IR 05000249/2009009

IR 05000249-09-009; on 05/08/2009 - 07/15/2009; Dresden Nuclear Power Station, Unit 3; Problem Identification and Resolution

ML092320164
Person / Time
Site:	Dresden
Issue date:	08/19/2009
From:	West K S Division Reactor Projects III
To:	Pardee C G Exelon Generation Co
References
EA-09-172 IR-09-009
Download: ML092320164 (26)

Text

August 19, 2009

EA-09-172 Mr. Charles Senior Vice President, Exelon Generation Company, LLC President and Chief Nuclear Officer (CNO), Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

SUBJECT: DRESDEN NUCLEAR POWER STATION, UNIT 3 INADVERTENT CONTROL ROD WITHDRAWAL, 05000249/2009009

Dear Mr. Pardee:

On July 15, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Dresden Nuclear Power Station, Unit 3. The enclosed report documents the inspection findings, which were discussed on July 15, 2009, with members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspector reviewed selected procedures and records, observed activities, and interviewed personnel. The enclosed report presents the results of this inspection including a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance that may require additional NRC inspections. As described in Section 4OA2 of this report, the finding involves a November 3, 2008, inadvertent and uncontrolled control rod withdrawal resulting from non-licensed operators performing maintenance activities without the involvement of licensed operators at the controls. Our inspection revealed that there were several opportunities to prevent this occurrence had the station properly evaluated and incorporated lessons learned from operating experience and had operations personnel aggressively pursued indications in the control room and in the field. We are concerned about the lack of questioning attitude demonstrated by the licensed and non-licensed operators and supervisors, the poor integration of operating experience into plant procedures and practices, and the poor coordination between the individuals working on the control rod drive system and the control room. After the finding was self-revealed, the control rods were returned to the full-in position to ensure there was no immediate safety concern and you implemented corrective actions, including conducting a prompt investigation. This finding was assessed based on the best available information, using the applicable Significance Determination Process (SDP). The final resolution of this finding will be conveyed in separate correspondence. Preliminarily, we consider this a self-revealed finding having low to moderate safety significance based on a qualitative assessment. The significance is driven by human performance issues, which created a potential for an inadvertent localized criticality. Although the event itself did not result in an inadvertent local criticality or fuel rod damage, deficiencies associated with the event demonstrated a lack of questioning attitude, acceptance to not follow established procedures, poor coordination of activities, and inadequate evaluation of operating experience. Accordingly, the finding is also associated with five apparent violations of NRC requirements specified by 10 CFR 50.54(j), Technical Specification 3.1.1, and Technical Specification 5.4.1. In accordance with NRC Inspection Manual Chapter (IMC) 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The SDP encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staff's final determination. Before the NRC makes a final decision on this matter, we are providing you an opportunity to: (1) attend a Regulatory Conference where you can present to the NRC your perspectives on the facts and assumptions the NRC used to arrive at the finding and its significance; or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation at least 1 week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation and a press release will be issued to announce it. If you decide to provide a written response in lieu of the Regulatory Conference, the submission should be sent to the NRC within 30 days of the receipt of this letter. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisites and Limitations Section of Attachment 2 of IMC 0609. Please contact Mark Ring at (630) 829-9703 within 10 days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence. Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of violations described in the enclosed inspection report may change as a result of further NRC review. If you decide to provide a written response in lieu of the Regulatory Conference, the submission should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission - Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector Office at the Dresden Nuclear Power Station. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)

component of NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA by Gary L. Shear, Acting For/

K. Steven West, Director Division of Reactor Projects

Docket No. 50-249 License No. DPR-25

Enclosure:

Inspection Report 05000249/2009009

w/Attachments:

1. Supplemental Information 2. Appendix M - Table 4.1 cc w/encl: Site Vice President - Dresden Nuclear Power Station Plant Manager - Dresden Nuclear Power Station Manager Regulatory Assurance - Dresden Nuclear Power Station Senior Vice President - Midwest Operations Senior Vice President - Operations Support Vice President - Licensing and Regulatory Affairs Director - Licensing and Regulatory Affairs Manager Licensing - Clinton, Dresden, and Quad Cities Associate General Counsel Document Control Desk - Licensing Assistant Attorney General J. Klinger, State Liaison Officer, Illinois Emergency Management Agency Chairman, Illinois Commerce Commission

SUMMARY OF FINDINGS

IR 05000249/2009-009; 05/08/2009 - 07/15/2009; Dresden Nuclear Power Station, Unit 3; Problem Identification and Resolution. This report covers an inspection by a regional inspector. One preliminary White finding associated with five apparent violations was self-revealed. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006. The alphanumeric references to cross-cutting aspects are described in IMC 0305,

"Operating Reactor Assessment Program."

Cornerstone: Mitigating Systems

• Preliminary

White.

A finding that has preliminarily been determined to be White, a finding with low to moderate safety significance, was self-revealed on November 3, 2008, when the licensee failed to prevent inadvertent and uncontrolled control rod withdrawal by non-licensed operators. After the finding was self-revealed, the control rods were returned to the full-in position to ensure there was no immediate safety concern and the licensee implemented corrective actions, including conducting a prompt investigation. The finding is also associated with five apparent violations of NRC requirements specified by 10 CFR 50.54(j), Technical Specification 3.1.1, and Technical Specification 5.4.1. The performance deficiency was determined to be more than minor because licensed operators did not maintain configuration control of the control rods when non-licensed operators were able to inadvertently cause control rods to move. Because probabilistic risk assessment tools were not well suited for this finding, the criteria for using IMC 0609, Appendix M, "Significance Determination Process Using Qualitative Criteria," were met. Based on the additional qualitative circumstances associated with this finding, regional management concluded the finding was preliminary low to moderate safety significance (preliminary White). The performance deficiency was determined to have resulted from several causes; however, the primary cause was determined to involve the ineffective use of operating experience. This finding has a cross-cutting aspect in the area of problem identification and resolution, operating experience, because the licensee did not effectively implement and institutionalize operating experience through changes to station processes, procedures, and training programs. (P.2(b)) (Section 40A2)

REPORT DETAILS

4OA2 Identification and Resolution of Problems

Cornerstone: Mitigating Systems

.1 Selected Issue Follow-Up Inspection:

Inadvertent Control Rod Movement while Shutdown

a. Scope

Unresolved item (URI)05000249/2008005-04, Inadvertent Control Rod Withdrawal, was opened in the fourth quarter 2008 Integrated Inspection Report pending review and evaluation of the licensee's root cause report. During this inspection, the inspector reviewed additional information regarding the circumstances and activities surrounding the November 3, 2008, unplanned control rod withdrawal event. The List of Documents Reviewed is provided in Attachment 1 to this report.

This review did not represent an inspection sample.

b. Findings

Introduction:

A finding of preliminary low to moderate safety significance (preliminary White) and five associated apparent violations of 10 CFR 50.54j, Technical Specification (TS) 3.1.1, and TS 3.5.4 were self revealed when non-licensed operators performing maintenance activities caused inadvertent control rod movement.

Description:

Event Specifics - On November 3, 2008, Unit 3 was in day 1 of the D3R20 refueling outage and the operations department was performing multiple tasks to support removing systems from service. The plant was shut down with all control rods fully inserted into the core. One of the scheduled tasks was alignment of the control rod drive (CRD) system in preparation for hydro-lazing the Unit 3 scram-discharge volume; however, the task did not have a specific starting time assigned. Non-licensed operators (NLOs) were in the process of isolating the CRD mechanisms per two clearance orders (COs) that directed using Dresden Operating Procedure (DOP) 0500-05, "Discharging of CRD Accumulators with Mode Switch in Shutdown or Refuel," when a control rod drift alarm was received in the control room at about 10:19 a.m. Over the next few minutes, multiple rod position indication system (RPIS) indications went to green double-dashes (- -), indicating the control rod had slightly inserted beyond the full-in

(00) position. The reactor operators notified the control room supervisor. Ensuing discussion between these individuals and the operations staff supervisor reached the opinion that instrument maintenance staff were probably working on another scheduled task on the rod position indication system (RPIS) in the auxiliary electrical equipment room (AEER) and may have caused an interruption in the RPIS indications. The operations staff supervisor was to be dispatched to the AEER to determine if the work there had disrupted the RPIS indication.

3 Enclosure Over about 21 minutes, seven control rod indications sequentially went to over-travel in. Four of the rods settled back to position 00; however, three control rods indicated having continued moving from the full-in position to out of the core (D-7 to position 06, E-7 to position 18, and E-6 to position 16). Until the three control rods indicated outward movement, the reactor operators had not recognized that the seven affected control rods were actually moving and had not taken any action to prevent possible outward rod motion. Once the control room operators realized that three control rods had actually moved out from the full-in position, they entered TS 3.1.1, Condition D, "SDM [shutdown margin] not within limits in Mode 4;" Procedure DOA 0300-12, "Mispositioned Control Rod;" referenced DGA 7, "Unexpected Reactivity Addition;" and attempted to drive the control rods back into the full-in position -- without success because all CRDs had been isolated when the last rod stopped moving. Additionally, the operators stopped multiple COs involving the CRDs, verified no work was in progress on RPIS and notified the qualified nuclear engineer. After being informed of the inadvertent rod withdrawal, the shift manager remembered reviewing operational experience on other inadvertent rod movements. Subsequent investigation revealed that the control rods had drifted due to increasing differential pressure between the cooling and/or exhaust water pressure and reactor pressure when the NLOs had sequentially shut the insert riser isolation valve (101) and the withdraw riser isolation valve (102) to each CRD hydraulic control unit (HCU), restricting the available flow path for the 25 gallons per minute cooling water flow. Operations department staff returned the three control rods to full-in by directing NLOs in the field to open the related 101 valve until the control rod moved in to the over-travel position. When the related 101 valve was re-shut, each of the control rods settled to the full-in position.

Operating Experience (OPEX) - The licensee completed a Prompt Investigation Report on this event (AR 839678839678 and determined that OPEX existed for this event. Specifically, OPEX dated April 10, 2007, detailed historical events at several boiling water reactors (BWRs) in Japan between 1978 and 2000 where single or multiple control rods unexpectedly moved out of the core without a deliberate withdrawal signal. The reactor had become critical at two plants, one of which had the reactor vessel head removed. The OPEX was caused by the same type of manipulations of CRD HCU valves with a control rod drive pump running as occurred during this event at Dresden on November 3, 2008.

The key lessons from the OPEX were:

(1) The isolation of multiple hydraulic control units (HCUs) with the control rod drive pumps in operation can cause higher-than-normal cooling and exhaust header pressures that may be a precursor to inadvertent rod motion (insert or withdraw) if a sufficient number of HCUs are not in service or if alternate system flow paths are not established.

(2) Station procedures should specify the minimum number of HCUs to be kept in service while the control rod drive pump is in service, to prevent inadvertent control rod movement when HCUs are being isolated and restored, particularly during outage conditions.

(3) Reactor operators should monitor control rod drive system pressures, rod positions, and alarms during outages when the system is being manipulated to identify changing conditions that could lead to inadvertent control rod movement.

4 Enclosure

(4) Personnel who operate valves to isolate and restore HCUs should be aware that their actions directly affect control rod drive system pressures that can lead to inadvertent control rod movement.

When the OPEX was originally received at Dresden in 2007, the HCU system manager and an operations technical superintendent performed a subject-matter expert review of the OPEX under Action Tracking Item (ATI) 616696-04. This ATI identified that the phenomena of inadvertent rod withdrawal could happen at Dresden and a search was conducted for procedures that might be affected by the OPEX. The "300 series" procedures on the control rod drive system were identified by the search. A qualified nuclear engineer (QNE) also reviewed the OPEX; however, the QNE stated that it was unlikely that he would have reviewed any operations procedures independent of the one series of procedures identified in ATI 616696-04 because he was not an operations procedures expert. The licensee incorporated the OPEX information into the "300 Series" procedures on the control rod drive system, specifically, to monitor the cooling and exhaust header pressures every 10 HCUs after 50 HCUs had been isolated (Dresden Unit 3 has 177 control rods and associated HCUs). This change was intended to alert operators to the potential increase in pressure in the CRD system so that operators could take actions to reduce pressure and avoid an unplanned control rod withdrawal event. However, the inspector determined the licensee had not reviewed all procedures that isolated the HCUs. Specifically, the OPEX information was not entered into the "500 Series" procedures that applied to the reactor protection system and no changes were made to these procedures to reflect the OPEX lessons learned. These "500 series" procedures could also be used to isolate HCUs. During the performance of the clearance order to drain the HCU accumulators on November 3, 2008, the non-licensed operators were using a "500 series" procedure, DOP 500-05, "Discharging CRD Accumulators with Mode Switch in Shutdown or Refuel," Revision 5, when the last three control rods, (D-7, E-7, and E-6) moved out of the core to positions 06, 18, and 16.

In addition to the OPEX review for procedure changes, the licensee also provided "just-in-time" (JIT) training on the OPEX for all operators prior to the Unit 2 refueling outage in the Fall of 2007. The inspector reviewed the JIT training that had been provided on the OPEX before the previous outage in 2007 and found that it consisted of 4 of 78 pages in a PowerPoint presentation. The pages repeated the four key points from the OPEX, but there was minimal discussion about the consequences of isolating all the HCUs with a rod drive pump running. The inspector concluded that the OPEX training in 2007 was ineffective in preventing the inadvertent rod withdrawal event in 2008, in that, none of the involved individuals recalled the OPEX training sufficiently in time to prevent the event.

Licensee Reviews and Analyses - The licensee analyzed the shutdown margin for several possible conditions and concluded that the reactor would have remained subcritical assuming actual temperature and xenon conditions regardless of the position of the three control rods. However, the licensee determined that, assuming the design shutdown margin (actual rod pattern plus one rod full out, 68° Fahrenheit (F), and zero xenon), the reactor would have been critical. In addition, the inspector noted that the licensee did not analyze the shutdown margin assuming the three rods drifted to full out at cold conditions. The licensee also determined the reactor would have been critical under those conditions.

5 Enclosure The temperature of the reactor coolant, the condition of the seals and orifices in the HCUs, the amount of xenon in the core, the order in which the control rod mechanisms were isolated, the pressure in the control rod drive system, and the time (between shutting the insert valve and shutting the withdraw valve) were key parameters for this event. The procedure in use, DOP 500-05, did not control any of these parameters.

Subsequent to initial inspection activities, the inspector reviewed the initial version (the licensee subsequently revised the report) of the licensee's Root Cause Investigation, No. 839678-08, and found it to be a detailed, systematic report that provided an in-depth discussion of certain aspects of the event. In particular, the Root Cause Report described the detailed workings of the control rod drive system and how the conditions of normal control rod withdrawal were inadvertently replicated. The Root Cause Report carefully examined the details of the inadequacies in procedure DOP 500-05 and how the OPEX came to be ineffectively incorporated into Dresden procedures. The report concluded that procedure DOP 500-05 was deficient even before the OPEX was received because the procedure allowed operation of the CRD pump with all downstream flow paths isolated which could result in excessive cooling water pressure and possible unplanned rod movement. This possibility was acknowledged in Dresden Annunciator procedure DAN 902(3)-5 A-3, "Rod Drift," which lists a probable cause as excessive cooling water pressure. The licensee's Root Cause Report attributed the root cause of the Dresden unplanned control rod withdrawal to latent procedure deficiencies in DOP 500-05 that were not identified during the OPEX review. However, the Root Cause Report was largely silent regarding the manipulation of apparatus and mechanisms other than controls, which may affect reactivity without the knowledge and consent of a licensed operator at the controls and provided little discussion of the loss of shutdown margin required by TS 3.1.1.

The inspector agreed with the Root Cause Report's primary root cause of the use of an inadequate procedure, DOP 500-05, exacerbated by inadequate incorporation of operating experience. The root cause investigation revealed a latent organizational weakness in the company-wide procedure, LS-AA-115, "Operating Experience," used for evaluating and incorporating operating experience into station actions, in that the method of searching available data bases was not specified. The results were very dependent on the search parameters and on who reviewed the proposed change. At Dresden, the search for procedures potentially affected by the OPEX relating to inadvertent control rod withdrawal was inadequate, in that, the "500 series" procedures were not revealed by the search.

The inspector did not agree with the initial Root Cause Investigation's conclusion, "No MCR [main control room] personnel human performance deficiencies or inappropriate actions were identified." The inspector reviewed the alarm procedures, the conduct of operations procedure, the watch standing practices procedure, and the operators' training and found that the main control room operators had failed to act in accordance with their training and procedures and did not take appropriate action to discover the reason(s) for the rod over-travel alarms until after the three control rods had actually moved partially out of the core. Interviews with the operators involved revealed that there was a mind set of "the reactor is shutdown with all control rods fully inserted; therefore, nothing can happen." Consequently, when the over-travel alarms actuated and later the three rods began to move out, the operators did not believe the indications of rod movement and did not take any actions to stop further rod movement. Rather, the control room operators believed the alarms were an indication problem and dispatched 6 Enclosure an individual to check on possible work on the rod position indication system. The interviews also revealed that the shift manager was the only person in the control room that recalled any of the "just-in-time" training related to the OPEX and the understanding that any manipulation of CRD valves could potentially result in control rod movement. The shift manager had entered the control room just after the third control rod had moved out of the core. Additionally, the interviews revealed that the control room operators were not in communication with the NLOs who were isolating CRDs and did not try to establish communication via the plant announcing system when the indications started to change; did not follow the rod-drift alarm annunciator procedure and check the cooling water pressure; and did not take any actions to prevent outward rod motion (insert a SCRAM signal) until after the three rods had completed partially withdrawing out of the core. One reactor operator in the control room, but not directly involved with the event, had suggested inserting a SCRAM signal, but the suggestion had not been acted on before the CRDs were fully isolated and the control room had no further control of the CRDs.

The inspector reviewed the licensee's risk review for the planned work during the D3R20 refueling outage and found that a shutdown risk review had been performed in accordance with procedure OU-DR-104, "Shutdown Safety Management Program."

The Dresden plant oversight review committee (PORC) meeting minutes, dated October 21, 2008, detailed the PORC discussion of "D3R20 Shutdown Safety Review, PORC #08-061," which included the schedule for discharging the HCU accumulators. The shutdown safety review did not note any Yellow or Orange risk windows or any High Risk Activities for the Reactivity Control Key Safety Function during the D3R20 outage.

However, the scheduled activities and hence the risk review did not consider that all of the CRD HCUs were going to be isolated because the activity of isolating the CRD HCUs was not scheduled. Instead, the Work Execution Center (WEC) supervisor, who was directing the activity of discharging the HCU accumulators, expanded the scope of scheduled activities and directed the isolation of all of the HCUs to prevent a buildup of nitrogen. This action was allowed by an optional procedure step in DOP 500-05 that stated, "Closing the 101 and 102 [valves] will limit migration of nitrogen into the HCU piping. This will shorten subsequent venting of [CR] drives after restoration." As a result, the licensee's risk review determined that shutdown margin was expected to remain > 0.38 k/k at all times during D3R20. If the licensee had performed a risk assessment with the control rods at other than full-in, it would have shown increased risk.

The WEC supervisor also discussed the isolation of all of the HCUs in the pre-job briefing. The inspector found that the control room operators were not a part of the pre-job briefing for hanging the clearance order (CO) tags and had not been informed that the work to hang the CO tags had started. During the pre-job briefing, the WEC supervisor, who was directing the CRD activities and conducting the pre-job brief, did not discuss any reactivity-management concerns, potential and/or actual impact, or contingencies. Results of interviews did not reveal any overt search for OPEX related to isolating all of the HCUs. The change of work scope by the WEC supervisor to isolate the HCUs represented an opportunity to reconsider the potential for affecting reactivity and, therefore, the need to involve the control room operators in the briefing.

The inspector's interviews with the NLOs that isolated the last of the CRDs revealed that the NLOs had noted increased resistance to turning the valves and increased flow noises; however, the NLOs had not stopped to investigate the reason(s) for these 7 Enclosure anomalies. The NLOs attributed the resistance to personal fatigue and "pressed on" to complete the clearance order. Similar to the control room operators, the NLOs did not recall the possibility of inadvertent rod movement from just-in-time training (JIT) on the OPEX conducted in the Fall of 2007, either. The inspector also reviewed the licensee's qualitative risk assessment, which presented a case that only five control rods had moved to the over-travel position; therefore, no more than three control rods could have drifted out of the core. This information was based on only five over-travel indications on the rod position indication portion of the plant computer print out and on "fitting" a pressure increase curve to the assumed pressure values for rod movement. At the time of the event, the computer was marking rod positions at 10 minute intervals. If a rod had gone to over-travel and subsequently moved back to full-in between computer scans, it would not have registered. The licensee agreed that more rods could have been in over-travel between the first alarm and the first time the computer made a recording of the rod positions. The pressure increase curve that the licensee developed was a reasonable approximation, but was based entirely on pressures in the CRD system before and after the event, since no pressures were recorded or checked during the event, and the design pressures required to move and withdraw the control rods. As a result, pressures could have been greater than the licensee's developed curve and the increases could have occurred earlier in the event. From interviews with the control room operators, the inspector concluded that seven rods had moved to over-travel based on comparing a core map to the location of the alarm lights that illuminated. The inspector also concluded that more than three control rods could have moved out of the core if the initial conditions and equipment material conditions had been different. The inspector determined that the control rods would have continued moving out continuously until the 102 valve to the related HCU was closed. Therefore, the inspector concluded it was possible that the three (or more) control rods could have moved to full out - position 48.

Analysis:

In accordance with NRC IMC 0612, Appendix B, "Issue Screening," the inspector determined that the licensee's failure to prevent inadvertent control rod withdrawal by non-licensed operators was a failure to meet a regulatory requirement. Additionally, the licensee was previously notified via OPEX that isolation of multiple hydraulic control units with the control rod drive pumps in operation could result in inadvertent rod motion and during the event operators received an alarm indicating unexpected control rod drift. As a result, the inspector determined that the inadvertent control rod movement was within the licensee's ability to foresee and correct, therefore, the issue of concern was considered a performance deficiency. The performance deficiency did not meet the conditions requiring traditional enforcement. The performance deficiency was determined to be more than minor because it is associated with the configuration control attribute and adversely affects the Mitigating Systems Cornerstone objective to ensure the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, licensed operators did not maintain configuration control of the control rods when non-licensed operators were able to inadvertently cause control rods to move and the ability of control room operators to scram the control rods was lost when all of the HCUs were isolated. Therefore, the performance deficiency is a finding.

This finding was screened using the SDP in accordance with IMC 0609, "Significance Determination Process," Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," Table 3b. Because the finding affects the safety of the 8 Enclosure reactor during shutdown conditions, IMC 0609 Appendix G, "Shutdown Operations Significance Determination Process," was reviewed. The appropriate phase 1 checklist for the plant operating state is Checklist 6, "BWR Cold Shutdown or Refueling Operation, Time to Boil < 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, RCS level < 23' above the top of flange." However, this checklist does not include any criteria to assess findings affecting reactivity control. Therefore, phase 1 evaluation could not be completed using Appendix G.

The Shutdown SDP phase 2 worksheets were reviewed for any risk insights to address this finding. The worksheets address loss of residual heat removal (RHR), loss of offsite power (LOOP), and loss of inventory (LOI) events. Reactivity control issues are not modeled as an initiating event or as a loss of a mitigating function. Therefore, a phase 2 evaluation could not be completed.

As a result, the inspector requested assistance from a Region III Senior Risk Analyst (SRA). The SRA concluded that there were no existing probabilistic risk assessment tools or data to perform a quantitative estimate of the change in core damage frequency for this finding. Therefore, the inspector and SRA determined that existing SDP and IMC 0609 Appendix G guidance is not appropriate to provide reasonable estimates of the finding's significance. Because probabilistic risk assessment tools were not well suited for this finding, the criteria for using IMC 0609, Appendix M, "Significance Determination Process Using Qualitative Criteria," were met.

Based on the additional qualitative circumstances associated with this finding, regional management concluded the finding was preliminary low to moderate safety significance (preliminary White). The completed Appendix M table is attached.

The inspector determined that the performance deficiency resulted from several causes; however, the primary cause was determined to involve the ineffective use of operating experience. This finding has a cross-cutting aspect in the area of problem identification and resolution, operating experience, because the licensee did not effectively implement and institutionalize operating experience through changes to station processes, procedures, and training programs. Specifically, the licensee did not identify and revise all of the appropriate procedures pertaining to isolation of CRD HCUs and did not effectively train individuals on the lessons learned from industry operating experience. P.2(b)

Enforcement:

The inspector identified the following apparent violations: a. Technical Specification 5.4.1, "Administrative Controls," requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide (RG) 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Appendix A, Paragraph 4, "Procedure for Startup, Operation, and Shutdown of Safety-Related BWR Systems," states, in part, that instructions for energizing, filling, venting, draining, startup, shutdown, and changing modes of operation should be prepared, as appropriate, for systems, including the control rod drive system.

9 Enclosure Regulatory Guide 1.33, Appendix A, Paragraph 9, "Procedures for Performing Maintenance," item (a), states, in part, that maintenance that can affect the performance of safety-related equipment should be properly preplanned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances.

Contrary to the above, on November 3, 2008, maintenance that affected the performance of the control rods, which are safety-related equipment, was performed in accordance with a written procedure that was not appropriate to the circumstances. Specifically, the maintenance activity used procedure DOP 0500-05, "Discharging CRD Accumulators with Mode Switch in Shutdown or Refuel," Revision 5, a procedure prepared in accordance with Regulatory Guide 1.33, Appendix A, Paragraph 4, to isolate each of the 177 HCU accumulators. This procedure was not appropriate to the circumstances, in that, the procedure did not contain any guidance regarding monitoring of CRD system pressure, did not contain any guidance for ensuring the control room operators were aware of the CRD accumulator activities, did not contain any precautions that the manipulation of hydraulic control unit (HCU) valves could affect reactivity, and did not specify how many HCUs could be isolated or whether a control rod drive pump should be operating. As a result, isolating all of the HCUs in accordance with the procedure caused the inadvertent withdrawal of three control rods.

b. Title 10 CFR 50.54(j) requires, "Apparatus and mechanisms other than controls, the operation of which may affect the reactivity or power level of a reactor, shall be manipulated only with the knowledge and consent of an operator or senior operator, licensed pursuant to part 55 of this chapter [10CFR] present at the controls." Contrary to the above, on November 3, 2008, mechanisms other than controls, which affected the reactivity of the reactor, were manipulated without the knowledge and consent of a licensed operator or senior operator present at the controls. Specifically, non-licensed operators manipulated the control rod drive system hydraulic control unit insert riser isolation valves and the withdraw riser isolation valves, an action which affected the reactivity of the reactor in that the valve manipulations caused three control rods, D-7, E-7, and E-6 to move out of the core to positions 06, 18, and 16, respectively. The valve manipulations were accomplished without the knowledge and consent of a licensed operator or senior operator present at the controls.

c. Technical Specification 3.1.1 requires, in part, that the shutdown margin shall be 0.38 k/k, with the highest worth control rod analytically determined, or 0.28 k/k, with the highest worth control rod determined by test.

The Shutdown Margin is defined in Technical Specification Bases, Section 1.1, as the amount of reactivity by which the reactor is subcritical assuming xenon free, temperature of 68°F, highest worth rod fully withdrawn and accounting for the reactivity worth of any rods not fully inserted.

Technical Specification 3.1.1, Action statement D, requires, in part, that if the shutdown margin is not within limits in Mode 4, then initiate action to fully insert all insertable rods immediately.

10 Enclosure Contrary to the above, on November 3, 2008, with the reactor in Mode 4, the shutdown margin was not 0.38 K/K or > 0.28 K/K and the control room operators could not immediately insert control rods. Specifically, based on the defined shutdown margin conditions of xenon free, temperature of 68°F, highest worth rod fully withdrawn and accounting for the reactivity worth of the actual control rod pattern, the reactor would have been critical.

d. Technical Specification 5.4.1, "Administrative Controls," requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Appendix A, Paragraph 1, "Administrative Procedures" lists "Authorities and Responsibilities for Safe Operation and Shutdown" as a subject which required a written procedure.

Procedure OP-AA-103-102, "Watch Standing Practices," Revision 8, was the implementing procedure for ensuring authorities and responsibilities for safe operation and shutdown. Section 4.3.2 of procedure OP-AA-103-102 requires operators to aggressively investigate annunciators and alarms to fully understand the reason for any alarm that comes in and to accept all alarms as correct until demonstrated otherwise.

Contrary to the above, on November 3, 2008, control room operators failed to accept multiple rod-drift alarms as correct until demonstrated otherwise and did not aggressively investigate the alarms until after three control rods had moved partially out of the full-in position.

e. Technical Specification 5.4.1, "Administrative Controls," requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Appendix A, Paragraph 6, "Procedures for Combating Emergencies and Other Significant Events," lists "Inability to Drive Control Rods" as a subject which required a written procedure.

Contrary to the above, on November 3, 2008, the licensee did not have a specific procedure addressing the inability to drive control rods and failed to use (or change before use) any existing procedure(s) which addressed stuck or drifted control rods. Specifically, the control room operators verbally directed non-licensed operators to open the affected HCU insert valves out-of-sequence for each control rod that had been withdrawn in order to cause the control rod to insert into the core, and then to re-shut the valve. Although these actions were successful in inserting the withdrawn control rods, the actions were not in accordance with any approved procedure.

Following identification of the inadvertent rod withdrawal, the licensee documented the condition; initiated a root cause review (RCR 839678-08);

and instituted corrective measures, including revising the corporate and station OPEX review procedures; incorporating the OPEX into all affected station procedures; re-training all operations personnel on the OPEX and the event; revising procedures with "knowledge-based 11 Enclosure steps" to require a peer review and notifying control room personnel of the proposed actions before proceeding; re-emphasizing the use of a questioning attitude in all actions; and reviewing all "canned" pre-job briefs to ensure that applicable OPEX is included. Pending determination of final safety significance, this finding with the associated apparent violations will be tracked as AV 05000249/2009009-01, Inadvertent Control Rod Movement While Shut Down.

4OA5 Other Activities

(Closed) Unresolved item (05000249/2008005-04) Inadvertent Control Rod Withdrawal.

This item is discussed in Section

4OA2 of this report.

The inspector identified a finding with several violations. This URI is closed.

4OA6 Management Meetings

.1 Exit Meeting Summary

On July 15, 2009, the inspector presented the inspection results to Mr. Tim Hanley and other members of the licensee staff. The licensee acknowledged the issues presented. The inspector confirmed that none of the potential report input discussed was considered proprietary.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

T. Hanley, Site Vice President

S. Marik, Station Plant Manager

J. Griffin, Regulatory Assurance - NRC Coordinator

D. Gronek, Operations Director

J. Hansen, Corporate Licensing

L. Jordan, Training Director

D. Leggett, Nuclear Oversight Manager

R. Rybak, Regulatory Assurance

S. Taylor, Regulatory Assurance Manager

S. Vercelli, Work Management Director

NRC

M. Ring, Chief, Division of Reactor Projects, Branch 1

J. Benjamin, Project Engineer

IEMA

R. Zuffa, Illinois Emergency Management Agency

R. Schulz, Illinois Emergency Management Agency

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened:

05000249/2009009-01 AV Inadvertent Control Rod Movement While Shutdown

Closed:

05000249/2008005-04 URI Inadvertent Control Rod Withdrawal

Attachment 1

LIST OF DOCUMENTS REVIEWED

The following is a list of documents reviewed during the inspection.

Inclusion on this list does not imply that the NRC s reviewed the documents in their entirety, but rather, that selected sections of portions of the documents were evaluated as part of the overall inspection effort.

Inclusion of a document on this list does not imply NRC acceptance of the document or any part of it, unless this is stated in the body of the inspection report. Section 4OA2

AD-AA-101-1002, Writers Guide and Process Guide for Procedures and T&RM, Revision 12; ANSI/ANS-3.2-1988, Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants; ANSI/ANS-3.2-2006, Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants; ANSI/ASME

NQA-1-1986, Quality Assurance Program Requirements for Nuclear Facilities;

AR 839678839678 U3 Multiple Control Rods Unexpectedly Withdraw During D3R20, November 3, 2008;

AR 886381886381 Evaluate CRD Rod Drift against 10

CFR 50.54(I) & (J) Criteria, February 27, 2009;

ATI 616696-16, INPO

SEN 264 Unplanned BWR CR Withdrawals/SC07-08, GE Safety Communication;

BWROG-TP-07-020, Inadvertent Control Rod Drive (CRD) Withdrawal, Revision 0;

DOA 0300-05, Inoperable or Failed Control Rod Drives, Revision 23;

DOA 0300-12, Mispositioned control Rod, Revision 13;

DOP 0300-01, Control Rod Drive System Start Up and Operation, Revision 38;

DOP 0500-04, Inserting a Manual SCRAM or Placing Reactor Mode Switch to Shutdown When All CRDs Are Fully Inserted, Revision 8;

DR-108-101-1002, Operations Department Standards and Expectations, Revision 15; Dresden Station Corrective Action Program Audit Report, April 2 - 13, 2007; Dresden Station Corrective Action Program Audit Report, March 14, 2008; Emergency Preparedness Audit

NOSA-DRE-08-03,

AR 706480706480Dresden Station, April 28 through May 2, 2008;

GE 10 CFR Part 21 Communication

SC 07-08: Inadvertent CRD Rod Withdrawal, October 10, 2007;

Attachment 1

HU-AA-1211, Briefings - Pre-Job, Heightened Level of Awareness, Infrequent Plant Activity, and Post-Job Briefings; Revision 3; Information Notice No. 88-21, Inadvertent Criticality Events at Oskarshamn and at U.S. Nuclear Power Plants, May 9, 1988;

LS-AA-125-1001, Attachment 13, Root Cause Report, "Dresden U3 Unplanned Rod Withdrawal Resulting from Latent

DOP 0500-05, Revision 5 Procedure Deficiencies Not Identified during the Operating Experience (OPEX) Review per

LS-AA-115, titled Operating Experience Procedure," Revision 1;

NO-AA-10, Quality Assurance Topical Report, Revision 81;

OP-AA-103-102, Watch-Standing Practices, Revision 8;

OP-AA-103-103, Operation of Plant Equipment, Revision 0;

OP-DR-108-101-1002, Operations Department Standards and Expectations, Revision 10

Attachment 1

LIST OF ACRONYMS

USED [[]]

AEER Auxiliary Electrical Equipment Room

ATI Action Tracking Item

BWR Boiling Water Reactor

CAP Corrective Action Program

CFR Code of Federal Regulations

CO Clearance Order

CRD Control Rod Drive F Fahrenheit

DRP Division of Reactor Projects

HCU Hydraulic Control Unit

IMC Inspection Manual Chapter

IP Inspection Procedure

IR Inspection Report

JIT Just-in-time

LOI Loss Of Inventory

LOOP Loss Of Offsite Power

NEI Nuclear Energy Institute

NRC [[]]

U.S. Nuclear Regulatory Commission

NLO Non-Licensed Operator

OPEX Operating Experience

PORC Plant Oversight Review Committee PI&R Problem Identification and Resolution

psig Pounds Per Square Inch Gauge

QNE Qualified Nuclear Engineer

RCS Reactor Coolant System

RFO Refueling Outage

RG Regulatory Guide

RHR Residual Heat Removal

RPIS Rod Position Indication System

SDP Significance Determination Process

SRA Senior Risk Analyst

TS Technical Specification

UFSAR Updated Final Safety Analysis Report

URI Unresolved Item

WEC Work Execution Center WO Work Order

Attachment

2 APPEND IX M -

TABLE 4.1 Qualitative Decision-Making Attributes for

NRC Management Review 1. The

SDP is the preferred path for determining the significance of findings in the Reactor Oversight Process. 2.

IMC 0609 Appendix M is provided for use when the existing

SDP guidance is not adequate to provide a reasonable estimate of the significance. 3.

IMC 0609 Appendix M could be used for this case. Appendix M utilizes a qualitative significance determination process focused on the below table where 5 of 8 attributes would have some level of applicability: Decision Attribute Applicable to Decision? Basis for Input to Decision - Provide qualitative and/or quantitative information for management review and decision making. Finding can be

bounded using

qualitative and/or quantitative information? Yes The shutdown safety significance determination process, IMC 0609 Appendix G, does not address findings

involving the shutdown safety function of reactivity control. As a result, no quantitative risk evaluation can be performed for this finding. Defense-in-Depth

affected? N/A Performance Deficiency effect on the Safety

Margin maintained?

Yes The TS shutdown margin was exceeded during this event. In the actual event, the core remained subcritical by 4.5 percent. If all three rods affected were fully withdrawn

from the core, the reactor would have been subcritical by 3.1 percent. A bounding assessment performed by the licensee showed that under cold, xenon-free conditions, a local criticality would have resulted if the three control rods had withdrawn fully from the core. The extent the

performance deficiency affects other equipment. N/A Degree of degradation of failed or unavailable component(s) N/A

Attachment 2 Decision Attribute Applicable to Decision? Basis for Input to Decision - Provide qualitative and/or quantitative information for management review and decision making. Period of time

(exposure time) affect on the performance deficiency.

Yes In this specific event, rod drift alarms came in beginning at 10:19 a.m. on 11/03/08. The rods began to drift out of the core at 10:36:36 a.m. By 11:56 a.m., the three rods that had drifted out of the core had been re-inserted. The entire event lasted approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 38 minutes. The issues that led to this specific event existed for many years. The likelihood that the licensee's recovery actions

would successfully mitigate the performance deficiency. Yes If a criticality event had occurred, operators would have to have inserted control rods by manually opening the local 3-0305-101 valves for each

HCU at the

HCU. The

operators could also have initiated the standby liquid control system to add negative reactivity. These actions are likely to be successful in shutting down the reactor. Additional

qualitative circumstances associated with

the finding that regional management should consider in the evaluation process. Yes Shutdown risk is evaluated by licensees by using qualitative criteria to assess shutdown safety functions. During this event, the shutdown safety function of reactivity control was not met. In this specific event, an

inadvertent reactor criticality did not occur. However, no licensee procedures or work controls limited the consequences to the event that actually occurred. Based on inspection results, more rod movement could have occurred and under different circumstances (less xenon, colder

RCS ) led to a different outcome (i.e., criticality). Use of

CDF and

LERF as risk metrics in the SDP may not

adequately capture the significance of shutdown reactivity events. Additionally, using shutdown risk does not properly address the multiple issues which led to the inadvertent control rod withdrawal event which include:

• The procedure in use,

DOP 0500-05, was not adequate to the circumstances in that, the procedure did not contain any guidance regarding monitoring of

CRD system pressure, did not contain any guidance for ensuring the control room operators were aware of the

CRD accumulator activities, did not contain any precautions that the manipulation of

HCU valves could

affect reactivity, and did not specify how many HCUs could be isolated or whether a control rod drive pump should be operating.

Attachment 2 Decision Attribute Applicable to Decision? Basis for Input to Decision - Provide qualitative and/or quantitative information for management review and decision making.

• Existing

OPEX (

SC 07-08) had not been thoroughly reviewed and all of the recommended actions had not been incorporated into all procedures that affected the CRDs. Specifically, part of the recommendations had been incorporated into

0300 CRD procedures but had not been incorporated into the 0500

RPS procedures.

• For years this licensee had allowed individuals without licenses to manipulate the

HCU that could affect reactivity without the knowledge or consent of a licensed operator at the controls. (10

CFR 50.54j). The difference in this case was that all HCUs were

isolated while a CRD pump was running.

• The control room operators lacked a questioning attitude as demonstrated by their failure to question and investigate the cause of the control rod movement. In addition, control room operators failed to take any action to prevent possible rod motion until after the three rods had moved; ~23 minutes elapsed before the operators took any overt actions. They then tried to drive the rods back into the core but could not. The high cooling and exhaust water differential

pressure was specifically mentioned in the annunciator procedure for the rod drift alarm but it was not checked as a possible cause.

• The non-licensed operators (NLO) lacked a questioning attitude as demonstrated by their failure to stop and investigate why it was getting harder to manipulate the isolation valves for the HCUs.

• The work execution center (WEC) supervisor made a knowledge based decision to isolate all of the HCUs as allowed by the procedure and did not inform the shift management of the decision; nor inform the

control room operators when the NLOs started performing the procedure.

• The pre-job briefing was inadequate in that the possibility of improper valve manipulations causing inadvertent rod motion was not discussed and the

main control room operators were not included in the briefing.

Attachment 2 Decision Attribute Applicable to Decision? Basis for Input to Decision - Provide qualitative and/or quantitative information for management review and decision making.

• All of the operators (licensed and non-licensed) had received just-in-time training on the specific

OPEX [[(4 of 78 slides) before the previous outage; however, it was ineffective. No one, with the exception of the Shift Manager, remembered the possibility of causing inadvertent rod movement by not controlling cooling water pressure when isolating large numbers of]]

HCUs. * In the recovery from the event, the operators failed to control cooling water pressure and flow using existing procedures to remove the cause of the rods moving -

the high cooling water pressure. If the differential pressure had been corrected and then the associated HCU -102 and -101 valves opened in the order prescribed in the 0500-05 procedure restoration section, the control room operators could have driven

the rods in from the control room. Instead, the control room operators decided not to open the -102 valve (exhaust side) because the operators were concerned that the control rod would/could move further out of the core. The control room directed the NLO to open

the -101 valve to one

HCU at a time, knowing that the rod would likely move into the core. The associated control rod did move into over-travel and the

NLO then re-shut the -101 valve. No procedure existed for these actions.

Result of management review (COLOR): Preliminary White