IR 05000313/2015008

IR 05000313/2015008 and 05000368/2015008; on 04/27/2015 - 05/15/2015; Arkansas Nuclear One, Units 1 and 2; Problem Identification and Resolution (Biennial)

ML15180A399
Person / Time
Site:	Arkansas Nuclear
Issue date:	06/29/2015
From:	Allen D Division of Reactor Safety IV
To:	Jeremy G. Browning Entergy Operations
References
EA-2014-008, EA-2014-088 IR 2015008
Download: ML15180A399 (56)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 1600 E. LAMAR BLVD. ARLINGTON, TX 76011-4511 June 29, 2015

EA-2014-008

EA-2014-088

Mr. Jeremy Browning, Site Vice President

Arkansas Nuclear One Entergy Operations, Inc.

1448 SR 333 Russellville, AR 72802-0967

SUBJECT: ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - NRC PROBLEM IDENTIFICATION AND RESOLUTION INSPECTION REPORT 05000313/2015008 AND 05000368/2015008

Dear Mr. Browning:

On May 15, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed a biennial problem identification and resolution inspection at your Arkansas Nuclear One, Units 1 and 2, and discussed the results of this inspection with you and other members of your staff. The inspection team documented the results of this inspection in the enclosed inspection report.

Based on the sample reviewed, the inspection team determined that Arkansas Nuclear One's corrective action program, and your staff's implementation of the corrective action program, were adequate to support nuclear safety. In reviewing your corrective action program, the team assessed how well your staff identified problems at a low threshold, your staff's implementation of the station's process for prioritizing and evaluating these problems, and the effectiveness of corrective actions taken by the station to resolve these problems. Through this review, the team identified some significant programmatic weaknesses in your staff's ability to identify and evaluate organizational and programmatic problems within the corrective action program. On multiple occasions, these weaknesses led to ineffective corrective actions for conditions identified in the corrective action program or their causes. These weaknesses are discussed in the attached report.

The team also evaluated other processes your staff used to identify issues for resolution. These included your use of audits and self-assessments to identify latent problems and your incorporation of lessons learned from industry operating experience into station programs, processes, and procedures. The team noted that your nuclear oversight organization conducted thorough and critical audits and assessments of line organization performance. However, the station appeared challenged to successfully implement actions to correct nuclear-oversight-identified deficiencies or weaknesses. The team determined that your station's management maintains a safety-conscious work environment in which your employees are willing to raise nuclear safety concerns through at least one of the several means available. However, the team identified some potential precursors to safety-conscious work environment challenges that appear to be related to the implementation weaknesses in some aspects of your corrective action program.

The team also reviewed your cause evaluations and corrective actions to address the performance deficiencies associated with two NRC-documented findings of substantial safety significance (Yellow). The attached report documents several observations or findings related

to the station's progress in addressing these def iciencies. The NRC will further review your development and implementation of corrective actions for these risk-significant findings during a future supplemental inspection.

NRC inspectors documented five findings of very low safety significance (Green) in this report, all of which involved violations of NRC requireme nts. The NRC is treating these violations as non-cited violations (NCVs) consistent with Se ction 2.3.2.a of the NRC Enforcement Policy. If you contest the violation(s) or significance of the(se) NCV(s), you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC

20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at Arkansas Nuclear One.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your

disagreement, to the Regional Administrator, Region IV, and the NRC resident inspector at Arkansas Nuclear One.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, "Public Inspections, Exemptions, Requests for Withholding," a copy of this letter, its enclosure,

and your response (if any) will be available electronically for public inspection in the NRC's Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Managem ent System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Donald B. Allen, Team Lead Technical Support Services Team Division of Reactor Safety Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6

Enclosure:

Inspection Report 05000313/2015008 and 05000368/2015008 w/ Attachments:

1. Supplemental Information 2. Information Request 3. Supplemental Information Request

REGION IV Dockets: 50-313 and 50-368 Licenses: DPR-51 and NPF-6 Report: 05000313/2015008 and 05000368/2015008 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Units 1 and 2 Location: Junction of Hwy 64W and Hwy 333 South Russellville, Arkansas Dates: April 27 through May 15, 2015 Inspectors:

E. Ruesch, J.D., Senior Reactor Inspector, Team Lead J. Dixon, Senior Reactor Inspector N. Hernandez, Resident Inspector (South Texas Project) P. Jayroe, Reactor Inspector B. Tindell, Senior Resident Inspector (Arkansas Nuclear One)

C. Young, Senior Project Engineer Approved By: Donald B. Allen Team Lead, Technical Support Services Team Division of Reactor Safety

- 2 -

SUMMARY

IR 05000313/2015008 and 05000368/2015008; 04/27/2015 - 05/15/2015; ARKANSAS NUCLEAR ONE, UNITS 1 AND 2; Problem Identification and Resolution (Biennial)

The inspection activities described in this report were performed between April 27 and May 15, 2015, by five inspectors from the NRC's Region IV office and the senior resident inspector at Arkansas Nuclear One. The report documents five findings of very low safety significance (Green), all of which involved violation of NRC requirements. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, "Significance Determination Process." Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects Within the Cross-Cutting Areas." Violations of NRC requirement s are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process."

Assessment of Problem Identification and Resolution

Based on its inspection sample, the team concluded that the licensee maintained a corrective action program in which individuals generally identified equipment issues at an appropriately low threshold. Once entered into the corrective action program, the licensee generally evaluated and addressed these equipment-related issues a ppropriately and timely, commensurate with their safety significance. The licensee's corrective actions for equipment conditions were generally effective, addressing the causes and extents of condition of problems. However, the team noted significant challenges in the license e's ability to appropriately identify and document conditions related to gaps in organizational or programmatic performance. Further, the licensee repeatedly failed to fully identify and address organizational and programmatic causes of issues in cause evaluations or to initiate comprehensive corrective actions to address these causes.

The team observed that in some cases, this led to subsequent issues occurring as a result of the same or similar causes.

The licensee appropriately evaluated industry-operating experience for relevance to the facility and entered applicable items in the corrective action program. The licensee usually appropriately evaluated industry-operating experience when performing root cause analysis and apparent cause evaluations. The licensee incorporated both internal and external operating experience into lessons learned for training and pre-job briefs. However, the team noted some instances where operating experience had not been incorporated into site procedures, resulting in missed opportunities to prevent adverse conditions from occurring.

The licensee performed effective and self-critical Nuclear Oversight audits and self-assessments. However, in some cases corrective actions from self-assessments were tracked as "enhancements" though the licensee's learning process, even when these issues were adverse conditions, instead of being tracked in the corrective action program. Further, the team noted examples where the station's follow-up to audit findings lacked rigor, resulting in the failure to correct the conditions, and in some cases in repeat audit findings.

Based on interviews of personnel, the team identified no significant challenges to the licensee's maintenance of a safety-conscious work environment in which personnel were willing to raise nuclear safety concerns without fear of retaliation. However, the team observed some potential precursors to future safety-conscious work environment challenges.

Cornerstone: Initiating Events

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," involving the licensee's failure to perform activities affecting quality as prescribed by documented procedures of a type appropriate to the circumstances and accomplished in accordance with these procedures.

Specifically, the team identified the licensee failed to ensure procedures important to safety were written in accordance with Procedure EN-AD-101-01, "Nuclear Management Manual

Procedure Writer Manual," Revision 14.

The licensee's failure to write procedures important to safety in accordance with Procedure EN-AD-101-01 was a performance deficiency. This finding was more than minor because it was associated with the procedure quality attribute of the Initiating Systems cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, the licensee did not adequately implement Procedure EN-AD-101-01 to ensure activities directing reactivity manipulations were accomplished in accordance with procedures of a type appropriate to the circumstances to prevent end-of-life axial-shape-index reactor trips. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not cause the loss of mitigation equipment relied upon to transition the plant to a stable shutdown condition. This finding had a crosscutting aspect in the area of human performance associated with resources because leaders failed to ensure personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety (H.1). (Section 4OA2.5.a.)

Cornerstone: Mitigating Systems

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to correct a condition adverse to quality. Specifically, the licensee failed to correct the containment spray pump interlock to automatically start the shutdown cooling heat exchanger room coolers.

The licensee's failure to promptly correct a condition adverse to quality as required by 10 CFR Part 50, Appendix B, Criterion XVI, was a performance deficiency. The licensee has identified in multiple instances since 1989 a degraded or nonconforming condition with shutdown cooling heat exchanger room cooler interlocks, but has failed to correct the condition. This finding was more than minor because it was associated with the design control and equipment performance attributes of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to events to prevent undesirable consequences. Specifically, the licensee failed to correct the interlock feature that automatically starts the room coolers when the pump starts. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluation because the licensee failed to thoroughly evaluate the issue to ensure that the resolution addressed the cause (P.2). (Section 4OA2.5.b)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," that occurred because the licensee's extent of condition performed in the root cause evaluation for the Yellow flooding finding failed to identify all potential water ingress paths into watertight rooms in the auxiliary building. The licensee identified additional examples of failures to construct the Unit 2 auxiliary building in accordance with the updated final safety analysis reports' description of internal and external flood barriers so that they could protect safety-related equipment from flooding. The team identified that the licensee had an opportunity to identify the unsealed conduit during a series of flooding reviews and walk-downs between 2012 and 2014, including an extent of condition review for unsealed conduits.

Failure to identify and correct a condition adverse to quality as required by 10 CFR Part 50,

Appendix B, Criterion XVI, and Procedure EN-LI-102 was a performance deficiency. This performance deficiency was more than minor because if left uncorrected, it could become a more significant safety concern. Specifically, the continued failure to identify all unsealed flooding penetrations could result in continued exposure of risk-significant equipment in the auxiliary building to flooding. This finding was associated with the Mitigating Systems cornerstone. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. This finding has a human performance cross-cutting aspect associated with teamwork, in that the licensee failed to communicate and coordinate their activities within and across organization boundaries to ensure that nuclear safety was maintained (H.4). (Section 4OA2.5.c)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the failure to promptly identify and correct a condition adverse to quality. Specifically, the licensee failed to promptly correct a design deficiency with breaker auxiliary contact switches that resulted in binding and could result in incorrect interlock signals to other equipment.

The licensee's failure to promptly identify a condition adverse to quality as required by 10 CFR Part 50, Appendix B, Criterion XVI, was a performance deficiency. The licensee failed to promptly correct a design deficiency with breaker auxiliary contact switches that resulted in binding and failed breaker interlocks. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events. Specifically, the untimely corrective actions have reduced the reliability of breaker interlocks, which may cause bus lockouts or safety equipment that could fail to automatically start.

Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. The licensee has taken corrective actions to lessen the probability of bound switches by aligning shafts and lubricating bearing surfaces. This finding has a human performance cross-cutting aspect associated with consistent process in that the licensee failed to use risk insights in a systematic approach to make decisions (H.13). (Section 4OA2.5.d)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to identify, document, and mitigate risk from long-term deficient conditions, as required by the Procedure EN-LI-102, "Corrective Action Program," Revision 24.

The failure to identify, document, and mitigate risk from long-term deficient conditions, as required by Procedure EN-LI-102, was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because if left uncorrected, it would have the potential to lead to a more significant safety concern. Specifically, the delayed corrective actions and unmitigated deficiencies could reduce the reliability of the Unit 2 emergency diesel generator A, alternate ac diesel generator, and Unit 2 non-vital switchgear. This finding is associated with the Mitigating Systems cornerstone. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. This finding has a human performance cross-cutting aspect associated with conservative bias in that the licensee failed to use decision-making-practices that emphasize prudent choices over those that are simply allowable and failed to determine that a proposed action was safe in order to proceed, rather than unsafe in order to stop (H.14). (Section 4OA2.e)

REPORT DETAILS

4OA2 Problem Identification and Resolution

The team based the following conclusions on a sample of corrective action documents that were open at Arkansas Nuclear One (ANO) during the assessment period, which ranged from March 4, 2013, to the end of the on-site portion of this inspection on May 15, 2015.

.1 Assessment of the Corrective Action Program Effectiveness

a. Inspection Scope

The team reviewed approximately 300 condition reports, including associated root cause analyses and apparent cause evaluations, from approximately 21,000 that the licensee had initiated or closed between March 4, 2013, and May 15, 2015. The majority of these (approximately 17,000) were lower-level condition reports that did not require cause evaluations. The inspection sample focused on higher-significance condition reports for which the licensee evaluated and took actions to address the cause of the condition. In performing its review, the team evaluated whether the licensee had properly identified, characterized, and entered issues into the corrective action program, and whether the licensee had appropriately evaluated and resolved the issues in accordance with established programs, processes, and procedures. The team also reviewed these programs, processes, and procedures to determine if any issues existed that may impair their effectiveness.

The team reviewed a sample of performance indicators, system health reports, operability determinations, self-assessments, trending reports and metrics, and various other documents related to the licensee's corrective action program. The team evaluated the licensee's efforts in determining the scope of problems by reviewing selected logs, work orders, self-assessment results, audits, system health reports, improvement plans, and results from surveillance tests and preventive maintenance tasks. The team reviewed daily condition reports and attended the licensee's condition review group, corrective action review board, and operations focus meetings to assess the reporting threshold and prioritization efforts, and to observe the corrective action program's interfaces with the operability assessment and work control processes. The team's review included an evaluation of whether the licensee considered the full extent of cause and extent of condition for problems, as well as a review of how the licensee assessed generic implications and previous occurrences of issues. The team assessed the timeliness and effectiveness of corrective actions, completed or planned, and looked for additional examples of problems similar to those the licensee had previously addressed. The team conducted interviews with plant personnel to identify other processes that may exist where problems may be identified and addressed outside the corrective action program.

The team reviewed corrective action doc uments that addressed past NRC-identified violations to evaluate whether corrective actions addressed the issues described in the inspection reports. The team reviewed a sample of corrective actions closed to other corrective action documents to ensure that the ultimate corrective actions remained appropriate and timely.

The team considered risk insights from both the NRC's and ANO's risk models to focus the sample selection and plant tours on risk-significant systems and components. The team focused a portion of its sample on the Unit 1 emergency feedwater system, which the team selected for a five-year in-depth review. The team conducted walk-downs of this system and other plant areas to assess whether licensee personnel identified problems at a low threshold and entered them into the corrective action program.

The team also conducted in-depth reviews of the licensee's corrective actions related to several non-safety-related systems that have a significant impact on ANO's risk model. These systems included the alternate-ac diesel generator, the Unit 2 feedwater control system, the Unit 1 integrated control system, the Unit 1 intermediate cooling water system, 4.16kV and 6.9kV MagneBlast breakers and cubicles, and the Unit 2 auxiliary feedwater system.

b. Assessments

1. Effectiveness of Problem Identification

During the 26-month inspection period, licensee staff generated approximately 21,000 condition reports. The team determined that most equipment conditions that required generation of a condition report by Procedure EN-LI-102, "Corrective Action Program," had been appropriately entered into the corrective action program.

However, the team noted several examples where the licensee had failed to properly identify and document conditions in accordance with procedures:

• In March 2014, the NRC documented in Inspection Report 2013012 an apparent violation related to the 2013 stator drop event. In June 2014, the NRC issued a notice of violation (EA-14-008) in a final significance determination letter with Inspection Report 2014008. In April 2014, the licensee had initiated Condition Report CR-ANO-C-2014-00858 to capture an overall observation discussed in the cover letter of Inspection Report 2013012. However, the licensee failed to document either the apparent violation or the violation in the corrective action program. The violation and associated performance deficiency were not specifically documented or addressed until September 2014, when the licensee initiated Condition Report CR-ANO-C-2014-2318 to perform a supplemental root cause evaluation associated with the March 2013 stator drop event. This September condition report was generated after a readiness assessment

for an IP 95002 inspection identified that the NRC violation had not been adequately addressed in the corrective action program. The team determined that the licensee's failure to initiate a condition report prior to September 2014 was contrary to Procedure EN-LI-123, Revision 4, which required the licensee to promptly document and address this violation in the corrective action program.

• The licensee has evaluated the causes and corrective actions associated with the problems involved with the two currently open Yellow NRC findings separately. In the associated cause evaluations, the licensee identified organizational and programmatic causal factors, some of which were common to both issues (e.g., risk recognition/management and oversight of contracted activities). However, the licensee has not identified and evaluated these factors as being common aspects of both safety-significant findings (i.e., common cause). The causes and corrective actions for these performance deficiencies are further discussed in Section 4OA2.6 below.

• During the operations focus meeting on May 12, 2015, the team observed a lengthy discussion among the site leadership about red "readiness indicators" in the work management ("T-week") process. The red indicators were due to a significant number of work packages that required assessments or reviews prior to approval for work. During the discussion, individuals commented that the site is "victims of our schedule rather than masters of our schedule," and that correcting the identified gaps is "fundamental to how we manage our risk and operate the plant safely." Despit e the extensive discussion of this performance gap and the acknowledgment of the need to improve, the licensee failed to document this organizational and programmatic issue in the corrective action program.

• In October 2013, the licensee performed a "snapshot" self-assessment of the Control Room Habitability Program. During this self-assessment, the licensee reviewed the on-site storage of hazardous chemicals and documented that an unanalyzed bulk storage tank containing anhydrous ammonia should be evaluated with respect to the impact of a potential release on control room habitability. After further investigation, the NRC team determined that the tank likely did not contain anhydrous ammonia, but rather ammonium hydroxide, and the tank was identified in the licensee's final safety analysis report (FSAR). However, the licensee personnel performing

the assessment appeared to have believed at the time that the tank contained anhydrous ammonia and had not been analyzed. The existence of unanalyzed chemicals in this quantity would have been an adverse condition, as defined by licensee Procedure EN-LI-102. However, after identifying this adverse condition, the assessors created an action within the licensee's organizational learning process to perform this evaluation, but did not initiate a condition report to evaluate the condition or to track this action item within their corrective action program. As of May 2015, the licensee had not completed the evaluation of the contents of the tank or of the impact of a potential release from the tank on the control room envelope. The tank identified in the self-assessment has a 15,000-gallon capacity; level indication shows the tank as having an inventory of approximately 70 percent, or 10,500 gallons. The team reviewed Regulatory Guide 1.78, "Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release" for guidance regarding hazard screening of chemical sources with the potential to impact control room habitability. According to the regulatory guide, "Any Hazardous Chemical stored onsite within 0.3 miles of the control room in a quantity greater than 100 pounds should be considered for control room habitability evaluation." The approximate weight of 10,500 gallons of anhydrous ammonia is 52,500 pounds. The approximate weight of 10,500 gallons of ammonium hydroxide is 77,000 pounds for commercially available solutions, of which approximately 22,000 pounds is dissolved ammonia. The storage tank is located immediately adjacent to Unit 2. The team noted that while the licensee is not committed to Regulatory Guide 1.78, it is referenced in the control room habitability program procedure and in the licensee's chemical control program procedure, both of which are used to implement the control room habitability program required by licensee technical specifications for both Units 1 and 2. Because the ammonium hydroxide tank was identified in the FSAR, this failure to comply with Procedure EN-LI-102 requirements for initiating condition reports constitutes a minor violation that is not subject

to enforcement action in accordance with the NRC's Enforcement Policy. The licensee documented this minor violation in Condition Report CR-ANO-C-2015-01526.

• In July 2013, the licensee documented in Work Order 348321 that the alternate-ac diesel generator switchgear connections had marginal digital low resistance ohmmeter test results, but the licensee failed to initiate a condition report, contrary to EN-LI-102 requirements. As a result, the licensee failed to evaluate the functionality of the connection. The licensee initiated Condition Report CR-ANO-C-2015-01357 to document the issue.

• The NRC identified that the licensee had failed to design and construct the auxiliary building to protect safety-related equipment from external flooding, as documented in NRC Inspection Report 2014009. Between April 24, 2013, and November 12, 2013, the licensee identified multiple auxiliary building flooding deficiencies:

o doors not designed for flooding as documented in Condition Report CR-ANO-2-2013-00892 on April 24, 2013;

o degraded building gap seals that could be exposed to flooding as documented in Condition Report CR-ANO-2-2013-00904 on April 25, 2013; o unsealed conduits as documented in Condition Report CR-ANO-2-2013-01822 on September 26, 2013 and CR-ANO-2-2013-02093 on November 12, 2013; o drains from the turbine building in to the auxiliary building as documented in Condition Report CR-ANO-1-2013-03023 on November 11, 2013; and o drains from the yard into the auxiliary building as documented in Condition Report CR-ANO-C-2013-02846 on November 12, 2013.

In addition to the physical condition, the licensee had identified that the flooding walk-downs up to that point had been inadequate (Condition Report CR-ANO-C-2013-01156; April 26, 2013). After identifying the unsealed conduits above, the licensee initiated an extent of condition review to determine if there were other unsealed conduits. The resident inspectors, on January 23, 2014, noted that the licensee had performed a root cause evaluation that only evaluated degraded hatch seals, as documented in Condition Report CR-ANO-C-2013-01304 on March 31, 2013. The team reviewed the remaining flooding deficiencies listed above and noted that the licensee had not identified that the cumulative deficiencies were safety significant, requiring more rigorous and timely evaluation and corrective actions. The team concluded that the licensee had failed to identify the significant condition adverse to quality related to flooding protection, as

documented in NRC Inspection Report 2014009. The licensee documented this issue in Condition Report CR-ANO-C-2014-00259.

The team identified potential challenges to the licensee's identification of broad performance issues through its trending process. The team determined that although the licensee had an adequate procedure for trending (described in Procedure EN-LI-121), the implementation of the procedure was subjective with little required management oversight. The procedure places the burden of evaluating whether trends exist on the department performance improvement coordinators. Once the threshold for the number of events in a 12-24 month period has been reached, the coordinator reviews the events. If that coordinator determines that some are not applicable, then a trend is not identified. This review is not required to be verified or second-checked. Further, department performance improvement coordinators indicated in interviews that the little training they were provided was potentially insufficient to ensure a consistent outcome across departments and experience levels. Additionally, the licensee recently (roughly 15 months ago) changed its trending software program, so no trend is looking at 24 months of data. The team could not determine if the threshold number of events had been reduced to correspond to the more limited timeframe or if events occurring between 15-24 months ago were being tracked separately. The actual threshold for determining if a trend existed was also difficult for the team to determine. In general, the team concluded that the licensee's threshold for verifying a trend appears too high such that a trend would seldom be identified.

Most of the personnel interviewed by the team understood the requirements for condition report initiation; most expressed a willingness to enter newly identified issues into the corrective action program at a very low threshold. However, approximately 34 percent of interviewees expressed negative views when asked how effective the station's corrective action program is at identifying and addressing problems. Several interviewees stated that the corrective action program appeared marginally effective or ineffective at correcting problems unless those problems were either

(1) major problems impacting plant operation or

(2) very minor problems that could be fixed using minimal resources. As a result, some of the interviewees (approximately 15 percent) stated a reluctance to continue to initiate condition reports for conditions that did not fall into one of these two categories based on a lack of confidence that the problem would be resolved.

Overall, the team concluded that the licensee generally maintained a low threshold for the formal identification of problems and entry into the corrective action program for evaluation when such problems were related to observable equipment conditions. However, as noted in several examples above, the licensee had significant challenges in appropriately identifying and documenting conditions related to gaps in organizational or programmatic performance.

2. Effectiveness of Prioritization and Evaluation of Issues The sample of condition reports reviewed by the team focused primarily on issues screened by the licensee as having higher-level significance, including those that received cause evaluations, those classified as significant conditions adverse to quality, and those that required engineering evaluations. The team also reviewed a number of condition reports that included or should have included immediate operability determinations to assess the quality, timeliness, and prioritization of these determinations.

PROGRAMMATIC WEAKNESSES IN IDENTIFICATION AND EVALUATION OF ORGANIZATIONAL AND PROGRAMMATIC PROBLEMS The team identified a programmatic weakness in the licensee's implementation of its cause evaluation process. The licensee repeatedly failed to fully identify and address organizational and programmatic causes of issues in cause evaluations or to initiate comprehensive corrective actions to address these causes. In at least one case, such causes were identified, and corrective actions were developed, but these actions were subsequently canceled by the licensee's corrective action review board. The team noted several examples in which the lack of identification of organizational and programmatic causes-and the resultant failure to correct these causes-resulted in the occurrence of subsequent issues, failures, or events with the same or

similar causes:

• The licensee initiated Condition Report CR-ANO-C-2013-00888 in March 2013 following the stator drop event (see Section 4OA2.6 below). The root cause evaluation performed under this condition report only addressed contractor performance aspects; it did not evaluate licensee performance causal factors (e.g., licensee oversight of contractor activities).

The licensee closed this condition report in May 2014 after the NRC had issued Inspection Report 2013012, documenting the licensee's failure to adequately review and approve work done by the contractor. Licensee performance causal factors were not adequately evaluated until Condition Report CR-ANO-C-2014-02318 was initiated in September 2014 to perform an additional root cause evaluation.

• The licensee completed Revision 0 of a root cause evaluation in Condition Report CR-ANO-C-2014-00259 on March 6, 2014, for flood protection deficiencies. In the evaluation, the licensee identified that flooding walk-downs performed by a contract firm had failed to identify the majority of the then-existing flood barrier deficiencies. The cause evaluation focused on the contract firm's failure to scope the inspections correctly; it failed to identify licensee performance causal factors (e.g. inadequate licensee oversight of contracted activities). After the licensee received a Yellow finding for flooding protection deficiencies (see Section 4OA2.6 below), the licensee initiated Revision 1 of this root cause evaluation. Revision 1 of the root cause evaluation, performed in April 2015 with NRC Inspection Procedure 95002 as a standard, identified that licensee personnel provided minimal oversight of the outside design agency activities related to the flooding walk-downs.

Therefore, the licensee took more effective organizational and programmatic

actions in relation to their oversight of contractors after the NRC issued the finding.

• The extent of condition evaluation performed under the Condition Report CR-ANO-C-2014-02318 root cause evaluation included a review of other contracted technical services procured in the last three years for controls in place to assure quality and technical requirements were met.

Inadequacies associated with the contracted Fukushima flood protection walkdown project were not captured/addressed in the extent of condition review of this root cause evaluation; however, the flooding walkdown deficiencies had been previously recognized and captured elsewhere in the corrective action program.

• As identified in Condition Report CR-ANO-C-2014-01545, the licensee identified a trend of control room supervisor command and control issues, which had resulted in improper operation of plant equipment, configuration control issues, and plant trips. The licensee completed a root cause evaluation for the condition on July 9, 2014. The licensee identified multiple missed opportunities to identify the command and control issues in internal condition reports from 2010 to 2014. The licensee noted in the root cause that "the symptom was treated, but not the underlying cause." The team noted that Procedure EN-LI-118, "Cause Evaluation Process," Revision 20, Attachment 9.6, "Operating Experience," stated that if a missed opportunity is identified, it should be identified as a Causal Factor in the root cause evaluation and a new condition report should be initiated. However, the team noted that the licensee had not initiated condition reports for the missed opportunities or identified them as causal factor. As a result, the licensee failed to evaluate the reason that earlier corrective actions, including previous root cause evaluations, had not identified and corrected the command and control issues. The licensee docum ented this issue in Condition Report CR-ANO-C-2015-01573.

The team also determined that the licensee was not following station procedures for addressing the organizational and programmatic deficiencies. Rather, the licensee's corrective actions often involved simply making procedure changes rather than fully evaluating and addressing organizational and programmatic causes such as leadership behaviors or human performance. The licensee documented this concern in Condition Reports CR-ANO-C-2015-01465 and CR-ANO-C-2015-01559. Examples follow:

• The station experienced a number of Occupational Safety and Health Administration (OSHA) recordable injuries and performed a root cause evaluation under Condition Report CR-ANO-C-2013-00117 to develop corrective actions to reduce the accident rate. The licensee took no organizational or programmatic actions, though the root cause clearly identified a lack of ownership and a program owner as a cause.

• As a result of a significantly over-budget circulating water pump overhaul, the licensee performed an apparent cause evaluation under Condition Report CR-ANO-C-2014-01418 to evaluate the circumstances. The apparent cause evaluation determined that lack of management involvement and oversight were the main reason for the over-budget and over-time situation.

However, during the corrective action review board's review of the apparent cause evaluation, the corrective action review board deleted the two corrective actions that addressed the lack of management involvement and oversight based on a procedure change t hat required the system supervisor to be briefed on the project. The team noted that the corrective action review board had effectively deleted the organizational and programmatic corrective actions.

• After identifying the potential for deadheading the auxiliary feedwater pump, the licensee failed to identify the full extent of condition in that the review failed to identify all procedures that could impact safe operation of the pump. The licensee performed an apparent cause evaluation under Condition Report CR-ANO-1-2015-01271 to evaluate the inadequate extent of condition review. Though the cause evaluation discussed organizational and programmatic weaknesses, it failed to document the review as required by station procedures. The licensee captured this issue in Condition Report CR-ANO-C-2015-01525.

• In an apparent cause evaluation performed under Condition Report CR-ANO-C-2013-01610, the licensee identified that the emergency planning organization had numerous deficiencies that needed to be corrected to restore compliance with station procedures. However, the licensee addressed these through procedure changes and failed to effectively address organizational and programmatic weaknesses. During this time, the emergency planning organization was experiencing a high level of turnover.

As a result, during the follow-up quality assurance surveillance, the emergency planning organization failed to make significant progress as the corrective actions had not been completed. The licensee's quality assurance organization then performed another audit, documented in Condition Report CR-ANO-C-2014-01603, which determined that the emergency planning organization was "Unsatisfactory." An organizational aspect was noted in the description of the condition report: "Contributing to this is that EP Leadership did not monitor the results of the corrective actions." Yet no organizational or programmatic deficiencies or corrective actions were identified. The most recent follow-up Quality Assurance surveillance, completed in February 2015, evaluated the effectiveness of the corrective actions as "indeterminate." This will result in the emergency planning organization having been identified as under-performing for a two-year period with no organizational or programmatic concerns identified. The team determined that the licensee focused on procedure changes as the corrective action rather than a deeper look at the performance, and stability, of the organization.

• In an apparent cause evaluation performed under Condition Report CR-ANO-C-2014-01912, the licensee identified that managers and supervisors were not performing the final supervisory review of work packages as required, preventing automatic record archival. This could have resulted in records being irretrievably lost or equipment discrepancies not being identified. Station procedures require these reviews to be completed within 30 days of the completion of the activities. When the issue was identified, there were over 2,000 work packages for which the work had been performed, but the supervisory review and close-out had not been completed as required. The corrective action for the apparent cause of the condition was to initiate a procedure change to the initial supervisor qualification that would provide an introduction to the work management procedures. This action was not approved by the corrective action review board. The apparent cause evaluation lists the apparent cause as "ineffective change management," yet all the corrective actions to address this were focused on ensuring personnel "utilize informational use procedures as needed to complete work as stated in the procedure." No discussion of what organization or programmatic expectations failed that resulted in the

ineffective change management.

• During two different hostile-action-based drills in 2014, the licensee failed to identify organization and programmatic concerns that resulted from human performance apparent cause evaluations, documented in Condition Reports CR-ANO-C-2014-02596 and CR-ANO-C-2014-02743. During the first drill, the licensee identified the missed organizational aspect during the human performance review closure. For the second drill, the team determined that the licensee had missed the organization and programmatic concerns entirely. The apparent cause evaluation contained contradictory information, but several of the checklist items were marked such that an organizational or programmatic concern should have been identified and corrective actions taken to resolve the concern. The licensee documented

this NRC-identified concern in Condition Report CR-ANO-C-2015-01555.

The team also identified examples where the licensee's evaluation of an identified deficiency was narrowly focused. This resulted in corrective actions being developed and implemented that did not fix the causes that led to the deficiency:

• In September 2013, in an apparent cause evaluation performed under Condition Report CR-ANO-1-2013-2090, the licensee failed to adequately evaluate the extent of a problem with an operations procedure. When performing decay heat pump surveillance testing during an outage, the procedure inadvertently created a system alignment where a sluice pathway was established for water to gravity drain from the borated water storage tank (BWST) to the reactor coolant system (RCS). Corrective actions included revising the procedure to prevent that alignment from being established. The evaluation failed to identify that the procedure also established an additional unintended sluice flowpath from the BWST to the RCS when a different system alignment is established in another part of the procedure. Consequently, a similar event recurred in the next outage in February 2015. The licensee identified this problem with the original problem evaluation in February 2015, as documented in Condition Report CR-ANO-1-2015-01050.

• In the root cause evaluation performed under Condition Report CR-ANO-2014-02318, the extent of cause evaluation associated with one of the contributing causes (Procedure EN-MA-119 lacked clear guidance for how to meet requirements associated with vendor-supplied special lift equipment.) considered whether there were other site procedures that contained guidance on meeting requirements associated with vendor-supplied special lift equipment. Corrective actions also included a review of all non-engineering site procedures that provide direction for engineering support of an activity. However, the actual deficiency in the EN-MA-119 procedure involved a lack of guidance with respect to meeting requirements associated with any temporary lift equipment, not just vendor-supplied equipment. The extent of cause did not include consideration of reviewing other site procedures that implement requirements for any station-owned or permanently installed lifting equipment that may be used to conduct risk-significant activities. The team identified some issues with the clarity in licensee procedures for operation of the containment polar crane and conducting reactor vessel head lifts with respect to implementing ASME code requirements for not exceeding rated crane capacity. These issues had not been captured by the licensee's extent of cause review.

PROGRAMMATIC WEAKNESSES IN PREVENTIVE MAINTENANCE IMPLEMENTATION

The team identified a potential trend with the licensee failing to implement vendor-recommended preventative maintenance procedures. The team noted that the licensee appears to have addressed these items individually. However, the licensee has not reviewed the preventative maintenance program as a whole to determine if there is a larger programmatic concern with the implementation of vendor-recommended maintenance. The licen see documented this concern in Condition Report CR-ANO-C-2015-01467.

• On January 2, 2013, during plant protection system Channel C testing, an unexpected full actuation of safety injection, containment isolation, and containment cooling occurred. The licensee's root cause evaluation determined that the associated Channel CD matrix test switch had degraded

due to having been cycled over 11,800 ti mes. The vendor's documented life expectancy for this switch was 6,000 cycles. The licensee's current replacement interval is 10,000 cycles based on the vendor stating that for manual applications the switch should last significantly longer than shown in laboratory testing. Prior to this failure, the licensee did not have an adequate preventative maintenance procedure to implement vendor recommendations. The NRC documented a non-cited violation associated with the failure in Inspection Report 05000368/2013004 and the licensee documented this issue in Condition Report CR-ANO-2-2013-00005.

• On March 28, 2013, low-pressure injection pump P-34B failed to start. The licensee's apparent cause evaluation determined that when the pump breaker was overhauled in 2010, the maintenance craft had failed to follow the preventative maintenance procedure with respect to prop spring replacement. The actual cause of the failure was that the prop springs had been reversed several years previously. Additionally, it was determined that the licensee did not implement all the recommended vendor changes for these type of breakers, several breakers had still not been overhauled, and the preventative maintenance instructions did not contain an adequate level of detail. The NRC documented a non-cited violation associated with the pump failure in Inspection Report 05000313/2014004 and the licensee documented these issues in Condition Report CR-ANO-1-2013-00701.

• On December 9, 2013, an electrical fault occurred on the unit auxiliary transformer 2X-02, which exploded and caught fire. A contributor to the event was that the licensee was not performing preventative maintenance on the 6.9 kV non-segregated bus bar bolted connections. Originally the preventative maintenance directed a visual inspection of the bolted connection, but since the connections are taped and have limited access, the licensee was justifying not performing these checks. The justification was based on the number of man-hours that would be required and the limited access. Additionally, the licensee had reviewed a similar significant operating experience event that occurred at Columbia Generating Station in 2009 (Failed Non-segregated Bus Bar), but failed to properly evaluate the operating experience. The licensee also discovered that the wrong insulation tape was being used to protect from a phase-to-ground short. The NRC documented a non-cited violation associated with the transformer failure in Inspection Report 05000368/2014002 and the licensee documented these issues in Condition Report CR-ANO-2-2013-02242. This issue is also discussed in Section 4OA2.3 below.

• On July 10, 2014, primary makeup pump P-36B outboard seal exhibited unacceptable leakage that resulted in the licensee declaring the pump inoperable. The licensee replaced the seal and returned the pump to service.

On July 16, 2014, the outboard seal again exhibited unacceptable leakage that resulted in the pump being declared inoperable. The licensee's apparent cause determined that the original seal had been in service for 17 years without any inspections or replacements. As a result, the licensee did not identify the thrust bearing wear until the second failure. Additionally, the licensee determined that the thrust shoe and nut had not been installed correctly during the first seal replacement. The licensee determined that no preventative maintenance strategy was in place to periodically inspect/ replace the seals and bearings to prevent failures, that maintenance was performed incorrectly during the seal reassembly, and that the station had a high tolerance for seal leakage on the makeup pumps. The team noted that the primary makeup pumps in the A and C trains have exhibited similar problems. There was at least a six-year history of condition reports documenting seal leakage in Pump P-36C before the seals were replaced in 2010. The licensee has still not repaired seal leakage in pump P-36A, though seal leakage has been repeatedly documented in condition reports over at least the last seven years. The licensee documented these issues in Condition Report CR-ANO-1-2014-01129.

In none of these examples did the licensee evaluate the adequacy of its preventive maintenance program or determine whether there were common-cause elements associated with the preventive maintenance program. However, the team noted that the licensee has identified the station's preventive maintenance program as a focus area for its current recovery effort.

INCONSISTENT CHARACTERIZATION OF ISSUE SEVERITY RESULTING IN REPEAT ISSUES

The team noted that the licensee's procedures permit the condition review group to downgrade condition report categorization from the default category identified in

Procedure EN-LI-102. The team identified several examples where the licensee had downgraded NRC-documented non-cited violations from the default category B-which requires an apparent cause evaluation-to category C. As a result, no apparent cause evaluations were performed and no corrective actions were taken to address organizational and programmatic causes. The apparent cause evaluation Procedure, EN-LI-119 requires extent of cause and condition reviews to ensure the underlying problem is not still a latent issue in other systems. While it may be appropriate to exercise management discretion to avoid expending excessive resources by performing cause evaluations when the causes of problems are obvious, the licensee appeared to overuse this procedurally permitted discretion. The team determined that had the licensee not downgraded the violations below, additional violations may have been avoided:

• The NRC originally issued a non-cited violation for light fixtures in the emergency diesel room not being installed per design in 2013. The licensee documented the issue in Condition Reports CR-ANO-1-2013-00403,

-00432, and -00500. These were then closed to Condition Reports CR-ANO-C-2013-00631 and -00632. All of these condition reports were classified as either Category C or D, which did not require an apparent cause evaluation or extent of condition review. After the licensee had performed corrective actions, the NRC identified another light fixture not installed per design in the emergency feedwater room and issued another Green, non-cited violation. After this second violation was documented, the licensee performed an extent of condition review under Condition Report CR-ANO-1-2013-02830 and identified numerous other light fixtures that were not installed per design. Had the licensee performed an apparent cause for the first violation, the extent of condition would have identified all impacted light fixtures and avoided the second violation.

• In February 2015, the NRC issued a Green, non-cited violation for the licensee's failure to have adequate procedures to protect the operation of the Unit 1 auxiliary feedwater pump (Inspection Report 2014005). The licensee's procedures would have permitted the pump to be operated in a deadheaded condition, potentially damaging the pump in as little as 20 seconds. The licensee documented this issue in Condition Report CR-ANO-1-2014-00286, then closed the condition report to a generic procedure revision condition report. The assigned action in the generic procedure condition report was then closed to Condition Report CR-ANO-1-2014-01234 because the licensee did not capture all the procedures that the NRC initially identified could be impacted. Subsequent to the licensee having performed its own procedure review, the NRC identified an additional procedure that impacted the safety operation of the auxiliary feedwater pump. The licensee documented the new procedure concern in Condition Report CR-ANO-1-2015-01576, which was then closed to an apparent cause being performed under Condition Report CR-ANO-1-2015-01271.

Had the licensee performed an apparent cause evaluation for the first Green, non-cited violation the extent of condition would have identified all other procedures with the potential to impact the safe operation of the

auxiliary feedwater system. The licensee captured this concern in Condition Report CR-ANO-C-2015-01384.

• The licensee received several Green, non-cited violations for ASME code violations during the inspection period. The NRC issued a Green, non-cited violation for an inadequate operability evaluation due to failure to characterize a weld flaw in October 2013. The licensee documented this issue in Condition Reports CR-ANO-2-2013-01913, CR-ANO 2-2013-01961, and CR-ANO-C-2014-01744, which were all classified as either Category C or D.

Because of this categorization, the licensee did not perform an apparent cause evaluation and did not initiate any actions to address organizational and programmatic causes, including the training issue described in the violation. The NRC documented four additional ASME-code-related Green non-cited violations in August 2014. The licensee documented these issues in Condition Report CR-ANO-C-2014-02372. Under this condition report, the licensee performed an apparent cause evaluation and developed corrective actions to address training deficiencies as a result of the additional examples in the August 2014 inspection report. The licensee documented this continuing training concern in Condition Report CR-ANO-C-2015-01398.

However, as of the end of the on-site portion of this inspection, these corrective actions had yet to be completed. Had the licensee performed an apparent cause evaluation for the first violation, the extent of condition review would have identified that training was an underlying contributor and could have potentially prevented the four additional Green, non-cited violations.

• Following a Unit 2 reactor trip in March 2013, the NRC identified a Green finding for the licensee's failure to maintain adequate preventative maintenance instructions for a main feedwater regulating valve linear variable differential transformer that provides valve position indication. The licensee documented the Green finding as part of Condition Report CR-ANO-C-2014-02042 to ensure appropriate corrective actions and closure reviews were performed. However, the team determined that the licensee failed to take corrective actions to address the cause of the Green finding and that the licensee failed to identify two additional main feedwater regulating bypass valve linear variable differential transformer that should have also been captured in the corrective actions. The licensee documented this issue in Condition Report CR-ANO-C-2015-01354. Had the licensee classified the condition report documenting the finding a Category B as recommended by procedure and performed an apparent cause evaluation, the licensee would have identified that the preventative maintenance instructions were still inadequate. Had the licensee performed an extent of condition review, it would have identified the two additional valves that were also impacted by the condition.

CONCLUSION

Overall, the team determined that the licensee's process for screening and prioritizing issues that had been entered into the corrective action program supported nuclear safety. However, as described above, the licensee had significant challenges in its implementation of these pr ocesses, particularly in its evaluation of organizational and programmatic deficiencies.

3. Effectiveness of Corrective Actions

In general, the corrective actions identified by the licensee to address adverse conditions were effective. However, the team noted instances in which corrective actions had been untimely or incompletely accomplished. Many of these instances were related to the failure to identify and evaluate organizational and programmatic issues as discussed above. However, the team noted additional examples of corrective actions being excessively deferred.

For example, on September 20, 2009, as documented in Condition Report CR-ANO-2-2009-02997, Unit 2 shutdown cooling was momentarily lost during non-vital off-site power feeder breaker operations due to a failed interlock. The licensee investigated and found a high resistance contact on a breaker auxiliary contact. To correct the issue, the licensee modified the auxiliary switch such that a different contact was used for the breaker interlock. During its investigation, the licensee identified that the vendor recommended periodic inspections and preventative maintenance that would address high resistance contacts in all similar auxiliary switches. Therefore, the licensee initiated a preventative maintenance activity and scheduled it to be completed in 2012. However, as of May 15, 2015, the licensee had not performed any maintenance.

Since 2008, the licensee has experienced multiple instances of the switches' plungers binding, which could send an incorrect interlock signal. The majority of failures have occurred during testing, with no consequences. However, as documented in Condition Report CR-ANO-1-2008-02379, CA-8, the licensee recognized that bound switches could have potentially significant effects, depending upon the circumstances, including bus lockouts or safety-related equipment that could fail to automatically start. As of the conclusion of the on-site portion of this inspection, the licensee had yet to complete corrective actions to replace these switches. This failure to promptly correct a condition adverse to quality is a Green, non-cited violation discussed in Section 4OA2.5.d below.

Further, the team identified examples where the licensee's corrective actions had not been performed in accordance with other site procedures:

• In two instances, when the licensee initiated corrective actions to revise procedures, the revisions added directional instructions in a procedural "note" or "warning." This was contrary to the requirements of Procedure EN-AD-101-01, "Nuclear Management Manual Procedure Writer Manual," which specifies that notes are to be used for clarifying information and are not to contain instructions. This performance deficiency is further discussed as a Green, non-cited violation in Section 4OA2.5.a below.

• The team identified three examples in which the licensee failed to identify, document, and mitigate the risk from long-term deficient conditions, as required by Procedure EN-LI-102. These failures are three examples of a Green, non-cited violation discussed in Section 4OA2.5.e below.

• The licensee failed to identify a 2010 axial shaping index technical specification violation as a Level 3 reactivity event as required by Procedure EN-FAP-OP-008, "Reactivity Management Indicator Program." In Condition Report CR-ANO-2-2010-1805, the licensee identified a condition where operators had exceeded the axial shaping index technical specification limit of -0.27 during a planned down power. The cause evaluation identified that the crew had not been aggressive enough with axial shaping index control and that the reactivity management plan had not been accurate. During the event, the operating crew had inserted control element assemblies beyond what the plan required and axial shaping index had drifted outside the technical specification limit. Procedure EN-FAP-008 defines a Level 3 reactivity event as "A Reactivity Management Event that represents a violation of process or procedures." Contrary to this, the licensee called the 2010 reactivity event a Severity Level (SL) 4: "A Reactivity Management Issue that indicates degradation of a barrier to proper Reactivity Management or creates an elevated potential for the occurrence of a Reactivity Management Event." Additionally, Procedure EN-FAP-OP-008 notes that, "If an issue can be classified at more than one SL, then the highest SL is used. Management discretion can be used to raise the SL of an issue but not to lower it." Reactor Engineering made changes to the one-hour reactivity plan, but those changes were not documented in the condition report and therefore not evaluated by the corrective action review board.

The team also noted that Procedure EN-LI-102, "Corrective Action Program,"

Revision 24, Section 5.7, requires annual periodic reviews for open Condition Reports classified as "A" and "B" to ensure that the condition has not changed, that the corrective action plan is adequate, and that the risk of not correcting the condition in the interim is acceptable. However, this requirement only applies to safety-related equipment, which potentially allows long-term degradations of risk-significant non-safety-related equipment not to receive the same amount of oversight and review.

The licensee initiated Condition Report CR-ANO-C-2015-01553 to document this issue.

Overall, the team concluded that the licensee generally identified effective corrective actions for causes identified during cause evaluations. However, as noted above, the licensee's programmatic challenges in its cause identification process have led to a lack of corrective actions for some causes. Further, as noted above, the corrective action review board has canceled corrective actions for some causes and other corrective actions have not been implemented as planned.

.2 Assessment of the Use of Operating Experience

a. Inspection Scope

The team examined the licensee's program for reviewing industry operating experience, including reviewing the governing procedures. The team reviewed a sample of industry and NRC operating experience communications and the associated site evaluations to assess whether the licensee had appropriately assessed the communications for relevance to the facility. The team also reviewed assigned actions to determine whether they were appropriate.

b. Assessment Overall, the team determined that the licensee appropriately evaluated industry-operating experience for its relevance to the facility. However, the team noted multiple examples-some identified by the licensee-where industry or internal operating experience information that existed prior to an event had not been incorporated into site procedures:

• Failure to incorporate operating experience was identified as a contributing cause in the root cause evaluation associated with Condition Report CR-ANO-C-2014-00259 (flood protection deficiencies) due to many prior industry events involving failed flood barriers not having been sufficiently reviewed by the station.

• The licensee performed an apparent cause evaluation under Condition Report CR-ANO-C-2014-01142 to evaluate a plant trip resulting from operators' loss of control of the axial shaping index during a rapid shutdown on April 27, 2014. This cause evaluation concluded that while there were no useful examples of rapid plant shutdowns at the end of core life that resulted in plant trips, there were enough examples that demonstrated difficulty controlling axial shaping index late in core life that the need for operator training should have been recognized. These examples included August 2010 internal operating experience, documented in Condition Report CR-ANO-C-2010-01805, which represented a missed opportunity to permanently revise how operators are trained and to evaluate adequacy of procedures.

• As discussed in Section 4OA2.1.c.2 above, the licensee's failure to take actions to address operating experience with bolted electrical connections contributed to a transformer fire on December 9, 2013.

• The team identified several instances in which the licensee failed to fully incorporate internal operating experience into station policies, procedures, and practices. As discussed above, the licensee has had multiple repeat conditions or events as a result of failing to identify and address the organizational and programmatic causes of issues during cause evaluations. The team noted that failures to identify organizational and programmatic causes inhibited organizational learning from internal operating experience.

Despite these examples, the team determined that the licensee usually appropriately evaluated industry-operating experience when performing root cause analysis and apparent cause evaluations. The licensee incorporated both internal and external operating experience into lessons learned for training and pre-job briefs.

.3 Assessment of Self-Assessments and Audits

a. Inspection Scope

The team reviewed a sample of licensee self-assessments and audits to assess whether the licensee was regularly identifying performance trends and effectively addressing them. The team also reviewed audit reports to assess the effectiveness of assessments in specific areas. The specific self-assessment documents and audits reviewed are listed in Attachment 1.

b. Assessment Overall, the team concluded that the licensee had an effective self-assessment and audit process. The team reviewed several audit reports conducted by the licensee's quality assurance organization and determined that the audits were very effective in identifying issues, that issues were clearly documented, that specific examples and supporting facts backed up programmatic strengths and weaknesses, and that issue follow up actions were generally effective in correcting problems.

The team also reviewed several self-assessments and determined that while self-assessments were effectively self-critical, identified issues were sometimes tracked as "enhancements" through the licensee's learning process instead of being tracked through the corrective action process. For example, a self-assessment of operator fundamentals (LO-ALO-2013-0108) identified negative observations of

(1) operators at the controls being challenged to maintain their primary function of monitoring the plant due to distractions caused by control room activities and

(2) operators inconsistently ensuring readiness and understanding when proceeding with infrequent, elevated risk, or abnormal conditions. Corrective actions for these observations were tracked through the licensee's learning process rather than the corrective action process.

In another example, discussed in Section 4OA2.1.b.1 above, a self-assessment conducted in the fall of 2013 of the control room habitability program identified the need to formally evaluate the potential impact of a postulated release of ammonia stored on site on the control room envelope. The corrective action for this negative observation was not entered into the corrective action program and the needed evaluation had not been completed as of the time of this inspection.

.4 Assessment of Safety-Conscious Work Environment

a. Inspection Scope

The team interviewed 41 individuals in six focus groups. The purpose of these

interviews was

(1) to evaluate the willingness of licensee staff to raise nuclear safety issues, either by initiating a condition report or by another method,

(2) to evaluate the perceived effectiveness of the corrective action program at resolving identified problems, and

(3) to evaluate the licensee's safety-conscious work environment. The focus group participants included personnel from maintenance, maintenance support, operations, production, radiation protection, chemistry, engineering, and security. At the team's request, the licensee's regulatory affairs staff selected the participants blindly from these work groups, based partially on availability. To supplement these focus group discussions, the team interviewed the Employee Concerns Program Coordinator to assess her perception of the site employees' willingness to raise nuclear safety concerns. The team reviewed the Employee Concerns Program case log and select case files. The team also reviewed the minutes from the licensee's most recent safety culture monitoring panel meetings.

b. Assessment 1. Willingness to Raise Nuclear Safety Issues All individuals interviewed indicated that they would raise nuclear safety concerns. All felt that their management was receptive to nuclear safety concerns and was willing to address them promptly. All of the interviewees further stated that if they were not satisfied with the response from their immediate supervisor, they had the ability to escalate the concern to a higher organizational level. Most expressed positive experiences after raising issues to their supervisors.

Most individuals expressed positive experiences documenting most issues in condition reports. However, several interviewees expressed hesitancy to raise some non-nuclear safety issues due to prior frustration with no actions being taken to correct identified problems or with actions not being timely. Additionally, several interviewees stated that there was a tendency for condition reports to get ass igned to the initiator, even if it would be better handled by another individual or group; this resulted in some reluctance to document low-level issues.

Overall, the team did not identify any significant current challenges to the safety-conscious work environment at the station. However, the hesitancy of some individuals to raise some non-nuclear safety issues and the frustration with the way some issues are addressed when raised appear to be precursors to potential future

challenges in maintaining a safety-conscious work environment.

2. Employee Concerns Program All interviewees were aware of the Employee Concerns Program. Most explained that they had heard about the program through various means, such as posters, training, presentations, and discussion by s upervisors or management at meetings. All interviewees stated that they would use the employee concerns program if they felt it was necessary, though a few individuals did not feel that issues were always adequately addressed. Most expressed confidence that their confidentiality would be maintained if they brought issues to employee concerns.

The team interviewed the licensee's employee concerns program coordinator and reviewed selected employee concerns program documentation. Based on this review, the team concluded that the site implements a generally effective employee concerns program that maintains visibility is used by employees and contractors, and conducts thorough investigations when necessary.

3. Preventing or Mitigating Perceptions of Retaliation When asked if there have been any instances where individuals experienced retaliation or other negative reaction for raising issues, all individuals interviewed stated that they had neither experienced nor heard of an instance of retaliation, harassment, intimidation, or discrimination at the site. The team identified no issues with the station's processes to prevent or mitigate these issues.

.5 Findings

a. Failure to Properly Implement Procedures for Writing Procedures Important to Safety

Introduction.

The team identified a Green, non-cited violation, of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," involving the licensee's failure to perform activities affecting quality as prescribed by documented procedures of a type appropriate to the circumstances and accomplished in accordance with these procedures. Specif ically, the team identified the licensee failed to ensure procedures important to safety were written in accordance with Procedure EN-AD-101-01, "Nuclear Management Manual Procedure Writer Manual,"

Revision 14.

Description.

On April 27, 2014, Unit 2 automatically tripped during a rapid plant shutdown near the end of core life due to the core power distribution axial shape index exceeding allowed limits. The licensee documented this issue in Condition Report CR-ANO-C-2014-1142. The licensee's apparent cause evaluation determined that the trip was caused by "inadequate procedural guidance or failure to follow procedures." Corrective actions from the apparent cause required the licensee to create a rapid plant shutdown abnormal operating procedure. The licensee failed to create the abnormal operating procedure in accordance with Procedure EN-AD-101-01.

Specifically, the licensee enhanced the One Hour Shutdown Reactivity Plan by adding a "warning." The warning contained actions on how to manipulate reactivity, including specifying the number of inches per insertion that control element assemblies are to be manipulated to maintain axial shape index within the Core Operating Limits.

However, the One Hour Shutdown Reactivity Plan is not a procedure. As such, Operations is allowed to use it as a guideline. The licensee failed to implement the corrective action by not translating that information into Abnormal Operating Procedure 2203.053, "Rapid Down Power," Revision 1, which is a controlled procedure rather than a guideline. Procedure 2203.053 does not contain the direction included in the One Hour Shutdown Reactivity Plan's warning. The team concluded that the licensee was directing reactivity manipulations based on a warning in a plan and not a reviewed procedure.

Procedure EN-AD-101-01, Attachment 9.1, "NMM Procedure's Writer's Instructions,"

states, "Note statements are allowed to provide additional information deemed beneficial to the procedure users but must not contain action instructions or 'shall' requirements."

Section 3.0 defines a critical step as "A Procedure or Work Instruction step, series of steps, or action that, if performed improperly-will significantly impact plant operation," including, "plant trip or unintended power reduction." Additionally, Procedure EN AD-101-01 states that, "Caution statements are intended to alert the user to conditions or actions that could result in-plant operations being adversely affected." Contrary to this, the licensee failed to incorporate a step that directs action in a quality-related procedure in accordance with Procedure EN-AD-101-01.

The team also identified a similar example in which the licensee failed to follow Procedure EN-AD-101-01 for preventative maintenance instructions on main feedwater regulating valve position indicators that resulted in complicating a reactor trip in 2013. The preventative maintenance procedure had a "note" that contained a directed action, that if the adjusting mechanism or the linear variable differential transformer were manipulated, that thread lock needed to be used to ensure the nuts did not loosen. This is contrary to Procedure EN-AD-101-01, which requires this note to be a step in the preventative maintenance instructions since it directs action. The team determined that the licensee failed to identity preventative maintenance work orders for two other valves that should also have a step included about the use of thread lock. Additionally, the team concluded that the licensee had failed to follow the vendor recommendation for including the use of thread lock. The licensee captured this issue in Condition Report CR-ANO-C-2015-01354.

This directly translated to the cross-cutting aspect of human performance associated with resources because the licensee wrote a new procedure, but failed to ensure that the procedure was written in accordance with the standards of EN-AD-101-01. Thus, the licensee failed to ensure the procedure was adequate to support nuclear safety.

Analysis.

The licensee's failure to write procedures important to safety in accordance with Procedure EN-AD-101-01 was a performance deficiency. This finding was more than minor because it was associated with the procedure quality attribute of the Initiating Systems cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, the licensee did not adequat ely implement Procedure EN-AD-101-01 to ensure activities directing reactivity m anipulations were accomplished in accordance with procedures of a type appropriate to the circumstances to prevent end-of-life axial-shape-index reactor trips. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not cause the loss of mitigation equipment relied upon to transition the plant to a stable shutdown condition. This finding had a crosscutting aspect in the area of human performance associated with resources because leaders failed to ensure personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety (H.1).

Enforcement.

Title 10 of the Code of Federal Regulations, Part 50, Appendix B, Criterion V, states in part, "Activities affecting quality shall be prescribed by documented procedures of a type appropriate to the circumstances and shall be accomplished in accordance with these procedures." Contrary to this requirement, the licensee failed to ensure that activities affecting quality as prescribed by documented procedures of a type appropriate to the circumstances were accomplished in accordance with those procedures. Specifically, Procedure EN-AD-101-01 is a procedure affecting quality that the licensee implements to write and maintain safety-related instructions and procedures. The licensee failed to follow Procedure EN-AD-101-01 to ensure all procedures and work instructions were appropriately written. In response to this issue, the licensee initiated procedure improvement Form 2-15-0150 to evaluate and revise Procedure 2203.053. This finding was entered into the licensee's corrective action program as Condition Report CR-ANO-C-2015-1355. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation (NCV), consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000368/2015008-01, "Failure to Properly Implement Procedures for Writi ng Procedures Important to Safety."

b. Failure to Correct Containment Spray Pump Interlock to Shutdown Cooling Heat Exchanger Room Coolers

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to correct a condition adverse to quality. Specifically, the licensee failed to correct the containment spray pump interlock with the shutdown cooling heat exchanger room coolers.

Description.

Shutdown cooling heat exchanger room coolers 2VUC-1A and B are interlocked with containment spray pump 2P-35A such that any time the containment spray pump is started the room coolers automatically start. In 2009, during a surveillance test of 2P-35A, room cooler 2VUC-1A did not auto start as designed. The licensee documented this issue in Condition Report CR-ANO-2-2009-01325 and resolved the issue by burnishing contacts on the STA 2A-304 device. In 2011, room cooler 2VUC-1A failed to auto start again. The licensee again burnished the contacts and documented the issue in Condition Report CR-ANO-2-2011-03743.

In 2012, the licensee was performing maintenance that required breaker 2A-304 to be racked out. Following the completion of that maintenance, the licensee racked in the breaker and performed a post-maintenance test of 2P-35A. During the test, both 2VUC-1A and B failed to automatically start. The licensee captured this issue in Condition Report CR-ANO-2-2012-01037. The licensee performed no corrective actions, but was able to start the room coolers as designed three times. The licensee declared the automatic start function inoperable and identified it as a degraded or nonconforming condition per Procedure EN-OP-104.

The licensee developed a troubleshooting plan to be implemented during the next outage; however, that action was cancelled in lieu of replacing the STA 2A-304 device.

During the subsequent outage in 2014, the licensee cancelled the work order to replace the STA 2A-304 device because a high resistance contact was identified that was believed to be the cause. During the subsequent post-maintenance test, room cooler 2VUC-1A failed to start automatically. Additionally, the licensee discovered during this outage that the device contains an internal contact that cannot be burnished and that another contact is in a difficult location and cannot be burnished properly.

Maintenance and operations personnel were prepared to perform troubleshooting, but operations signed the surveillance as satisfactory and continued with plant heat-up based on the acceptance criteria in the procedure. However, the licensee had changed these acceptance criteria in 1996 via a 10 CFR 50.59 screening. The reason for the change was the failure of the automatic start feature of the room coolers in 1989, 1994, and 1996. These earlier failures also affected the interlock feature with the high head safety injection pump. The licensee did not identify a cause of the failure, but rather made a procedure change to allow the control room to start the room coolers manually if they failed to start automatically. The team determined that this was a minor violation of 10 CFR 50.59 for not having performed an adequate evaluation to justify the change from automatic to manual action. The licensee was able to provide separate calculations and evaluations that when combined could support an evaluation of the change.

This change allowed operations to interpret the design basis as not needing the automatic start. Therefore, so long as the cooler started manually, the surveillance could be determined to be satisfactory. However, the current updated safety analysis report still discusses the room coolers as being interlocked with the starting of the pump with no discussion about manual operation if the interlock does not function. These room coolers ensure that the environmental conditions in the room are maintained below the design temperature to ensure that the components will be able to perform their safety function under all accident scenarios.

The team determined that the reason the licensee failed to correct this issue was identified by the licensee in a Focused Assessment:

The guidance in Procedure EN-OP-104 is not sufficiently specific to ensure degraded and nonconforming conditions are always being recognized, tracked, and corrected in a timely manner. In some cases related to Technical Specification-related components, operability of SSCs has been assured by accommodating the condition impacting operability through procedure changes or modifications to the plant. However, the condition itself has not been corrected.

This directly translated to the cross-cutting aspect of problem identification and resolution associated with evaluation because the licensee had made a procedure change but had not addressed correcting the underlying condition. Thus, the licensee had failed to thoroughly evaluate the issue to ensure that all aspects had been resolved even though they identified the inoperable and degraded or nonconforming condition on June 7, 2012.

Analysis.

The licensee's failure to promptly correct a condition adverse to quality as required by 10 CFR Part 50, Appendix B, Criterion XVI, was a performance deficiency. The licensee has identified in multiple instances since 1989 a degraded or nonconforming condition with shutdown cooling heat exchanger room cooler interlocks, but has failed to correct the condition. This finding was more than minor because it was associated with the design control and equipment performance attributes of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to events to prevent undesirable consequences. Specifically, the licensee failed to correct the interlock feature that automatically starts the room coolers when the pump starts. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. This finding had a cross-cutting aspect in the area of problem identification and resolution associated with evaluation because the licensee failed to thoroughly evaluate the issue to ensure that the resolution addressed the cause (P.2).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," states in part, "Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances are promptly identified and corrected." The licensee's measures are established by Procedure EN-LI-102, "Corrective Action Program," Revision 24. Step 5.5 of this procedure requires for conditions adverse to quality that assigned corrective actions are appropriately completed within the prescribed time frame. Contrary to the above, prior to May 15, 2015, the licensee failed to assure that a condition adverse to quality was promptly corrected. Specifically, the licensee failed to correct the containment spray pump interlock to the shutdown cooling heat exchanger room coolers. The licensee was tracking this as a nonconforming condition, and was in the process of creating work orders to ensure it is addressed during the next refueling outage. This finding was entered into the licensee's corrective action program as Condition Reports CR-ANO-C-2015-01561 and CR-ANO-2-2012-01037. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation (NCV) consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000368/2015008-02, "Failure to Correct Containment Spray Pump Interlock to Shutdown Cooling Heat Exchanger Room Coolers."

c. Inadequate Extent of Condition Review for Risk-Significant Condition

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," that occurred because the licensee's extent of condition performed in the root cause evaluation for the yellow flooding finding failed to identify all potential water ingress paths into watertight rooms in the auxiliary building. The licensee identified additional examples of failures to construct the Unit 2 auxiliary building in accordance with the updated final safety analysis reports' description of internal and external flood barriers, so that they could protect safety-related equipment from flooding. The team identified that the licensee had an opportunity to identify the unsealed conduit during a series of flooding reviews and walk-downs between 2012 and 2014, including an extent of condition review for unsealed conduits.

Description.

As described in NRC Inspection Report 2014009, the licensee performed multiple flooding evaluations and walk-downs from 2012 to 2014 to ensure that the auxiliary building could protect safety-related equipment from flooding exterior to the building. This included drawing reviews to identify unsealed embedded conduits that may provide open flooding pathways, which could result in submerged safety-related equipment. The licensee completed those draw ing reviews, walk-downs, and corrective actions for all identified unsealed conduits by June 19, 2014, as documented in

Condition Report CR-ANO-C-2014-00259.

Afterwards, the licensee began an internal flooding design review and walk-down to ensure that similar deficiencies were identified and corrected for internal flooding barriers. As part of the effort, the licensee performed embedded conduit drawing reviews for potential internal flooding pathways. On April 6, 2015, the licensee identified an embedded conduit that crossed the Unit 2 auxiliary building external flood boundary with a junction box in the turbine building that should have been identified during the walk-downs completed in 2014. The licensee generated a work order to inspect the junction box, and upon finding that the conduits were unsealed on April 7, 2015, the licensee immediately sealed the conduits and generated Condition Report CR-ANO-2-2015-00716, that documented the unsealed conduits. The unsealed conduits could have allowed water from the turbine building basement to leak into both delay heat removal pump vaults, which were required to be fire-protected. The licensee performed an extent of condition review for other unsealed conduits missed by the 2014 review and found no other unsealed conduits.

The team, on May 7, 2015, noted that Condition Report CR-ANO-2-2015-00716 did not document that the previous external flooding reviews, completed by June 19, 2014, had failed to identify and correct the unsealed conduit. Therefore, the team identified that the embedded conduit drawing reviews performed under CR-ANO-C-2014-00259 were inadequate due to a human performance error. Specifically, in 2014, the drawing reviewer had failed to recognize a junction box on a drawing and the licensee failed to ensure that further reviews or walk-downs would identify errors. As a result of the licensee's failure to identify the human performance error in the 2014 review, or subsequent to the April 6, 2015, discovery, the licensee failed to evaluate the human performance error to ensure that future embedded conduit drawing reviews were adequate and that the extent of condition was fully identified.

The technical issue associated with this finding-the licensee's failure to maintain the auxiliary building flood protection in accordance with the design basis-constituted additional examples of violation VIO 05000313;05000368/2014009-01 (EA-14-088),

which was documented in Inspection Reports 2013011, 2013012, 2014009, and 2014010. In accordance with Section 1.3.6 of the NRC Enforcement Policy, these additional examples will not be cited separately. Further corrective actions for this additional example are expected to be taken in conjunction with corrective actions for the previously cited violation. The licensee's response to VIO 05000313;05000368/2014009-01, which is associated with a finding of substantial safety significance (Yellow), is discussed in Section 4OA2.6.b below.

Analysis.

Failure to identify and correct a condition adverse to quality as required by 10 CFR Part 50, Appendix B, Criterion XVI, and Procedure EN-LI-102 was a performance deficiency. This performance deficiency was more than minor because if left uncorrected, it could become a more significant safety concern. Specifically, the continued failure to identify all unsealed flooding penetrations could result in continued exposure of risk-significant equipment in the auxiliary building to flooding. This finding was associated with the Mitigating Systems cornerstone using Inspection Manual Chapter 0609, Appendix A. The team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. This finding has a human performance cross-cutting aspect associated with teamwork, in that the licensee failed to communicate and coordinate their activities within and across organization boundaries to ensure that nuclear safety was maintained (H.4).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires in part that the licensee shall establish measures to assure that conditions adverse to quality are promptly identified and corrected. Contrary to this requirement, from June 19, 2014, through April 7, 2015, the licensee failed to establish measures to ensure that a condition adverse to quality was promptly identified and corrected.

Specifically, the licensee failed to identify and correct unsealed penetrations into the Unit 2 auxiliary building, which is designed to be watertight. These unsealed penetrations were below the design flood level. The licensee corrected this condition by sealing the penetrations. Because this violation is of very low safety significance (Green) and was entered into the licensee's corrective action program as Condition Report CR-ANO-C-2015-01431, this violation is being treated as a non-cited violation (NCV), consistent with Section 2.3.2.a of the Enforcement Policy:

NCV 05000368/2015008-03, "Inadequate Extent of Condition Review for Risk-Significant Condition."

d. Failure to Promptly Identify and Correct Breaker Auxiliary Switch Binding

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the failure to promptly identify and correct a condition adverse to quality. Specifically, the licensee failed to promptly correct a design deficiency with breaker auxiliary contact switches that resulted in binding and could result in incorrect interlock signals to other equipment.

Description.

The licensee's breaker auxiliary (STA) switches provide interlocks between breakers' position and other equipment. Since 2008, the licensee has experienced multiple instances of the switches' plungers binding, which could send an incorrect interlock signal. The majority of failures have occurred during testing, with no consequences. However, as documented in Condition Report CR-ANO-1-2008-02379, CA-8, the licensee recognized that bound switches could have potentially significant effects, depending upon the circumstances, including bus lockouts or safety-related equipment that could fail to automatically start.

On December 10, 2010, in Condition Report CR-ANO-C-2010-00912, CA-9, the licensee documented, "A disadvantage to the ANO fix is that it addresses the symptoms, not the cause. It will still allow the STA shaft to flex and impact the STA bushing during a breaker close event, but it will minimize the chance for bushing damage to occur and thus minimize the chance for binding to occur." The team noted that the cause of the issue is an inadequate design, in that wear of the switches, combined with high friction points, allows the switches to bind. The licensee implemented corrective actions to lower friction in the switch operator, which addressed the symptoms, in the fall of 2011.

However, in 2013, as documented in Condition Reports CR-ANO-1-2013-01875 and CR-ANO-1-2013-02551, all three feeder breakers for non-vital bus A-1 experienced STA failures during testing. The licensee has commenced switch replacements, but has failed to justify the timing of the replacements, and the low margin between friction and available force inherent to the current switch design may result in additional switch failures-and therefore reduced breaker reliability-before corrective actions are complete.

Analysis.

The licensee's failure to promptly correct a condition adverse to quality as required by 10 CFR Part 50, Appendix B, Criterion XVI, was a performance deficiency. The licensee failed to promptly correct a design deficiency with breaker auxiliary contact switches that resulted in binding and failed breaker interlocks. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events. Specifically, the untimely corrective actions have reduced the reliability of breaker interlocks, which may cause bus lockouts or safety-equipment that could fail to automatically start. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or

functionality of any system or train and did not screen as risk-significant in response to external events. The licensee has taken corrective actions to lessen the probability of bound switches by aligning shafts and lubricating bearing surfaces. This finding has a human performance cross-cutting aspect associated with consistent process in that the licensee failed to use risk insights in a systematic approach to make decisions (H.13).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," states, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. Contrary to the above, as of May 15, 2015, the licensee failed to promptly correct a condition adverse to quality. Specifically, from 2008 to present, the licensee has failed to correct an identified design deficiency with breaker auxiliary contact switches that can result in bound switches and incorrect interlock signals to other equipment. The licensee has taken corrective actions to lessen the probability of bound switches by aligning shafts and lubricating bearing surfaces, and plans to address the design deficiency by replacing the switches with a new design. The licensee entered this issue into its corrective action program as Condition Report CR-ANO-C-2015-01569. This violation is being treated as a non-cited violation (NCV), consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000368/2015008-04, "Failure to Promptly Correct Breaker Auxiliary Switch

Binding."

e. Failure to Identify, Document, and Mitigate Risk from Long Term Deficient Conditions

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to identify, document, and mitigate risk from long-term deficient conditions, as required by the Procedure EN-LI-102, "Corrective Action Program," Revision 24.

Description.

Procedure EN-LI-102, "Corrective Action Program," Revision 24, requires that the licensee document the risk to plant operation imposed by long-term deficient conditions and how the risk is reduced to an acceptable level for the duration of the action plan. The licensee uses two similar forms to accomplish this: Attachment 9.8, "CR Periodic Review Form," is used yearly for open condition reports on safety-related equipment; Attachment 9.9, "Long Term Corrective Action Classification Form," is used for corrective actions planned at least six months after initiation for both non-safety and safety-related equipment.

The team identified three examples of the licensee's failure to identify, document, and mitigate the risk from the long-term deficient conditions:

• On March 31, 2013, startup transformer 3, a Unit 2 off-site power source locked out due to water intrusion to the bus work, as documented in Condition Report CR-ANO-2-2013-00565. The licensee currently plans to correct the issue and its extent of condition by modifying the bus work from startup transformers 2 and 3 and the auxiliary transformer so that water intrusion will not cause a fault. The licensee currently plans to complete the corrective action in 2016, so the licensee has designated it as a long-term corrective action. However, in the long-term corrective action evaluation process, the licensee failed to implement compensatory measures that would mitigate water intrusion and a potential risk-significant event until permanent corrective actions were in place. This was documented in Condition Report CR-ANO-C-2015-01205 and compensatory measures were put in place. The team concluded that the licensee had inadequately mitigated risk to the plant until corrective actions were in place.

• On August 23, 2010, as documented by Condition Report CR-ANO-2-2010-01796, Unit 2 operators performed a technical specification-required shut down, because the B emergency diesel generator was inoperable longer than the allowed outage time. The licensee determined that the diesel could not perform its safety function due to a positive crankcase pressure. The licensee performed a root cause evaluation, but could not identify a definitive cause for the positive crankcase pressure. However, an engine overhaul corrected the condition. The root cause also identified that the nearly identical Unit 2 A emergency diesel generator was susceptible to the same condition. The licensee initiated corrective actions to overhaul the A diesel to prevent the diesel from potentially developing positive crankcase pressure. However, the licensee subsequently extended the 20-year overhaul of the A engine from 2011 to September 2015. The licensee documented in a periodic review form on February 22, 2015, that there is no additional risk to the plant because the A diesel is showing no signs of degrading vacuum. However, the team identified that this logic contradicted the licensee's root cause evaluation, which noted that there were no signs of degrading vacuum on diesel B before the failure, so an impending failure of the A diesel couldn't be predicted by trending vacuum. Therefore, the team concluded that the licensee had inadequate justification to extend the corrective action plan from 2011 to 2015.

• On January 20, 2014, the licensee documented in Condition Report CR-ANO-C-2014-00166 that the alternate-ac diesel generator, a risk-significant non-safety-related power source, had not been maintained in accordance with its risk-significance. The licensee determined that part of the condition was that the engine had a preventative maintenance strategy based upon a frequently run engine, but that the alternate-ac diesel generator was a standby machine that was run only infrequently. The licensee determined that the engine's soft parts, such as gaskets, likely needed to be replaced based on time and not engine hours. The licensee documented, in a periodic review form on July 15, 2014, that there was no risk to plant operation because the corrective action plan was associated with administrative changes and not the repair of degraded equipment. However, the team noted that in 2009, the licensee documented the need to replace soft parts on the engine due to their age and projected that it would be prudent to replace them by 2015. In addition, the team noted that the 2010 Unit 2 emergency diesel generator crankcase vacuum root cause, as discussed above, listed the alternate ac diesel generator as susceptible to crankcase pressure concerns due to soft parts on the diesel and because the diesel has a positive crankcase pressure trip. However, as of May 15, 2015, the licensee had not identified any updated preventative maintenance strategy and had not performed any inspections on the engine or researched internal or external operating experience reviews to identify if there needed to be any short-term preventative maintenance while finalizing the corrective action plan. Therefore, the team concluded that the licensee had failed to ensure that risk was reduced to an acceptable level while the licensee was evaluating corrective actions.

Analysis.

The failure to identify, document, and mitigate risk from long-term deficient conditions, as required by Procedure EN-LI-102, "Corrective Action Program," Revision 24, was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because if left uncorrected, it would have the potential to lead to a more significant safety concern. Specifically, the delayed corrective actions and unmitigated deficiencies could reduce the reliability of the Unit 2 emergency diesel generator A, alternate ac diesel generator, and Unit 2 non-vital switchgear. This finding is associated with the Mitigating Systems cornerstone. Using Inspection Manual Chapter 0609, Appendix A, the team determined that the finding was of very low safety significance (Green) because it did not result in the loss of operability or functionality of any system or train and did not screen as risk-significant in response to external events. This finding has a human performance cross-cutting aspect associated with conservative bias in that the licensee failed to use decision-making practices that emphasize prudent choices over those that are simply allowable and failed to determine that a proposed action was safe in order to proceed, rather than unsafe in order to stop (H.14).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," requires in part that activities affecting quality shall be prescribed by documented procedures and shall be accomplished in accordance with these procedures. Procedure EN-LI-102, "Corrective Action Program," Revision 24, a procedure for activities affecting quality, Attachment 9.8, "CR Periodic Review Form," and Attachment 9.9, "Long Term Corrective Action Classification Form," require that the licensee document the risk to plant operation imposed by the condition and how the risk is reduced to an acceptable level for the duration of the action plan. Contrary to the above, as of May 15, 2015, the licensee failed to accomplish activities affecting

quality in accordance with Procedure EN-LI-102. Specifically, from 2010 to present, with three examples, the licensee has failed to document the risk to plant operation imposed by the conditions and how the risk is reduced to an acceptable level for the duration of the action plan. The licensee has taken corrective actions by initiating Condition Report CR-ANO-2015-01571 and updating the corrective action plans. This violation is being treated as a non-cited violation (NCV), consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000368/2015008-05, "Failure to Identify, Document, and Mitigate Risk from Long Term Deficient Conditions."

.6 Review of Open Risk-Significant Findings

a. (Discussed) VIO 05000313/2013012-04 (EA-14-008), Unit 1 - Failure to Follow the Materials Handling Program during the Unit 1 Generator Stator Move, and VIO 05000368/2013012-05, Unit 2 - Failure to Follow the Materials Handling Program during the Unit 1 Generator Stator Move

On April 5, 2013, the NRC chartered an Augmented Inspection Team (AIT) to review the circumstances surrounding the March 31, 2013, failure of a temporary lifting rig, dropping the 525-ton Unit 1 main generator stator. This stator drop resulted in a loss of offsite power for ANO Unit 1, a reactor trip and partial loss of offsite power for ANO Unit 2, and structural damage to the turbine building and portions of the fire suppression

systems. On June 7, 2013, following the AIT's inspection, the NRC documented Unresolved Item (URI)05000313/2013011-09 associated with the licensee's implementation of its material handling program. On March 24, 2014, the NRC closed this unresolved item to Apparent Violations (AVs)05000313/2013012-04 and 05000368/2013012-05, in which the NRC determined that the licensee failed to implement requirements contained in Procedure EM-MA-119. On June 6, 2014, the NRC issued a final significance determination and notice of violation with Inspection Report 2014008, concluding that the findings associated with these violations were of substantial safety significance (Yellow).

The licensee initiated Condition Report CR-ANO-C-2013-0888 in March 2013 to document the collapse of the lift rig. The root cause evaluation performed under this condition report was approved in July 2013. The licensee's evaluation identified root causes that the organization that was subcontracted to perform the lift of the stator failed to perform load testing of lift assembly prior to use at ANO, and that the subcontractor's design of the temporary lift assembly did not ensure that the lift assembly could support the loads anticipated for the lift. Corrective actions included

revising Procedure EN-DC-114 "Project Management" to ensure that contract requirements are in place to ensure that calculations, quality requirements, and standards are provided for internal and third party review when specially designed temporary lift assemblies are to be used, as well as revising Procedure EN-MA-119, "Material Handling Program," to require that a detailed engineering response be developed to evaluate the use of lifting equipment.

However, as discussed in Sections 4OA2.1.b.1 and

.2 above, the licensee initially failed to evaluate for and identify organizational and programmatic causes associated with licensee performance.

Instead, the evaluation was focused on contractor performance.

Over a year after the initial root cause evaluation was approved by the corrective action review board, and approximately six months after the NRC documented the licensee's failure to follow its material handling program procedure requirements, the licensee initiated Condition Report CR-ANO-C-2014-02318 in September 2014 to evaluate the how the station's performance may have contributed to the event.

In the root cause evaluation performed under Condition Report CR-ANO-C-2014-2318, the licensee identified root causes that the stator rewind project did not include sufficient oversight of the vendor's design and testing for the temporary lift assembly and did not provide for adequate oversight of supplemental personnel involved with the project, as well as that Procedure EN-DC-114, "Project Management" provided insufficient guidance to identify and manage risk items with high consequence, resulting in a failure to identify the level of risk associated with structural design of the stator lift assembly and an appropriate risk mitigation strategy. The licensee's corrective action plan included several corrective actions in addition to those associated with the Condition Report CR-ANO-C-2013-0888 root cause evaluation that had previously been implemented. These actions included revising project management Procedures EN-FAP-PM-003 and 004, which superseded Procedure EN-DC-114, to ensure that:

(1) projects are organized and managed with effective support by subject matter experts and effective vendor and technical oversight, and

(2) high consequence risks are properly identified and eliminated/mitigated through a structured risk management process. Additional corrective actions included issuing a revised Procedure EN-OM-126, "Management and Oversi ght of Supplemental Personnel," to establish improved processes for oversight of supplemental personnel, as well as conducting reviews of ongoing and planned site projects to ensure effective measures for risk management and oversight of contracted technical services are in place and being maintained.

The team reviewed the licensee's root cause evaluations and its completed and planned corrective actions. Several observations, including discussion of the extent of condition and extent of cause reviews performed as part of the cause evaluations, are documented in Section 4OA2.1.b.2 above.

The NRC will further review the licensee's evaluation of these issues and response to these risk-significant findings during a future supplemental inspection. Violations VIO 05000313/2013012-04 and VIO 05000368/2013012-05 remain open.

b. (Discussed) VIO 05000313;05000368/2014009-01 (EA-14-088), Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings

On April 5, 2013, the NRC chartered an Augmented Inspection Team (AIT) to review the circumstances surrounding the March 31, 2013, failure of a temporary lifting rig, dropping the 525-ton Unit 1 main generator stator. This stator drop resulted in a loss of offsite power for Arkansas Nuclear One, Unit 1, a reactor trip and partial loss of offsite power to Arkansas Nuclear One, Unit 2, and structural damage to the turbine building and portions of the fire suppression systems. On June 7, 2013, following the AIT's inspection, the NRC-documented Unresolved Item (URI)05000313/2013011-05 associated with the effectiveness of the licensee's design and maintenance of flood barriers. On September 9, 2014, the NRC closed this unresolved item to Apparent Violation (AV) 05000313;05000368/2014009-01. On January 22, 2015, the NRC issued a final significance determination and notice of violation with Inspection Report 2014010, concluding that the finding associated with the violation was of substantial safety significance (Yellow).

The team reviewed the licensee's evaluation of this deficiency and its corrective actions, which were still in progress. The licensee's evaluation and corrective actions are discussed in Sections 4OA2.1.b.1 and 4OA2.5.c above. Section 4OA2.5.c also documents an additional example of the licensee's failure to adequately design, construct, and maintain flooding barriers.

The NRC will further review the licensee's evaluation of this issue and response to this finding during a future supplemental inspection. Violation VIO 05000313;05000368/2014009-01 remains open.

4OA6 Meetings, Including Exit

On May 15, 2015, the team presented the inspection results to Mr. J. Browning, Site Vice President, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the team had been returned or destroyed.

ATTACHMENTS: 1. Supplemental Information 2. Information Request

3. Supplemental Information Request

A1-

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Bice, Senior Licensing Specialist

L. Blocker, Nuclear Oversight Manager

J. Browning, Site Vice President

P. Butler, Design Engineering Manager

T. Chernivec, Performance Improvement Manager

D. Edgell, System Engineering Manager

R. Gordon, Sr. Manager, Site Projects and Maintenance Services

J. Hines, Coordinator Equipment Reliability

B. Hollowoa, Superintendent, Site Projects

N. Jones, System Engineer

R. Knight, Shift Manager Unit 2

D. Macphee, Design Engineer

L. Marvin, Employee Concerns Program Manager

S. Morriss, Chemistry Supervisor

J. Oliver, EFIN Supervisor

D. Pehrson, Assistant Operation Manager Unit 1

S. Pyle, Regulatory Assurance Manager

P. Rehm, Engineering Department Performance Improvement Coordinator

J. Sieter, Sr. Licensing Specialist

M. Stang, Electrical Coordinator

G. Stephenson, Performance Improvement Specialist

J. Stroud, Electrical and I&C Supervisor

G. Sullins, Site Recovery Manager

K. Talbert, Electrical Superintendent

N. Van Wie, Regulatory Assurance

D. Vest, System Engineer

T. Woodson, NSSS Supervisor

NRC Personnel

M. Keefe, Human Factors Specialist

M. Young, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000368/2015008-01 NCV Failure to Properly Implement Procedures for Writing Procedures Important to Safety (Section 4OA2.5.a)

05000368/2015008-02 NCV Failure to Correct Containment Spray Pump Interlock to Shutdown Cooling Heat Exchanger Room Coolers (Section 4OA2.5.b)

Opened and Closed

05000368/2015008-03 NCV Inadequate Extent of Condition Review for Risk-Significant

Condition (Section 4OA2.5.c)

05000368/2015008-04 NCV Failure to Promptly Correct Breaker Auxiliary Switch Binding (Section 4OA2.5.d)

05000368/2015008-05 NCV Failure to Identify, Document, and Mitigate Risk from Long-Term Deficient Conditions (Section 4OA2.5.e)

Discussed

05000313/2013012-04 VIO Unit 1 - Failure to Follow the Materials Handling Program

during the Unit 1 Generator Stator Move (Section 4OA2.6.a)

05000368/2013012-05 VIO Unit 2 - Failure to Follow the Materials Handling Program

during the Unit 1 Generator Stator Move (Section 4OA2.6.a)

05000313/2014009-01 &

05000368/2014009-01

VIO Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings (Section 4OA2.6.b)