IR 05000259/2014010

IR 05000259-14-010 and 05000260-14-010, April 7, 2014 Through April 11, 2014, Browns Ferry, Supplemental Inspection Report

ML14135A387
Person / Time
Site:	Browns Ferry
Issue date:	05/15/2014
From:	Bartley J Reactor Projects Region 2 Branch 6
To:	James Shea Tennessee Valley Authority
References
IR-14-010
Download: ML14135A387 (28)

Text

UNITED STATES May 15, 2014

SUBJECT:

BROWNS FERRY NUCLEAR PLANT - NRC SUPPLEMENTAL INSPECTION REPORT 05000259/2014010 AND 05000260/2014010

Dear Mr. Shea:

On February 17, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Browns Ferry Nuclear Plant Units 1, 2, and 3. Based on the results of this inspection, documented in NRC Inspection Report (IR) 05000259/2012007, 05000260/2012007, 0500296/2012007 (ADAMS Accession No. ML12150A219) on May 18, 2012, and the final significance determination documented in NRC IR 05000259/2012013, 05000260/2012013, and 05000296/2012013 (ADAMS Accession No. ML12226A647) on August 13, 2012, the NRC assigned a white finding Action Matrix input associated with Safe Shutdown Instructions to the Mitigating Systems cornerstone in the second quarter of 2012. On October 11, 2012, the U.S.

Nuclear Regulatory Commission (NRC) completed a supplemental inspection pursuant to Inspection Procedure 95001, Supplemental Inspection for One or Two White Inputs in a Strategic Performance Area, which was documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014 (ADAMS Accession No. ML12331A180).

On January 25, 2013, your staff reported an Emergency AC Power System Mitigating System Performance Indicator that crossed a threshold from green to white. The white performance indicator resulted from excessive unreliability of the U1/U2 Emergency AC Power System due to four emergency AC power system functional failures within the past three years. Based on your report, the NRC assigned a white performance indicator Action Matrix input to the Mitigating Systems cornerstone in the fourth quarter of 2012.

In response to these Action Matrix inputs, the NRC informed you that a supplemental inspection under Inspection Procedure 95002, Supplemental Inspection for One Degraded Cornerstone or any Three White Inputs in a Strategic Performance Area, would be required.

On February 19, 2014, you informed the NRC that Browns Ferry Nuclear Plant was ready for the supplemental inspection. On April 11, 2014, the NRC completed the supplemental inspection and the NRC inspection team discussed the results of this inspection and the implementation of your corrective actions with Steve Bono, General Manager, Site Operations and other members of your staff. The inspection team documented the results of this inspection in the enclosed inspection report. The NRC performed this supplemental inspection to determine if: 1) the root and contributing causes for the significant issues were understood; 2) the extent of condition and extent of cause for the identified issues were understood; and 3) your completed or planned corrective actions were sufficient to address and prevent repetition of the root and contributing causes. The NRC also conducted an independent review of the extent of condition and extent of cause for the white performance indicator and the white finding and an assessment of whether any safety culture component caused or significantly contributed to the performance issues.

The inspectors determined that the individual root cause evaluations for each of the diesel failures were thorough and broad in scope. The evaluations appropriately determined the root and contributing causes, addressed the extent of condition and extent of cause, and determined if safety culture contributed to the issue. The inspectors determined that your staff conducted a comprehensive extent of condition and extent of cause review that sufficiently identified relevant areas. Your staff identified the primary root cause of the issue to be that station personnel do not consistently consider risk when making decisions and such non-conservative decision making at BFN led to increased EDG unavailability and system component failures. The inspectors determined your staffs corrective actions were thorough and should prevent recurrence. Corrective actions included the implementation of BP-289, Leadership Performance Management, to reinforce and institutionalize conservative decision making principles at BFN and the establishment of initial and continuing training requirements, which included developing and delivering training to provide expected behaviors for leaders and craft that support their roles and responsibilities.

With regard to the white finding, the inspectors determined that your staff performed a comprehensive evaluation of the NRC-identified issue associated with the Safe Shutdown Instructions and that the corrective actions were adequate to address the identified causes and prevent recurrence. The extent of condition and extent of cause evaluations were determined adequate and the corrective actions sufficiently broad. This inspection item was closed and the assessment was previously documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014. As such, an additional review of items inspected during the 95001 evaluation was not required for this inspection. However, inspection requirements unique to IP 95002 were evaluated as well as a review of the status of implementation of corrective actions and an evaluation of changes made subsequent to the completion of the 95001 inspection.

Inspectors determined that there were no adverse changes made to the root cause evaluation for this issue and that corrective actions were adequate and effectiveness reviews were in process. In addition, the NRC concluded that the root cause evaluations appropriately considered whether safety culture components caused or significantly contributed to the findings.

The NRC has determined that completed and planned corrective actions were sufficient to address the performance issues that led to the white finding and the white performance indicator. The white finding was no longer an input into the Action Matrix beginning the second quarter of 2013 and white MSPI will not be considered as an Action Matrix input when it returns to the green performance band. Any additional follow-up assessment results which affect Action Matrix applicability will be conveyed in separate correspondence.

The NRC inspectors did not identify any findings or violations of more than minor significance. In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Jonathan H. Bartley, Chief Reactor Projects Branch 6 Division of Reactor Projects Docket Nos.: 50-259, 50-260 License Nos.: DPR-33, DPR-52

Enclosure:

Inspection Report 05000259/2014010 and 05000260/2014010 w/Attachment: Supplemental Information

REGION II==

Docket Nos.: 50-259, 50-260 License Nos.: DPR-33, DPR-52 Report Nos.: 05000259/2014010, 05000260/2014010 Licensee: Tennessee Valley Authority (TVA)

Facility: Browns Ferry Nuclear Plant, Units 1, 2 and 3 Location: Corner of Shaw and Nuclear Plant Roads Athens, AL 35611 Dates: April 7, 2014 through April 11, 2014 Inspectors: L. Suggs, Senior Construction Projects Inspector, Lead M. Donithan, Operations Engineer A. Hutto, Senior Resident Inspector J. Montgomery, Reactor Inspector Approved by: Jonathan H. Bartley, Chief Reactor Projects Branch 6 Division of Reactor Projects Enclosure

SUMMARY

Inspection Report (IR) 05000259/2014010, 05000260/2014010; 04/07/2014 -

04/11/2014; Browns Ferry Nuclear Plant, Units 1, 2, and 3; Supplemental Inspection -

Inspection Procedure (IP) 95002 This supplemental inspection was conducted by a senior construction projects inspector, a senior resident inspector, an operations engineer and a reactor inspector. No findings were identified. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5, dated February 2014.

Cornerstone: Mitigating Systems

The NRC staff performed this supplemental inspection in accordance with IP 95002,

Supplemental Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area, to assess the licensees evaluations associated with the Emergency AC Power Systems performance indicator in the Mitigating Systems Cornerstone crossing the green-white threshold at the beginning the fourth quarter 2012. During this supplemental inspection, the inspectors determined that the licensee performed a comprehensive evaluation of the Emergency Diesel Generator (EDG) failures that resulted in the white performance indicator. The inspectors determined that the licensee conducted a comprehensive extent of condition and extent of cause review that sufficiently identified relevant areas. The licensee identified the primary root cause of the issue to be that station personnel do not consistently consider risk when making decisions and such non-conservative decision making at BFN led to increased EDG unavailability and system component failures. The inspectors determined the licensees corrective actions were thorough and should prevent recurrence. Corrective actions included the implementation of BP-289, Leadership Performance Management, to reinforce and institutionalize conservative decision making principles at BFN and the establishment of initial and continuing training requirements, which included developing and delivering training to provide expected behaviors for leaders and craft that support their roles and responsibilities.

Given the licensees acceptable performance in addressing the performance that led to the white performance indicator, the performance issues will only be considered in assessing plant performance until the performance indicator returns to green in accordance with the guidance in Inspection Manual Chapter (IMC) 0305, Operating Reactor Assessment Program.

Additionally, the inspectors reviewed the licensees evaluation associated with the failure to adequately accomplish the requirements contained in procedure NPG-SPP-09.3, Plant Modifications and Engineering Change Control during the implementation of DCN 69957. As a result, the systems approach to training was not properly implemented and the procedures could not be satisfactorily performed by plant operators and staff. The NRC staff previously characterized this issue as having low to moderate safety significance (white), as documented in NRC IR 05000259/2012013, 05000260/2012013, 05000296/2012013. On October 11, 2012, the NRC staff performed a supplemental inspection in accordance with IP 95001, Supplemental Inspection for One or Two White Inputs in a Strategic Performance Area. During that inspection, the NRC determined that the licensee performed a comprehensive evaluation of the NRC-identified issues associated with the Safe Shutdown Instructions and that the corrective actions were adequate to address the identified causes and prevent recurrence. The extent of condition and extent of cause evaluations were determined adequate and the corrective actions sufficiently broad. This inspection item was closed and the assessment was previously documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014. As such, an additional review of items inspected during the 95001 evaluation was not required for this inspection. However, inspection requirements unique to IP 95002 were evaluated as well as a review of the status of implementation of corrective actions and an evaluation of changes made subsequent to the completion of the 95001 inspection. Inspectors determined that there were no adverse changes made to the root cause evaluation for this issue and that corrective actions were adequate and effectiveness reviews were in process.

NRC-Identified and Self-Revealing Findings

None.

Licensee-Identified Violations

None.

REPORT DETAILS

4OA4 Supplemental Inspection

.01 Inspection Scope

The inspectors performed this supplemental inspection in accordance with IP 95002 to assess the licensees evaluation of one white performance indicator and one white finding, which affected the Mitigating Systems Cornerstone in the Reactor Safety strategic performance area. The inspection objectives were to:

• Provide assurance that the root and contributing causes of risk-significant issues were understood;

• Provide assurance that the extent-of-condition and extent-of-cause of risk-significant issues were identified and to independently assess the extent-of-condition and extent-of-cause of individual and collective risk-significant issues;

• Independently determine if safety culture components caused or significantly contributed to the risk significant issues; and

• Provide assurance that the licensees corrective actions for risk-significant issues were or will be sufficient to address the root and contributing causes and to preclude repetition.

The licensee entered the Degraded Cornerstone column of the NRCs Action Matrix as a result of one white finding in the Mitigating Systems Cornerstone originating in the second quarter of 2012 and one white performance indicator in the Mitigating Systems Cornerstone originating in the fourth quarter of 2012.

The white finding was associated with the licensees failure to adequately accomplish the requirements contained in procedure NPG-SPP-09.3, Plant Modifications and Engineering Change Control, during the implementation of DCN 69957. Specifically, on September 13, 2011, the licensee implemented Procedures 0-SSI-25-1,-2,-3, and -26, Safe Shutdown Instructions, in support of DCN 69957 without adequately performing an evaluation of training needs. As a result, the systems approach to training was not properly implemented and the procedures could not be satisfactorily performed by plant operators and staff. The NRC staff previously characterized this issue as having low to moderate safety significance (white), as documented in NRC IR 05000259/2012013, 05000260/2012013, 05000296/2012013. On October 11, 2012, the NRC staff performed a supplemental inspection in accordance with IP 95001, Supplemental Inspection for One or Two White Inputs in a Strategic Performance Area. During that inspection, the NRC determined that the licensee performed a comprehensive evaluation of the NRC-identified issues associated with the Safe Shutdown Instructions and that the corrective actions were adequate to address the identified causes and prevent recurrence. The extent of condition and extent of cause evaluations were determined adequate and the corrective actions sufficiently broad. This inspection item was closed and the assessment was previously documented in NRC IR05000259/2012014, 05000260/2012014, 05000296/2012014.

The white Mitigating System Performance Indicator (MSPI) resulted from excessive unreliability of the U1/U2 Emergency AC Power System due to four emergency AC system functional failures within the past three years. The four failures were:

• June 2010: PER 243132 - Fouling of the EECW side of the D Emergency Diesel Generator (EDG) Heat Exchanger resulted in a past operability conclusion that the D EDG could not have performed its safety function.

• April 2011: PER 362395 - A fitting in the governor oil system failed from cycle fatigue resulting in an oil leak and emergency shutdown of the C EDG and loss of shutdown cooling on Units 1 and 2.

• May 2011: PER 362340 - The A EDG output breaker tripped due to inadvertent actuation of the overspeed trip limit switch.

• December 2012: PER 660235 - 3D EDG to D EDG load sharing circuit failed to properly share load resulting in a reverse power trip of the D EDG Output Breaker and subsequent loss of 4KV Shutdown Board D with a resultant half scram.

The licensee staff informed the NRC staff on February 19, 2014, that they were ready for the supplemental inspection. In preparation for the inspection, the licensee performed a root cause analysis (RCA), RCA 669462 Revision 2, to identify weaknesses that existed in various organizations, which allowed for a degraded Reactor Oversight Process (ROP) cornerstone, and to determine the organizational attributes that resulted in the white PI. The licensee also compiled a safety culture self-assessment report. The inspectors reviewed the licensees RCA in addition to other evaluations conducted in support and as a result of the RCA. The inspectors reviewed corrective actions that were taken or planned to address the identified causes. The inspectors also held discussions with licensee personnel to ensure that the root and contributing causes and the contribution of safety culture components were understood and corrective actions taken or planned were appropriate to address the causes and preclude repetition. The inspectors also independently assessed the extent of condition and extent of cause of the identified issues. In addition, the inspectors performed an assessment of whether any safety culture components caused or significantly contributed to the issues.

.02 Evaluation of the Inspection Requirements

02.01 Problem Identification a. IP 95002 requires that the inspection staff determine that the evaluation documented who identified the issue (i.e. licensee-identified, self-revealing, or NRC-identified) and under what conditions the issue was identified.

i. Emergency AC Power MSPI The licensee identified the performance indicator had crossed the green-white threshold in January 2013. The performance indicator crossed the threshold due to four EDG functional failures within the past three years. One violation of very low safety significance (green) was associated with the functional failures which contributed to the performance indicator exceeding the green-white threshold (NCV 05000259/2011004-03, Unit 1 Loss of Shutdown Cooling Caused by the Emergency Diesel Generator Output Breaker Trip). The licensee determined that three of the four EDG failures were self-revealing, and one failure was licensee-identified.

ii. SSI Criterion V As documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014, this violation was NRC-identified. The inspectors verified that this information was documented in the licensees current evaluation for two white inputs into the ROP Action Matrix.

b.

IP 95002 requires that the inspection staff determine that the evaluation documented how long the issue existed and prior opportunities for identification.

i. Emergency AC Power MSPI The licensees root cause evaluation documented that the white Emergency AC Power PI status has existed since December 2012, when the D EDG tripped following a failure to properly share load with the 3D EDG. Each of the RCAs associated with the four functional failures stated how long the individual conditions existed. For three of the four failures, the licensee identified that there were prior opportunities to identify conditions which caused or contributed to the events. The failure associated with a leak on the governor oil system was caused by a cyclic fatigue failure of rigid tubing, with no prior opportunities for identification.

ii. SSI Criterion V As documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014 the licensee determined that the sequence of events which led to the SSI violation could be traced to March 29, 2011. The evaluation also noted that there were multiple opportunities to identify the issue prior to NRC identification. The inspectors concluded that the licensees current evaluation adequately identified how long the issue existed and prior opportunities for identification.

c.

IP 95002 requires that the inspection staff determine that the evaluation documented the plant-specific risk consequences, as applicable, and compliance concerns associated with the issue(s) both individually and collectively.

i.

Emergency AC Power MSPI The NRC determined this issue was white due to the Emergency AC Power PI exceeding 1E-6 delta core damage frequency (CDF). Units 1 & 2 Emergency AC Power system passed the threshold in January 2013 due to the fourth failure in the 12 quarter reporting window. This resulted in an unavailability index = -2.17E-8 CDF and an unreliability index = 1.08E-6 CDF for a total rounded MSPI = 1.1E-6 CDF. The inspectors concluded that the licensee appropriately documented the risk consequences and compliance concerns associated with the issue.

ii. SSI Criterion V The demonstrated inability of operators to successfully execute the revised SSIs five months after procedure revisions became effective had the potential to reduce defense in depth as it applies to maintenance of the integrity and independence of fission product barriers. Redundant and diverse safety systems, including trained operators conducting operations in accordance with approved station procedures developed under an approved quality control program, are integral to maintaining defense in depth. The licensees evaluation of these plant-specific risk consequences was determined to be acceptable, as previously documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014.

iii. Collective Risk Consequences The licensee performed a Common Cause and Significant Issue Gap Analysis to evaluate the two white inputs together. At the time of the MSPI white input, the SSI white violation had been closed and NRC inspectors determined that the licensees corrective actions were appropriate. Therefore, the licensees report did not perform a quantitative risk analysis for the two events collectively; however it did qualitatively discuss risk consequences of performance issues associated with the degraded cornerstone. The inspectors determined that the licensees evaluation of collective risk was acceptable.

d. Findings

No findings were identified.

02.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation a.

IP 95002 requires that the inspection staff determine that the problem was evaluated using a systematic methodology to identify the root and contributing causes.

i.

Emergency AC Power MSPI The licensee used the following systematic methods to complete their root cause analyses:

• Management Oversight and Risk Tree (MORT) analysis

• Events and Causal Factor Analysis

• Barrier analysis

• Comparative Time Line

• Support/Refute matrix

• Pareto analysis The inspectors determined that the licensee evaluated the issue using a systematic methodology to identify the root and contributing causes.

ii. SSI Criterion V The licensee used the following systematic methods to complete their root cause analyses:

• Event and Causal Factor Analysis

• Barrier analysis

• Organizational and Programmatic Contributors Analysis

• Safety Culture Evaluation The inspectors determined that the licensee evaluated the issue using a systematic methodology to identify the root and contributing causes, as documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014 b.

IP 95002 requires that the inspection staff determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the issue.

i.

Emergency AC Power MSPI The licensees root cause analysis included an extensive timeline of events and an event and causal factors chart, as discussed in the previous section. Using multidisciplinary teams, the licensee identified one root cause and two contributing causes for the roll up investigation to determine why the Unit 1/2 Emergency AC Power System incurred multiple equipment failures and excessive unavailability. The root cause identified that station personnel were not consistently considering risk and exercising conservative decision making relevant to long-term equipment reliability. The contributing causes were a less than adequate implementation of processes to monitor and maintain EDG reliability, and station management did not ensure adequate resources were dedicated to safety system maintenance and monitoring in a timely enough fashion to maintain system reliability. In addition, the evaluations for the four specific equipment issues identified four root causes and six contributing causes.

The inspectors noted that the licensee determined that RCA 243132, which was performed for the failure associated with excessive fouling on the D EDG heat exchanger, was not effective in preventing future heat exchanger fouling events. This was evidenced by subsequent fouling events on the 3D EDG heat exchanger, and the 3C RHR heat exchanger. In response to these events, the licensee performed a new RCA (PER 750848), whose scope included the original D EDG heat exchanger fouling failure. The inspectors noted that one contributing cause documented in RCA 750848 was that previous cause evaluations and actions were not effective in preventing heat exchanger macrofouling. Based on the scope of work performed for the new cause evaluation, the inspector concluded that the evaluation was conducted to a level of detail commensurate with the significance of the problem.

ii. SSI Criterion V The licensee determined that there were three root causes:

1. Inadequate project management oversight for a pulled-forward Design Change resulted in failure to understand the implications of the accelerated schedule.

2. Inadequate emphasis on the importance of regulatory compliance has contributed to a culture which lacks urgency in the identification and timely resolution of issues associated with non-compliant and potentially non-conforming conditions.

3. Decision-making associated with the Systematic Approach to Training (SAT) process was not used appropriately to analyze, design, develop, implement, and evaluate operator training of sufficient quality to produce operators capable of executing new and revised SSI procedures.

The inspectors determined that the evaluation was conducted to a sufficient level of detail as previously documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014.

c. IP 95002 requires that the inspection staff determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience (OE).

i. Emergency AC Power MSPI The licensees evaluations included a review of both internal and external OE. Based on the licensees detailed evaluation and conclusions, the inspectors determined that the licensees evaluations considered prior occurrences of the problems and knowledge of prior OE. The licensee concluded that two of the four EDG functional failures were OE preventable. The licensee noted that the failure associated with improperly set overspeed trip limit switch (RCA 362340) could have been prevented if OE had been incorporated appropriately. SR 753948 was written to address the issue. The licensee also noted that the failure associated with the EDG heat exchanger fouling (RCA 243132 and RCA 750848) could have been prevented if the site did not routinely defer preventative maintenance to inspect and clean the RHRSW pump pit. Therefore, the licensee considered this failure to be OE preventable, and a recurring plant event. SR 766794 was written to address the issue.

ii. SSI Criterion V As documented in NRC IR05000259/2012014, 05000260/2012014, 05000296/2012014, the licensees evaluation included an evaluation of internal and external operating experience. As a result of this review, the licensee concluded that there was adequate operating experience both internally and externally that could have prevented this issue if it had been incorporated appropriately. PER 534755 was generated to capture this deficiency. Corrective action for this issue credited corrective actions from an earlier PER (PER 423213) which created a new series of procedures under fleet procedure TVA-SPP-034.0, Project Management. One of these was TVA-SPP-34.016, Project Lessons Learned Management, effective October 1, 2011, which included the use of OE and lessons learned in project development and implementation. As identified in Root Cause 1 of RCA PER 507721, the licensee failed to ensure that then-in-progress DCN 69957 was reviewed against the new standard. Corrective Action 1 for this Root Cause was to, Review all in progress corporate managed projects ... to validate projects are in compliance with TVA-SPP-34.0 series procedures...

The inspectors determined that the evaluation was conducted to a sufficient level of detail and appropriate corrective actions were taken.

d. IP 95002 requires that the inspection staff determine that the root cause evaluation addresses the extent of condition and the extent of cause of the problem.

i. Emergency AC Power MSPI The team concluded that the licensees RCAs addressed the extent of condition and the extent of cause of the four EDG functional failures. Each RCA included proper consideration of the extent of condition and extent of cause. This included whether other units, systems, equipment, programs or conditions could be affected.

Additionally, the roll up investigation considered the extent of condition associated with multiple equipment failures and excessive unavailability driving ROP performance indicators toward White. The licensee identified that Unit 1 and 2 High Pressure Coolant Injection (HPCI) MSPI, Unit 2 Unplanned Scrams with Complications, Unit 3 Unplanned Scrams per 7000 Critical Hours, and Unit 3 Unplanned Scrams with Complications as having a declining trend that represents a potential challenge to maintaining nuclear safety.

The inspectors concluded the licensees root cause analysis report adequately addressed the extent of condition and the extent of cause of the issue.

ii. SSI Criterion V The licensees extent of condition statement in PER 507721 was: The extent of condition is deficient training for any groups and any change not adequately incorporated into a procedure. They reviewed deficient training for all Design Change Notices (DCNs) initiated since May 2010 that impacted all workgroups on site. They also reviewed a representative sample of new procedures, across several disciplines, independent of whether the new procedure was the result of a DCN. Only minor deficiencies were found, which were captured in the licensees corrective action program (CAP).

The licensees extent of cause review included three elements: 1) inadequate project management controls for plant modifications; 2) inadequate emphasis on identified concerns; and 3) inadequate decision making in all activities on the site.

The inspectors concluded that the licensees evaluations of the extent of condition and extent of cause were adequate.

e. Findings

No findings were identified.

02.03 Corrective Actions a. IP 95002 requires that the inspection staff determine that appropriate corrective actions are specified for each root and contributing cause or that the licensee has an adequate evaluation for why no corrective actions are necessary.

i. Emergency AC Power MSPI The inspectors did not identify any concerns with the licensees corrective actions. The licensee took immediate corrective actions to restore operability of the Unit 1 and 2 Emergency AC Power System for the individual failures that contributed to the white PI.

The licensee identified corrective actions, including corrective actions to prevent recurrence (CAPRs), that were appropriate for the root and contributing causes for each EDG functional failure, as well as for the Emergency AC Power MSPI changing from green to white. The licensees corrective actions were adequate to address potential vulnerabilities identified by the extent of condition and extent of cause reviews. To address the multiple failures in the Emergency AC Power System, the licensee implemented a leadership improvement program to reinforce and institutionalize conservative decision making principles at the station. The inspectors determined that the proposed corrective actions were appropriate and addressed each root and contributing cause.

ii. SSI Criterion V As documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014, the licensee took appropriate corrective actions for each root and contributing cause.

Immediate corrective actions included ensuring all SSIs were correct, licensed operators were properly trained on their use, and processes were changed to require a Training Needs Analysis for every DCN issued. The licensee identified eight CAPRs and many other corrective actions that were appropriate for the root and contributing causes. At the time of this inspection, all corrective actions for the SSI violation had been completed. The inspectors determined that corrective actions were appropriate.

b. IP 95002 requires that the inspection staff determine that the corrective actions have been prioritized with consideration of risk significance and regulatory compliance.

i. Emergency AC Power MSPI The inspectors reviewed the licensees schedule for completion of corrective actions for each identified root and contributing cause and determined that the licensee appropriately prioritized corrective actions with consideration of risk significance and regulatory compliance. The licensees corrective actions to address the root and contributing causes were prioritized through the assignment of graded corrective actions types; Corrective Actions to Prevent Recurrence, Corrective Actions, and Enhancements in accordance with the licensees procedures. The inspectors determined that the licensee prioritized corrective actions with consideration of risk significance and regulatory compliance.

ii. SSI Criterion V All corrective actions that were not complete at the time of the 95001 inspection documented in NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014 have since been completed, and inspectors determined the licensees prioritization of corrective actions to be appropriate.

c. IP 95002 requires that the inspection staff determine that a schedule has been established for implementing and completing the corrective actions.

i. Emergency AC Power MSPI The inspectors determined that all of the corrective actions listed in the root cause analysis report were either scheduled or completed.

ii. SSI Criterion V The inspectors determined that all corrective actions associated with the root cause analysis report were completed.

d. IP 95002 requires that the inspection staff determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

i. Emergency AC Power MSPI The inspectors determined that the licensee had developed quantitative and qualitative measures of success for determining the effectiveness of the corrective actions to preclude repetition. The inspectors determined that an effectiveness review for the corrective actions on operational focus/decision making listed in the root cause evaluation was scheduled for June 2014. This effectiveness review will focus on conducting a self-assessment with respect to operational focus and decision making at the site. This review is measured by observing overall site improvement in NRC, INPO, and internal QA inspections/audits.

The inspectors noted that the effectiveness reviews associated with the Emergency AC Power MSPI RCA were focused on monitoring the sites safety culture and personnel decision making, and did not include monitoring of the health of the diesel generators as an indication of effectiveness. The licensee generated PER 870516 to address this observation, and is taking corrective actions to develop additional effectiveness reviews that assess system health as a measure of effectiveness.

ii. SSI Criterion V The inspectors noted that the licensee had specified three effectiveness reviews for RCA PER 507721, one for each root cause. Each review contained a due date of June 28, 2014, and therefore the results of the effectiveness reviews could not be reviewed.

However, inspectors determined that the licensee specified both quantitative and qualitative measures of success, and the effectiveness review plans were determined to be comprehensive:

For Root Cause 1 the licensee planned to review a sample of pull-forward and traditional projects for their compliance with TVA-SPP-034 series procedures.

Success criteria was specified as no repeat occurrences of project management failing to comply with procedural requirements.

For Root Cause 2 the effectiveness review plan is to interview a sample population of employees across the major site organizations to determine knowledge retention of lessons learned and corrective actions taken. Success criteria was defined as respondents scoring 80% or better on a defined battery of questions.

For Root Cause 3 effectiveness would be measured by reviewing all procedure revisions or new procedures issued after May 2012 and verifying that a job analysis was performed when applicable. Corrective actions would be judged satisfactory if no condition is identified where a job analysis was required but not performed.

e. IP 95002 requires that the inspection staff determine that the corrective actions planned or taken adequately address a Notice of Violation (NOV) that was the basis for the supplemental inspection, if applicable.

i. Emergency AC Power MSPI The NRC staff did not issue an NOV to the licensee; therefore, this inspection attribute was not applicable.

ii. SSI Criterion V Inspectors determined that the actions planned and taken adequately addressed the white violation Failure to Properly Implement the Requirement of the Plant Modifications and Engineering Change Control Procedure, as described in NRC IR 05000259/260/296/2012007. NRC IR 05000259/2012014, 05000260/2012014, 05000296/2012014 closed the white violation.

f. Findings

No findings were identified.

02.04 Independent Assessment of Extent of Condition and Extent of Cause

a. Inspection Scope

IP 95002 requires that the inspectors independently assess the validity of the licensees conclusions regarding the extent-of-condition and extent-of-cause of the findings. The objective of this requirement was to independently sample performance, as necessary, within the key attributes of the cornerstone that were related to the findings to ensure that the licensees evaluation regarding the extent-of-condition and extent-of-cause were sufficiently comprehensive.

The inspectors conducted independent extent of condition and extent of cause reviews of the issues associated with the white MSPI and SSI white finding and the associated licensee root cause evaluation reports. The inspectors specifically focused on the licensees common cause and significant gap analysis (PER 736217) which examined the broader overarching common causal factors that affected both the emergency AC power MSPI and the SSI white finding. The inspectors assessed whether the licensees extent of condition and extent of cause evaluations sufficiently identified and bounded other potential existing conditions that could adversely affect other plant SSCs, plant processes, or human performance.

i. Emergency AC Power MSPI The inspectors reviewed a sample of PERs with similar cause codes as the four EDG issues that led to the white MSPI as well as a sample of deferred preventive maintenance (PMs) and PMs deep in grace. The inspectors also reviewed maintenance rule margin reports for selected safety related systems and current maintenance rule (a)(1) plans for five designated safety related systems to assess the licensees attention to safety system health.

The inspectors performed walk down inspections of the A, B, C, D, 3A and 3B diesel generators, selected areas of the Unit 1 reactor building, and associated equipment to assess configuration control, active deficiency tags, housekeeping, and overall readiness of the area equipment to function properly.

In conducting this independent review, the inspectors interviewed station management and engineering personnel, reviewed program and process documentation, and reviewed existing station program monitoring and improvement efforts specified in the stations Integrated Improvement Plan.

ii. SSI Criterion V The inspectors reviewed a sample of PERs with similar cause codes as the white SSI finding in addition to a sample of PERs related to specific human performance issues where inadequate training implementation may have contributed to the issue. The inspectors also reviewed the 10 most risk significant operator actions and associated training documents as well as a sample of DCNs requiring procedure changes and associated training to determine if additional examples of inadequate training implementation for risk significant activities existed.

b. Assessment The inspectors determined that the licensee conducted a comprehensive extent of condition and extent of cause review that sufficiently identified relevant areas for both the white finding and AC power MSPI. To address the commonalities between the two issues, the licensee performed a common cause analysis and significant gap analysis as described in the TVA Cause Evaluation Handbook. This analysis represented both a collective analysis of the two white inputs to the degraded cornerstone and a collective analysis of all the inputs to the ROP Matrix for BFN since 2011.

Barrier Analysis, Organizational and Programmatic Deficiencies, and the Safety Culture Analysis were collectively reviewed by the licensee for common causes using the direct inputs to the Mitigating Systems Degraded cornerstone and the inputs identified by the extent of condition review. A Pareto analysis was used to identify common causes or problem statements. The licensee conducted a second method of analysis by mapping the broken barriers and organizational and programmatic issues to the MORT basic and general events and identified the common causes. As a result of the above analyses, the licensee identified the following five problem statements:

• Management had not consistently ensured that personnel, equipment, procedures, and other resources were available and adequate to assure nuclear safety.

• Management had not consistently defined the lines of authority and responsibility for nuclear safety.

• Issues had not been consistently identified, evaluated, and corrected in a timeframe commensurate with nuclear safety.

• Work activities had not been consistently planned and coordinated in a manner consistent with nuclear safety.

• Operating experience had not been consistently used to support nuclear safety.

On October 23, 2010, Unit 1 experienced an event that resulted in a Red Finding and assessment of plant regulatory performance to be in the Multiple/Repetitive Degraded Cornerstone column of the NRCs ROP Action Matrix. The stations response was to conduct a thorough diagnostic effort and assessment of station performance. This concluded in the development of a comprehensive list of problem statements which were thoroughly evaluated. Evaluation of the these problem statements produced a substantial number of corrective actions designed to improve station risk and safety performance, as well as safety culture at all levels. These actions were captured in the Integrated Improvement Plan (IIP) section of the Station Improvement Plan (SIP).

Significant Issue Gap Analyses were performed by the licensee to determine if the problem statements identified above represented new problems, or had been previously identified in the recent past by the 95003 evaluation. The licensee determined that each of the five problem statements was found to have been addressed in an existing cause analysis. Corrective actions in recent, previously performed cause analysis products were found to be acceptable for addressing the problem statements identified by the analyses.

The inspectors did not identify any substantive extent of condition or extent of cause issues that the licensee was not aware of and had not already identified with corrective action plans in place. The inspectors found the corrective actions taken or planned by the licensee were adequate in addressing the causes of the white MSPI and the white finding and should help address any additional issues similar to the shortfalls identified in the two subject root cause evaluation reports.

The inspectors did find one example of a missed opportunity to demonstrate and reinforce standards with regard to management's decision-making that reflects a renewed focus on nuclear safety. PER 714818 was written to address a perceived issue with management failing to treat nuclear power as unique or special associated with decision making during the implementation of a cable replacement modification. The PER was dispositioned as a C level PER with no cause analysis or corrective actions to address the perceived inadequate decision making. This example underscores that there should be a sensitivity to plant staff's perception of management's decision-making and priorities versus management's intentions (reality). The licensee initiated SR 864733 to further address this issue.

The inspectors noted a subsequent related extent of condition item where a change was made to a Functional Evaluation (an Engineering product) that supported an Operator Work Around regarding reactor cooldown rate while implementing certain SSIs.

Licensee procedure NEDP-22, Operability Determinations and Functional Evaluations, revision 15, does not have a requirement to consider training requirements. The change was communicated to licensed operators in the form of a posted document in the Control Room. Although operators were responsible for being knowledgeable and cognizant of such postings, given ongoing station vulnerabilities in the area of operator training, inspectors noted that an opportunity was missed to conduct a Training Needs Analysis to determine if such a communication should be included in formal operator training.

The licensee concurred and captured this observation as Service Request 870521 in their corrective action program.

b. Findings

No Findings were identified.

02.05 Safety Culture Consideration

a. Inspection Scope

IP 95002 requires that the inspection staff perform a focused inspection to independently determine that the licensees RCA appropriately considered whether any safety culture component caused or significantly contributed to any risk significant issue.

The inspectors reviewed problem evaluation reports and procedures and conducted interviews with licensee personnel to determine if the licensee properly considered whether any safety culture component caused or contributed to the issues.

b. Assessment i. Emergency AC Power MSPI As part of the root cause evaluation for the issue, the licensee evaluated the identified root and contributing causes against the safety culture components that could have contributed to the issues. The licensees root cause evaluation included a discussion of the 13 safety culture components described in Regulatory Issue Summary 2006-013, Information on the Changes Made to the Reactor Oversight Process to More Fully Address Safety Culture, dated July 31, 2006, (ADAMS Accession No. ML061880341)as they applied to the white Emergency AC Power PI affecting the mitigating systems cornerstone. The RCA included a Safety Culture Evaluation Checklist which the licensee completed to assess the safety culture components and aspects. The licensee identified several key safety culture areas in their RCA.

The licensee identified the following root and contributing causes:

• RC: Station personnel do not consistently consider risk when making decisions.

• CC1: Less than adequate implementation of processes to monitor and maintain EDG reliability.

• CC2: Station management did not ensure adequate resources were dedicated to safety system maintenance and monitoring in a timely enough fashion to maintain system reliability.

Inspectors determined that the licensee correlated each cause to an appropriate safety culture aspect. During the course of their evaluation, the licensee identified additional data points that did not play a direct role in the MSPI decline but gave direct indication that station decision making with regards to the reliability of the diesels was less than adequate.

The licensee determined that weaknesses in decision making, inadequate designation of resources and inadequate implementation of equipment reliability processes were the most prevalent safety culture attributes. The licensee also considered the results of a safety culture assessment and safety conscious work environment (SCWE) survey in the consideration of safety culture components.

For each of the identified prevalent and contributing safety culture components, the inspectors confirmed that the licensee established corrective actions to address the issues. During the course of interviews with licensee personnel, the inspectors incorporated questions related to SCWE to determine if licensee staff were reluctant to raise safety concerns or if retaliation existed for raising safety concerns. The inspectors did not identify concerns related to SCWE ii. SSI Criterion V As part of the root cause evaluation for the issue, the licensee evaluated the identified root and contributing causes against the safety culture components that could have contributed to the issues. The licensees root cause evaluation included a discussion of the 13 safety culture components described in Regulatory Issue Summary 2006-013, Information on the Changes Made to the Reactor Oversight Process to More Fully Address Safety Culture, dated July 31, 2006, (ADAMS Accession No. ML061880341)as they applied to the white finding affecting the mitigating systems cornerstone. The RCA included a Safety Culture Evaluation Checklist which the licensee completed to assess the safety culture components and aspects.

Each aspect of the Human Performance Area was found to be deficient in some way.

Many Human Performance aspects were root causes or significant contributors to the events analyzed in the RCA, which recognized that the overall Human Performance culture was weak. The majority of the cultural elements identified in the RCA were being addressed by the following root cause analyses:

• PER 516455: Identified by 95003 Recovery Team: Operational Focus/Decision Making.

• PER 516437: Identified by 95003 Recovery Team: Management and Leadership Standards.

• PER 516458: Identified by 95003 Recovery Team: Work Management Issues.

These three root causes represent three of the fifteen fundamental problem areas the licensee was focusing on in response to the NRC Red Finding and resultant 95003 inspection preparation.

Inspectors determined that the licensee appropriately correlated root and contributing causes to the appropriate safety culture aspects. For each of the identified prevalent and contributing safety culture components, the inspectors confirmed that the licensee established corrective actions to address the issues. During the course of interviews with licensee personnel, the inspectors asked interviewees questions related to SCWE to determine if licensee staff were reluctant to raise safety concerns or if retaliation existed for raising safety concerns. The inspectors did not identify concerns related to SCWE

b. Findings

No Findings were identified.

02.06 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues The licensee did not request credit for self-identification of an old design issue; therefore, the risk-significant issue was not evaluated against the IMC 0305 criteria for treatment of an old design issue.

4OA6 Exit Meeting

On April 11, 2014, the inspectors presented the inspection results to Mr. Steve Bono and other members of his staff. The inspectors verified no proprietary information was reviewed or documented in the report.

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Acker, Site Licensing

J. Baker, Operations

S. Bono, Site Operations General Manager

S. Brown, Maintenance Manager

J. Comeens, Civil Design Engineering

P. Donahue, 9500X Team Lead

G. Doyle, 95003 Director

H. Higgins, Operations Training Supervisor

S. Honnewell, Engineering Director

R. Kerving, Corrective Action Program Manager

M. Oliver, Site Licensing

J. Paul, Licensing Manager

R. Pochron, Maintenance Program Specialist

K. Polson, Vice President

E. Quidley, Work Control

T. Selph, Mechanical Design Engineering

R. Weems, Lead Operations Instructor

P. Wilson, Corporate Licensing

NRC Personnel

D. Dumbacher, Senior Resident Inspector