ML17271A431

Diablo Canyon Power Plant - NRC Supplemental Inspection Report and Assessment Follow-Up Letter; 05000275/2017008 and 05000323/2017008

ML17271A431
Person / Time
Site:	Diablo Canyon
Issue date:	09/27/2017
From:	Pruett T W NRC/RGN-IV/DRP
To:	Halpin E D Pacific Gas & Electric Co
T. PRUETT
References
EA-16-168 IR 2017008
Download: ML17271A431 (22)

See also: IR 05000275/2017008

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 1600 E. LAMAR BLVD. ARLINGTON, TX 76011-4511 September 27, 2017 EA-16-168 Mr. Edward D. Halpin Senior Vice President and Chief Nuclear Officer Pacific Gas and Electric Company Diablo Canyon Power Plant P.O. Box 56, Mail Code 104/6 Avila Beach, CA 93424 SUBJECT: DIABLO CANYON POWER PLANT - NRC SUPPLEMENTAL INSPECTION REPORT AND ASSESSMENT FOLLOW-UP LETTER; 05000275/2017008 AND 05000323/2017008 Dear Mr. Halpin: On June 15, 2017, the NRC completed the on-site portion of a supplemental inspection using Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." On September 21, 2017, the NRC inspection team discussed the results of this inspection with Mr. J. Welsch and other members of your staff. The results of this inspection are documented in the enclosed report. The NRC performed this inspection to review your station's actions in response to a White finding in the Mitigating Systems cornerstone which was documented in NRC Inspection Reports 05000275/2016010 and 05000323/2016010, dated October 3, 2016, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML16277A340), and finalized in a letter to you from Kriss Kennedy, Regional Administrator, dated December 28, 2016 (ADAMS Accession No. ML16363A429). On May 3, 2017, you informed the NRC that your station was ready for the supplemental inspection. The NRC inspectors did not identify any finding or violation of more than minor significance. The NRC determined that your staff's cause evaluations were not performed to the depth and breadth described in Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." Your staff did not perform root cause evaluations to a level of detail commensurate with the significance of the problem (White finding). In particular, the questioning process concluded prior to the causes identified being beyond your control as described in Section 03.03.b of Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." Had continued questioning occurred, additional organizational and programmatic causes associated with the failure to provide supervisory oversight and the failure to provide adequate guidance for developing work instructions would

E. Halpin 2 likely have been identified. The additional organizational and programmatic causes would also require the development of corrective actions and effectiveness measures. Therefore, the adequacy of the extent of cause, extent of condition, and corrective actions required to prevent recurrence cannot be assessed until the depth and breadth of the root cause evaluation is fully developed. After reviewing your performance in addressing the White finding, the NRC concluded your actions did not meet the objectives of Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." As a result, in accordance with the guidance in Inspection Manual Chapter (IMC) 0305, "Operating Reactor Assessment Program," the White finding will be held open and will continue to be considered in assessing plant performance until you notify the NRC of your readiness for additional inspection on this issue and the NRC concludes, by inspection, that the objectives of the inspection procedure have been met. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding." Sincerely, /RA/ Troy W. Pruett, Director Division of Reactor Projects Docket Nos. 50-275 and 50-323 License Nos. DPR-80 and DPR-82 Enclosure: Inspection Report 05000275/2017008 and 05000323/2017008 w/ Attachment: Supplemental Information

SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive By: MSH2/dll Yes No Publicly Available Sensitive OFFICE RIV/PBD RIV/PE BC:DRP/A RIV/DRP NAME CPeabody CJewett MHaire TPruett SIGNATURE NON-CONCUR /RA/ /RA/ /RA/ DATE 08/15/17 08/24/17 08/23/17 9/26/17

SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive By: MSH2/dll Yes No Publicly Available Sensitive OFFICE RIV/PBD RIV/PE BC:DRP/A RIV/DRP NAME CPeabody CJewett MHaire TPruett SIGNATURE NON-CONCUR /RA/ /RA/ /RA/ DATE 09/26/17 09/25/17 09/22/17 09/26/17

Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 05000275; 05000323 License: DPR-80; DPR-82 Report: 05000275/2017008; 05000323/2017008 Licensee: Pacific Gas and Electric Company Facility: Diablo Canyon Power Plant, Units 1 and 2 Location: 7 1/2 miles NW of Avila Beach Avila Beach, CA Dates: June 12 through September 21, 2017 Inspectors: C. Peabody, Senior Resident Inspector C. Jewett, Project Engineer Approved By: Troy W. Pruett Director, Division of Reactor Projects

2 SUMMARY IR 05000275/2017008, 05000323/2017008; 06/07/2017 - 09/21/2017; Diablo Canyon Power Plant; Supplemental Inspection - Inspection Procedure 95001 This supplemental inspection was conducted by a senior resident inspector from the Palo Verde Generating Station and a project engineer from NRC's Region IV office. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process." No findings were identified. Cornerstone: Mitigating Systems The NRC determined that the licensee's cause evaluations were not performed to the depth and breadth described in Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." The licensee did not perform root cause evaluations to a level of detail commensurate with the significance of the problem (White finding). In particular, the questioning process concluded prior to the causes identified being beyond the licensee's control as described in Section 03.03.b of Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." Had continued questioning occurred, additional organizational and programmatic causes associated with the failure to provide supervisory oversight and the failure to provide adequate guidance for developing work instructions would likely have been identified. The additional organizational and programmatic causes would also require the development of corrective actions and effectiveness measures. Therefore, the adequacy of the extent of cause, extent of condition, and corrective actions required to prevent recurrence cannot be assessed until the depth and breadth of the root cause evaluation is fully developed. After reviewing the licensee's performance in addressing the White finding, the NRC concluded the licensee's actions did not meet the objectives of Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." As a result, in accordance with the guidance in Inspection Manual Chapter (IMC) 0305, "Operating Reactor Assessment Program," the White finding will be held open and will continue to be considered in assessing plant performance until the licensee notifies the NRC of its readiness for additional inspection on this issue and the NRC concludes, by inspection, that the objectives of the inspection procedure have been met.

3 REPORT DETAILS 4. OTHER ACTIVITIES Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security 4OA4 Supplemental Inspection (95001) .01 Inspection Scope This inspection was conducted in accordance with Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs," to assess the licensee's evaluation of a White finding, which affected the Mitigating Systems Cornerstone in the Reactor Safety Strategic Performance Area. The inspection objectives included the following: Assure that the root causes and contributing causes of the significant performance issues are understood. Independently assess and assure that the extent of condition and extent of cause of significant performance issues are identified. Assure that corrective actions taken to address and preclude repetition of significant performance issues are prompt and effective. Assure that corrective plans direct prompt actions to effectively address and preclude

repetition of significant performance issues. The licensee remained in the Regulatory Response Column (Column 2) of the NRC's Action Matrix in the second quarter of 2017 as a result of one inspection finding of low to moderate safety significance (White). The finding was associated with the failure to establish adequate work instructions for installation of NamcoŽ Snap Lock limit switches. Specifically, the licensee failed to provide site-specific instructions for limiting the travel of these external limit switches when installed on safety-related motor operated valves (MOVs). Consequently, the lever switch actuator for valve RHR-2-8700B, residual heat removal pump 2-2 suction from the refueling water storage tank, was operated repeatedly in an over-travel condition resulting in a sheared internal roll pin that ultimately caused the limit switch to fail. The NRC staff characterized this issue as having low to moderate safety significance (White), as documented in NRC

Inspection Report 05000275; 05000323/2016010, dated October 3, 2016, (ADAMS Accession No. ML16277A340), and updated in a letter to E. Halpin from K. Kennedy, dated December 28, 2016, (ADAMS Accession No. ML16363A429). On May 3, 2017, the licensee informed the NRC that they were ready for the supplemental inspection. In preparation for the inspection, the licensee performed root cause evaluation (RCE) 50886801 to address the performance deficiency associated with the White finding. The licensee provided revision 1A of the report, completed in April 2017, to the inspectors for review. This evaluation determined two root causes for the White finding. The first root cause identified that Electrical Maintenance leadership was not ensuring that workers perform procedures as written. The second root cause identified that guidance for

4 determining Maintenance Verification Testing work instructions in the electrical maintenance procedures writing process was not sufficient. In addition, the licensee performed RCE 50870357 to address why a probabilistic risk assessment (PRA)-significant component failure was not recognized in a timely manner. The licensee provided revision 2 of RCE 50870357, completed in October 2016, to the inspectors for review. There were two root causes and one contributing cause identified

for RCE 50870357. The first root cause involved a non-industry standard design feature of the emergency core cooling system (ECCS) interlocks which resulted in a failure mechanism that was not immediately recognizable. Specifically, Diablo Canyon utilizes external limit switches to provide feedback to the ECCS pump suction interlocks, whereas it is more common for nuclear power plants to use the limit switches internal to the valve's motor operator. Having a separate external limit switch provides additional

separation and redundancy in the design, but warrants additional testing and verification beyond the normal MOV testing to ensure that the external limit switch is functioning properly. The second root cause identifieded that the external limit switch was not identified as requiring additional post-maintenance testing to verify proper operation. A similar contributing cause identified that the external limit switches were not identified as requiring additional monitoring which could eliminate missed opportunities to identify degraded conditions. The inspectors reviewed the licensee's two RCE reports and supporting evaluations. The inspectors reviewed corrective actions that were taken or planned to address the identified causes. The inspectors also interviewed licensee personnel to determine whether the root and contributing causes were understood, and whether corrective actions taken or planned were appropriate to address the causes and preclude repetition. .02 Evaluation of the Inspection Requirements 02.01 Problem Identification a. Determine that the evaluation documented who identified the issue and under what conditions the issue was identified. The RHR-2-8700B valve failure event of May 16, 2016, was self-revealing. The initial licensee corrective actions in response to the event failed to identify the performance deficiencies associated with the inadequate level of guidance provided by the maintenance work instructions that constituted the White finding. The NRC inspection effort identified the performance deficiency independently of the efforts of the licensee's corrective action program. This 95001 inspection requirement is closed. b. Determine the evaluation documented how long the issue existed and prior opportunities for identification. The limit switch failed sometime after the last successful stroke test of interlocked valves 2-RHR-8982A and 2-RHR-8982B during the Unit 2, fall 2014 refueling outage. The condition can be reasonably determined to have been introduced at the last maintenance interval during the Unit 2, spring refueling outage of 2013. The misalignment which caused the limit switch to over-travel was not detected during the

5 post-maintenance testing of 2-RHR-8700B. The misaligned switch repeatedly over-traveled during quarterly stroke testing. RCE 50886801 determined that the quarterly stroke testing and other maintenance activities performed on 2-RHR-8700B were missed opportunities to visually identify the misaligned external limit switch. In recognition of the safety significance of the interlocks associated with the external limit switch, involved personnel missed the opportunity to visually inspect the valve and limit switch travel during quarterly stroke testing as a means of validating proper switch alignment. The inspectors noted the licensee also missed opportunities to confirm interlock circuit continuity during valve testing. However, since there was not adequate guidance to include additional procedural direction to check this separate external limit switch or the ECCS interlock circuitry, the deficiency was not identified. The licensee's corrective actions included direction to visually inspect the valve and limit switch travel and circuit continuity during quarterly stroke testing as a means of validating proper switch alignment. Both RCE 50886801 and RCE 50870357 concluded that the physical positioning of the switch adjacent to the building wall, combined with the lack of indication of switch position for the external limit switch and ECCS interlock, made the degradation and failure of the switch unlikely to be identified during quarterly testing of 2-RHR-8700B without the additional guidance to specifically observe operation.

This 95001 inspection requirement is closed. c. Determine that the evaluation documented significant plant-specific consequence, as applicable, and compliance concerns associated with the issue. The licensee conducted RCE 50886801 to address the White finding and RCE 50870357 to address their failure to timely recognize a PRA-signficant component failure. RCE 50870357 addressed plant specific consequences by using PRA information to compile a list of components with elevated failure consequences. These components were flagged in the corrective action program system so that future conditions adverse to quality identified on these components will prompt automated notifications, instructing the initiators to take corrective action in the timeliest manner possible. RCE 50886801 addressed the White finding and restoration of compliance. RCE 50886801 corrective actions (as outlined in Section 02.03.a below) added procedural guidance to ensure the external limit switches are operating correctly and surveillance monitoring of the ECCS interlock circuitry. This 95001 inspection requirement is closed. 02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation a. Determine that the problem was evaluated using a systematic methodology to identify the root and contributing causes. The White finding RCE 50886801 used Comparative Timeline©, Event and Causal Factors Analysis, and a Barrier Analysis. The undetected failure RCE 50870357 used Factor Tree Analysis and ABS Consulting Root Cause MapTM. These cause evaluation tools provided a systematic methodology that can be used to identify the root and contributing causes of the event.

6 No deficiencies were noted with the licensee's selection of root cause methods. This 95001 inspection requirement is closed. b. Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem. The NRC determined that the licensee's cause evaluations were not performed to the depth and breadth described in Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." The licensee did not perform root cause evaluations to a level of detail commensurate with the significance of the problem (White finding). In particular, the questioning process concluded prior to the causes identified being beyond the licensee's control as described in Section 03.03.b of Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." This 95001 inspection requirement will remain open. c. Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience. Both RCEs included a thorough review of internal and external operating experience to search for previous occurrences. No identical failures of ECCS interlocks resulting from external limit switches were identified. There were two instances from early refueling outages in the fall of 1988 and fall of 1989 that identified maintenance difficulties in setting the external limit switches, but no identical service failures were identified. There were six industry operating experience events for over-travel failure of NamcoŽ external limit switches in low safety applications such as plant process systems or alarm and indication functions, but none in applications related to safety system interlocks. As a result of the low safety significance of these operating experience items, the six industry events were characterized as broke/fix conditions rather than formally evaluated under the respective licensees' corrective action program.

This 95001 inspection requirement will remain remain open pending completion of a re-assessment of the licensee's root cause to satisfy Section 02.02.b, above. In particular, the licensee should consider whether there are organizational and programmatic concerns associated with how the licensee dispositions low risk operating experience from other sites that may have risk significance at Diablo Canyon. d. Determine that the root cause evaluation addressed the extent of condition and the extent of cause of the problem. Both RCEs identified the extent of condition as the population of risk significant valves containing NamcoŽ external limit switches which provided input into ECCS or other engineered safety features actuation system (ESFAS) interlocks. The extent of condition identified 8 ECCS valves on each unit, 16 in total, that met this criteria. Extent of condition and extent of cause cannot be fully evaluated at this time because of the determination that the root cause evaluations were not conducted to sufficient depth and breadth. Of particular concern is whether or not organizational and programmatic deficiencies involving management oversight of work activities, operating experience, and guidance documents existed and corrective actions that may be warranted. This 95001 inspection requirement will remain open.

7 e. Determine that the root cause, extent of condition, and extent of cause evaluation appropriately considered the safety culture traits in NUREG-2165, "Safety Culture Common Language," referenced in IMC 0310, "Aspects within Cross-Cutting Areas." Both RCEs contained a safety culture analysis. The White finding RCE 50886801 identified seven safety culture attributes associated with the White Finding. The RCE identified H.2 Field Presence and H.8 Procedure Adherences as safety culture attributes associated with the leadership oversight root cause. RCE 50886801 also identified X.5 Leader Behaviors, X.6 Standards, and X.10 Expectations as supplemental cross cutting aspects associated with the leadership oversight root cause. In addition, RCE 50886801identified H.1 Resources and H.7 Documentation as safety culture attributes associated with the inadequate work instructions root cause. The undetected failure RCE 50870357 identified the H.1 and H.7 assafety culture attributes associated with the inadequate test requirements root cause and the inadequate monitoring contributing cause. No deficiencies were noted in this area, however further revisions of the RCEs could introduce additional safety culture attributes that would require NRC review. This 95001 inspection requirement will remain remain open. f. Examine the common cause analyses for potential programmatic weaknesses in performance when a licensee has a second white input in the same cornerstone. Not applicable; there was not a second White input in the affected cornerstone. 02.03 Corrective Actions Taken a. Determine that appropriate corrective actions are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary. Immediate corrective actions were taken under Notification 50852345 to walk down and visually inspect all of the accessible affected MOVs in the extent of condition population for physical signs of damage to the external limit switch assemblies. Corrective actions taken in response to the White finding RCE 50886801 included the following actions: (1) Establishment of supervisory observation signoffs for maintenance verification testing on NamcoŽ external limit switches. (2) Revision of the Nuclear Procedure Writer's Manual to include specific guidance for

establishing maintenance verification testing in electrical procedures. (3) Revision of MOV maintenance procedures that set and test external limit switches to provide explicit instructions for switch configuration control, as well as switch travel setting and testing. (4) Development and implementation of a dynamic learning activity for Electrical Maintenance MOV crews. Revision of the Pre-outage Just in Time Training module offered to MOV technicians to include operating experience on this event.

8 (5) Revision of the MOV Sizing, Switch Setpoint Determination and Test Evaluation procedure to include the NamcoŽ vendor total travel limits and parameters, as well as associated testing criteria. (6) Education of the Diablo Canyon Power Plant's extended leadership team on this event and recent related human performance events in accordance with the Diablo Canyon Power Plant's Human Performance Reinforcement policy. Corrective actions taken in response to the undetected failure RCE 50870357 included the following actions: (1) Development of a routine check to verify interlock circuit continuity for the RHR 8700A/B valves and their associated external limit switches on a quarterly basis in conjunction with the quarterly valve stroke surveillance. (2) Revision of applicable maintenance procedures to specify direction as appropriate: (a) Inclusion of external limit switch operation data. (b) Specific evaluation of external limit switch and geared limit switch settings. (c) Provide instructions for standardized assembly, configuration, and adjustment of external limit switches. (d) Provide inspection of external limit switch configuration against a set of standardized criteria. (e) Perform visual inspections of the external limit switch with each quarterly valve stroke surveillance test. (f) Apply position indication lamacoids on the 16 extent of condition valves. The actions taken have restored compliance. The revised maintenance procedure work instructions contain adequate and specific guidance to ensure confidence of operability to the affected extent of condition valve population. Subsequent visual inspections and electrical testing of the affected ECCS interlocks has confirmed operability. No deficiencies were noted in this area, however further revisions of the RCEs could introduce additional corrective action items that would require NRC review. This 95001 inspection requirement will remain open. b. Determine that the corrective actions have been prioritized with consideration of significance and regulatory compliance. The licensee's corrective actions have been prioritized with consideration of significance and regulatory compliance. All corrective actions for the White finding RCE 50886801 are completed. There is one remaining corrective action planned for the undetected failure RCE 50870357. This action is to implement a design change to remove the external limit switches associated with the ECCS MOV interlocks. Plans to modify the system to remove the external limit switches will take until Spring 2019 to analyze and implement in order to ensure the modification is conducted in accordance with 10 CFR 50.59 and

9 50.90. In the interim, the licensee added test requirements to electrically verify the condition of the ECCS interlock when valves are stroked quarterly for surveillance testing. During the quarterly stroke tests, the licensee also added visual field inspections of the valve stroke by qualified MOV engineers. As the actions were implemented at the first reasonable opportunity following the White finding, the inspector concluded that the actions were prioritized. No deficiencies were noted in this area, however further revisions of the RCEs could introduce additional corrective action items that would require NRC review to assess

prioritization. This 95001 inspection requirement will remain remain open. c. Determine that corrective actions taken to address and preclude repetition of significant performance issues are prompt and effective. Corrective actions to prevent recurrence (CAPR) of the White finding RCE 50886801 included the following: (1) Establishment of supervisory observation signoffs for maintenance verification testing on NamcoŽ external limit switches. (2) Revision of the Nuclear Procedure Writer's Manual to include specific guidance for establishing maintenance verification testing in electrical procedures. (3) Revision of MOV maintenance procedures that set and test external limit switches to provide explicit instructions for switch figure configuration control and switch travel setting and testing. Corrective actions to prevent recurrence of the undetected failure RCE 50870357 included the following actions: (1) Development of a routine check to verify interlock circuit continuity for the RHR 8700A/B valves and their associated external limit switches on a quarterly basis; which was performed concurrent with the quarterly valve stroke surveillance. (2) Revision of applicable maintenance procedures to specify direction as appropriate: (a) Inclusion of external limit switch operation data. (b) Specific evaluation of external limit switch and geared limit switch settings. (c) Provide instructions for standardized assembly, configuration, and adjustment of external limit switches. The corrective actions taken to address and preclude repetition of significant performance issues were prompt and effective. All but one CAPR is completed, and that action has a corresponiding interim CAPR to monitor the interlock directly. The CAPRs implemented have restored regulatory compliance and demonstrated operability for the affected ECCS interlocks. No deficiencies were noted in this area, however further revisions of the RCEs could introduce additional CAPR items that would require NRC review to assess effectiveness. This 95001 inspection requirement will remain remain open.

10 d. Determine that each Notice of Violation (NOV) related to the supplemental inspection is adequately addressed, either in corrective actions taken or planned. Corrective actions taken thus far have restored compliance with Technical Specification 5.4.1.a., "Procedures." The licensee has made applicable and appropriate revisions to the maintenance procedures pertaining to VIO 05000323/2016010-01. The licensee has taken steps to ensure that there are no additional failures in the extent of condition valve population. As outlined above, surveillance testing of the affected valves has been enhanced to provide additional means of verification, including visual testing of proper external limit switch operation and electrical circuit verification of the associated ECCS interlock function.

This 95001 inspection requirement is closed. 02.04 Corrective Action Plans a. Determine that appropriate corrective action plans are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary. Determine that the corrective action plans have been prioritized with consideration of significance and regulatory compliance. All corrective actions for the White finding RCE 50886801 are completed. There is one remaining corrective action planned for the undetected failure RCE 50870357. This action is to implement a design change to remove the external limit switches associated with the ECCS MOV interlocks. This design change is expected to be implemented during the respective unit refueling outages in the spring 2018 and the spring 2019. Corrective actions taken thus far have been appropriate. Corrective actions taken and planned have been prioritized with consideration of safety significance and regulatory compliance. The interim actions to verify the design basis of the ECCS interlocks and NamcoŽ external limit switches provide a reliable means of maintaining safety and regulatory compliance. This 95001 inspection requirement will remain remain open pending completion of a re-assessment of the licensee's root cause to satisfy Section 02.02.b, above. b. Determine that corrective plans direct prompt actions to effectively address and preclude repetition of significant performance issue. All corrective actions to prevent recurrence under White finding RCE 50886801 are completed. The remaining actions planned for the undetected failure RCE 50870357 to modify the system by removing the external limit switches have corresponding interim actions in place to verify the ECCS interlocks associated with the NamcoŽ external limit switches are functioning properly. This 95001 inspection requirement will remain remain open pending completion of a re-assessment of the licensee's root cause to satisfy Section 02.02.b, above.

11 c. Determine that appropriate quantitative or qualitative measures of success have been developed for determining the effectiveness of planned and completed corrective actions. The White finding RCE 50886801 specified the following effectiveness evaluations: (1) Procedure use and adherence - Targeted supervisory observations during outages and online; review of station and department level events for procedure use and adherence as a causal factor; and quick hit self-assessments. (2) Procedure writers guide changes - 100 percent review of maintenance procedure revisions, as well as interviews with maintenance procedure writers to confirm understanding of the writers guide changes. The undetected failure RCE 50870357 specified the following effectiveness evaluations: (1) Design verification testing and return to service following the design change modification to remove the external limit switches from the ECCS interlocks. (2) During outages 1R20 and 2R20, satisfactory verifications of the setting, testing, and adjustment of affected NamcoŽ external limit switches. (3) Satisfactory testing of the interlock circuit continuity testing during the quarterly surveillance testing. The success measures for RCE 50886801 were appropriate and provide qualitative measures of success of the corrective actions taken. RCE 50870357 effectiveness measures are satisfactory; the second and third criteria provide appropriate effectiveness measures until the modifications associated with the first criteria are implemented. This 95001 inspection requirement will remain remain open pending completion of a re-assessment of the licensee's root cause to satisfy Section 02.02.b, above. d. Determine that each Notice of Violation (NOV) related to the supplemental inspection is adequately addressed in corrective actions taken or planned. As discussed in Section 02.03.d (above), the corrective actions have restored compliance with Technical Specification 5.4.1.a., "Procedures." for which the NOV was issued associated with the White finding. This 95001 inspection requirement is closed. 02.05 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues. Not applicable; the performance deficiency associated with the White finding does not warrant treatment as an old design issue. This 95001 inspection requirement is closed.

12 03.00 Inspection Results Summary The NRC determined that the licensee's cause evaluations were not performed to the depth and breadth described in Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." The licensee did not perform root cause evaluations to a level of detail commensurate with the significance of the problem (White finding). In particular, the questioning process concluded prior to the causes identified being beyond the licensee's control as described in Section 03.03.b of Inspection Procedure 95001, "Supplemental Inspection Response to Action Matrix Column 2 Inputs." Had continued questioning occurred, additional organizational and

programmatic causes associated with the failure to provide supervisory oversight and

the failure to provide adequate guidance for developing work instructions would likely have been identified. The additional organizational and programmatic causes would also require the development of corrective actions and effectiveness measures. Therefore, the adequacy of the extent of cause, extent of condition, and corrective actions required to prevent recurrence cannot be assessed until the depth and breadth of the root cause evaluation is fully developed. The status of the inspection requirements of Inspection Procedure 95001 have been categorized below. Requirements held open in entirety by this inspection will require a full re-evaluation by NRC inspectors at a later date. Requirements held open for changes only are those for which no deficiencies were noted during this inspection but may be impacted, and therefore require additional review, as a result of revisions to the licensee's RCEs. In this instance, only the changes added by future revisions of the RCEs will have to be evaluated by NRC inspectors at a later date. Requirements closed by this inspection effort will require no additional inspection effort. 03.01 Inspection Requirements Held Open in Entirety 02.02b Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem 02.02d Determine that the root cause evaluation addressed the extent of condition and the extent of cause of the problem 03.02 Inspection Requirements Held Open for Changes Only 02.02c Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience 02.02e Determine that the root cause, extent of condition, and extent of cause evaluation appropriately considered the safety culture traits in NUREG-2165, "Safety Culture Common Language," referenced in IMC 0310, "Aspects within Cross-Cutting Areas" 02.03a Determine that appropriate corrective actions are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary 02.03b Determine that the corrective actions have been prioritized with consideration of significance and regulatory compliance

13 02.03c Determine that corrective actions taken to address and preclude repetition of significant performance issues are prompt and effective 02.04a Determine that appropriate corrective action plans are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary. Determine that the corrective action plans have been prioritized with consideration of significance and

regulatory compliance 02.04b Determine that corrective plans direct prompt actions to effectively address and preclude repetition of significant performance issue 02.04c Determine that appropriate quantitative or qualitative measures of success have been developed for determining the effectiveness of planned and completed corrective actions 03.03 Inspection Requirements Closed 02.01a Determine that the evaluation documented who identified the issue and under what conditions the issue was identified 02.01b Determine the evaluation documented how long the issue existed and prior opportunities for identification 02.01c Determine that the evaluation documented significant plant-specific consequence, as applicable, and compliance concerns associated with the

issue 02.02a Determine that the problem was evaluated using a systematic methodology to identify the root and contributing causes 02.02f Examine the common cause analyses for potential programmatic weaknesses in performance when a licensee has a second white input in the same cornerstone 02.03d Determine that each Notice of Violation (NOV) related to the supplemental inspection is adequately addressed, either in corrective actions taken or planned 02.04d Determine that each Notice of Violation (NOV) related to the supplemental inspection is adequately addressed in corrective actions taken or planned 02.05 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues

14 4OA6 Meetings, Including Exit Exit Meeting Summary On September 21, 2017, the inspectors presented the inspection results to Mr. J. Welsch, Site Vice President, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

Attachment SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT Licensee Personnel T. Baldwin, Director, Nuclear Site Services J. Cheek, MOV Program Engineer D. Evans, Director, Security & Emergency Services M. Fraunheim, Manager Nuclear Performance Improvement P. Gerfen, Senior Director Plant Manager M. Ginn, Manager, Emergency Planning E. Halpin, Sr. Vice President, Chief Nuclear Officer Generation H. Hamzehee, Manager, Regulatory Services A. Heffner, NRC Interface, Regulatory Services J. Hinds, Director, Quality Verification L. Hopson, Director Maintenance Services T. Irving, Manager, Radiation Protection K. Johnston, Director of Operations M. McCoy, NRC Interface, Regulatory Services J. Morris, Senior Advising Engineer C. Murry, Director Nuclear Work Management J. Nimick, Senior Director Nuclear Services A. Peck, Director, Nuclear Engineering R. Walthos, Nuclear Engineering Specialist, Principal J. Welsch, Site Vice President NRC Personnel C. Newport, Senior Resident Inspector J. Reynoso, Resident Inspector LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED Discussed 05000323/2016010-01 VIO Failure to Establish Adequate Work Instructions for Installation of NamcoŽ Snap Lock Limit Switches (Section 4OA4) LIST OF DOCUMENTS REVIEWED Section 4OA4: Supplemental Inspection (95001) Procedures Number Title Revision AD1 Administrative Controls Program 17 AD1.ID1 Nuclear Generation Procedure Writer's Manual 30

A-2 Procedures Number Title Revision AD7.ID12 Work Management Process 6 AD7.ID15 On-Line Maintenance Outrage Window Execution 3 AD7.ID16 Tool Pouch and Minor Maintenance 4 AD7.ID2 Daily Notification Review Team (DRT) & Standard Plant Priority Assignment Scheme 27 AD7.ID4 On-line Maintenance Scheduling 25 AWP E-027 Motor Operated Valve Sizing, Switch Setpoint Determination and Test evaluation 4 MA1.DC58 Troubleshooting Evidence Preservation and Forensic Analysis 1 MP E-53.10A Preventive Maintenance of Limitorque Motor Operators 41 MP E-53.10A1 Low Impact External Inspections of Limitorque Motor Operators 2 MP E-53.10R Augmented Stem Lubrication for Limitorque Operated Valves 9 MP E-53.10S Limitorque Swap-Out and Switch Settings 14 MP-E-53.10V1 MOV Diagnostic Testing 18 OM15.ID8 Human Performance Error Prevention Tools 7 OM7.ID1 Problem Identification and Resolution 49A OM7.ID3 Root Cause Evaluation 45 OM7.ID4 Cause Determinations 36 OM7.ID7 Emerging Issue and Event Investigations 18A OP1.DC18 Authorization of Test Equipment Operation, Maintenance, and Testing 11 OP2.ID1 Clearances 39 PEP V-7B Test of ECCS Valve Interlocks 10 PRA 17-02 Probabilistic Risk Assessment 1 STP V-2B2 Exercising and Position Verification of Valves 9003A and 9003B Unit 2 0 STP V-2B2 Exercising and Position Verification of Valves 9003A and 9003B Unit 1 16 STP V-2D2A Exercising and Position Verification of Valve 8700A Unit 2 0 STP V-2D2A Exercising and Position Verification of Valve 8700A Unit 1 3

A-3 Procedures Number Title Revision STP V-2D2B Exercising and Position Verification of Valve 8700B Unit 2 0 STP V-2D2B Exercising and Position Verification of Valve 8700B Unit 1 3 STP V-2O6 Exercising and Position Verification of Valves 8982A and 8982B Unit 2 1 STP V-2O6 Exercising and Position Verification of Valves 8982A and 8982B Unit 1 10 STP V-2V1 Exercising and Position Verification of Valves 8804A and 8804B Unit 2 0 STP V-2V1 Exercising and Position Verification of Valves 8804A and 8804B Unit 1 11 TP V-3M5 Exercising Valves RHR-8701 and RHR-8702, Reactor Coolant Loop 4 to RHR Pump Suction 16 Notifications 50852345 50870357 50923338 50923339 50857553 50874911 50886801 50871499 50910294 50908100 50915340 50891772 50906150 50906119 50915775 50893249 50874463 50875300 50866497 50872919 50913951 50891005 50910293 50891005 Miscellaneous Documents Number Title Revision / Date Cause Determination Manual May 18, 2017 2016 Maintenance Audit November 7, 2016 HUJITDC055 JITT Validating Assumptions April 20, 2017 HUJITDC050 Confined Space DLA February 16, 2017 HUJITIS041 Human Performance Training March 29, 2016 JITTEM1604 JITT Pre-Outage MOV Training April 19, 2017 1R20 Supervisor Stand Down May 1, 2017 R165C11 Task Training: Nuclear Operators 0 Program and Process Codes May 2, 2013 Cause Codes

A-4 Miscellaneous Documents Number Title Revision / Date Site Standards Handbook WG-24 NRC Administrative Support 7 WG-7 Reportability Reviews 8 2017-S009-001 Undetected ECCS Interlock Failure April 18, 2017 50870357 Root Cause Evaluation Report Undetected ECCS Interlock Failure 2 50886801 Root Cause Evaluation Report DCPP Inadequate NAMCO Procedure 1A 50913375 95-001 Pre-Inspection Assessment May 3, 2017 130100011 Work Order Preparation January 28, 2013 150360043 Assessment of 1Y19 February 5, 2015 163620001 2017 Fire Protection Audit 1 9000035423 Motor Operated Valve Sizing and Switch Setting Calculations September 30, 2013 Work Orders 60098575 60098576 60098577 60098578 60094730 60094731 60090383 64090172 60100131 64065079 LIST OF ACRONYMS ADAMS Agencywide Document Access and Management System CAPR corrective action to prevent recurrence CFR Code of Federal Regulations ECCS emergency core cooling system ESFAS engineered safety features actuation system MOV motor-operated valve PRA probabilistic risk assessment RCE Root Cause Evaluation RCS reactor coolant system RHR residual heat removal