveness Review (AER) performed by the NOS Department in July 2013 for missed opportunities associated with the risk-significant finding. The inspectors reviewed the RCEs analysis of NOS deficiencies and the AER that was performed, and determined this causal factor was not explored in sufficient depth. The inspectors observed the AER had a very narrow scope and focused only on the limited timeframe where the bin wall was incorporated into MNGP documents to explore missed NOS opportunities. This was despite the fact there were several deficiencies and weaknesses in the licensees external flooding mitigation plan as a whole, dating back to at least January 2002.

As the inspectors explored NOS weaknesses that contributed to the external flooding protection deficiencies, they noted NOS did assess flooding protection readiness as part of the operations focus area per its process. The inspectors questioned why this periodic review did not identify an issue of substantial safety significance. Specifically, external flooding issues identified as part of and following the yellow finding ranged from the timeline and bin wall construction issues, to USAR noncompliance, dozens of unidentified unsealed penetrations that would be expected to be located and sealed at the time of an external flooding event, a lack of materials assured available, and the plenty of time and infinite resource availability mindset that openly existed with plant engineering staff and management. The inspectors concluded the lack of a thorough review of NOS deficiencies could mean NOS was not recognizing the need for important process or training changes that potentially should have come from the RCE. For example, the inspectors questioned whether NOS was sampling correctly, appropriately referencing the CLB in its assessments, maintaining a questioning attitude, having the correct perspective, and recognizing safety significant hazards.

The inspectors observed there were only two corrective actions in the RCE specific to the NOS Department based on the conclusion that there were only two performance gaps:

(1) NOS was not as engaged in communications with the NRC resident inspectors as it should have been, and

(2) NOS did not have appropriate awareness of NRC interest and focus areas. As a result, the NOS corrective actions included establishing regular meetings with the NRC resident inspectors, and institutionalizing checking of the MNGPs NRC inspection tracking system to determine what topics the NRC is currently interested in. The inspectors concluded the RCE did not fully explore the various ways that NOS could have identified and prevented the safety issue prior to the NRC resident inspectors identifying it. The inspectors noted the failure to achieve adequate depth for this causal factor impacted both the NOS-related corrective actions for this issue, as discussed above, as well as the extent of cause review for NOS-related deficiencies. The extent of cause impact is discussed in more detail in Section 4OA4.02.04.b.

Overall, for the NOS causal factor, the inspectors concluded licensee actions from the RCE had also been applied to NOS personnel. The inspectors determined from a mitigating factors standpoint, this appeared to have allowed NOS to internalize lessons learned from the risk-significant issue and indirectly may have driven some NOS process changes outside of what was contained and tracked in the RCE.

The inspectors also reviewed whether the RCE had repeatedly asked Why? to sufficiently develop the identified causes. The inspectors observed the contributing cause associated with inadequate screening of the engineering products (Contributing Cause 1) was not fully developed. The inspectors noted there were several instances throughout the RCE where inappropriate actions were discussed involving several engineering procedures that were determined to contain unclear guidance. Specifically, in several locations, the RCE stated that FP-E-MOD-02, Fleet Modification Process, and FP-E-DOC-01, Documentation-Only Process, were unclear. This ultimately resulted in the inappropriate use of the doc-only modification process for the modification to include the deficient bin wall in the external flooding mitigation plan.

However, in the causal analysis development for Contributing Cause 1 regarding the inadequate engineering screening, only the FP-E-DOC-01 procedure was determined to be deficient with respect to the use of the doc-only process. The inspectors found this to be an inconsistent result.

The inspectors reviewed the subject documents and conducted interviews to help explore this causal factor. Interviews revealed that FP-E-MOD-02 and FP-E-DOC-01 screening criteria were both used and assessed during decision making on whether to use the doc-only process, and using both procedures, the MNGP staff came to the wrong conclusion for processing the bin wall modification. The inspectors reviewed FP-E-MOD-02 and noted the same unclear wording that was amended in the FP-E-DOC-01 procedure existed in the FP-E-MOD-02 screening guidance.

The inspectors observed the FP-E-MOD-02 procedure barrier appeared to have broken during the processing of this modification, and incorrectly directed use of the doc-only process. The RCE did not identify this as a broken barrier. Instead, only FP-E-DOC-01 was determined to be a broken barrier. As a result, only FP-E-DOC-01 was fixed, and there were no corrective actions to fix FP-E-MOD-02.

Ultimately, the inspectors determined FP-E-DOC-01 was the end point for the screening phase of the modification when using the doc-only process and this procedure had been changed in order to prevent future misuse of the process. This mitigated the inspectors concerns. However, as FP-E-DOC-01 was only an Information Use procedure, the inspectors determined the failure to correct the FP-E-MOD-02 procedure left the licensee vulnerable to future errors.

The inspectors concluded the licensees determination of the root and contributing causes and the development and detail of these causes was satisfactory, with concerns.

However, the inspectors determined any concerns were minor and would not have significantly affected established corrective actions, and the issues identified were entered into the licensees CAP. As a result, the inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

c. Determine that the RCE included a consideration of prior occurrences of the problem and knowledge of prior operating experience.

The inspectors determined the RCE included a consideration of prior occurrences of the problem and knowledge of prior operating experience.

As discussed in the missed opportunities review of Section 4OA4.02.01.b, the licensee identified two key examples where operating experience was not properly utilized-the Fort Calhoun external flooding issue and the Fukushima Dai-ichi event. The licensee recognized for both of these operating experience reviews it did not evaluate them in enough detail to recognize potential MNGP weakness such as CLB compliance and/or quality issues with MNGPs external flooding protection procedures.

The inspectors noted the RCE discussed examples of CAPs that were generated (CAPs 01277413 and 01280496) when potential deficiencies with the overall external flooding mitigation plan were identified during operating experience follow-up activities, including post-Fukushima actions. However, these CAPs were incorrectly closed because the licensee believed the concerns discussed were beyond the design bases.

The inspectors confirmed these incorrect actions during discussions with MNGP personnel.

The RCE also referenced other recently performed RCEs including RCE 01388760, NOS AAF: MNGP Leadership Nuclear Safety Culture Concern; RCE 01425443, Six NRC Findings in H.14 Cross-cutting Aspect; and RCE 01399730, NRC Findings in H.7 Cross-cutting Aspect. These evaluations recognized, among other things, MNGP managements resistance to input from external stakeholders as well as a lack of understanding of the MNGPs CLB. These items contributed to the deficiencies that resulted in the risk-significant finding.

The inspectors identified weaknesses associated with the proposed corrective actions for the licensees use of operating experience. In particular, the licensees failure to recognize white findings issued to other licensees as potential operating experience that should also be reviewed. Refer to Section 4OA4.02.04.b for further details.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

d. Determine that the RCE addresses the extent of condition and the extent of cause of the problem.

The inspectors reviewed the RCE, extent of cause and condition evaluations, and supporting documentation to determine whether the RCE considered the impact on other systems, structures, equipment, programs, or conditions. The inspectors reviewed the analysis and conclusions of the extent of condition and cause evaluations to assess the adequacy of the licensees scope. The inspectors reviewed the sampling method utilized by the licensee for the root cause and each of the contributing causes to determine if cross-functional and organizational vulnerabilities that may exist had been identified and addressed. The inspectors also conducted interviews with about 15 individuals who were involved in determining the root cause and assessing the extent of condition and extent of cause of the risk-significant performance issue.

The inspectors review for this objective was focused on determining whether the scope of the extent of condition and extent of cause evaluations performed as part of the RCE was adequate. The inspectors evaluated whether the extent of condition review assessed the degree the actual condition may exist in other plant organizations, processes, or human performance. The inspectors also reviewed whether the extent of cause review assessed the applicability of the root cause across disciplines or departments to different programmatic activities, human performance, or different types of systems or structures.

The inspectors concluded the licensees determination of extent of condition and extent of cause was generally accurate, but not necessarily fully complete. However, the inspectors determined that any concerns were minor to moderate and would not have significantly affected established corrective actions, and the issues identified were entered into the licensees corrective action program. Noteworthy observations are addressed and discussed in Section 4OA4.02.04.b, which documents the inspectors independent assessment and sampling of extent of condition and extent of cause of the problem.

Overall, the inspectors determined that the licensee performed a detailed extent of condition and extent of cause evaluation for the problem. The licensees evaluation appropriately assessed programmatic, cross-functional, organizational, equipment, and human performance areas for vulnerabilities. However, there was one notable exception. As discussed in Section 4OA4.02.04.c.1, the inspectors identified and documented a finding associated with the licensees failure to fully evaluate and resolve issues with the Security Departments readiness to implement the licensees external flooding mitigation plan for a design basis external flooding event.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

e. Findings

(1) Failure to Update the USAR for a Change to the Mitigation Strategy for the Design Basis External Flooding Event (Exercise of Enforcement Discretion)

Introduction The inspectors identified a Severity Level III Violation of 10 CFR 50.71(e), Maintenance of Record, Making of Reports, for the licensees failure to update the USAR to correctly describe its mitigation plan for the design basis external flooding event. Specifically, the licensee failed to fully reflect and incorporate the use of levees as part of its external flooding mitigation plan into the USAR as required.

Description On January 10, 2002, the licensee issued Procedure A.6, "Acts of Nature," Revision 13.

This changed the primary means of protecting the MNGP during the design basis external flooding event from reliance on sandbags and steel plates to reliance on an earthen ring levee encircling the plant, which would be built if and when needed. The use of sandbags and steel plates was described in Section 12.2.1.7.1 of the USAR.

However, when Revision 13 of Procedure A.6 was issued, the licensee did not update the USAR to reflect the change in its external flooding mitigation plan.

In February 2012, the licensee modified its external flooding mitigation plan from an all earthen ring levee to an earthen horseshoe levee with bin walls. While the original berm construction plan was developed in 2001 and implemented in January 2002, the use of bin walls near the intake structure came from a February 2012 modification to increase the reliability of the ring levee in this location. As part of the change process, on January 30, 2012, the licensee performed a 10 CFR 50.59 screening (SCR-12-0027)for the proposed change. The screening compared the change against the USAR, particularly Section 12.2.1.7.1. However, because the USAR had not been changed (in 2002), the licensee considered the proposed change to be an enhancement to the current defense in depth plan. On February 28, 2012, the licensee issued EC 19415, Berm Construction for A.6, Acts of Nature, and Procedure A.6, Acts of Nature, Revision 41.

On October 22, 2012, the licensee recognized USAR Section 12.2.1.7.1 was out of date and needed revision to become aligned with the mitigation plan and initiated CAP 01355853, "Update USAR for External Flooding Description Discrepancy."

However, no "adverse or questionable condition" was identified in CAP 01355853. The USAR revision was issued on January 31, 2014. This revision discussed an all earthen horseshoe levee, which was an interim external flooding mitigation plan because during this time the NRC was assessing a violation associated with the licensees external flooding mitigation plan (i.e., the original horseshoe/bin wall plan). On August 28, 2013, the NRC issued Inspection Report 05000263/2013009 with the yellow finding and associated NOV.

On July 29, 2014, the licensee initiated CAP 01440644, "Update USAR 12.02 to Reflect Addition of Bin Walls (EC 24369)". This resulted in Revision 31P to USAR Section 12.2.1.7, which describes a revised horseshoe with bin wall levee mitigation plan. This revision will be incorporated when the USAR bi-annual update is completed.

Analysis The inspectors determined the licensees failure to update the USAR to correctly describe its mitigation plan for the design basis external flooding event was a performance deficiency warranting a significance evaluation. The inspectors reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no examples related to this issue. Consistent with the guidance in IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was a finding of more than minor significance because, if left uncorrected, the issue would have the potential to lead to a more significant safety concern. Specifically, a failure to update the USAR with all changes made in the facility or procedures as described in the USAR could result in unacceptable changes made to the facility based on inaccurate or incomplete information in the USAR. The inspectors previously determined the underlying issue was a finding affecting the Mitigating Systems Cornerstone having substantial safety significance (i.e., yellow) during a Phase 3 SDP review and documented the finding and associated NOV in NRC Inspection Report 05000263/2013009 (VIO 05000263/2013008-001, Failure to Maintain an Adequate Flood Plan Consistent with Design Requirements).

Violations of 10 CFR 50.71(e) are dispositioned using the traditional enforcement process because they are considered to be violations that potentially impede or impact the regulatory process. This violation was also associated with a finding that has been evaluated by the SDP and communicated with a SDP color reflective of the safety impact of the deficient licensee performance. The SDP, however, does not specifically consider regulatory process impact. Thus, although related to a common regulatory concern, it is necessary to address the violation and finding using different processes to correctly reflect both the regulatory importance of the violation and the safety significance of the associated finding. In accordance with Section 6.1.c.7 of the NRC Enforcement Policy, this violation was categorized as Severity Level III because the licensee had failed to update the USAR as required by 10 CFR 50.71(e) and the un-updated USAR was used to perform a 10 CFR 50.59 screening for a change to the facility and procedures, implemented without Commission approval, that resulted in a condition evaluated as having more than low-to-moderate safety significance (i.e., white, yellow, or red) by the SDP.

No cross-cutting aspect was assigned to this traditional enforcement issue for which enforcement discretion has been granted.

Enforcement 10 CFR 50.71(e) required in part, that licensees shall periodically update the final safety analysis report (FSAR), originally submitted as part of the application for the operating license, to assure that the information included in the report contains the latest information developed. This submittal shall include the effects of all the changes necessary to reflect information and analysis submitted to the Commission by the licensee or prepared by the licensee pursuant to Commission requirement since the submittal of the original FSAR, or as appropriate, the last update to the FSAR under this section.

Contrary to the above, from January 10, 2002 to January 31, 2014, the licensee did not update the FSAR to assure the information included in the report contained the latest information. Specifically, the licensee failed to update the FSAR with the description and basis for maintaining an external flooding mitigation plan to protect the site against external flooding events as changes to the facility and procedures were implemented, in that it failed to fully reflect and incorporate the use of a temporary levee to mitigate the consequences of a design basis PMF.

In accordance with Section 6.1.c.7 of the NRC Enforcement Policy, this violation was classified as a Severity Level III Violation. The licensee entered this issue into its corrective action program as CAP 01355853.

NRC Enforcement Policy Section 3.3, Violations Identified Because of Previous Enforcement Action, states in part, The NRC may refrain from issuing an NOV or a proposed civil penalty for a Severity Level II, III, or IV violation that is identified after the NRC has taken enforcement action, if the violation is identified by the licensee as part of the corrective action for the previous enforcement action and the violation has the same or similar root cause as the violation for which enforcement action was previously taken.

In this case, the issue was identified by the licensee after the NRC had already taken enforcement action for another related violation evaluated as having substantial safety significance by the SDP. The previous violation was documented in NRC Inspection Report 05000263/2013009 on August 29, 2013. As part of the corrective action for the previous enforcement action, the violation was corrected by revision to the USAR on January 31, 2014. Therefore, in accordance with the NRC Enforcement Policy, and after consultation with the Director of the Office of Enforcement and the Region III Regional Administrator, the NRC has decided to exercise enforcement discretion in accordance with Section 3.3 of the NRC Enforcement Policy and to refrain from issuing enforcement action for the violation. In accordance with the NRCs Reactor Oversight Process, this condition will not be considered in the assessment process or the NRCs Action Matrix.

(2) Failure to Perform a Written Safety Evaluation (Exercise of Enforcement Discretion 50.59)

Introduction The inspectors identified a Severity Level III Violation of 10 CFR 50.59, Changes, Tests, and Experiments, for the licensees failure to perform and maintain a written evaluation to demonstrate that changes to its external flooding mitigation plan did not require a license amendment. Specifically, the licensee implemented EC 19415, Berm Construction for A.6, Acts of Nature, and Procedure A.6, Acts of Nature, Revision 41, which changed the external flooding mitigation plan without performing a 10 CFR 50.59 evaluation. This change subsequently had a consequence evaluated by the SDP as having substantial safety significance.

Description On February 28, 2012, the licensee issued EC 19415, Berm Construction for A.6, Acts of Nature, and Procedure A.6, Acts of Nature, Revision 41, which changed the external flooding mitigation plan for the MNGP from an all earthen ring levee to an earthen horseshoe levee with bin walls. As part of the change process, on January 30, 2012, the licensee performed a 10 CFR 50.59 screening (SCR-12-0027)for the proposed change. The screening compared the change against the USAR, particularly Section 12.2.1.7.1, which describes the external flooding mitigation plan.

However, as discussed in Section 4OA4.02.02.e.1, the licensee had failed to update the USAR when the ring levee plan was originally implemented in January 2002. The USAR only mentioned the external flooding mitigation plan in place prior to January 2002, which did not involve the construction of a levee. The previous plan relied on sandbags and steel plates. As a result, the licensee considered the proposed change to be an enhancement for defense-in-depth and not an actual change to the external flooding mitigation plan.

On August 28, 2013, the NRC issued Inspection Report 05000263/2013009 with the yellow finding and associated NOV. Prior to issuing the finding, the NRC determined the licensee would have been unable to implement the MNGP's external flooding mitigation plan within the time allowed by the USAR. The design change and associated procedure revision verification review did not identify necessary procedure steps to implement the external flooding mitigation plan within the required 12-day timeframe.

Because changes to structures and systems would be made upon implementation of the modification and limited time was available to implement the engineering change during a design basis external flooding event, the screening should have resulted in an actual 10 CFR 50.59 evaluation. Because the new proposed plan would have taken longer to implement (about 25 days), the expected delay would have caused the licensee to exceed the allowed time per the design basis (12 days) to implement the mitigation plan, for which a license amendment was required.

10 CFR 50.59(c)(2)(ii) states, in part, that a licensee shall obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated). As discussed above,

(1) the change resulted in an external flooding mitigation plan different than the one described in the USAR, and

(2) the NRC concluded prior to issuing the yellow finding and associated NOV that the change resulted in an external flooding mitigation plan that would not protect the MNGP against the design basis PMF.

The deficient 10 CFR 50.59 screening was identified by the licensee while performing the RCE for the yellow finding and it was documented in CAP 01399840. The inspectors found the licensees RCE appropriately evaluated the incorrect 10 CFR 50.59 screening of the design change and the licensee implemented appropriate corrective actions.

Corrective actions included a procedure revision to Procedure FG-E-SE-03, "50.59 Resource Manual," to improve 10 CFR 50.59 screening/evaluation quality, training for qualified 10 CFR 50.59 individuals, establishing a 10 CFR 50.59 screening review team to review screenings and evaluations to ensure attributes of FG-E-SE-03 are being reinforced, and revision to Procedure A.6 to require 10 CFR 50.59 and validation reviews. The licensee also updated USAR Section 12.2.1.7.1 regarding the external flooding mitigation plan and modified the external flooding mitigation plan so it could be implemented within the required time.

Analysis The inspectors determined the licensees failure to maintain a written safety evaluation to demonstrate the change to its mitigation plan for the design basis external flooding event in February 2012 did not require a license amendment was contrary to 10 CFR 50.59(d)(1); and, therefore was a performance deficiency warranting a significance evaluation. The inspectors reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no examples related to this issue.

Consistent with the guidance in IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was a finding of more than minor significance because, if left uncorrected, the issue would have the potential to lead to a more significant safety concern. Specifically, a failure to evaluate changes to the facility as required by 10 CFR 50.59(d)(1) could result in unacceptable changes made to the facility that adversely affect safety. The inspectors previously determined the underlying issue was a finding affecting the Mitigating Systems Cornerstone having substantial safety significance (i.e., yellow) during a Phase 3 SDP review and documented the finding and associated NOV in NRC Inspection Report 05000263/2013009 (VIO 05000263/2013008-001, Failure to Maintain an Adequate Flood Plan Consistent with Design Requirements).

Violations of 10 CFR 50.59 are dispositioned using the traditional enforcement process because they are considered to be violations that potentially impede or impact the regulatory process. This violation was also associated with a finding that had been evaluated by the SDP and communicated with a SDP color reflective of the safety impact of the deficient licensee performance. The SDP, however, does not specifically consider regulatory process impact. Thus, although related to a common regulatory concern, it is necessary to address the violation and finding using different processes to correctly reflect both the regulatory importance of the violation and the safety significance of the associated finding. In accordance with Section 6.1.c.6 of the NRC Enforcement Policy, this violation was categorized as Severity Level III because the licensee had failed to obtain prior Commission approval required by 10 CFR 50.59 for a change that has a consequence evaluated by the SDP as having low-to-moderate or greater safety significance (i.e., white, yellow, or red).

No cross-cutting aspect was assigned to this traditional enforcement issue for which discretion has been granted.

Enforcement 10 CFR 50.59(d)(1) required, in part, that the licensee maintain records of changes to the facility, of changes in procedures, and of tests and experiments made pursuant 10 CFR 50.59(c). These records must include a written evaluation which provides the bases for the determination that the change, test, or experiment does not require a license amendment pursuant to Paragraph (c)(2) of this section. 10 CFR 50.59(c)(2)(ii)required that a licensee shall obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated).

Contrary to the above, on or about January 30, 2012, the licensee failed to perform and maintain a written evaluation as required by 10 CFR 50.59(d)(1) to demonstrate a change to its facility did not require a license amendment. Specifically, the licensee incorrectly concluded no 10 CFR 50.59 evaluation was required prior to implementing EC 19415, Berm Construction for A.6, Acts of Nature, and Procedure A.6, Acts of Nature, Revision 41 based on screening SCR-12-0027. Therefore, an evaluation was not performed and without an evaluation the licensee could not have ascertained if a license amendment would have been required for this change as required by Section (c)(2)(ii). Specifically, the NRC determined the external flooding mitigation plan implemented by the licensee was unable to mitigate the consequences of the design basis PMF.

In accordance with Section 6.1.c.6 of the NRC Enforcement Policy, this violation was classified as a Severity Level III Violation. The licensee entered this issue into its corrective action program as CAP 01399840 and implemented appropriate corrective actions.

NRC Enforcement Policy Section 3.3, Violations Identified Because of Previous Enforcement Action, states in part, The NRC may refrain from issuing an NOV or a proposed civil penalty for a Severity Level II, III, or IV Violation that is identified after the NRC has taken enforcement action, if the violation is identified by the licensee as part of the corrective action for the previous enforcement action and the violation has the same or similar root cause as the violation for which enforcement action was previously taken.

In this case, the issue was identified by the licensee after the NRC had already taken enforcement action for another related violation evaluated as having substantial safety significance by the SDP. The previous violation was documented in NRC Inspection Report 05000263/2013009 on August 29, 2013. As part of the corrective action for the previous enforcement action, the licensee documented the incorrect 10 CFR 50.59 screening in its CAP and implemented appropriate corrective actions. Therefore, in accordance with the NRC Enforcement Policy, and after consultation with the Director of the Office of Enforcement and the Region III Regional Administrator, the NRC has decided to exercise enforcement discretion in accordance with Section 3.3 of the NRC Enforcement Policy and to refrain from issuing enforcement action for the violation.

In accordance with the NRCs Reactor Oversight Process, this condition will not be considered in the assessment process or the NRCs Action Matrix.

02.03 Corrective Actions a. Determine that appropriate corrective actions are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary.

The inspectors determined the licensee had appropriate corrective actions for the root cause and each contributing cause.

The inspectors verified the root cause had associated CAPRs. Additionally, the inspectors verified all contributing causes and weaknesses associated with the extent of condition and extent of cause were addressed through corrective actions. A detailed assessment was performed for each CAPR and all the contributing cause corrective actions. This included sampling corrective action documents, procedures, field walkdowns, interviewing selected MNGP individuals, and reviewing the CLB.

Furthermore, the proposed corrective actions were reviewed to determine whether they created any new or additional problems.

The licensee developed and implemented the following CAPRs to address the risk-significant performance issue:

• CAPR 1: Revise the Supervisory Leadership Development Program Training Program Description to include delivery of a case study for initial and continuing training for the continual reinforcement of behaviors and attributes associated with ensuring proper validation of the MNGP design bases. The approach should be similar to [specific industry operating experience event reports omitted] case studies.

• CAPR 2: To ensure proper validation of the external flooding plan design bases, create a formal engineering program in accordance with Procedure CD 5.26, Program Engineering, to manage MNGP external flooding mitigation. This program will provide intrusive oversight, governance, systematic review, and implementing procedures of external flooding mitigation strategies.

• CAPR 3: Clarify in appropriate MNGP documents, including, but not limited to the USAR, the external flooding section of Procedure A.6, and the Design Bases Document for External Flooding, that the PMF antecedent conditions are required to be assumed present and actions to mitigate a PMF must be preplanned.

• CAPR 4: Revise Procedure A.6, Section 5.0, to be an 8000 series special procedure. Control the procedure as an Infrequently Performed Test or Evolution.

During procedure preparation, validate its adequacy and improve quality. Identify the regulatory and/or MNGP bases, review the basis and clarity of wording, and validate that the procedure documentation, plant design, and protective and recovery measure will protect the plant and public safety.

The inspectors concluded the CAPRs appeared to be adequate to prevent recurrence of the risk-significant performance issue. The inspectors concluded the licensee could implement its external flooding mitigation plan as designed; however, they identified the proposed corrective actions created additional complications for the MNGP security organization that had not been adequately evaluated by the licensee. This issue was characterized as a finding in Section 4OA2.02.03.f.2. The remaining corrective actions associated with the contributing causes were adequately documented and essentially completed prior to this inspection. The only remaining exceptions were the EFRs associated with the CAPRs. These are discussed further in Section 4OA2.02.03.d.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

b. Determine that the corrective actions have been prioritized with consideration of risk significance and regulatory compliance.

The inspectors concluded the corrective actions were prioritized with consideration of both risk significance and regulatory compliance.

The inspectors assessed the licensees timeliness of the corrective actions associated with the yellow finding. The inspectors noted the licensee performed extensive evaluation of the finding and took reasonable actions to correct the root and contributing causes prior to completion of the final revision of the RCE. Specifically, the RCE was subject to multiple independent reviews resulting in additional revisions to address additional causes and corrective actions. Additionally, the inspectors noted the licensee appropriately addressed individual performance deficiencies.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

c. Determine that a schedule has been established for implementing and completing the corrective actions.

The inspectors concluded the licensee established an appropriate schedule for implementing and completing the corrective actions.

The inspectors found the licensee established a schedule for implementing, tracking, and completing the corrective actions. As documented in the RCE, each corrective action identified an action, an owner, and a reasonable due date. All corrective actions were completed, with the exception of EFRs, before this supplemental inspection commenced. However, the inspectors identified an example where corrective actions were not implemented before regulatory compliance was believed to be restored by the licensee. This issue is discussed above in Section 4OA4.02.01.d.1.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

d. Determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

The inspectors concluded the licensee developed adequate quantitative or qualitative measures of success for determining the effectiveness of the CAPRs.

The inspectors reviewed the CAPRs established by the licensee and the associated EFRs. The licensee developed four EFRs, one for each of the four CAPRs. These were not performed by the time of the inspection, but were scheduled at a reasonable time in the future. The planned EFRs were scheduled to be performed by the licensee throughout 2015 and include interviews, observations, CAP reviews, design basis reviews, procedure reviews, and tabletop demonstrations. For each area reviewed, measures of success were clearly defined and measurable.

To measure effectiveness between the implementation of corrective actions and the final EFRs, the licensee conducted interim EFRs. The inspectors reviewed the conclusions from the interim EFRs and noted the interim EFRs were of adequate scope and had measurable success criteria to measure effectiveness of the corrective actions.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

e. Determine that the corrective actions planned or taken adequately address the notice of violation that was the basis for the supplemental inspection.

The inspectors determined corrective actions taken adequately addressed the NOV associated with the yellow finding that was the basis for this supplemental inspection.

The inspectors conducted interviews of licensee personnel, reviewed the RCE and associated CAPRs and corrective actions, reviewed applicable procedures, drawings, WOs, and calculations to assess whether the licensees response to the NOV adequately addressed the reason for the violation and whether the licensee implemented appropriate corrective actions to restore compliance.

(1) Implementation of the Mitigation Strategy to Construct the Flood Control Levee and Structural Design A key element of the external flooding mitigation plan at MNGP involves construction of a horseshoe shaped levee consisting of approximately 280 feet of bin walls and 2,080 feet of clay berm. Recognizing the importance of the construction of the flood control levee to licensees external flooding mitigation plan, the inspectors reviewed the levee design, the capability to build the levee to the design requirements, the timeline for completion of the levee prior to river water level reaching plant grade elevation, and the capability to accurately predict the onset of the external flooding event in sufficient time for the licensee to implement its mitigation plan. This was not intended to be a detailed design review, but rather an informed determination as to whether the licensees external flooding mitigation plan would be able to protect the site as described in the USAR from rising river water level that peaks within 12 days.

The inspectors evaluated whether the licensee can reasonably implement its mitigation plan prior to the projected river water level reaching the plants grade elevation by examining materials on site for construction of the levee; assessing the licensees pre-arranged outside vendor resources needed for construction of the levee; and, reviewing the associated schedule, procedures, and pre-planned WOs. In addition, the inspectors reviewed the levee and bin wall design for structural and stability adequacy, including slope, overturning, and sliding stabilities, as well as foundation bearing capacity and settlement requirements under all possible loading conditions. The loading conditions included transient seepage, total stress, effective stress, and sudden drawdown conditions.

During their review, the inspectors identified discrepancies existed between factors of safety listed in tables and figures in the stability analyses and what was listed in the analysis output files. In response to the inspectors questions, the licensee identified the incorrect output files were attached to the calculation and a CAP was generated to revise the calculation with the correct output files. This error did not affect the actual design factor of safety.

The inspectors determined the design of the levee was acceptable from an engineering perspective and could effectively protect the MNGP from the design basis PMF, specifically:

• The design of the bin wall frame structures followed the industrial standard. The strength analyses for all components used in the frame met the requirements.

• Stability analyses results indicated that the slope stability, overturning stability, sliding stability, settlement and bearing capacity requirement for the foundation underneath the bin walls met the design requirements.

• Slope stability analysis results showed that the designed earthen berm met the slope stability requirement with no seismic loading considered.

(2) Predicting the Onset of an External Flooding Event The inspectors determined the licensees process and procedure for prediction of the onset of an external flooding event (Procedure 1478, External Flood Monthly and Annual Surveillance) was inadequate to predict the onset of the event with sufficient time for the licensee to implement its external flooding mitigation plan prior to Revision 8 in January 2014.

The inspectors reviewed Revisions 7, 8, and 12 of the procedure and discussed them with the licensees Flood Protection Engineer. Revision 7, which was released in February 2013, required a monthly surveillance with minimal guidance. The procedure directed the Flood Protection Engineer to determine the potential for flooding at the MNGP and record a predicted river crest. There was no clear guidance as to how to obtain this elevation other than contacting the National Weather Service. The procedure directed the Flood Protection Engineer to determine if the predicted river crest was greater than or equal to 913 feet. If greater than 913 feet, then daily monitoring of the river level was to be performed and a weekly performance of the river crest prediction was to be performed.

During an interview, the Flood Protection Engineer stated he would know what information to obtain from the National Weather Service to perform this prediction.

However, based on review of the procedure guidance, the inspectors determined any engineer who may be assigned the Flood Protection Engineers responsibilities in his absence could interpret this monthly surveillance procedure in various ways, and could obtain a river crest prediction from the National Weather Service that might not indicate the river crest would exceed site grade in sufficient time to enact the necessary flood protection measures required by the CLB.

Revision 8 of Procedure 1478 corrected this issue by providing more clear guidance on how to obtain the prediction in a manner that would provide sufficient warning that a flood would exceed site grade. Therefore, there is no current safety concern with the procedure and the licensees capability to predict the onset of an external flooding event.

It appeared the licensee did not recognize this condition was not in compliance with its CLB even though it recognized a need to revise the procedure. The Flood Protection Engineer believed this was simply an enhancement. However, CA 01378062-40 from the RCE identified the revision as a CA or corrective action. While there were a number of significant changes made to the procedure with Revision 8, the procedure was revised, in part, to provide specific instructions for performing the monthly flood projections and plant configuration compliance for flood protection. Inability to predict the onset of the event in sufficient time would have put the external flooding mitigation plan in jeopardy prior to January 2014.

Because the deficient procedure coexisted with the actual period of noncompliance of the yellow finding that existed until January 31, 2014, no additional finding of significance was identified.

(3) Materials, Procedures, and Timeline for Construction of the Flood Control Levee As stated above, the success of the licensees external flooding mitigation plan is dependent on its ability to successfully construct the horseshoe levee. As such, the inspectors reviewed the materials, procedures, and timeline associated with the construction of the levee. In general, the inspectors determined specified materials and procedures were adequate to construct the levee as designed, with sufficient margin in the timeline to account for possible delays due to weather, material, procedural, and human performance issues.

The inspectors questioned whether construction of the levee could be accomplished according to the timeline the licensee developed. While the inspectors found the licensee should be able to complete the levee prior to the river level reaching plant grade elevation, some important factors were apparently not factored into the timeline (e.g., steps to ensure 90 percent clay compaction is consistently achieved, security requirements (i.e., based on an unrealistic fit to the timeline after-the-fact without any performance-based assessment), frozen clay/sand removal from the mounds staged onsite, and additional materials required to be delivered to the site). In response to the inspectors questions, the licensee completed an aggregate review of the issues identified during the inspection to evaluate the cumulative impact on the construction timeline. Notwithstanding these issues, adequate margin exists in the schedule to complete construction of the levee. The licensee entered the issues identified into its CAP for evaluation of improvements to its external flooding mitigation plan procedures and schedule.

As discussed below in Section 4OA4.02.03.f.1, the inspectors identified documents for construction of the flood control levee did not have requirements (e.g., procedure steps)to sequence (or build-up) the berms and measure compaction during building of the berms to ensure the levee will meet design requirements. In addition, as discussed below in Section 4OA4.02.04.c.1, the inspectors identified weaknesses in the Security Departments assessment of the potential adverse impacts that actions required to construct the levee may have on the ability to implement the sites defensive plan during the design basis external flooding event.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

f. Findings

(1) Failure to Maintain Procedures to Ensure Design Requirements Would Be Met During Construction of the External Flooding Protection Levee Introduction The inspectors identified a finding of very low safety significance (green) with an associated NCV of TS 5.4.1.a for the licensees failure to maintain adequate procedures to protect the MNGP from external flooding events. Specifically, the licensee failed to maintain Procedure 8300-02, External Flooding Protection Implementation to Support A.6 Acts of Nature, in that it lacked sufficient instructions to ensure testing of materials necessary to the external flooding mitigation plan were adequately controlled.

Description The inspectors found documents for construction of the flood control levee did not have requirements (e.g., procedure steps) to sequence (or build-up) the berms and measure compaction during building of the berms to ensure the levee will meet design requirements. Additionally, no steps existed for control of qualified instrumentation, environmental conditions, qualified personnel, and quality control or verification of compaction measurements to ensure consistent 90 percent compaction is achieved.

Procedure 8300-02, External Flooding Protection Implementation to Support A.6 Acts of Nature, Revision 5, provides instructions for protection of the plant from damage by floodwaters, including the construction of a horseshoe levee. Entry into this procedure is directed by Step 5.5.3 of Procedure A.6, Acts of Nature, Revision 49.

The levee, along with other protective features, is designed to prevent flooding of many critical plant areas including the Reactor, Turbine, and Control Buildings. The levee varies in height as the grade elevation changes around the perimeter of the buildings.

However, the levee was designed to protect against the PMF elevation of 939.2 feet by being constructed of compacted clay to approximately 941 feet, providing approximately 2 feet of freeboard. When river level is projected to exceed 930 feet, Step 42.d.4 of Procedure 8300-02 directs the construction of the horseshoe levee using Work Order 473207-01, Building Large Horseshoe Levee, and drawing series NH-178639.

A note in WO 473207-01 states that guidance for constructing the horseshoe levee can be found in the NH-178639 series drawings and Step 8.6.77 directs constructing the horseshoe levee per the same drawings. Drawing NH-178639-2, Details and Sections, provides construction notes to the builder of the levee berms. In the notes, the following guidance is provided: place approved engineered fill in maximum 8-inch thick, loose lifts and compact to at least 90 percent of its ASTM [American Society for Testing & Materials] D698 (standard proctor) MDD [maximum dry density].

The inspectors noted in the levee design calculations that compacting to 90 percent was a critical assumption in the design to ensure the levee would protect the MNGP from floodwater. However, the inspectors found the instructions for constructing the levee lacked specific details on how the licensee would ensure the clay levee was constructed, compacted, and tested to at least 90 percent compaction. Specifically, the inspectors noted the test method, the number of tests, and the location of tests to ensure compaction of at least 90 percent was not contained in the instructions. In addition, the inspectors noted that no steps existed for control of qualified instrumentation, environmental conditions (e.g., use of a moisture density gauge with frost present),qualified personnel, and quality control or verification of compaction measurements.

Analysis The inspectors determined the licensees failure to maintain adequate external flooding protection procedures that provide instructions for construction of the levee with appropriate requirements to ensure design requirements are met was a performance deficiency warranting a significance evaluation. The inspectors assessed this finding using the SDP. The inspectors reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no examples related to this issue. Consistent with the guidance in IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was a finding of more than minor significance because it was associated with the of Protection Against External Factors and Procedure Quality attributes and adversely affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the instructions for constructing the levee lacked specific details on how the licensee would ensure it was constructed, compacted, and tested to at least 90 percent compaction.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 3, SDP Appendix Router, the inspectors determined this finding affected the Mitigation Systems Cornerstone, specifically the External Event Mitigation Systems, and would require review using IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, June 19, 2012. The inspectors performed a Phase 1 SDP review of this finding using the guidance provided in IMC 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, and determined this finding was a licensee performance deficiency of very low safety significance (green) because it did not involve a loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event (e.g., seismic snubbers, flooding barriers, tornado doors). This determination was based on reasonable assurance the licensee could construct and compact the levee to at least 90 percent compaction.

The inspectors determined this finding affected the cross-cutting area of human performance and the work management aspect due to the licensees failure to implement a process of planning, controlling, and executing work activities such that safety is the overriding priority. Specifically, the licensees process for developing and validating the work instructions for construction of the levee did not ensure appropriate quality control steps were incorporated for critical design attributes. (IMC 0310 H.5)

Enforcement TS 5.4.1.a required, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978. Regulatory Guide 1.33, Revision 2, Appendix A, Section 6.w, recommends procedures for combating emergencies and other significant events, specifically Acts of Nature (e.g., tornado, flood, dam failure, and earthquakes). Procedure 8300-02, External Flooding Protection Implementation to Support A.6 Acts of Nature, Revision 5, implemented the requirements of Regulatory Guide 1.33, Revision 2, Appendix A, Section 6.w and contained instructions for constructing a flood control levee to combat a significant external flooding event.

Contrary to the above, as of November 7, 2014, the licensee failed to maintain Procedure 8300-02 External Flooding Protection Implementation to Support A.6 Acts of Nature, Revision 5, such that it would ensure design requirements for the flood control levee would be satisfied. Because this violation was not repetitive or willful, and was entered into the licensees CAP, it is being treated as a NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy (NCV 05000263/2014009-03, Failure to Maintain Procedures to Ensure Design Requirements Would Be Met During Construction of the External Flooding Protection Levee). The licensee entered this violation into its corrective action program as CAP 01453794 to evaluate changes to its procedures to correct the problem.

02.04 Independent Assessment of Extent of Condition and Extent of Cause

a. Inspection Scope

As part of the IP 95002 inspection, the inspectors conducted an independent extent of condition and extent of cause review of licensee programs and processes to verify the programs and processes appropriately considered the CLB of the plant, procedures were consistent with the CLB, and there were plant personnel knowledgeable with the CLB and implementation of the governing procedures, as applicable. The inspectors also reviewed elements of programs and processes to determine if causes identified for the risk-significant performance issue affected the current viability of other programs and processes and if conditions identified in the RCE existed in other programs and processes. The method of analysis included the use of elements from IP 71111.01, Adverse Weather Protection, for high winds and drought (i.e., low river level and high river temperature) conditions and IP 71111.06, Flood Protection Measures, for internal flooding protection.

The inspectors independently assessed the validity of the licensees conclusions regarding the extent of condition and extent of cause for the risk-significant issue. The objective of this requirement was to independently sample performance, as necessary, related to the yellow finding and to provide assurance the licensees assessments regarding the extent of condition and extent of cause were sufficiently comprehensive.

The extent of condition review differs from the extent of cause review in that the extent of condition review focuses on the actual condition and its existence in other places. The extent of cause review focuses more on the actual root cause of the condition and on the degree; the root cause has resulted in additional weaknesses. The inspectors independent review identified no significant issues of concern.

The inspectors independently reviewed program and processes the licensee had reviewed as part of its extent of condition and cause efforts and also reviewed several programs and processes the licensee did not identify as being reviewed in its RCE efforts. Specifically, the inspectors reviewed the following programs and processes:

• Internal flooding protection;

• High Energy Line Break (HELB) protection;

• High wind protection;

• Tornado protection;

• Gas voiding of water-filled accident mitigation systems;

• Low river water level;

• High river water temperatures;

• Upstream and downstream dam failures;

• Operating experience;

• Functionality and operability assessments;

• Emergency Planning;

• Doc-only modification process;

• Corrective Action Program;

• Safety Culture Decision Making attributes;

• Operating Decision Making Instruments; and

• Compensatory security measures for the design basis external flooding event.

The inspectors interviewed licensee personnel, and reviewed program and process documentation, procedures, and corrective action documents during their independent assessment. In addition, the inspectors conducted field walkdowns with MNGP personnel specific to internal flooding protection, HELB protection, high wind protection, tornado protection, and compensatory security measures. The inspectors looked for plant conditions that may be challenged by design basis events. Additionally, the inspectors assessed the knowledge of MNGP personnel on their programs.

b. Assessment The inspectors concluded the licensees extent of condition and extent of cause evaluation appeared reasonable and no significant issues of concern were identified.

The licensee had reviewed numerous programs and processes as part of its extent of condition and extent of cause evaluation. That evaluation identified several concerns where there were questions on the adequacy of procedures, ability of other than the licensees subject matter expert to effectively use a program procedure, lack of overall plant knowledge on a program, and effectiveness of management oversight. For the issues the licensee identified during its evaluation, CAPs were written with some of the actions not yet complete at the end of the inspection.

The inspectors independent assessment identified several items not identified by the licensee and included some questions the inspectors concluded could have been better answered. However, these items were not sufficient for the inspectors to question the overall adequacy of the licensees extent of condition and extent of cause evaluation.

(1) Inadequate Screening for Flooding Modifications-Contributing Cause 1 As discussed in Section 4OA4.02.02.b, the inspectors identified concerns with the development of the contributing cause associated with screening of the external flooding modifications, Contributing Cause 1. The inspectors noted in the causal analysis, only Procedure FP-E-DOC-01, Documentation-Only Process, was determined to be deficient, as the causal analysis concluded this was the only procedure to screen the external flooding modification. As a result, only correction of the FP-E-DOC-01 procedure was pursued. However, the inspectors identified FP-E-MOD-02, Fleet Modification Process, the sites general modification process, was also used to screen the modification and was similarly deficient. The inspectors observed that because the causal analysis did not recognize FP-E-MOD-02 was used to incorrectly screen the modification, the RCE may not have fully reviewed and evaluated this procedure to determine the extent of its deficiencies. The inspectors observed this lack of recognition of the broken barrier may have left the licensee vulnerable when it performed the extent of cause for Contributing Cause 1.

(2) Self and Independent Assessment-Contributing Cause 2 As discussed in Section 4OA4.02.02b, the inspectors concluded the licensee had not fully explored the causal implications of the NOS Departments failure to identify the external flooding related issues. This observation related to Contributing Cause 2, for self and independent assessment failures. As a result, the inspectors concluded these NOS missed opportunities were not fully examined in the licensees extent of cause evaluation. Specifically, the RCE failed to sufficiently evaluate whether changes were necessary for the NOS assessment process.

The inspectors questioned whether the external flooding related assessment process did enough to drive NOS assessors to reference the USAR for design requirements. The inspectors noted this and other concerns could have been extended to evaluate vulnerabilities in other aspects of the NOS assessment process for other samples the assessors are required to perform. The inspectors also noted this evaluation should have been extended to determine whether scoping was correct for the NOS external flooding samples, and whether scoping issues exist in other NOS assessment areas.

The inspectors observed that other portions of the extent of cause evaluation extended beyond flooding to examine similar vulnerabilities in other areas, including other Acts of Nature related programs and procedure guidance. The inspectors noted this was not reviewed as part of the NOS related extent of cause evaluation. The inspectors concluded the examination of NOS deficiencies was very narrow and should have been expanded to include these and other areas.

(3) Low Threshold for CAP Generation-Contributing Cause 3 The inspectors reviewed the extent of cause for Contributing Cause 3, which related to the licensees failure to fully utilize the CAP at a low threshold. The inspectors identified this as a continued focus area for the licensee as a result of insights provided by the resident inspectors. Specifically, the resident inspectors observed some recent examples where CAP generation was delayed or would not have occurred without NRC or senior MNGP management engagement and questioning. Some examples included delayed CAP generation for not meeting an Infrequently Performed Test or Evolution standard for briefing expected bands and limits for monitored parameters during a plant power manipulation, delayed CAP generation for sum of six indication of potential fuel cladding leakage, and a trend of over 40 examples of untimely CAP initiation documented in CAP 01444328. This was highlighted as a focus area during the NRCs Problem Identification & Resolution Inspection (NRC Inspection Report 05000263/2014007) for the MNGP in October 2014.

During the IP 95002 inspection, the inspectors assessed CAP generation thresholds during licensee interactions with the inspection team and noted the licensee appeared to have an appropriate willingness to write CAPs at a low threshold. The inspectors also noted the licensee had appropriately identified when CAPs were necessary during the course of the inspection. The inspectors identified one concern associated with the licensees low threshold for CAP initiation. The inspectors reviewed the licensees AER performed by NOS to address missed opportunities to identify the yellow finding.

Despite identifying missed opportunities that ultimately were determined to be causal to the yellow finding, no CAP was generated to document and address the NOS performance deficiencies. As discussed in Section 4OA.02.02.b, there appeared to be a blind spot with the licensees evaluation of NOS performance and corrective actions.

The inspectors questioned the licensee whether the NOSs missed opportunities and failures to identify an issue of substantial safety significance met its threshold for generating a CAP. In response to the inspectors questions, the licensee initiated CAP 01454523 to address the concern in its CAP.

(4) Operating Experience-Contributing Cause 5 The inspectors reviewed the licensees extent of cause evaluation for issues associated with operating experience usage that contributed to the cause of the finding, Contributing Cause 5. The inspectors noted the RCE had actions to escalate oversight of operating experience related to yellow and red industry NRC inspection findings. The causal evaluation stated the licensees operating experience evaluation of the Fort Calhoun yellow finding was wholly inadequate and concluded additional oversight of these types of evaluations was necessary. The inspectors observed the licensee did not look more broadly and expand its evaluation to also include appropriate oversight of high significance traditional enforcement NRC citations, including Severity Level I and II Violations, which could have equally important lessons learned. The inspectors also observed the licensee did not expand its evaluation to review oversight vulnerabilities for other safety significant findings, namely white inspection findings. The inspectors noted this review could be valuable; especially considering most of the external flooding-related issues that had important learnings the licensee could have benefitted from came from white inspection findings at other licensees facilities.

The inspectors sampled the licensees assessment of applicable white issues and identified a noteworthy observation associated with this review. Specifically, the inspectors selected an example from another plant with similar technology, where the failure of a turbine speed indicator resulted in a white finding due to that licensees lack of recognition of potential impacts to the equipment. The inspectors noted a similar equipment malfunction had occurred at the MNGP and questioned how the operating experience associated with the white finding had been evaluated. The licensee provided documentation relating to the regulatory learnings from several cumulative events from that plant; however, no operating experience evaluation was performed for the equipment issue itself. Given this issue was not evaluated (same equipment, similar issue), the inspectors observed the licensee could be missing important learnings from white findings at other licensees facilities. On a positive note, the inspectors observed that although the licensee did not address the equipment issue in the operating experience evaluation, the evaluation was used to learn from the other licensees IP 95002 inspection results in order to improve MNGPs own preparations for this inspection.

(5) High Wind Conditions The CLB of the plant is for the design of safety-related structures, systems, and components to withstand 100 miles-per-hour (mph) winds at an elevation 30 feet above ground level. Licensee Procedure A.6, Acts of Nature, has a section entitled High Wind Condition. That procedure section addresses how to monitor wind speed and what to do after a high wind event. In the licensees RCE there were no items specifically identified for modification of the licensees response to high winds.

In 2004, in response to NRC inspector concerns with cleanliness and housekeeping related to potential wind-generated debris in the MNGP switchyard and near the condensate storage tanks, (CAP 00727626), the licensee developed Procedure 1487, Site Housekeeping Quarterly Inspection. During walkdowns of the site with MNGP personnel, the inspectors asked what the licensee would do for high winds that did not reach the threshold of 100 mph and how it was assured high winds less than 100 mph would not create missiles or flying debris that might cause equipment problems. The licensee acknowledged a procedure was desirable for lesser high wind conditions and a procedure had been written, but the current draft was delayed for identifying and addressing all the potential procedure interfaces.

The licensee also identified, in addition to the quarterly housekeeping inspections, plant operators on a daily basis walked down outside areas and documented in the Control Room logs completion of the walkdown with an entry stating no loose material was found. In reviewing the operators logs, the inspectors did not find a specific entry for identifying loose material; but the logs had an entry to verify if unnecessary material was accumulating due to ongoing work. The inspectors asked for any training or written direction or job briefings provided to the operators for looking for loose material outside of plant buildings. None was identified, but a list of CAPs written by plant operators for the period of November 4, 2013 through September 17, 2014 was provided. Of the approximate 650 CAPs listed, 10 were written for loose material found.

The licensee also said Control Room operators monitored a weather radio and if high winds were expected, it would dispatch personnel to check for loose material using the quarterly housekeeping procedure, which contains examples of unacceptable and acceptable material in areas being inspected. No specific written guidance was provided for this practice of sending personnel out with this procedure. However, a walkdown of plant outside areas by the inspectors did not identify any loose material that might be of concern during a tornado or high winds event.

(6) Low River Water Level/Flow In the RCE, the licensee identified its actions for low river water flow/level in Procedure A.6, Acts of Nature, had potential deficiencies in meeting the CLB. There were no alarm points for river water temperature, conditions for stop log removal were not properly identified, and there was no operating limit for degraded river conditions. CAPs were initiated for those issues.

During review of Procedure A.6, the inspectors noted at a river flow of approximately 240 cubic-feet-per-second (cfs), which corresponds to a river level of approximately 902.4 feet above mean sea level, the licensee has a potential Emergency Plan entry for a Notice of Unusual Event declaration. At a river level of 905.0 feet, the procedure identifies a potential Emergency Plan entry for an Alert declaration. A river flow is not identified in the procedure for any river levels less than 902.4 feet. The procedure also has provisions for removing a stop log in the intake sill, which would allow river water to flow into the sill down to a river lever of about 898 feet.

The licensee was not able during the course of the inspection to equate the 898 feet level to a river flow. During review of the Atomic Energy Commission Safety Evaluation Report dated March 18, 1970, the inspectors noted the Safety Evaluation Report stated the plant can maintain adequate cooling with a river water flow of over 50 cfs. The inspectors questioned the relevancy of the statement. The inspectors and the licensee did not find any mention of that number in any current licensee documents including the USAR. The inspectors questioned if the 50 cfs would result in river levels below the intake sill. The inspectors noted licensee Procedure C.4-M, Loss of Intake Structure, provided guidance for a condition affecting the intake structure when water from the river could not be used in plant cooling. In response to the inspectors questions, the licensee initiated CAP 01454793 to review the basis for 50 cfs and 898 feet.

(7) Operability Evaluations The inspectors reviewed the licensees Operability/Functionality Determination process and Operational Decision Making process. The inspectors did not identify any issues that would invalidate the adequacy of the licensees extent of condition and extent of cause evaluation.

The inspectors questioned Operability Recommendation 1443664-01, Control Room Pressurization, and the licensees rationale for justifying the acceptability of a Control Room pressurization test conducted in 2014. During the test, anomalous results were obtained and with plausible reasons for the anomalous readings, a lengthy justification was developed instead of just rerunning the test. In this particular case, the test performance resulted in a negative pressure in the Control Room; whereas a positive result was expected. The licensee concluded an improper ventilation lineup caused the negative readings but it did not invalidate the test since the test acceptance criteria was pressurization flow rates developed by the fans in the system. The licensee used the results from a 2011 Control Room smoke test and a visual examination of the Control Room boundary after the 2014 test to conclude there were no issues with the Control Room boundary (i.e., actual leakage of the boundary was within the licensees design requirements.) While not questioning the operability of the Control Room boundary, the inspectors believed a pressurization retest would have been a more conservative approach and would have verified the ventilation lineup was the cause of the observed anomalous Control Room pressure.

(8) Emergency Preparedness During a review of the extent of condition of the problem, the inspectors observed the licensee may not have fully recognized all emergency preparedness (EP) impacts as a result of changes to its external flooding mitigation plan. Specifically, following corrective actions for the yellow finding, the emergency action level instrumentation being relied upon for emergency classification purposes during an external flooding event changed from a Control Room accessible instrument to markings on MNGP buildings external to the Control Room. Ultimately, the inspectors determined the change to the instrumentation was acceptable, given the evaluations performed by the licensee.

However, the inspectors identified the licensee did not fully recognize necessary changes to the Equipment Important to Emergency Response (EITER) procedure, which designated and controlled primary and backup EP equipment. In this case, the primary emergency preparedness equipment for declaring an external flooding related Alert was still designated as the Control Room indication even though the instrument range did not reach the Alert threshold, and the backup method was listed as a manual method. As a result, it appeared that in every case the primary EP instrument would be unavailable to declare an external flooding based Alert. The inspectors also noted failing to procedurally recognize that building markings served as the primary means to declare an Alert could leave the licensee vulnerable to not appropriately maintaining and managing availability of the subject markings.

(9) Security Compensatory Measures The licensees mitigation plan for responding to the design basis external flooding event will require modifications to the sites physical security equipment, systems, and protective measures to ensure the licensee maintains the ability to protect against acts of radiological sabotage and to prevent the theft or diversion of special nuclear materials.

While conducting an independent review of the security measures associated with the licensees external flooding mitigation plan, it was evident security was incorporated in the licensees review and development of actions needed to be completed to effectively implement the mitigation plan. However, the inspectors identified weaknesses in the licensees assessment of the potential adverse impacts these actions may have on the ability to implement the sites defensive plan. Presently, the licensee was using what security management termed an ad hoc approach by relying on the implementation of security compensatory measures to support the existing external flooding mitigation plan. As a result, the planned MNGP security measures lacked detailed assessments and documentation to verify and validate the alternate security systems and measures provided a high assurance the planned protective plan changes would provide an equivalent level of protection as required by the Physical Security Plan and security implementing procedures. In reviewing the licensees external assessments performed in preparation for the IP 95002 inspection, the inspectors noted the Mock 2 assessment recommended the licensee complete a more comprehensive review of security planning for a design basis external flooding event. In response to inquiries by the inspectors as to whether this review was subsequently performed, they were informed such a review was not conducted.

The licensee entered the security related issues identified by the inspectors into its CAP and expressed its intent to conduct assessments and reviews of the security measures associated with the external flooding mitigation plan to verify and validate the planned alternate security measures provide a high assurance it can protect against potential acts of radiological sabotage and prevent the potential theft or diversion of special nuclear materials during an external flooding event. As discussed below in Section 4OA4.02.04.c.1, the inspectors identified a finding of very low security significance (green) associated with the licensees failure to adequately assess and manage the potential for adverse effects on safety and security associated with the development and planned implementation of its external flooding mitigation plan.

(10) Safety Culture Aspects: Decision Making Review The inspectors reviewed and assessed several Safety Culture decision making attributes, most notably those involving conservative biases in decision making, associated with issues that had occurred at the MNGP over the course of the past year.

This review included examples that rose to the level of findings and violations that were documented in previous NRC Inspection Reports. This review also included resident inspector observations and current performance issues from the fourth quarter of 2014 and observations and performance issues related to the IP 95002 inspection activities.

The inspectors performed this review as part of the independent extent of cause evaluation because the root cause for the yellow finding was linked directly to non-conservative assumptions in decision making. The resident inspectors have continued to highlight this area to the licensee as an important Safety Culture focus area. The inspectors utilized the data points to determine whether corrective actions to fix the root cause of the risk-significant performance issue had been successful in mitigating the trend of human performance issues associated with non-conservative decision making more broadly.

The inspectors referred to the following examples as part of this assessment:

3rd Quarter 2013

• Temporary level instrumentation inappropriately relied on during reactor pressure vessel drain down resulted in a lack of accurate vessel level instrumentation.

(NCV 05000263/2013004-03, Loss of Accurate Level Indication During Partial Reactor Coolant System Drain Down)1st Quarter 2014

• Inadequate operability evaluation for Reactor Building closed cooling water leak resulted in failure to recognize reactor coolant pressure boundary leakage.

(NCV 05000263/2014002-02, Failure to Follow Procedure for Reactor Coolant System Operability Determination)

• Inadequate operability evaluation for eight Drywell-to-Torus vacuum breakers resulted in several revisions and only the final revision successfully justified operability. (NCV 05000263/2014002-04, Failure to Follow Procedure for Drywell-Torus Vacuum Breaker Operability Determination)

• Incorporation of preconditioning activities into the Drywell-to-Torus vacuum breaker surveillance procedure despite significant site and external challenges.

(NCV 05000263/2014002-05, Inadequate Drywell-Torus Monthly Vacuum Breaker Test Procedure Due to Proceduralized Unacceptable Preconditioning)2nd Quarter 2014

• Site decision making resulted in preconditioning for standby liquid control surveillance testing in response to testing inconsistencies.

(NCV 05000263/2014003-01, Inadequate Standby Liquid Control Quarterly Pump and Valve Test Due to Proceduralized Unacceptable Preconditioning)3rd Quarter 2014

• Initially rushed decision making for increasing power following violation of the Minimum Critical Power Ratio operational limit; subsequently the appropriate decision making occurred to prompt gathering more information before proceeding forward. (NCV 05000263/2014004-01, Failure to Follow Reactivity Management Procedure)

• Condenser vacuum related decision making was non-conservative, which was self-revealed through vacuum transients and self-identified by the licensee.

(NRC Inspection Report 05000263/2014004 observation)4th Quarter 2014

• Operations and Engineering Department interface regarding reactivity control during Xenon transients lacked formality and relied on informal and imprecise controls.

• Engineering Department document reviewed by the Plant Operations Review Committee was used to inappropriately screen (10 CFR 50.59 screening) out of specific Inservice Testing Relief Request conditions for containment isolation valve testing.

IP 95002 Observations

• Security preparedness for external flooding event relies on non-conservative assumptions. (Section 4OA4.02.04.c.1)

• The RCE failed to adequately assess the full scale of noncompliance for the external flooding issue, subsequent evaluations of the impact of deficiencies on the external flooding mitigation plan failed to look at the big picture and assess issues in aggregate. (Sections 4OA4.02.01.c and 4OA4.02.01.d.1)

• Operability recommendation for Control Room Emergency Filtration Train operability assessment did not prompt rerunning of the surveillance test as an input to the reasonable assurance of operability. (Section 4OA4.02.04.b.7)

The inspectors concluded conservative bias in decision making should remain a focus area for the licensee as it moves forward with its corrective actions. The inspectors noted in the second quarter of 2014, a RCE was performed for the licensees conservative bias issues and the licensee was also assigned a substantive cross-cutting issue in this area. Since then, the resident inspectors have noted that non-conservative decision making examples have decreased. However, the inspectors concluded there continued to be notable examples and continued licensee attention is warranted to focus on improvement and sustainability in this area.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

c. Findings

(1) Safety/Security Interface Assessment Failure Introduction The inspectors identified a finding of very low security significance (green) for the licensees failure to adequately assess and manage the potential for adverse effects on safety and security associated with the development and planned implementation of its external flooding mitigation plan. This finding is not a violation of the regulatory requirements since the licensee has not actually implemented the changes that could have adversely impacted the sites security equipment, systems, and protective measures.

Description During review of the licensees external flooding mitigation plan, the inspectors noted the Security Department was incorporated in the licensees review and development of the actions needed to effectively implement its plan. However, the inspectors identified weaknesses in the Security Departments assessment of the potential adverse impacts these actions may have on the ability to implement the MNGPs defensive plan during the design basis external flooding event. Specifically, the assessments performed lacked a systematic process and review that would provide a high assurance the planned protective plan changes would provide an equivalent level of protection as required by the Physical Security Plan and security implementing procedures.

Through an independent review of the licensees assessment process and interviews of the licensees staff, the inspectors identified issues associated with the effectiveness of the licensees assessments in identifying potential weaknesses in the security compensatory measures that could result in degradation in the licensees ability to implement the sites protective plan.

In discussions with the licensees security staff the term ad hoc was used in reference to the actions that would be taken in the application of protective measures (compensatory measures). The inspectors found the security assessments lacked the verification and validation necessary to ensure the measures implemented would provide high assurance the licensee can effectively implement the protective plan and the conclusions reflected non-conservative decision-making.

In response to the inspectors identification of this issue, the licensee entered the issue into its CAP to perform and document the assessments required to manage the planned changes and to evaluate and develop potential corrective actions.

Analysis The inspectors determined the licensees failure to adequately assess and manage the potential for adverse effects on safety and security associated with the development and planned implementation of the external flooding mitigation plan was a performance deficiency warranting a significance evaluation. Specifically, 10 CFR 73.58(b)(3)(i)requires the licensee to have the capabilities to detect, assess, interdict and neutralize threats up to and including the design basis threat of radiological sabotage at all times.

The failure to adequately review and evaluate the security measures and changes that would be implemented in response to a flooding event would have resulted in the requirements of 10 CFR 73.58(b)(3)(i) not being adequately maintained. The inspectors reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no examples related to this issue. Consistent with the guidance in IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined the performance deficiency was a finding of more than minor significance because it adversely affected the Security Cornerstone objective to provide high assurance the licensee's security system uses a defense-in-depth approach and can protect against the design basis threat of radiological sabotage from external and internal threats.

Specifically, the licensee failed to assess and manage changes to security equipment, systems, and protective measures that would be required in the event of the implementation of the external flooding mitigation plan to determine whether these changes could adversely impact its ability to implement the sites protective plan, which could potentially lead to a loss of defense-in-depth.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 3, SDP Appendix Router, the inspectors determined this finding would require review using IMC 0609, Appendix E, Physical Protection Significance Determination Process for Power Reactors, November 30, 2012, because the issue relates to site physical protection. The inspectors performed a significance screening of this finding using the guidance provided in IMC 0609, Appendix E, Part 1, Baseline Security Significance Determination Process for Power Reactors, dated January 15, 2014. The inspectors determined the finding was of very low security significance (green) because the total point value of this issue was determined to be one (1).

The inspectors determined this finding affected the cross-cutting area of human performance with a cross-cutting aspect of change management due to the licensees failure to use a systematic process for evaluating and implementing change so that nuclear safety remains the overriding priority. Specifically, the licensee did not provide validation of the security plan by conducting integrated tabletops and reviews and perform additional assessment based on feedback from its external reviewers to determine whether these changes could adversely impact its ability to implement the sites protective plan. (IMC 0310, H.3)

Enforcement No violation of regulatory requirements was identified. This issue is considered to be a finding (FIN 05000263/2014009-04, Safety/Security Interface Assessment Failure).

This finding is very similar to the requirements in 10 CFR 73.58, Safety/security interface requirements for nuclear power reactors; however, the inspectors concluded it was not a violation of the regulatory requirements since the licensee has not actually implemented the changes that could have adversely impacted the sites security equipment, systems, and protective measures. The licensee entered this finding into its corrective action program as CAP 01454721.

02.05 Safety Culture Consideration

a. Inspection Scope

As part of the IP 95002 inspection, the inspectors independently confirmed the safety culture components, which contributed to the risk-significant performance issue that was the subject of this inspection, were identified in the licensees RCE. The RCE included a discussion of the applicable safety culture components described in Regulatory Issue Summary 2006-013, Information on the Changes Made to the Reactor Oversight Process to More Fully Address Safety Culture, (ADAMS Accession No. ML061880341)as they applied to the yellow finding. The licensee determined weaknesses in management decision making, resources, self and independent assessments, CAP, environment for raising concerns, and use of operating experience were the most prevalent safety culture attributes. For each of the identified prevalent and contributing safety culture components, the inspectors confirmed the licensee established appropriate corrective actions to address them.

As directed by IP 95002, the inspectors performed a focused inspection to independently determine if the licensees RCE appropriately considered whether any safety culture component caused or significantly contributed to the risk-significant performance issue.

The inspectors reviewed procedures, CAPs, corrective actions, site safety culture assessments and surveys, and independent safety culture assessments and surveys.

The inspectors conducted interviews with MNGP staff to independently evaluate the sites safety culture. A random sample of 14 non-supervisory and supervisory personnel from the Engineering and Operations Departments were assembled in two focus groups and were interviewed by the inspectors. In addition, during the course of conducting interviews associated with inspection activities, the inspectors asked interviewees a series of questions related to Safety Conscious Work Environment (SCWE) that were used in assessing the sites SCWE and the willingness of MNGP personnel to raise issues or concerns without fear of retaliation. The inspectors did not identify concerns related to SCWE during the course of these interviews. Additionally, 12 individual interviews were conducted with MNGP managers b. Assessment As part of the RCE, the licensee evaluated the identified root and contributing causes against the safety culture components that could have contributed to the risk-significant performance issue. The licensee determined that weaknesses in the areas of decision making, use of the CAP, conduct and analysis of self and independent assessments, use of operating experience, and SCWE issues were the most prevalent safety culture attributes.

The inspectors independently confirmed a number of the safety culture components that contributed to the risk-significant performance issue were identified in the RCE. For each of the identified prevalent and contributing safety culture components, the inspectors confirmed the licensee established corrective actions to address them.

In the RCE, the licensee identified the safety culture aspect of decision making, specifically the use of non-conservative decision making as a contributing cause of the yellow finding. During the course of the IP 95002 extent of cause inspection activities, the inspectors noted a number of issues that potentially had contributing cause attributes related to non-conservative decision making and provided these examples to the licensee. These examples and the inspectors assessment are more thoroughly discussed in Section 4OA4.02.04.b.10.

During the conduct of the focus groups, participants expressed a common theme that they were satisfied with the MNGP managements current focus on safety. Participants stated personnel changes in senior management positions and the licensees implementation of changes in programs and processes demonstrate managements commitment to safety and focus on promoting a positive safety culture within the organization.

Focus group participants provided the following examples of management practices that reflect the licensees current safety focus:

(1) Corrective Action Program Participants across all departments stated they were comfortable raising concerns through the use of the CAP, they were encouraged to submit CAPs, and they were familiar with the process for submitting CAPs. Individuals stated management promotes a low threshold for implementing CAPs, and the CAP enables individuals to verify the resolution of issues or concerns that are raised.

(2) Environment for Raising Concerns Employee Concerns Program

• All the focus group participants were aware of the purpose of the Employee Concerns Program (ECP) and could identify the ECP Manager. Participants recognized the ECP Manager for being visible and available out in the plant.

• Focus group participants stated they would be comfortable raising concerns by using the ECP and believed their anonymity would be maintained.

Raising Concerns through Management

• Participants conveyed a general theme that they would be comfortable raising concerns through the management chain without fear of retaliation. This theme was commonly expressed during all of the interviews and focus groups.

Communication

• Participants in the focus groups and the interviews highlighted the fact that management effectively communicates plant issues through the use of various tools such as videos, weekly newsletters, planning meetings, all hands meetings, etc.

• Participants stated site management promotes supervisory and management staff presence in the field and is responsive to receiving feedback from staff personnel.

(3) Resources Department Staffing

• All departments identified the need to increase staffing levels in the Maintenance and Radiation Protection Departments to meet site production demands. Individuals demonstrated a pride in ownership for the plant and a desire to improve the plants operational performance and physical condition. However, all department focus group participants identified the need to increase staffing levels in the Maintenance (specifically Mechanical Maintenance and Maintenance Services) and Radiation Protection Departments to enable the site to sustain the focus on and completion of improvements similar to those that were achieved during the recent outage.

Participants stated the sites ability to make these improvements were the direct result of the increase in staffing levels during the outage due to the hiring of temporary workers in both Maintenance and Radiation Protection.

• Individuals expressed a desire to become a high performing plant but believed that, with the current staffing levels, they could not achieve that goal. Their general perception was there needs to be an increase in temporary staffing levels to facilitate this performance improvement, and that once the site achieves the higher performance through physical and operational improvements, the present approved staffing levels would be adequate to sustain the higher performance standards.

• The sites Nuclear Safety Culture Monitoring Review Board identified staffing concerns during the Third Quarter 2102 Nuclear Safety Culture Monitoring Review Board meeting that evaluated the results of the Site-Wide SCWE Survey completed in August of 2013. However, the present authorized site staffing levels of the Maintenance and Radiation Protection Departments were still perceived by all department focus group participants as inadequate to meet existing production demands and improve the performance and physical condition of the plant.

Training

• Participants recognized the fact that site management has provided extensive training and communication on safety culture and the yellow finding associated with this inspection. Individuals acknowledged licensee managements emphasis on promoting a positive safety culture.

• Licensee management recognized the need for recurring training to reinforce the behaviors required to sustain a positive safety culture and acknowledged the fact that an organizations safety culture is not changed overnight. Additionally, management understood the need to focus on implementing processes and promoting changes in habits and behaviors that will ensure the sustainability of a positive safety culture.

Work Practices

• Licensee management promoted supervisory and management staff presence in the field, conducting site walkdowns to identify risks, and conducting field observations of work performance.

• Licensee management incorporated operating experience in work planning and daily department briefs. Focus group participants and individuals that were interviewed identified the licensees increased focus on the use of operating experience; both site specific and industry samples, as a positive element of the sites continuous learning environment.

• Participants emphasized the organizations focus is on safety over production and all individuals stated they would stop work to resolve any safety issues or concerns they may potentially identify. Additionally, they would not proceed or restart their work activity until the issue or concern was properly resolved. If necessary, they would raise the concern up the management chain prior to proceeding with any work or condition that they felt was unsafe.

The inspectors concluded the licensee met this aspect of the IP 95002 objectives and this item is closed.

c. Findings

No findings were identified 02.06 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues The licensee did not request credit for self-identification of an old design issue.

Consequently, the subject risk-significant finding was not evaluated against the IMC 0305 criteria for treatment of an old design issue.

4OA5 Other

(1) (Closed) Violation 05000263/2013008-001, Failure to Maintain an Adequate Flood Plan Consistent with Design Requirements The inspectors determined the licensees RCE was conducted to a level of detail commensurate with the significance of the problem and reached reasonable conclusions as to the root and contributing causes of the event. The inspectors also concluded the licensee identified reasonable/appropriate corrective actions for each root and contributing cause and the corrective actions appeared to be prioritized commensurate with the safety significance of the issues. Although the inspectors determined the period of noncompliance was actually longer than originally considered, it resulted in no additional safety consequence and the licensee appropriately addressed the issues identified during the additional time. No other instances of the violation were identified.

This violation is closed.

4OA6 Management Meeting

Exit Meeting Summary

On December 2, 2014, the inspectors presented the inspection results to Ms. Fili and other members of the licensees staff. The licensee acknowledged the issues presented. The inspectors confirmed that none of the potential report input discussed was considered proprietary.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

P. Albares, Operations Manager

R. Anderson, Response Team

K. Conlon, Response Team

K. Fili, Site Vice President

G. Foote, Response Team Lead

P. Gardner, Director of Site Operations

J. Gausman, Response Team

S. Halbert, Response Team

C. Hannon, Response Team

H. Hanson, Jr., Plant Manager

K. Jepson, Recovery Manager

M. Lingenfelter, Engineering Director

K. Markling, Response Team

E. Newberg, Response Team

J. Ohotto, 95002 Inspection Manager

Nuclear Regulatory Commission

K. Riemer, Chief, Reactor Projects Branch 2

P. Zurawski, Senior Resident Inspector, Monticello

LIST OF ITEMS

Opened

05000263/2014009-01 NCV Failure to Satisfy 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition (Section 4OA4.02.01.d.1)

05000263/2014009-02 NCV Failure to Satisfy 10 CFR 50.72 and 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition (Section 4OA4.02.01.d.2)

05000263/2014009-03 NCV Failure to Maintain Procedures to Ensure Design Requirements Would Be Met During Construction of the External Flooding Protection Levee (Section 4OA4.02.03.f.1)

05000263/2014009-04 FIN Safety/Security Interface Assessment Failure (Section 4OA4.02.04.c.1)

Closed

05000263/2013-003-00 LER Inadequate External Flooding Procedure (Section 4OA3.1)

05000263/2013-003-01 LER Inadequate External Flooding Procedure (Section 4OA3.1)

05000263/2013-003-02 LER Inadequate External Flooding Procedure (Section 4OA3.1)

05000263/2013-007-00 LER Unanalyzed Condition Due to Inadequate Flooding Procedures (Section 4OA3.2)

05000263/2013-007-01 LER Unanalyzed Condition Due to Inadequate Flooding Procedures (Section 4OA3.2)

05000263/2014009-01 NCV Failure to Satisfy 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition (Section 4OA4.02.01.d.1)

05000263/2014009-02 NCV Failure to Satisfy 10 CFR 50.72 and 10 CFR 50.73 Reporting Requirements for an Unanalyzed Condition (Section 4OA4.02.01.d.2)

05000263/2014009-03 NCV Failure to Maintain Procedures to Ensure Design Requirements Would Be Met During Construction of the External Flooding Protection Levee (Section 4OA4.02.03.f.1)

05000263/2014009-04 FIN Safety/Security Interface Assessment Failure (Section 4OA4.02.04.c.1)

05000263/2013008-01 VIO Failure to Maintain an Adequate Flood Plan Consistent with Design Requirements (Section 4OA5.1)