ML18093B550

IMC 0612 App E Examples of Minor Issues

ML18093B550
Person / Time
Issue date:	10/01/2018
From:	Casey L NRC/NRR/DIRS/IRAB
To:
Casey L, NRR/DIRS, 415-1038
Shared Package
ML18093B545, ML18274A007	List:
References
CN 18-033, DC 18-007
Download: ML18093B550 (30)

Text

NRC INSPECTION MANUAL IRAB INSPECTION MANUAL CHAPTER 0612 APPENDIX E EXAMPLES OF MINOR ISSUES This guidance applies to thresholds for documenting findings and violations in Inspection Manual Chapter 0612. Although the following examples are all violations of requirements, ROP findings not associated with requirements should be considered minor if the finding is similar to the example guidance.

Minor findings and violations are below the significance of that associated with green SDP findings and are not the subject of formal enforcement action or documentation. Failures to implement requirements that have insignificant safety or regulatory impact or findings that have no more than minimal risk should normally be categorized as minor. While licensees must correct minor violations, minor violations or other minor findings do not normally warrant documentation in inspection reports or inspection records and do not warrant enforcement action.

NRC Inspection Manual Chapter 0612 Appendix B, Issue Screening, provides guidance for determining if a finding should be documented and whether the finding can be analyzed using an SDP. When determining whether identified issues can be considered minor, inspectors should compare the issue to the following examples.

1. Record Keeping Issues ............................................................................................................ 2

2. Licensee Administrative Requirement/Limit Issues ................................................................. 3

3. Non-significant Dimensional, Time, Calculation, or Drawing Discrepancies .......................... 6

4. Insignificant Procedural Errors ................................................................................................. 9

5. Work in Progress Findings ..................................................................................................... 14

6. Health Physics ........................................................................................................................ 15

7. Maintenance Rule .................................................................................................................. 20

8. Thermal Power Limits ............................................................................................................ 23

9. Worker Fatigue ....................................................................................................................... 25

10. Cyber Security....26 Issue Date: 10/01/18 1 0612 App E

1. Record Keeping Issues Example a. Post-maintenance testing was performed on ten glycol air handling units during an outage of a Westinghouse ice condenser facility. All the required tests were performed, based on statements from licensee workers, but there was no record that an actual air flow test was conducted on two of the units. Based on indication in the control room, both air handling units had comparable air flow to those that had documented test results, and the ice condenser technical specification required air temperatures were all well-within specification.

The violation: 10 CFR 50, Appendix B, Criterion XI or the licensee=s procedures require test results to be documented and evaluated to assure that test requirements are satisfied.

Minor because: This was a record keeping issue of low significance. There was reasonable assurance that test requirements were met as evidenced by actual air flow being satisfactory and technical specification temperatures being within limits.

Not minor if: The air flow was determined to be degraded during subsequent testing.

Example b. In a records storage vault, the licensee observes a ceiling leak.

Temporary containers were used to collect water during rainstorms. This "work around" was entered for resolution in the licensee=s corrective action program. The condition continued for a year. The containers overflowed during a heavy weekend rainstorm when no one was available to monitor the containers and some safety-related records were damaged, but were still readable.

The violation: The licensee failure to correct the water intrusion problem in a prompt manner which resulted in damage to records violated the 10 CFR 50.71 requirement to maintain certain records.

Minor because: This was a failure to implement a corrective action that had no safety impact because no records were lost.

Not minor if: Required records were irretrievably lost.

Example c. The licensee=s surveillance test records were not complete for a safety-related pump because the operators skipped a page of the surveillance procedure and failed to record one section of the test.

Issue Date: 10/01/18 2 0612 App E

The violation: The surveillance test is required by Technical Specifications.

Minor because: The surveillance test was performed, but not completely documented. The portion of the test documented and the last completed surveillance test revealed that the equipment performed its= safety function.

Not minor if: The subsequent surveillance test showed that the equipment would not perform some safety-related function.

Example d. Deleted - Revised example moved to Health Physics Section

2. Licensee Administrative Requirement/Limit Issues Example a. While performing a review of a completed surveillance test, the system engineer determines that operators performing the test had made a calculation error when determining the leak rate of a power-operated relief valve's nitrogen accumulators. When calculated correctly, the actual check valve leakage exceeded the surveillance leakage rate's acceptance criterion in the surveillance procedures (but not the Technical Specifications surveillance requirement). The surveillance had been completed a week earlier and the system had been returned to service.

The allowable leakage rate was below that used in the design assumptions for sizing of the accumulators and it was determined that with the identified leakage, the valves would be able to perform the required number of strokes assumed in the accident analysis.

The violation: The Technical Specification surveillance test's allowable check valve leakage rates were exceeded and the system was returned to service.

Minor because: The limit exceeded was an administrative limit. Actual check valve leakage rates, based on testing history, have always been significantly low enough to meet the required number of valve strokes.

Issue Date: 10/01/18 3 0612 App E

Not minor if: Maintenance records indicated that historical check valve leakage rates were too high bringing the ability of the valves to meet the required number of valve strokes into question or Technical Specification limits were exceeded.

Example b. Deleted - Revised example moved to Health Physics Section Example c. During a refueling outage, the licensee tested a charging pump at full flow conditions as required every 18 months. Vibration data taken during this test indicated vibration of 0.324 inches per second (ips), which exceeded the test procedure Alert range of 0.320 ips.

The procedure required the surveillance frequency to be increased to every nine months after exceeding the Alert range. The licensee failed to identify that the test result exceeded the Alert range, so the test frequency was not increased. Subsequent vibration testing revealed no further vibration degradation. The ASME Code acceptance criterion for vibration measurements was 0.325 ips.

The violation: Criterion XI or the licensee=s procedures require that test procedures shall incorporate acceptance limits established by design documents.

Measured vibration data exceeded the test procedure alert levels and the additional testing was not performed.

Minor because: This limit was a licensee administrative limit. The ASME Code limit was not exceeded and there was no subsequent degradation of vibration of the pump.

Not minor if: Subsequent vibration tests revealed degradation into the action range, the same issue affected a number of pumps tested, or the issue was repetitive.

Example d. The licensee missed an hourly update of a state agency during a declared Unusual Event because of an oversight by the Shift Manager.

The violation: 10 CFR 50.54(q) requires that licensees follow their emergency plan and the plan committed the licensee to hourly updates of state agencies during declared emergencies.

Minor because: There is no regulatory requirement to make this update, there was no impact on public health and safety, and it did not detract significantly from the state agency=s ability to function during the emergency.

Not minor if: There was a failure to make required initial notifications, a significant breakdown in communication functions committed to in the emergency plan, or a failure that affected the agency=s ability to respond to the emergency.

Issue Date: 10/01/18 4 0612 App E

Example e. During an inspection of silicon foam penetration seals, an inspector noted that foam extrusion (3/8 inch) from repaired seals was less than the amount specified in the seal repair procedure (2 inch). However, the silicon foam vendor's instructions permit extrusions as little as 1/4 inch.

The violation: The seal repair was not performed in accordance with the licensee's procedure.

Minor because: This is a violation of a licensee administrative requirement. Because the extrusions met the vendor=s instruction=s limits, no regulatory limit was violated.

Not minor if: Both the licensee and vendor procedures were violated such that the condition would have impacted the ability of the seal to perform its function.

Example f: The licensee's procedure required that heat tracing be energized in the diesel fire pump room from September 30 to April 30. In December, an inspector observed that the heat tracing was de-energized. The room temperature was 68 degrees, maintained by the steam boiler (50 degrees was the minimum temperature for operations). The temperature of the room was monitored and annunciated in the control room. An annunciator response procedure instructs the operator to check heat tracing if the room temperature alarms were received. The inspector verified that the temperature in the room had not dropped below 50 degrees since September 30.

The violation: A licensee procedural requirement was not met.

Minor because: This is a failure to implement a procedural requirement that had no safety impact under the given situation. The temperature had not dropped below the minimum temperature for operations.

Not minor if: The annunciator was inoperable or the room temperature fell below 50 degrees.

Example g. An operating procedure requires the shift supervisor to advise the station manager prior to making any mode changes. A mode change is made without this notification due to an oversight by the shift supervisor.

The violation: The licensee is required to follow their procedures per Technical Specification 6.8.1, if applicable.

Minor because: This is a minor procedural error that had no impact on safety equipment and caused no safety consequences. All requirements for the mode change were met except this notification.

Issue Date: 10/01/18 5 0612 App E

Not minor if: A mode change was made without all required equipment being operable.

Example h. The NRC requires licensees to maintain the total effective dose equivalent (TEDE) to five rem per year. The licensee established by procedure an administrative limit of 2 rem per year. Radiation protection manager or general manager approval was required for any individual to exceed the procedural limit. Contrary to the licensee=s program, a technician received 2.7 rem in one year without approval from the radiation safety officer because the technician, the technician=s supervisor and the HP personnel failed to notice that the technician had exceeded the administrative limit.

The violation: The licensee is required to follow their procedures per license conditions.

Minor because: This was a licensee administrative limit. The worker was within federal limits.

Not minor if: Multiple examples were identified of failures to satisfy station radiation protection procedures indicating a failure to maintain and implement programs to keep exposures as low as reasonably achievable.

3. Non-significant Dimensional, Time, Calculation, or Drawing Discrepancies Example a. A temporary modification was installed on one of two redundant component cooling water system surge tanks to restore seismic qualification. The supporting calculations did not receive a second-level review due to engineers failing to adhere to licensee=s requirements on review of calculations. The calculations were found to contain technical errors that did not result in the train being inoperable.

The violation: 10 CFR 50, Appendix B, Criterion III design control measures for verifying the adequacy of design were not implemented. Design changes are required to be subjected to design control measures commensurate with those applied to the original design.

Minor because: These are non-significant calculation errors. The calculation errors were minor and the installed modification restored seismic qualification of the tank.

Not minor if: The calculation errors were significant enough that the modification required revision or rework to correctly resolve seismic concerns.

Example b. A controlled design drawing shows a plug valve where a ball valve is actually installed. This deficiency occurred because of an oversight by the licensee. The valve design was changed to a ball valve but the licensee failed to update the drawing.

Issue Date: 10/01/18 6 0612 App E

The violation: The design is required to be correctly translated into drawings.

Minor because: This is a non-significant drawing deficiency.

Not minor if: Operation of the system was adversely affected by the difference in valves.

Example c. A licensee procedure required that all valves specified on a locked valve list be indicated as locked on the plant drawings. Inspectors identified safety-related valves on the locked valve list that were not indicated as locked on the plant drawings. All valves on the locked valve list were properly positioned and locked, as determined by field verification.

The violation: Activities were not performed in accordance with procedures.

Minor because: This is a non-significant drawing discrepancy. All valves required to be locked were locked and properly positioned.

Not minor if: More than one valve was in the required position but not locked.

Example d. The technical specification required a primary sample to be taken and analyzed within two hours of a power change in excess of 20 percent. The inspector found that the chemistry sample was taken and analyzed within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 35 minutes after a recent power increase from 60 to 85 percent. The sample was within specification requirements.

The violation: The technical specification was violated.

Minor because: This is a failure to implement a requirement that has no safety impact. The sample delay was not significant.

Not minor if: The sample had not been conducted or was delayed to the extent that the sample results were not reliable.

Example e. Deleted - Revised example moved to Health Physics Section Example f. Deleted - Revised example moved to Health Physics Section Example g. During construction of a safety-related concrete wall, a licensee quality control inspector observed that an imbedded Richmond insert is cocked at an angle of 6 degrees. The specification required plus-or-minus 3 degrees.

The licensee discovered that the worker who placed the insert failed to use a level as required. For reasons unknown, the condition report was closed without implementing corrective actions. Subsequent to this incident, the Issue Date: 10/01/18 7 0612 App E

same worker misoriented three other inserts. All of the inserts were later abandoned in place.

The violation: The condition adverse to quality was not corrected and it recurred.

Minor because: These misoriented inserts represent a failure to implement a corrective action that has no safety impact. It had no direct safety impact because the out-of-specification inserts were abandoned in place.

Not minor if: A safety-related attachment had been made to an out-of-specification insert and placed in service.

Example h. The licensee's security fence is required to be 12 feet tall. The NRC discovers that, in one section, the fence is only 11 feet, 10 2 inches tall.

The violation: A license condition requires that the licensee meet their Physical Security Plan, which states that the security fence is required to be 12 feet tall.

Minor because: This is not a significant dimensional discrepancy.

Not minor if: The fence was significantly shorter (e.g., 11 feet).

Example I. The FSAR states the volume of the refueling water storage tank is 250,000 gallons. The actual volume is 248,000 gallons.

The violation: The facility was not consistent with the FSAR.

Minor because: This is a non-significant dimensional discrepancy.

Not minor if: The accident analysis assumed 250,000 gallons of useable volume above the suction point and the actual volume required accident analysis calculations to be re-performed to assure the accident analysis requirements were met.

Example j. The licensee used a non conservative value for condensate storage tank temperature as an input to an accident analysis calculation. The value used was 118 degrees Fahrenheit where the actual value can be as high as 120 degrees Fahrenheit. As a result of this error, there was a slight reduction in the net positive suction head available to the safety injection pumps under accident conditions. The reduction was only a few percent of the available margin. No other similar concerns were identified and there were no programmatic concerns identified with this issue that could lead to worse errors if uncorrected.

The violation: 10 CFR 50, Appendix B, Criterion III design control measures for verifying the adequacy of design were not implemented. Design changes are Issue Date: 10/01/18 8 0612 App E

required to be subjected to design control measures commensurate with those applied to the original design.

Minor because: This was a non significant calculation error that had minimal effect on the outcome of the calculation and there were no programmatic concerns identified associated with the issue that could lead to worse errors if uncorrected.

Not minor if: If the engineering calculation error results in a condition where there is now a reasonable doubt on the operability of a system or component, or if significant programmatic deficiencies were identified with the issue that could lead to worse errors if uncorrected.

Example k. In its analysis to support a safe shutdown of the plant from the alternate control panel, the licensee assumed operators could complete the required tasks in ten minutes, when in fact, completing the required tasks could take as long as eleven minutes. The outcome of the licensee=s analysis was unaffected, as up to 30 minutes of time was allowable to complete these actions. No other similar concerns were identified and there were no programmatic concerns identified with this issue that could lead to worse errors if uncorrected.

The violation: 10 CFR 50, Appendix B, Criterion III design control measures for verifying the adequacy of design were not implemented. Design changes are required to be subjected to design control measures commensurate with those applied to the original design.

Minor because: This was a non significant calculation error that had minimal effect on the outcome of the calculation and there were no programmatic concerns identified associated with the issue that could lead to worse errors if uncorrected.

Not minor if: If the engineering calculation error results in a condition where there is now a reasonable doubt on the operability of a system or component, or if significant programmatic deficiencies were identified with the issue that could lead to worse errors if uncorrected.

Note: The intent behind examples Aj@ and Ak@ is to illustrate that equipment inoperability is not a prerequisite to an issue being more than minor.

4. Insignificant Procedural Errors Example a. A scaffold erected between safety-related plant service water strainers was wedged tightly between the system piping. Licensee procedures required an engineering evaluation be performed for all scaffolding located above or near safety-related equipment. No engineering evaluation was Issue Date: 10/01/18 9 0612 App E

performed to assess the seismic impact of the scaffold. A later engineering evaluation determined that there is no safety concern.

The violation: 10 CFR 50, Appendix B, Criterion V requires that activities affecting quality shall be performed in accordance with procedures.

Minor because: This is a procedural error that has no safety impact.

Not minor if: The licensee routinely failed to perform engineering evaluations on similar issues, or if the later evaluation determined that safety-related equipment was adversely affected.

Example b. While performing a reactor protection procedure, an operator inadvertently operated the bypass switch which caused a single channel trip condition.

The operator failed to follow the procedure and adequately self-check to ensure the right switch was manipulated.

The violation: 10 CFR 50, Appendix B, Criterion V requires that activities be accomplished in accordance with procedures.

Minor because: This was an insignificant procedural error and there were no safety consequences.

Not minor if: The error caused a reactor trip or other transient.

Example c. A valve motor operator was test wired for reading operating current during testing required by Generic Letter 89-10. The valve was successfully cycled, the data recorded and determined to be within the acceptable range, and the valve was returned to service. However, the ammeter used a 0-100 amp scale instead of a 0-10 amp scale as required by the procedure. Subsequent retest with the proper meter resulted in satisfactory amperage readings.

The violation: The test procedure was not followed.

Minor because: This was a procedural error that had no impact on safety equipment. The mistake did not result in an actual equipment problem.

Not minor if: The retest revealed that the data was actually outside of the acceptable range.

Example d. During a review of the lighting in the safety injection pump room, an inspector-identified that the lighting was less than FSAR design levels for operator action. The licensee informed the inspector that this condition was previously identified. However, the corrective action to increase the lighting was given a low priority and was not completed in the two years since initial identification. Interviews with operators revealed that some had Issue Date: 10/01/18 10 0612 App E

difficulties conducting surveillance or emergency drills without the use of flashlights in the pump room.

The violation: The licensee failed to take prompt corrective action for a condition adverse to quality.

Minor because: This is a failure to implement a corrective action that has no safety impact.

Operators are procedurally required to carry flashlights and had no problems functioning in this light condition as evidenced by the lack of operational errors due to poor lighting.

Not minor if: The degraded lighting condition contributed to an operator error or was shown to significantly impact the operator=s ability to do the task.

Example e. The inspector-identified a valve with a missing name-plate, a violation of plant procedures requiring that all equipment be labeled. Discussions with operators revealed that this condition had existed for several years, but because operators routinely referred to the plant drawings, even though the valve was routinely operated, the missing name-plate had no safety consequences.

The violation: Plant procedures required that equipment be labeled.

Minor because: This is a failure to meet procedural requirements that had no safety impact. The operators used the drawings and had no trouble identifying the valve location.

Not minor if: Improper valve manipulation occurred due to the missing name-plate.

Example f. A small leak occurs on a welded connection in the diesel generator day tank causing a slow drip of fuel oil onto the floor in the diesel room.

Maintenance used a sealant to temporarily repair the leak and wrote a work order for a permanent repair, which was scheduled for the next outage. Later, the seal failed and additional leakage occurred, which soaked a safety-related solenoid. The licensee subsequently determined that the wrong sealant was used in the temporary repair.

The violation: The licensee failed to adequately correct a condition adverse to quality.

Minor because: This is a failure to implement a corrective action that had no safety impact because the problem did not affect the operability of the diesel generator.

Not minor if: The damage to the solenoid affected diesel operability or caused a fire hazard.

Example g. The reach rod for a safety-related valve was jammed and could not be used. However, the valve could be operated manually one level down.

Issue Date: 10/01/18 11 0612 App E

This condition existed for two years and, despite complaints from the operators, it was not fixed. The NRC inspector noted that this work-around cost about one minute in operator response time and recognized that manual manipulation of this valve was required by certain off-normal procedures. The valve was accessible during all these off-normal events.

The violation: The licensee failed to identify and correct a condition adverse to quality as required by 10 CFR 50, Appendix B, Criterion XVI.

Minor because: This is a failure to implement a corrective action that had little to no safety impact. The valve could still be operated and the extra time requirement would not affect recovery operations.

Not minor if: There were occasions where access to the valve would be restricted for environmental reasons (heat, radiation, oxygen).

Example h. An inspector discovered that 3 of 150 emergency response organization members who are on the duty roster in different functional areas were not current in their training. The licensee=s emergency plan required that all members be trained annually.

The violation: 10 CFR 50.54(q) requires that the licensee follow and maintain in effect emergency plans. The plan was not followed.

Minor because: There are others on the duty roster in each functional area whose qualifications are current.

Not minor if: Emergency response personnel qualification lapses are wide spread or occur in such a manner that positions cannot be staffed by qualified individuals.

Example i. Deleted - Revised example moved to Health Physics Section Example j. An inspector found that the evaluation of the adequacy of emergency preparedness procedures in the annual audit was not in sufficient depth in one functional area. The licensee reviewed the areas not covered and found no problems.

The violation: 10 CFR 50.54(t) requires that the audit be conducted and that it contain the evaluation of the adequacy of EP procedures.

Minor because: No problems were identified and the revisions of the procedures that were not audited addressed improvements identified in drills.

Not minor if: The procedures that were not evaluated were in a condition that would effect the licensee=s response to an emergency.

Issue Date: 10/01/18 12 0612 App E

Example k. NRC inspectors identified three ten-foot lengths of wood left from a scaffold disassembled the previous week in the auxiliary feedwater pump room. The licensee had not completed an engineering evaluation approving this temporary storage location for transient combustible materials as required by the fire protection plan.

The violation: These transient combustible materials were not reflected in the fire hazards analysis and the licensee failed to complete the required engineering evaluation.

Minor because: This is a failure to implement a fire protection plan requirement that has little or no safety impact. Specifically, the transient combustibles could not affect equipment important to safety and did not exceed any licensing basis requirements. The licensee was able to show that the transient combustibles were well below the fire hazards analysis limits.

Not minor if: The fire loading was not within the fire hazard analysis limits, or a credible fire scenario involving the identified transient combustibles could affect equipment important to safety, or the identified transient combustibles were in excess of those permitted by an NRC safety evaluation report which formed the licensing basis for the plant, or the identified transient combustibles were in a combustible free zone required for separation of redundant trains.

Example l. The technical specifications required that one-third of all safety-related molded case circuit breakers be tested each refueling outage (such that all are tested every three outages) and that the instantaneous trip currents be recorded for trending purposes. The NRC inspector found that two outages ago during testing, the instantaneous trip current for a breaker was not tested due to the breaker not being listed for the instantaneous trip current test. The last recorded trip current for this breaker was five outages ago.

The subject breaker was subsequently found to be in specification.

The violation: The technical specification is violated, because all required tests were not performed on the breaker within three outages.

Minor because: This is a failure to implement a procedural requirement that has no safety impact. All other tests on the breaker were satisfactory at the time of testing and the trip was subsequently found to be in specification.

Not minor if: The subject breaker was out of specification.

Example m. The technical specifications require that 10 percent of all safety-related snubbers be tested each refueling outage and that if one failure occurs, an additional 10 percent sample be tested during the same outage. One snubber in the original population of 17 snubbers (there are a total of 168 snubbers) fails, necessitating an additional sample of 17 snubbers.

Issue Date: 10/01/18 13 0612 App E

However, because of an oversight by the licensee, only 16 additional snubbers are tested with no failures.

The violation: The technical specification was violated because the required number of snubbers were not tested.

Minor because: This is a failure to implement a procedural requirement that has no safety impact since none of the additional snubbers tested failed.

Not minor if: A failure had occurred in the additional sample, necessitating yet another expansion of the sample, and this was not accomplished.

Example n. Deleted - Revised example moved to Health Physics Section

5. Work in Progress Findings Example a. Prior to system restoration following a modification, the licensee determined that the modification package that replaced the spent fuel pool cooling system suction piping did not include the siphon hole called for by the original system design because the engineers failed to realize that the requirements of the original design. The siphon hole was not installed. Due to the location of the piping, a siphoning event would lower spent fuel pool level below the point allowed in Technical Specifications but not to the point where fuel would have been uncovered.

The violation: The pipe design was not correctly translated into work instructions and drawings.

Minor because: This was work in progress. The error was identified and corrected during turnover of the modification prior to system restoration.

Not minor if: The system was returned to service without installation of the siphon hole or completion of an evaluation to remove the requirement for the siphon hole.

Example b. During installation of a modification, the licensee failed to follow the installation procedures and a check valve is installed backward. Quality control did not find the error. During a post-modification test, prior to returning the system to service, the licensee discovered the problem.

The violation: The licensee failed to correctly translate the design to the as-built configuration.

Minor because: It is work in progress and there are no safety consequences.

Not minor if: The system was returned to service.

Issue Date: 10/01/18 14 0612 App E

Example c. A solenoid that did not meet the specification was screened through receipt inspection and placed in the warehouse. When the solenoid was withdrawn to be installed, an electrician noted that it was not the correct type.

The violation: The licensee is supposed to establish controls to prevent nonconforming parts from being used inadvertently and the wrong part could have been installed.

Minor because: It was work in progress and no adverse consequences resulted.

Not minor if: The valve was installed and the system returned to service.

6. Health Physics General Screening Criteria: The NRCs regulatory framework is structured to provide a series of radiation protection barriers and protective measures (e.g., training, procedures, ALARA programs, radiation surveys, worker briefings, area postings, monitoring requirements, etc.)

that, in combination, ensure adequate protection of occupational and public health and safety.

A minor performance deficiency in the implementation of one radiation protection barrier by itself is generally a minimal reduction in the overall adequacy of the protection of health and safety.

However, a performance deficiency involving more than one barrier or the loss of a significant barrier would be classified as a more-than-minor performance deficiency. The determination of minor performance deficiencies or more-than-minor performance deficiencies will also be based on the particular circumstances involved and NRC inspectors evaluation of the importance of the performance deficiency.

Example a: A licensee properly performed a radiation survey, but the survey was not documented.

Performance Deficiency: A radiation survey was not documented as required by Health Physics procedures.

Minor because: The survey was actually performed and proper radiological controls were established.

Not minor if: The lack of a survey record led to a situation (e.g., supervision or health physics technicians being unaware of radiological conditions) that resulted in the failure to establish radiological controls and led to a reasonable likelihood of significant unplanned or unintended dose to an individual.

Issue Date: 10/01/18 15 0612 App E

Example b: Radiation detection instruments (e.g., portable instruments or installed area radiation monitors) were not calibrated properly or not response checked prior to use in accordance with site procedures.

Performance Deficiency: Radiation protection instrumentation was not calibrated properly or was not response checked prior to use.

Minor because: When recalibrated or response checked, the as-found condition of the instrument was within acceptance criteria for the calibration or response check, or provided conservative measurement (i.e., over-response), or if the installed area radiation monitor would have performed its alarm function within a reasonable level of safety margin considering the overall level of radiological hazard being monitored.

Not minor if: When recalibrated or response checked, the as-found condition of the instrument was not within acceptance criteria for the calibration or response check and did not provide conservative measurement, or if the installed area radiation monitor would not have performed its safety function within a reasonable level of safety margin considering the overall level of radiological hazard being monitored.

Example c: Deficiencies were found in the channel calibration of radiation monitoring instrumentation or in the establishment of associated alarm set points, either of which are used for effluent control/monitoring associated with normal operations (i.e., non-emergency planning (EP) program activities).

Performance Deficiency: Instruments or equipment used for effluent monitoring were not properly calibrated or alarm set points were incorrectly established.

Minor because: The effluent monitor with its alarm set point still would have allowed the instrumentation to perform its intended function (e.g., trip or alarm function) to prevent an instantaneous effluent release in excess of the applicable Technical Specification instantaneous concentration limit for liquids or dose rate limits for gases, or if the effluent monitor (e.g., a Boiling Water Reactor (BWR) continuous effluent monitor) calibration deficiency led to a un-assessed dose of a magnitude less than or equal to 10% of 10 CFR 50 Appendix I design objectives (as specified by Technical Specifications/Offsite Dose Calculation Manual (ODCM)).

Not minor if: The effluent monitor with its alarm set point would have failed to perform its intended function (i.e., trip or isolation function) to prevent an instantaneous effluent release in excess of the applicable Technical Specification instantaneous concentration limit for liquids or dose rate limits for gases, or if the effluent monitor (e.g., a BWR continuous effluent monitor) calibration deficiency led to an un-assessed dose of a magnitude Issue Date: 10/01/18 16 0612 App E

greater than 10% of 10 CFR 50 Appendix I design objectives (as specified by Technical Specifications/ODCM).

Example d: A Health Physics technician provided job coverage or performed a task that the technician was not fully qualified to perform (e.g., a task performance qualification was not completed as required, or the Health Physics technician did not have adequate experience).

Performance Deficiency: The licensee did not utilize qualified and trained Health Physics technicians per Technical Specification requirements.

Minor because: Either no errors or only minor errors were made by the Health Physics technician, who had completed basic Health Physics training. The work performed by the technician (e.g., radiological surveys and monitoring) provided a reasonable level of radiological protection and monitoring.

Not minor if: One or more substantial errors were made by the technician while performing radiological surveys and monitoring for a radiologically risk significant task. The work performed by the technician did not provide a reasonable level of radiological protection and monitoring.

Example e: An item (e.g., tool) containing detectable licensed radioactive material (RAM) was not surveyed properly and released from further radiological control. In this example, the area where there were no further radiological tool controls was the area outside the boundary of licensee-defined radiation control area (RCA), where surveys are performed for release of tools and items from the RCA.

Performance Deficiency: An item containing RAM was not surveyed properly with reasonable survey techniques appropriate for the item and the type of radioactive material.

Note: A performance deficiency does not occur in the situation where an item with RAM has been properly surveyed using appropriate survey techniques, evaluated as not having detectable RAM, is released, and is later discovered as containing RAM when surveyed using a more sensitive survey method.

Minor because: An inadequate survey was performed for an item that was released and later discovered. The follow-up survey concluded that the item contained radioactive material with a measured dose rate that was indistinguishable from background (measured in a low background area, at a distance of 30 cm from the item with a micro-rem per hour type instrument that typically uses a 1 by 1 scintillation detector) and the calculated dose using a realistic exposure scenario is less than or equal to 1% of any occupational or public dose limit.

Issue Date: 10/01/18 17 0612 App E

Not minor if: An inadequate survey was performed for an item that was released and later discovered. The follow-up survey concluded that the measured dose rate is distinguishable from background (as measured in a low background area, at a distance of 30 cm from the item with a micro-rem per hour type instrument that typically uses a 1 by 1 scintillation detector) or the calculated dose using a realistic exposure scenario is in excess of 1% of any occupational or public dose limit.

Example f: An inadequate radiation survey did not identify a radiation area (i.e., dose rates were greater than 5 mrem/hr at 30 cm and 100 mrem/hr at 30 cm).

Performance Deficiency: An inadequate radiation survey was performed resulting in an un-posted radiation area.

Minor because: Radiological conditions existed such that the dose to an uninformed worker (e.g, a worker who had not been briefed on or reviewed radiological conditions) was not likely to exceed an unplanned dose > 10 mrem.

Not minor if: Radiological conditions existed such the dose to an uninformed worker was likely to exceed an unplanned dose > 10 mrem.

Example g: A barricade to a posted High Radiation Area (HRA) was circumvented (e.g., a gate was tied open).

Performance Deficiency: Access to a posted HRA was not controlled in accordance with site procedures.

Minor because: The HRA was conservatively posted. The highest radiation level was 100 mrem/hr at 30 cm (i.e., the radiological conditions did not actually constitute a HRA area in accordance with the regulatory definition of a HRA).

Not minor if: The radiation levels exceeded 100 mrem/hr at 30 cm (i.e., a HRA actually existed and was not barricaded).

Example h: An improper entry was made into a High Radiation Area (HRA) (i.e., not in accordance with Technical Specifications and plant procedures).

Performance Deficiency: Licensee personnel did not comply with established radiological barriers and protective measures as specified for entry into and work within a HRA (i.e., an area > 100 mrem/hr at 30 cm and less than or equal to 1,000 mrem/hr at 30 cm). Note: Other examples of performance Issue Date: 10/01/18 18 0612 App E

deficiencies with respect to HRA entries will be evaluated by the NRC based on the importance of the radiological conditions.

Minor because: The individual was authorized for entry into a HRA (e.g., authorized by radiation protection personnel or by radiation work permit), was made aware of the radiological conditions in the area (e.g., during a pre-job briefing or a review of radiation survey results), but the individual signed in on the wrong Radiation Work Permit (RWP), and complied with the instructions of the correct RWP.

Not minor if: The individual was not authorized to enter a HRA or; the individual was authorized for entry, but was not made aware of the radiological conditions (e.g., did not get briefed or did not review radiological surveys) or; the individual was authorized to enter a HRA, was made aware of the radiological conditions and given specific radiological instructions, but took unauthorized actions that significantly changed the radiological conditions or; the individual continues work in a HRA after receiving an electronic dosimeter (ED) alarm without taking the prescribed procedural actions as defined in the licensees radiation protection program/procedures (e.g., stopping work, leaving the area and contacting Health Physics) or; the individual takes actions that involved the bypassing of physical controls (e.g., bypassed the barrier around a locked high radiation area, or an individual bypassed an interlock on a calibration source).

Example i: Performance deficiencies occurred in ALARA planning and/or job execution that resulted in the actual collective dose exceeding the planned, intended dose for a work activity. The ALARA planning process should achieve reasonable precision in estimating collective dose. For tasks with actual collective dose > 5 rem, the actual dose should not exceed the planned, intended dose by more than 50%. For information on expanded work scope, see the following example.

Performance Deficiency: ALARA planning or radiological controls did not prevent unplanned, unintended dose for a work activity.

Minor because: The actual collective dose was 5 person-rem; OR, the actual collective dose was greater than 5 rem but did not exceed the planned, intended dose by more than 50%.

Not minor if: The actual collective dose exceeded 5 person-rem AND exceeded the planned, intended dose by more than 50% (e.g., a task planned for 4 person-rem received 6.1 person-rem).

Note 1: In cases where the licensee arbitrarily divide the radiological work into very small work activities, or dose estimates were over estimated for the purpose of avoiding inspection findings, the criteria should be applied to a reasonable grouping of work and reasonable dose estimates (i.e.,

Issue Date: 10/01/18 19 0612 App E

consistent with prior history or industry norms).

Note 2: The 10 CFR 20.1101 regulations establish a regulatory requirement to use, to the extent practical, procedures and engineering controls to achieve doses that are ALARA. Licensees that establish ALARA programs and procedural controls will normally meet this regulatory requirement and will not incur violations for not reducing doses to an absolute minimum. However, performance deficiencies meeting the not minor if criteria are findings.

Example j: ALARA planning deficiencies were identified in an expanded work activity where 16 person-rem actual collective dose was received to complete a work activity and exceeded the original estimate of 10 person-rem planned, intended dose. When the full scope of the job was determined, the job was re-planned, additional ALARA controls were implemented as appropriate, and the revised dose estimate was 14 person-rem. The 16 person-rem dose would be an increase of 2 person-rem above the revised 14 person-rem planned, intended dose.

The expanded work scope could have resulted from several factors related to additional maintenance or repair that the licensee would not have been reasonably expected to have foreseen before the work began.

Once a work activity is started, and the expanded work scope is fully understood, it may be necessary to re-plan the activity and revise the dose estimate. The revised dose estimate should be based on the full scope of the work had it been known at the time of the initial planning.

Performance Deficiency: ALARA planning and/or radiological controls did not prevent unplanned, unintended dose for a work activity with expanded work scope.

Minor because: The actual collective dose was 5 person-rem; OR, the actual collective dose was greater than 5 rem but did not exceed the revised dose estimate by more than 50% (i.e., the actual collective dose exceeded 5 rem, but the unplanned, unintended dose did not exceed the revised dose estimate by more than 50%).

Not minor if: The actual collective dose exceeded 5 person-rem AND exceeded the planned, intended dose by more than 50% (e.g., a task re-planned for 14 person-rem received 22 person-rem).

7. Maintenance Rule Example a: During an inspectors review of the licensees 10 CFR 50.65a(3) periodic evaluations of the site maintenance program, the inspector noted that two evaluations exceeded the 24 month interval by approximately 2 and 6 months respectively.

Issue Date: 10/01/18 20 0612 App E

The violation: Violation of 10 CFR 50.65(a)(3) in that the periodic maintenance evaluations exceeded the required interval of at least every refueling cycle provided the interval between evaluations does not exceed 24 months.

Minor because: The failure to perform the periodic evaluation by the required interval did not adversely affect the balance of reliability and unavailability and therefore, no necessary adjustments to the maintenance program were required.

Not minor if: The failure to perform the periodic evaluation by the required interval adversely affected the balance of reliability and unavailability and therefore, necessary adjustments to the maintenance program were warranted but not completed.

Example b: Deleted Example c: Violations of 10 CFR 50.65(a)(3): Most 10 CFR 50.65(a)(3) violations, including failure to perform the periodic evaluation within the time requirements, will usually be minor unless they have other consequences such as equipment problems attributable to failure to take industry operating experience into account where practicable.

The inspectors identified that during an (a)(3) periodic evaluation, the licensee failed to include the system unavailability time during T/S required surveillance testing of the emergency diesel generators. Although the licensee conducts monthly EDG testing, the EDGs are unavailable to perform their intended safety function during T/S surveillance testing for a few minutes during each monthly test. The unavailability time due to surveillance testing was insignificant when compared against total unavailability such that the (a)(3) balancing was not affected.

The violation: The licensee failed to consider all unavailability when conducting the (a)(3) evaluation.

Minor because: The small contribution to unavailability due to the surveillance testing is insignificant when compared to total unavailability.

Not minor if: The contribution to unavailability due to surveillance testing was significant enough to affect the balancing determination.

Example d: The inspectors identified that the licensee had not included some components of the augmented off-gas system within the scope of its program for implementation of the Maintenance Rule. Failure of these components could result in a plant transient or scram and are therefore required to be with in the scope. Even though these components were Issue Date: 10/01/18 21 0612 App E

not scoped properly, the licensee had been performing appropriate preventive maintenance and no equipment performance problems had been identified.

The violation: A violation of 10 CFR 50.65b(2) in that the licensee failed to scope certain components of the augmented off-gas system which could have caused a plant transient or scram if failed.

Minor because: There were no equipment performance implications. Had the components been scoped, the preventive maintenance being performed on the system would presumably be demonstrating effective control of performance or condition (absent equipment problems) as provided in paragraph (a)(2) of the Maintenance Rule.

Not minor if: An actual failure had occurred with the non-scoped components causing a transient/scram or if equipment performance problems were such that effective control of performance or condition through appropriate preventive maintenance under (a)(2) could not be demonstrated.

Example e: In accordance with the guidance of IP 71111.13, inspectors reviewed the plant=s maintenance risk assessment performed pursuant to 10 CFR 50.65(a)(4) for in progress maintenance activities and identified that the risk assessment was inadequate. Specifically, not all on-going maintenance activities affecting structures, systems, and components (SSCs) within the licensee=s established (a)(4) scope had been taken into account, one of the maintenance activities was taking longer than assumed in the risk assessment, plant conditions/operations, including technical specifications requirements, were not consistent with the assumptions used in the risk assessment, and some relevant information provided to the risk assessment tool/process was inaccurate/incomplete.

The violation: Failure to perform an adequate risk assessment when required by 10 CFR 50.65(a)(4).

Minor because: The overall elevated plant risk would not put the plant into a higher licensee-established risk category and would not require risk management actions (RMAs) or additional RMAs under licensee procedures*.

Not minor if: The overall elevated plant risk would put the plant into a higher licensee-established risk category or would require, under plant procedures*,

RMAs or additional RMAs. In addition, the performance deficiency would be more than minor if the risk assessment failed to account for (at least qualitatively) the loss or significant, uncompensated impairment of a key operating or shutdown safety function.

Example f: In accordance with the guidance of IP 71111.13, inspectors reviewed the plant=s maintenance risk assessment for in progress maintenance Issue Date: 10/01/18 22 0612 App E

activities required by 10 CFR 50.65(a)(4) and identified that a risk assessment had not been performed prior to commencing maintenance activities or maintenance support activities that increased plant risk.

The violation: Failure to perform a risk assessment when required by 10 CFR 50.65(a)(4).

Minor because: The overall elevated plant risk would not put the plant into a higher licensee-established risk category and would not require RMAs or additional RMAs under licensee procedures*.

Not minor if: The overall elevated plant risk would put the plant into a higher licensee-established risk category or would require, under plant procedures*,

RMAs or additional RMAs. In addition, the performance deficiency would be more than minor if the risk assessment failed to account for (at least qualitatively) the loss or significant, uncompensated impairment of a key operating or shutdown safety function Example g: In accordance with the guidance of IP 71111.13, the inspectors reviewed the plant=s maintenance risk assessment for in progress maintenance activities required by 10 CFR 50.65(a)(4) and determined that a risk assessment had been performed when required and was adequate.

Upon inspection of the plant, the inspectors identified that one of the RMAs prescribed by the licensee had not been effectively implemented.

The violation: Failure to manage risk as required by 10 CFR 50.65(a)(4).

Minor because: All key safety functions were preserved.

Not minor if: Any key safety functions were lost or significantly degraded without sufficient compensation.

• Note: Under certain circumstances regarding an assessed risk level, the inspector may identify RMAs that should be taken which could be contrary to the required RMAs in accordance with licensee procedures. In such cases, management review is required for more-than-minor determination, including consultation with the regional Maintenance Rule subject matter expert and then the Maintenance Rule lead in NRR if necessary.

8. Thermal Power Limits Example a: While operating at 99.9 % RATED THERMAL POWER (RTP), operators conducted a pre-planned evolution to swap operating feed pumps.

Operators did not comply with a licensee procedure prerequisite to reduce thermal power 0.5% below RTP prior to the pre-planned feed pump swap; which is in place to account for the anticipated 0.2% to 0.4%

increase in thermal power. Upon starting the second feed pump, thermal power increased to 100.2% RTP. Operators promptly stopped the first Issue Date: 10/01/18 23 0612 App E

feed pump, returning the unit to RTP. Throughout the incident, thermal power remained bounded by reactor safety analysis (i.e. thermal power did not enter an unanalyzed region) and no safety limits were exceeded.

The violation: Violation of TS when operators did not comply with procedure prerequisite prior to swapping feed pumps. Additionally, a violation of the thermal power limit associated with a license condition. This condition could have been prevented.

More than minor because: Not complying with a procedure prerequisite contributed to exceeding RTP, a condition prohibited by the operating license. Other factors that would contribute to this example being more than minor are: 1) operators did not promptly lower thermal power below or at RTP once they identified they were exceeding their licensed thermal power limit or 2) the maximum thermal power reached entered an unanalyzed region.

Minor if: Operators had performed the prerequisite power reduction to 0.5% below RTP, however, after the feed pump swap thermal power increased to 100.1% RTP; which was 0.2% higher than the anticipated maximum increase of 0.4% according to operating experience. After realizing that thermal power had exceeded RTP, the operators promptly decreased thermal power below or at RTP.

Example b: Following several days of steady state operation at or below RTP, operators operated the unit in excess of RTP as indicated by both the 1-hour and 2-hour average core thermal power (CTP) indication.

To monitor and control reactor power in accordance with the operating license, operators rely on computer-generated time-averaged indications of CTP that are updated every 10 seconds, providing running averages for 15-minute, 1-hour, 2-hour, and 8-hour CTP. A licensee procedure requires operators to review 15-minute average CTP and make necessary adjustments to maintain the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> average CTP at or below RTP. Similarly, it requires operators to review 1-hour average CTP and make necessary adjustments to maintain the 2-hour average CTP at or below RTP.

Contrary to this guidance and license RTP requirements, when the 1-hour average CTP indication exceeded RTP, operators did not make necessary adjustments to maintain 2-hour CTP at or below RTP.

The violation: Violation of TS in that operators did not comply with procedure requirement to monitor 15-minute-, 1-hour-, and 2-hour average CTP and to make timely CTP adjustments as necessary to maintain 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> average CTP within the RTP limit.

More than minor Issue Date: 10/01/18 24 0612 App E

because: Operator non-compliance with the procedure requirements and license conditions to operate the reactor at or below RTP could have the potential to lead to a more significant safety concern.

Minor if: Operators minimally exceeded the 1-hour average RTP in spite of having made timely and appropriate power adjustments based on the 15-minute average indication but then made appropriate and timely adjustments to prevent the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> average CTP from exceeding RTP.

Example c: Following a 90-minute period of constant steady state plant operation at 99.5% RATED THERMAL POWER (RTP), operators took specific actions to raise and maintain thermal power to 101.4% RTP for 30 minutes in order to increase the two-hour average thermal power to approximately 100% RTP. A 99.98% two-hour average thermal power was subsequently confirmed. Thermal power throughout the incident remained bounded by reactor safety analysis (i.e. thermal power did not enter an unanalyzed region) and no safety limits were exceeded.

The violation: Violation of TS in that operators took specific actions to raise and maintain thermal power above RTP, a condition prohibited by the operating license. When RTP was exceeded, operators did not promptly restore power below or at RTP.

More than minor because: Operator actions to raise and maintain thermal power above RTP and the failure to promptly restore the unit to RTP once exceeded could have the potential to lead to a more significant safety concern.

Minor if: Operators had not exceeded RTP but had, instead, exceeded only a licensee self-imposed requirement or standard (e.g. good operating practice thermal power limit of 99.97% RTP).

9. Worker Fatigue Example a: Failure to Limit Work Hour Waivers for Covered Workers As Necessary For Safety or Security Performance Deficiency: The licensee inappropriately used work hour control waivers during the refueling outage which permitted the workers to exceed 72 work hours in a 7-day period on a group basis instead of an individual basis that resulted in the workers subsequently exceeding this requirement.

Contrary to § 26.207, the licensee failed to determine that each individual waiver was necessary to mitigate or prevent a condition adverse to safety or to maintain site security, and relied on the granting of a group waiver to address circumstances that could have been reasonably controlled.

Issue Date: 10/01/18 25 0612 App E

More than Minor Because: The licensee routinely failed to perform appropriate use of a waiver. If left uncorrected, the continued inappropriate use of waivers to permit workers to exceed work hour limits, could lead to a more significant safety concern. (See IMC 0612, Appendix B, Section 1-3 Minor Screening Question c.2)

Minor if: This inappropriate use of work hour control waiver was an isolated incident (e.g. one or two instances) as opposed to several instances, and was reasonably determined not to have demonstrated the potential to erode the effectiveness of work hour controls and to contradict intent of § 26.207, Waivers and exceptions.

Example b: Failure to Assess Individuals Competency to Perform Duties Prior to Granting Work Hour Waivers Performance Deficiency: Inspectors determined that, contrary to § 26.207, the licensee, prior to granting waivers of work hour controls, failed to ensure supervisors assessed individuals face to face to establish reasonable assurance that each individual would be able to safely and competently perform his or her duties during the additional work period for which the waiver was granted.

More than Minor Because: Subsequently, a licensed operator, working under a waiver, without having received a face to face assessment, incorrectly reconfigured a safety-related SSC. The configuration error resulted in an at-power event that upset plant stability and challenged critical safety functions. Fatigue could not be ruled out as a contributor. The failure to assess covered workers face to face prior to granting work hour waivers was, in this instance, associated with the human performance attribute of the reactor safety initiating events cornerstone. It adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions. Finally, fatigue could not be ruled out as a contributor. (See IMC 0612, Appendix B, Section 1-3 Minor Screening Question c.4)

Minor if: The failure to assess a covered worker face to face prior to granting work hour waivers was an isolated incident that did not become associated with a cornerstone attribute or did not adversely affect the cornerstone objective.

10. Cyber Security Issue Date: 10/01/18 26 0612 App E

Example a: NEI 08-09, Appendix A, Section 3.1.3 - Identification of Critical Digital Assets A critical digital asset (CDA) was classified by the licensee as a direct CDA and the inspectors discovered that the licensee had inadequately implemented some of the NEI 08-09, Cyber Security Plan for Nuclear Reactors, Appendix D technical controls. However, when re-reviewed, it was determined that the CDA met the criteria for an indirect CDA and the required baseline controls, in accordance with NEI 13-10, Cyber Security Control Assessments, Section 5 were in place.

Performance Deficiency: Failure to implement the required controls for a direct CDA as required by the approved cyber security plan (CSP).

More than Minor Because: The baseline controls for an indirect CDA were not in place. In addition, the performance deficiency would be more than minor if the CDA was categorized as an indirect CDA, and inspector assessment showed that the CDA was a direct CDA, and the CDA was not adequately protected because some of the required controls were not in place.

Minor if: Upon assessment the CDA met the criteria for an indirect CDA in accordance with NEI 13-10 and all the required baseline controls were in place for an indirect CDA.

Example b: NEI 08-09, Appendix D, Section 1.17 - Wireless Access Restrictions The CSP requires that scans are conducted every 31 days for unauthorized wireless access points in accessible areas. Inspectors found that the licensee had missed a scan as required by site procedures within 31 days, and the scan was not performed until 35 days. Once the scan was complete, no wireless access points were identified.

Performance Deficiency: Licensee procedure and CSP requirement were violated.

More than Minor Because: This was an issue where multiple scans were being routinely missed or significantly delayed. In addition, the performance deficiency would be more than minor if once the scan was conducted or logs were reviewed, rogue wireless access points were identified.

Minor if: This is a failure to implement a requirement that had no safety, security, or emergency preparedness impact. The scanning delay was not significant (e.g. less than 25% of the required frequency - in this case less than 7 days) and review of logs indicates that no rogue connections occurred during the delay period.

Issue Date: 10/01/18 27 0612 App E

Example c: NEI 08-09, Appendix D, Section 4.3 - Password Requirements The inspector performed an initial review of the cyber security control assessment that was completed for an auxiliary feedwater control system which was determined to be a direct CDA. During the review, the inspector observed that the evaluation for the password security control stated that a password was not required and there was not an alternate control evaluation performed. The digital device had the capability to store a password in order to provide protective measures for access control and multiple threat vectors existed. All other security controls had been properly evaluated and implemented.

The violation: The sites CSP commits to using NEI 08-09, Revision 6 in order to protect digital assets that perform a safety, security and emergency preparedness (SSEP) function. NEI 08-09, Appendix D, Section 4.3 requires passwords to be implemented in order to limit access control to only authorized users of CDAs. Section 3.1.6 of the sites CSP requires the site to perform and document the analyses of the CDA and alternative countermeasures to confirm that the alternate controls/countermeasures mitigate the consequences of the threat/attack vector(s).

More than Minor because: Alternate controls were not implemented to protect this device. While the device was located in a vital area, the issue would be more than minor if the device could be reconfigured. In addition, the performance deficiency would be more than minor if alternate controls were implemented to protect this device, but the licensee was not able to provide an evaluation demonstrating that the alternate controls/countermeasures mitigate the consequences of the threat/attack vector(s) (mitigated the consequences of an attack the control was designed to protect).

Minor if: This is an isolated incident and alternate controls were implemented (e.g.,

component was in a locked vital area and had a locked cover protecting the device from being reconfigured) although the alternate control evaluation was not performed and documented in the cyber security control assessment. However, the licensee was able to provide an evaluation that demonstrated that alternate controls/countermeasures mitigate the consequences of the threat/attack vectors.

Issue Date: 10/01/18 28 0612 App E

ATTACHMENT 1 Revision History Commitment Accession Description of Change Description of Comment Resolution Tracking Number Training and Closed Feedback Number Issue Date Required and Forms Accession Change Notice Completion Number (Pre-Date Decisional, Non-Public Information)

N/A ML031610641 Initial issuance of Appendix E to IMC-0612 which N/A N/A 06/24/2003 provided numerous new examples of minor CN 03-021 violations in Appendix E.

N/A ML051400260 Appendix E was revised to add minor issue N/A N/A 05/19/2005 examples pertaining to maintenance risk CN 05-014 assessments and risk management issues resulting from baseline inspection procedure IP 71111.13, AMaintenance Risk Assessments and Emergent Work Evaluation.@ In addition, additional clarifications have been made to the existing maintenance rule minor issues examples.

N/A ML052700276 Appendix E was revised to provide additional N/A N/A 09/30/2005 examples of cross-cutting aspects and additional CN 05-028 examples of minor findings were added.

N/A 02/10/2006 Revision history reviewed for the last four years. N/A N/A N/A ML0607301310 Appendix E was revised to remove discussion of Yes N/A 6/22/06 cross-cutting aspects of inspection findings. A 07/01/2006 CN 06-015 new appendix, Appendix F, was created to provide examples of cross-cutting aspects of inspection findings which reflected the work by the safety culture working group.

NA ML070720202 Appendix E Section 4, Example k (fire loading) N/A ML071560246 09/20/07 was revised to provide more detail in aid of a CN 07-029 minor versus more-than-minor determination.

Issue Date: 10/01/18 Att1-1 0612 App E

Commitment Accession Description of Change Description of Comment Resolution Tracking Number Training and Closed Feedback Number Issue Date Required and Forms Accession Change Notice Completion Number (Pre-Date Decisional, Non-Public Information)

N/A ML083040261 Appendix E was revised to add Health Physics, N/A ML083040254 07/08/09 Thermal Power, Maintenance Rule, and Worker CN 09-017 Fatigue Examples.

NA ML092190386 Appendix E, Section 6, Example e: was revised N/A N/A 08/11/09 to correct a logic error in the Minor because CN 09-020 paragraph. The example is minor only if both the activity is indistinguishable from background, and the dose to an individual was less than 1% of the occupational or public dose limit.

N/A ML18093B550 Appendix E, Section 10 was added to provide N/A ML18093B551 10/01/18 minor and more than minor examples for Cyber CN 18-033 Security Violations Issue Date: 10/01/18 Att1-2 0612 App E