IR 05000249/2010009

IR 05000249-10-009 on 05/10/10 - 05/14/10 for Dresden, Unit 3; Supplemental Inspection - Inspection Procedure 95001

ML101550506
Person / Time
Site:	Dresden
Issue date:	06/04/2010
From:	Stephanie West Division Reactor Projects III
To:	Pardee C Exelon Generation Co, Exelon Nuclear
References
EA-09-172 IR-10-009
Download: ML101550506 (28)

Text

une 4, 2010

SUBJECT:

DRESDEN NUCLEAR POWER STATION, UNIT 3, SUPPLEMENTAL INSPECTION REPORT 05000249/2010009

Dear Mr. Pardee:

On May 14, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Dresden Nuclear Power Station, Unit 3. The enclosed report documents the inspection results, which were discussed during a Regulatory Performance Meeting on May 14, 2010, with Mr. T. Hanley and other members of your staff.

As required by the NRC Reactor Oversight Process Action Matrix, this supplemental inspection was performed in accordance with Inspection Procedure 95001, Inspection for One or Two White Inputs in a Strategic Performance Area. The purpose of the inspection was to examine the causes for, and actions taken related to a finding having low to moderate safety significance (i.e., White) at Dresden Station. The finding involved the failure on November 3, 2008, to prevent inadvertent and uncontrolled control rod withdrawal by non-licensed operators.

This issue was documented previously in NRC Inspection Reports 05000249/2009009 and 05000249/2009010. The NRC staff was informed on April 5, 2010, of your staffs readiness for this inspection.

This supplemental inspection was conducted to provide assurance that the root causes and contributing causes of the event resulting in the White finding are understood, to independently assess the extent of condition, and to provide assurance that the corrective actions for the risk-significant performance issues are sufficient to address the root causes and contributing causes to prevent recurrence.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records and interviewed personnel.

The inspectors determined that your root cause evaluation was conducted to a level of detail commensurate with the significance of the problem and reached reasonable conclusions as to the root and contributing causes of the event. The inspectors also concluded that you identified reasonable/appropriate corrective actions for each root and contributing cause and that the corrective actions appeared to be prioritized commensurate with the safety significance of the issues. However, the inspectors had several observations regarding specific aspects of the root cause evaluation and corrective actions that warranted additional consideration by your staff.

Based on the results of this inspection, no findings of significance were identified.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)

component of NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Steven West, Director Division of Reactor Projects Docket No. 50-249 License No. DPR-25

Enclosure:

Inspection Report 05000249/2010009

REGION III==

Docket No: 50-249 License No: DPR-25 Report No: 05000249/2010009 Licensee: Exelon Generation Company, LLC Facility: Dresden Nuclear Power Station, Unit 3 Location: Morris, Illinois Dates: May 10, 2010, through May 14, 2010 Inspectors: B. Kemker, Senior Resident Inspector, Clinton D. Reeser, Operations Engineer Approved by: M. Ring, Chief Reactor Projects Branch 1 Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000249/2010009; May 10, 2010 - May 14, 2010; Dresden Station, Unit 3; Supplemental

Inspection - Inspection Procedure 95001.

This supplemental inspection was performed by a Senior Resident Inspector and Operations Engineer. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

This supplemental inspection was performed in accordance with Inspection Procedure 95001, Inspection for One or Two White Inputs in a Strategic Performance Area to assess the licensees root cause evaluation, extent of condition determination, and corrective actions for the licensees failure on November 3, 2008, to prevent inadvertent and uncontrolled control rod withdrawal by non-licensed operators. This finding was previously characterized as having low to moderate safety significance (i.e., White) in an NRC letter dated October 26, 2009, which finalized the preliminary assessment of the finding documented in NRC Inspection Report 05000249/2009009.

During this inspection, the inspectors determined that the licensees root cause evaluation was conducted to a level of detail commensurate with the significance of the problem and reached reasonable conclusions as to the root and contributing causes of the event. The inspectors also concluded that the licensee identified reasonable/appropriate corrective actions for each root and contributing cause with one notable exception and that the corrective actions appeared to be prioritized commensurate with the safety significance of the issues. The inspectors noted the following observations that warranted additional consideration by the licensee:

• The root cause evaluation did not adequately address all of the compliance concerns documented in the Notice of Violation related to this event. Specifically, the licensee did not correctly evaluate the failure to implement a written procedure addressing the inability to drive control rods. In response to the inspectors questions, the licensee provided an acceptable response to the compliance issue.

• One and one-half years after the event at Dresden Station and two and one-half years after the licensees Nuclear Oversight Department first identified that implementation of the Operating Experience Program was inadequate; it is still unknown whether corrective actions taken to address this problem will be fully effective. While significant changes have been made to improve the licensees Operating Experience Program and these actions appear to be reasonable, additional work is required to completely correct problems found with program implementation to ensure a robust and effective program going forward.

• The licensees root cause evaluation and the safety culture components evaluation had not correctly considered the licensees failure to implement a written procedure addressing the inability to drive control rods.

Given the licensees acceptable performance in addressing the uncontrolled control rod withdrawal event, the White finding associated with this issue will only be considered in assessing plant performance for a total of four quarters in accordance with the guidance in Inspection Manual Chapter 0305, Operating Reactor Assessment Program.

Findings No findings of significance were identified.

Licensee-Identified Violations

No findings of significance were identified.

REPORT DETAILS

OTHER ACTIVITIES

40A4 Supplemental Inspection (95001)

.01 Inspection Scope

This inspection was conducted in accordance with Inspection Procedure (IP) 95001, Inspection for One or Two White Inputs in a Strategic Performance Area, to assess the licensees evaluation of one inspection finding of low to moderate safety significance (i.e., White) in the Mitigating Systems Cornerstone. The inspection objectives were to:

• Provide assurance that the root causes and contributing causes of risk-significant performance issues were understood;

• Provide assurance that the extent of condition and extent of cause of risk-significant issues were identified; and

• Provide assurance that the licensees corrective actions to risk-significant performance issues were or will be sufficient to address the root causes and contributing causes, and to prevent recurrence.

In a letter dated October 26, 2009, the NRC communicated the final significance determination for a finding having low to moderate safety significance (i.e., White), with five associated violations of NRC requirements, at Dresden Station. The finding involved the failure on November 3, 2008, to prevent inadvertent and uncontrolled control rod withdrawal by non-licensed operators. The NRC reviewed the circumstances that led to the finding and the licensees initial root cause evaluation activities during a Selected Issue Follow-up Inspection completed on July 15, 2009. The details of the performance issues and the preliminary results of the NRCs significance evaluation were documented in NRC Inspection Report 05000249/2009009. Dresden Station, Unit 3, entered the Regulatory Response column of the NRCs Action Matrix in the third quarter of 2009 based on the White inspection finding. On April 5, 2010, the licensee notified the NRC that applicable corrective actions for the finding had either been completed or initiated, and that it was ready for the NRC to conduct this supplemental inspection to review its evaluation of the causes and the actions taken to address the White finding.

The inspectors reviewed the licensees root cause evaluation in addition to other evaluations conducted in support and as a result of the root cause evaluation.

The inspectors reviewed corrective actions that were taken or planned to address the identified causes. The inspectors also held discussions with licensee personnel to ensure that the root and contributing causes and the contribution of safety culture components were understood and corrective actions taken or planned were appropriate to address the causes and preclude repetition.

.02 Evaluation of the Inspection Requirements

02.01 Problem Identification a. Determine that the evaluation documented who identified the issue (i.e., license-identified, self-revealed, or NRC-identified) and under what conditions the issue was identified.

The inspectors determined that the licensees root cause evaluation adequately described the conditions of this self-revealed event.

On the morning of November 3, 2008, Dresden Unit 3 was in day one of a refueling outage and was shut down with all control rods fully inserted into the core. At the time of the event, non-licensed operators (NLOs) were in the process of isolating the control rod drive (CRD) mechanisms per two clearance orders that directed using Dresden Operating Procedure (DOP) 0500-05, Discharging of CRD Accumulators with Mode Switch in Shutdown or Refuel, Revision 4. The Work Execution Center (WEC)

Operations Field Supervisor directed the NLOs to perform optional knowledge-based procedure conditional statements to isolate all CRD hydraulic control units (HCUs) by closing the 3-0305-101 HCU Insert and 3-0305-102 HCU Withdraw valves in series with an operating CRD pump per DOP 0500-05. Licensed operators in the Control Room were unaware that this was happening.

The unexpected control rod withdrawals occurred during isolation of the last three HCUs.

With a CRD pump running and the majority of HCUs isolated, CRD system pressure had increased sufficiently for the three control rods to withdraw from the core when the associated 3-0305-101 HCU Insert valves were closed just before the 3-0305-102 HCU Withdraw valves were closed.

On January 6, 2009, the licensee completed its initial root cause evaluation to investigate the organizational and programmatic issues that led to the Dresden Station event. The licensee subsequently revised the initial root cause evaluation. The inspectors reviewed Revision 3 of the root cause evaluation, which was completed on March 25, 2010.

b. Determine that the evaluation documented how long the issue existed and prior opportunities for identification.

The inspectors determined that the licensees root cause evaluation provided a detailed chronology of the event, including the issues and actions leading up to and directly influencing the event.

The root cause evaluation detailed the time when the first control rod positions on the Control Room Full Core Display changed state and annunciators were received, subsequent control rod positions changing state and annunciators received, unplanned rod withdrawals from the core, and operator actions throughout the event. The first control rod drift annunciator was received at 10:19 a.m. Over the next several minutes, multiple control rod positions changed state and annunciators were received. The control rods began to drift out of the core at 10:36:36 a.m. The unplanned withdrawal of the three control rods was terminated when the last HCU was isolated by closing the associated 3-0305-102 HCU Withdraw valve. The last control rod withdrawal stopped at 10:39:49 a.m. At 11:53:44, the first of the three control rods was reinserted into the core by manually cycling open and then closing the associated 3-0305-101 HCU Insert valves. By 11:56 a.m., the three control rods that had drifted out of the core had been reinserted. The entire event lasted approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 38 minutes; however, the issues and actions leading up to and directly influencing the event existed before the first Control Room annunciator was received. As discussed further in this inspection report, appropriate response to operating experience received by the licensee one year prior to the event could have prevented it.

c. Determine that the evaluation documented the plant-specific risk consequences, as applicable, and compliance concerns associated with the issue.

The inspectors determined that the root cause evaluation adequately documented the plant-specific risk consequences associated with the event.

The licensee performed two risk assessments, which were documented in calculations DR MD83 01, Risk Assessment - Multiple CRDs Drift From Fully Inserted, IR 839678 -

MD 8.3, Revision 1, and DR-SDP-01, SDP Risk Assessment, Multiple CRDs Drift From Fully Inserted, IR 839678, Revision 0.

The conclusion of the risk assessments was summarized on page 8 of the root cause evaluation. Two aspects of this potential core damage sequence were evaluated and the risk of core damage from this event was judged to be negligible due to the reactor remaining subcritical, no boiling in the core and redundant heat removal methods being available. For this event, the actual core moderator temperature and Xenon conditions present resulted in significant margin to criticality. Reactor Engineering calculations determined the core remained sub-critical by approximately 4.5 %. If all three control rods had fully withdrawn to rod position 48, then the reactor would have been sub-critical by approximately 3.1%. Therefore, based on [the] foregoing, there was no impact to nuclear safety as a result of the actual event circumstances and the risk of core damage is judged to be negligible. Based on the core conditions at the time of the event, there were no nuclear, industrial, radiological safety impacts and minimal outage impact.

The licensees conclusion in DR-SDP-01 was that the risk significance of the event is very low (much less than 1E-06 [per year]) and can be screened to Green [i.e., very low safety significance under the Significance Determination Process].

Technical Specification (TS) 3.1.1 requires, in part, that the shutdown margin shall be 0.38 k/k, with the highest worth control rod analytically determined, or 0.28 k/k, with the highest worth control rod determined by test. The shutdown margin is defined in TS Section 1.1, as the amount of reactivity by which the reactor is subcritical assuming Xenon free condition, moderator temperature of 68 degrees Fahrenheit (°F), highest worth rod fully withdrawn, and accounting for the reactivity worth of any rods not fully inserted. In response to the inspectors questions during the Selected Area Follow-up Inspection, the licensee determined that, assuming the design shutdown margin (i.e.,

actual rod pattern plus one rod full out, 68°F, and Xenon free), the reactor would have been critical. In addition, the inspector noted that the licensee did not analyze the shutdown margin assuming the three rods drifted full out under cold (68°F) conditions.

The licensee also determined the reactor would have been critical under those conditions.

As discussed in NRC Inspection Report 05000249/2009009, the NRC considered multiple additional qualitative circumstances associated with the event to reach the conclusion that the performance deficiency associated with the event should be characterized as a finding of low to moderate safety significance (i.e., White) under the Significance Determination Process.

The inspectors determined that the root cause evaluation did not adequately address all of the compliance concerns that were identified related to this event.

In NRC Inspection Reports 05000249/2009009 and 05000249/2009010, the NRC identified a violation of TS 5.4.1, Administrative Controls, for the licensees failure to implement a written procedure addressing the inability to drive control rods. TS 5.4.1 requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Regulatory Guide 1.33, Appendix A, Paragraph 6, Procedures for Combating Emergencies and Other Significant Events, lists Inability to Drive Control Rods as a subject that required a written procedure.

During the event, Control Room operators verbally directed NLOs to open the affected HCU Insert valves out-of-sequence for each control rod that had been withdrawn in order to cause the control rod to insert into the core, and then to re-shut the valve.

Although these actions were successful in inserting the withdrawn control rods, this was not done by implementing an approved procedure.

During this inspection, the inspectors found that the licensees response to this violation in Action Request (AR) 01024479, Historical NRC Issue Not Identified in Issue Report, and on page 63 of the root cause evaluation was inadequate because the response did not restore compliance with the TS 5.4.1 requirement. The licensees conclusion was that the actions were in accordance with procedures, which directs that the plant be placed in a safety [sic] condition; then validation that procedural guidance reflects the plant configuration.

The licensee referenced steps from two administrative procedures:

(1) OP-AA-101-111-1001, Operations Philosophy Handbook, Revision 6, Step 4.11.1 states: When conditions arise which are unexpected, or are outside the scope of normal operating conditions or procedures, management promotes a culture which ensures that operations personnel do not proceed in the face of uncertainty, but instead place the plant in a safe condition and then obtain the appropriate guidance before proceeding.

(2) HU-AA-104-101, Procedure Use and Adherence, Revision 4, Step 4.8.3 also states: During transients, actions required to place the plant in a stable condition may be performed from memory and followed up with review of the procedure steps as soon as possible.

The inspectors noted that having administrative procedures with general guidance for actions to be taken during unexpected or transient conditions did not obviate the requirement to implement a written procedure addressing the inability to drive control rods. Whether sufficient procedure guidance was available at the time but unknown to the operators or whether an existing procedure could have been modified using the licensees formal procedure change process was not clear; however, those options were not used.

The first procedure step referenced above discusses an expectation for operators not to proceed in the face of uncertainty, but instead to place the plant in a safe condition and then obtain appropriate guidance before proceeding. It was questionable whether operators followed this step to obtain appropriate guidance before proceeding. The inspectors noted that the plant was in a safe condition after the HCUs were isolated because all uncontrolled control rod motion had stopped. Although timely action was required to reinsert the control rods and satisfy the TS 3.1.1 action requirement to immediately initiate action to fully insert the control rods to satisfy the shutdown margin, there was sufficient time for operators to obtain appropriate guidance and document the plan of action (i.e., written procedural guidance) for reinsertion of the control rods.

The second procedure step was not relevant to the event situation. Implicit in this step is that procedure guidance already exists and operators are familiar enough with it such that they can perform actions from memory and then follow up with review of the procedure steps as soon as possible afterwards.

In response to the inspectors questions, the licensee wrote AR 01068608, acknowledging that what was documented in AR 01024479 and in the root cause evaluation did not restore compliance with the TS 5.4.1 requirement. The inspectors concluded that corrective actions taken to revise operating procedures to prevent the plant configuration that precipitated the inadvertent control rod withdrawal along with operator training would adequately address the compliance issue and should prevent its recurrence. Therefore, no finding of significance was identified.

d. Findings

No findings of significance were identified.

02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation a. Determine that the problem was evaluated using systematic methodology to identify the root and contributing causes.

The inspector determined that the root cause evaluation adequately applied systematic methods in evaluating the issue in order to identify root causes and contributing causes.

In its root cause analysis, the licensee used appropriate systematic processes and methods including Barrier Analysis, use of an Event and Causal Factor Chart, and TapRooT to identify root causes and contributing causes for the event.

b. Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem.

The inspectors determined that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem and reached reasonable conclusions as to the root and contributing causes of the event.

Following the November 3, 2008, event, the licensee initiated a root cause evaluation to investigate the organizational and programmatic issues that led to the inadvertent control rod withdrawal event. The NRC previously reviewed the licensees initial root cause evaluation during a Selected Area Follow-up Inspection that was completed on July 15, 2009. During this inspection, the inspectors reviewed Revision 3 of the root cause evaluation.

There were two causal factors identified in the root cause evaluation:

(1) DOP 0500-05, Discharging of CRD Accumulators with Mode Switch in Shutdown or Refuel, Revision 4, lacked sufficient guidance for the intended use. The procedure contained optional knowledge-based procedure conditional statements for operators to isolate any or all CRD HCUs by closing the 3-0305-101 HCU Insert and 3-0305-102 HCU Withdraw valves to limit the migration of nitrogen into HCU piping and limit the subsequent venting of the system after restoration. The procedure was deficient in that it did not contain any precautions, prerequisites, selection criteria or limitations for the number of HCUs to be isolated with an operating CRD pump.

(2) The review of relevant operating experience received at Dresden Station 11/2 years before the event, detailing historical events at several boiling water reactors in Japan between 1978 and 2000 where single or multiple control rods unexpectedly moved out of the core without a deliberate withdrawal signal, failed to identify and correct the latent procedure deficiencies in DOP 0500-05. This was attributed to weaknesses in the implementation of the licensees Operating Experience Program and in the governing procedure LS-AA-115, Operating Experience Procedure.

The root cause was determined to be a combination of these two causal factors (i.e., the failure to identify and correct latent procedure deficiencies in DOP 0500-05, Discharging of CRD Accumulators with Mode Switch in Shutdown or Refuel, Revision 4, during the review of relevant operating experience due to inadequate implementation of the licensees Operating Experience Program.)

There were several contributing causes identified in the root cause evaluation, including:

(1) The use of conditional statements in operating procedures resulted in over-reliance on Operations supervision knowledge-based decisions.

(2) The Control Room operators were not informed of field activities authorized by the WEC Operations Field Supervisor, including the isolation of the HCUs.

(3) There was a mind-set that isolating a system or component in the desired condition always results in placing the system or component in a safe condition. In some cases, a hidden system response may not be intuitively realized as a result of a first time or infrequently performed evolution.

(4) Control Room operators failed to correctly respond when control rod positions on the Control Room Full Core Display changed state and annunciators were received.

Operators assumed the Rod Drift annunciator was due to a maintenance activity and did not take actions to address the actual control rod drift.

(5) Training of plant operators on lessons learned from the operating experience associated with the Japanese reactor events was ineffective.

(6) Knowledge gaps existed with plant operations and engineering personnel on the Electronic Data Management System search capabilities and limitations, negatively affecting the review of applicable procedures for revisions to address lessons learned from operating experience.

c. Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience.

The inspectors determined that the root cause evaluation included consideration of prior occurrences of the problem and knowledge of prior operating experience.

Operating experience dated April 10, 2007, detailed historical events at several boiling water reactors in Japan between 1978 and 2000 where single or multiple control rods unexpectedly moved out of the core without a deliberate withdrawal signal. The reactor had become critical at two plants, one of which had the reactor vessel head removed.

The Japanese reactor events were caused by the same type of manipulations of CRD HCU valves with a CRD pump running as the event at Dresden Station on November 3, 2008. The licensee received this operating experience and wrote AR 0616696 to enter the operating experience into its corrective action program for evaluation on April 13, 2007.

The licensee concluded that the root cause for the Dresden Unit 3 unplanned control rod withdrawal event was a direct result of its failure to identify latent procedural deficiencies in DOP 0500-05 during the operating experience review of the Japanese reactor events described in the April 2007 operating experience. Four individuals performed operating experience reviews of the information and all four individuals failed to identify DOP 0500-05 as a procedure requiring revision. During the course of the root cause investigation, the licensee found numerous programmatic deficiencies in the procedure governing operating experience reviews - LS-AA-115, Operating Experience Procedure, Attachment 1, OPEX [Operating Experience] Reviewers Guidelines, Revision 10.

The inspectors noted that in November 2007, the licensees Nuclear Oversight Department identified that implementation of the Operating Experience Program at the corporate as well as at the site level was inadequate in AR 00698512.

Nuclear Oversight highlighted several examples where governance, implementation, and oversight weaknesses within the administration of the Operating Experience Program existed.

In October 2007, Nuclear Oversight had specifically performed an assessment of the site and corporate operating experience reviews of the operating experience received on the Japanese reactor events and found multiple deficiencies. These issues were entered into the licensees corrective action program as AR 00690076. The primary cause was stated to be a weakness in technical human performance on the part of the site reviewers and their managers, as well as the corporate subject matter expert reviewer that was likely influenced by the fact that the events described in the operating experience were considered to be of very low likelihood, leading to a lower sensitivity on the part of the reviewers and their managers. While Nuclear Oversight identified the problem early enough to possibly have prevented the Dresden Station event, appropriate actions were not taken to correct the inadequate operating experience review of the Japanese reactor events.

In December 2008, Nuclear Oversight elevated its concern with inadequate governance, oversight, and implementation of the Operating Experience Program, citing the Dresden Station event and the inadequate site and corporate responses to the previous operating experience from the Japanese reactor events as well as several other recent examples.

The Nuclear Oversight elevation of the Operating Experience Program performance issues was entered into the licensees corrective action program as AR 00852173.

In January 2009, Nuclear Oversight wrote AR 00867475 to capture the broader issues associated with deficiencies identified with the Operating Experience Program to assure resolution. In AR 00867475, Nuclear Oversight stated that lessons learned from significant operating experience were not always rigorously evaluated and incorporated into Exelon procedures and practices. Station reviews were not consistently critical, thus opportunities had been missed to implement the changes required to prevent similar events.

In February 2009, the licensee completed a common cause evaluation to determine the common cause(s) associated with significant operating experience implementation deficiencies described in AR 00867475. The conclusion was that a lack of clear procedural guidance was contributing to problems with the oversight of the Operating Experience Program and impacting the rigor and closeout quality of some events.

This cause was consistent with a conclusion in the root cause evaluation for the Dresden Station event. Corrective actions were identified to develop and implement a revised Operating Experience Program.

In January 2010, Nuclear Oversight identified that weaknesses continued to be found in the responses to significant industry operating experience after corrective actions were taken for the issues raised in the elevation letter one year earlier. Nuclear Oversight stated in AR 01021565 that, since the implementation of corrective actions, independent quality reviews of several completed significant external operating experience responses were all found to be inadequate. Nuclear Oversight found that operating experience reviews with applicability to multiple stations were not receiving adequate compilation and analysis prior to submittal to Management Review Committees (MRCs),

Nuclear Oversight (NOS), and the Executive Challenge Board. The NOS's view was that the responses showed a tendency toward technical arrogance, in that the focus of the responses was not what could be learned and implemented as a result of the operating experience, but instead to justify why the event could not happen within Exelon or did not warrant any additional effort or changes in processes.

Separate from the root cause evaluation and in response to the Dresden Station event, the Nuclear Oversight Department reviewed the event for learning opportunities to incorporate into its assessment activities. These actions were driven by Nuclear Oversights procedure NO-AA-1001, Nuclear Oversight Lessons Learned Assessment.

Missed Opportunity Evaluation Report, Dresden Control Rod Drift Caused by Inadequate OPEX Program Implementation, was completed on January 30, 2009.

The event was determined to be a missed opportunity for Nuclear Oversight.

Nuclear Oversights conclusion was that its failure to use its existing tools, including the Station Issues Matrix, the Elevation/Escalation Process, as well as the failure to consider the Operating Experience Program issues as a finding eliminated the need to perform a follow-up on the line organizations corrective actions. This follow-up could have identified resolution inadequacies, possibly preventing the Dresden Station event from occurring. Failure to elevate/escalate the identified Operating Experience Program weaknesses in October 2007 under the licensees formal process and enter them into the Station Issues Matrix, despite the significant weaknesses noted during the Nuclear Oversight assessment, was a contributor to the event. Elevation would have required a follow-up by Nuclear Oversight and would have heightened line managements attention to the identified issues and driven an improvement plan much earlier before the event.

The NRC concluded in NRC Inspection Report 05000249/2010009 that the primary cause of the November 2008 Dresden Station event involved the ineffective use of operating experience because the licensee did not effectively implement and institutionalize operating experience through changes to station processes, procedures, and training programs. Specifically, the licensee did not identify and revise all of the appropriate procedures pertaining to isolation of CRD HCUs and did not effectively train individuals on the lessons learned from industry operating experience.

The inspectors were concerned that, 11/2 years after the event at Dresden Station and 21/2 years after the licensees Nuclear Oversight Department first identified that implementation of the Operating Experience Program was inadequate; it is still unknown whether corrective actions taken to address this problem will be fully effective.

The inspectors noted that the December 2008 Nuclear Oversight elevation letter remained open because the licensee has not yet satisfactorily resolved the broader issues raised in the letter with the overall implementation of the Operating Experience Program. While significant changes have been made to improve the licensees Operating Experience Program and these actions appear to be reasonable, additional work is required to completely correct problems found with program implementation to ensure a robust and effective program going forward. The NRC will further review the effectiveness of the licensees Operating Experience Program during the next scheduled Problem Identification and Resolution Inspection.

Because this is a licensee-identified issue and because the licensee has implemented reasonable corrective actions that should correct the problem, no finding of significance was identified.

d. Determine that the root cause evaluation addressed extent of condition and the extent of cause of the problem.

The inspectors determined that the root cause evaluation adequately addressed the extent of condition and extent of cause of the problem. The inspectors reviewed the status of the licensees actions to address the extent of condition and extent of cause and found no additional issues of significance.

The licensee concluded that the extent of condition encompassed all procedures that provide direction for isolation or restoration of HCUs and lack the necessary direction to prevent sufficient pressurization of the CRD cooling water header to result in unplanned control rod movement. Regarding the failure of the operating experience reviews to identify the latent procedure deficiencies in DOP 0500-05, the extent of condition was limited to the LS-AA-115 procedure weaknesses.

The licensee concluded that the extent of cause encompassed the mind-set that isolating a system or component in the desired condition always results in placing the system or component in a safe condition. However, in some cases, a hidden system response may not be intuitively realized as a result of a first time or infrequently performed evolution. In some instances, a routine evolution may result in different outcomes due to the change of a single parameter such as HCU isolation with and without an operating CRD pump. The licensee further concluded that the extent of cause encompassed all significant operating experience reports previously evaluated as applicable.

The inspectors concluded that sufficient time has not been available to fully measure the licensees success at addressing the weaknesses in the implementation of its Operating Experience Program that led to the event.

e. Determine that the root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in Inspection Manual Chapter (IMC) 0310.

The inspectors determined that, in general, the root cause evaluation, extent of condition, and extent of cause appropriately considered the safety culture components as described in IMC 0310. The inspectors noted, however, that the licensees root cause evaluation and the safety culture components review had not correctly considered the licensees failure to implement a written procedure addressing the inability to drive control rods that was discussed previously in Section 02.01.c.

The licensee completed a Safety Culture Evaluation as part of the overall root cause evaluation effort in accordance with its Corrective Action Program procedure.

The inspectors noted that the review appropriately characterized several of the performance issues identified in the root cause evaluation with respect to the safety culture components. These included the decision by the WEC Operations Field Supervisor to perform optional knowledge-based procedure conditional statements to isolate all CRD HCUs and his failure to communicate with Control Room operators, the ineffective training of operators on the operating experience from the Japanese reactor events, and the inadequate review of the operating experience and failure to identify necessary procedure changes to DOP 0500-05.

However, the inspectors also noted that there were several performance issues that could have been considered in the licensees Safety Culture Evaluation that were not.

These included the failure to follow a systematic process when faced with an unexpected plant condition and deciding to un-isolate the HCUs without procedural guidance, the failure of Control Room operators to correctly respond when control rod positions on the Control Room Full Core Display changed state and annunciators were received, and the failure to appropriately correct the inadequate operating experience review after it was identified by the Nuclear Oversight Department one year prior to the event. Nonetheless, there is no regulatory requirement to complete this evaluation.

f. Findings

No findings of significance were identified.

02.03 Corrective Actions a. Determine that appropriate corrective actions are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary.

The inspectors reviewed applicable corrective actions and corrective actions to prevent recurrence and determined that the licensee specified reasonable/appropriate corrective actions for each root/contributing cause. The inspectors also reviewed implementation of the corrective actions to verify completion status.

The licensee completed two corrective actions to address the root cause. The first was to revise DOP 500-05 to provide administrative barriers to prevent the type of unplanned control rod withdrawal that occurred on November 3, 2008, and as described in previous operating experience documents. Secondly, the licensees Operating Experience Program was reviewed and restructured to create an OPEX review hierarchy that begins with a graded screening process based on significance/risk of the incoming OPEX, and continues with a rigorous evaluation process that includes departmental, inter-departmental and cross-discipline reviews, as well as MRC and NOS reviews of completed evaluations, and scheduled follow-up effectiveness reviews to ensure that actions have been properly implemented and institutionalized by the fleet.

To address the many contributing causes identified, the licensee initiated and completed numerous actions to:

(1) Revise several plant procedures related to operation of control rod drive components to provide/update administrative barriers, similar to those added to DOP 500-05, to prevent the type of unplanned control rod withdrawal that occurred on November 3, 2008, and as described in previous operating experience documents.

(2) Require peer checks by a second licensed operator and pre-job briefs of non-emergency actions that implement knowledge-based decisions within procedures.

(3) Implement administrative controls to ensure that Control Room operators are briefed on details of work/tests authorized by personnel external to the Control Room.

(4) Ensure that appropriate station/fleet personnel are trained on how to effectively utilize the Electronic Document Management System search capability.

(5) Ensure that training is provided to the appropriate station personnel that addressed the programmatic and process failures that lead up to the Dresden Station event; the physical phenomena that permitted withdrawal of the control rods; the human performance issues that allowed manipulation of components affecting reactivity without the knowledge of licensed operators at the controls in the Control Room, permitted untimely response to an alarm condition, and permitted actions to be taken that were not in accordance with approved written procedures; and the corrective actions that were taken to prevent recurrence.

(6) Conduct a sample review of significant operating experience documents, originally reviewed under the previous program, using the revised program to identify and, if necessary, implement any additional actions that may be required.

The inspectors concluded that appropriate corrective actions have been specified for each causal factor of the root cause. The inspectors also concluded that corrective actions for the identified contributing causes were appropriately identified with the exception of two actions initiated to address human performance issues involving Control Room operators.

(1) The licensee initiated a revision of the Control Room Operator Rounds to observe and record CRD system parameters every four hours in all modes of operation when a CRD pump is operating. While this action may allow operators to detect increasing trends in parameters such as cooling water differential pressure, the effectiveness of preventing a similar occurrence would be largely dependent upon when the indication was observed since it is only recorded every four hours.

The significant changes in cooling water pressure that resulted in unplanned control rod movement occurred over a matter of minutes. It is expected that Control Room operators should be continuously aware of operating system conditions.

(2) As discussed previously in Section 02.01.c, the licensee did not correctly address the issue of manipulating CRD system components without an approved written procedure. In response to the inspectors questions, the licensee wrote AR 01068608, acknowledging that what was documented in AR 01024479 and in the root cause evaluation did not restore compliance with the TS 5.4.1 requirement.

Because corrective actions taken to revise operating procedures to prevent the plant configuration that precipitated the inadvertent control rod withdrawal along with operator training would adequately address the compliance issue, no finding of significance was identified.

b. Determine that corrective actions have been prioritized with consideration of the risk significance and regulatory compliance.

The inspectors concluded that the licensee adequately prioritized the corrective actions with consideration of the risk significance and regulatory compliance. The licensees corrective actions appeared to be prioritized commensurate with the safety significance of the issues.

The corrective actions associated with the latent procedure errors in the CRD operating procedures were completed within a week of the unplanned control rod withdrawal, whereas the actions associated with the Operating Experience Program review and program changes were assigned a due date consistent with conducting the program evaluation, benchmarking to determine best practices, and developing and validating the program changes. Justification for changes to due dates (some shortened and some extended) were documented and commensurate with the significance of the issues being addressed as well as the level of effort required to complete the actions.

c. Determine that a schedule has been established for implementing and completing the corrective actions.

The inspectors determined that the licensee adequately established a schedule for implementing and completing the corrective actions.

The licensee assigned completion due dates that were commensurate with the significance of the issues being addressed as well as the level of effort required to complete the actions.

d. Determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

The inspectors determined that the licensee adequately developed quantitative or qualitative measures of success for determining effectiveness of the corrective actions to prevent recurrence.

The licensees Management Review Committee was in the process of reviewing two effectiveness reviews conducted by the Regulatory Assurance Department to evaluate the effectiveness of the changes to the Operating Experience Program. Additional reviews by the Nuclear Oversight Department were planned for later in the year.

Effectiveness actions to correct latent procedure errors and human performance issues will be measured by no unplanned control rod movements during evolutions that involve manipulation of components associated with the CRD system by operators outside the Control Room. At least one unit outage, that included isolation of control rod HCUs with CRD pumps running, has been completed without incident since the corrective actions were put into place.

e. Determine that the corrective actions planned or taken adequately address the Notice of Violation that was the basis for the supplemental inspection.

The inspectors concluded that the corrective actions planned or taken adequately addressed the Notice of Violation with one exception. The Notice of Violation identified five violations of NRC requirements associated with the Dresden Station event. The root cause evaluation and associated corrective actions satisfactorily addressed four of the five violations as follows:

(1) Violation of 10 CFR 50.54(j). Mechanisms which affected the reactivity of the reactor were manipulated without the knowledge and consent of a licensed operator or senior operator present at the controls. The licensee implemented administrative controls to ensure that licensed operators in the Control Room will be fully aware of the details of work/tests authorized by personnel external to the Control Room, and to require peer checks and pre-job briefs of non-emergency actions that implement knowledge-based decisions.

(2) Violation of Technical Specification 3.1.1. The licensee failed to initiate immediate actions to insert control rods with the shutdown margin < 0.38 k/k. Training was conducted by Operations Management for all licensed operators and senior operators stressing the importance of timely action when license conditions are not satisfied. The effectiveness of this action should be continuously evaluated as part of the Licensed Operator training programs.

(3) Violation of Technical Specification 5.4.1. Maintenance that affected the performance of the control rods, which are safety-related equipment, was performed in accordance with a written procedure that was not appropriate to the circumstances. DOP 500-05 and several other operating procedures, related to operation of CRD components, were revised to provide administrative barriers to prevent the type of unplanned control rod withdrawal that occurred on November 3, 2008, and as described in previous operating experience documents.

The effectiveness of these actions will be measured by no unplanned control rod movements during evolutions that involve manipulation of components associated with the CRD system by operators outside the Control Room. At least one unit outage, that included isolation of control rod HCUs with CRD pumps running, has been completed without incident since the corrective actions were put into place.

(4) Violation of Technical Specification 5.4.1. The Control Room operators failed to implement Section 4.3.2 of Procedure OP-AA-103-102, in that they did not aggressively investigate annunciators and alarms and did not accept the alarms as correct until demonstrated otherwise. Training sessions were conducted by Operations Management for all licensed operators and senior operators stressing the importance of accepting alarm conditions as valid until proven otherwise and aggressively following through with response to alarm conditions until the condition is corrected or proven to be invalid. The effectiveness of this action should be continuously evaluated as part of the Licensed Operator training programs.

(5) Violation of Technical Specification 5.4.1. The licensee failed to implement its written procedure that addressed the inability to drive control rods. The inspectors review of the licensees actions to address this violation is discussed in detail in Section 02.01.c. In response to the inspectors questions, the licensee wrote AR 01068608, acknowledging that what was documented in AR 01024479 and in the root cause evaluation did not restore compliance with the TS 5.4.1 requirement.

Because corrective actions taken to revise operating procedures to prevent the plant configuration that precipitated the inadvertent control rod withdrawal along with operator training would adequately address the compliance issue, no finding of significance was identified.

f. Findings

No findings of significance were identified.

40A5 Other

.1 (Closed) Violation 05000249/2009009-01, Inadvertent Control Rod Movement While

Shutdown The inspectors determined that the licensees root cause evaluation was conducted to a level of detail commensurate with the significance of the problem and reached reasonable conclusions as to the root and contributing causes of the event.

The inspectors also concluded that the licensee identified reasonable/appropriate corrective actions for each root and contributing cause and that the corrective actions appeared to be prioritized commensurate with the safety significance of the issues.

No other instances of the violations were identified. These violations are closed.

40A6 Meetings, Including Exit

.1 Exit Meeting Summary

The inspectors presented the inspection results to Mr. T. Hanley and other members of licensee management on May 14, 2010. The licensee confirmed that no proprietary information was reviewed during this inspection.

.1 Regulatory Performance Meeting

On May 14, 2010, the NRC met with the licensee to discuss its performance in accordance with IMC 0305, Section 10.02.b.4. During this meeting, the NRC and licensee discussed the issues related to the White finding that resulted in Dresden Nuclear Power Station, Unit 3, being placed in the Regulatory Response Column of the Action Matrix. This discussion included the causes, corrective actions, extent of condition, extent of cause, and other planned licensee actions.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

T. Hanley, Site Vice President

D. Hieggelke, Nuclear Oversight Performance Assessment Director

C. Kent, Operations Support Manager

D. Leggett, Regulatory Assurance Manager

S. Marik, Plant Manager

R. Radulovich, Nuclear Oversight Assessor

R. Ruffin, Regulatory Assurance Specialist

J. Tocco, Plant Engineering CRD System Manager

LIST OF ITEMS

Opened

None

Closed

05000249/2009009-01 VIO Inadvertent Control Rod Movement While Shutdown (Section 40A5)

Discussed

None Attachment