IR 05000313/2009008

IR 05000313-09-008 on 06/01/09 - 06/30/09 for Arkansas Nuclear One, Unit 1, Supplemental Inspection Report

ML092260065
Person / Time
Site:	Arkansas Nuclear
Issue date:	08/14/2009
From:	Clark J NRC/RGN-IV/DRP/RPB-E
To:	Walsh K Entergy Operations
References
IR-09-008
Download: ML092260065 (19)

Text

UNITED STATES NUC LE AR RE G UL AT O RY C O M M I S S I O N ust 14, 2009

SUBJECT:

ARKANSAS NUCLEAR ONE - NRC INSPECTION PROCEDURE 95001 SUPPLEMENTAL INSPECTION REPORT 05000313/2009008

Dear Mr. Douet On June 4, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed the onsite portion of a supplemental inspection at your Arkansas Nuclear One, Unit 1 facility pursuant to Inspection Procedure 95001. The enclosed inspection report documents the inspection results, which were discussed during a telephonic exit meeting on June 30, 2009, with you and other members of your staff.

As required by the NRC Reactor Oversight Process Action Matrix, this supplemental inspection was performed in accordance with Inspection Procedure 95001. The purpose of the inspection was to examine the causes for and actions taken related to the performance indicator for unplanned scrams per 7000 critical hours crossing the threshold from Green (very low risk significance) to White (low to moderate risk significance) in the 1st quarter of 2009.

This supplemental inspection was conducted to provide assurance that (1) the root causes and contributing causes for the risk significant issues were understood, (2) the extent of condition and extent of causes of the issues were identified, and (3) to provide assurance that the corrective actions for risk significant performance issues are sufficient to address the root causes and contributing causes and to prevent recurrence. The inspections examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspection consisted of examination of selected documents and interviews with personnel.

The inspection concluded that the root causes of the unplanned reactor scrams were adequately defined and understood, the extent of condition and extent of causes of the issues were identified, and the corrective actions resulting from the evaluations appropriately addressed the identified causes.

The attached report documents one NRC-identified finding having very low safety significance (Green). The finding was determined not to involve violations of NRC requirements. Since the finding does not violate NRC requirements, enforcement does not apply. The finding had crosscutting aspects in the area of human performance.

Entergy Operations, Inc -2-If you contest the subject or significance of the finding, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E.

Lamar Blvd, Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the Arkansas Nuclear One facility.

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, its enclosure, and your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Should you have any questions concerning this inspection, we will be pleased to discuss them with you.

Sincerely,

/RA/

Jeff Clark, P.E.

Chief, Project Branch E Division of Reactor Projects Docket: 50-313 License: DPR-51

Enclosure:

NRC Inspection Report 05000313/2009008 w/Attachment: Supplemental Information

REGION IV==

Docket: 50-313 License: DPR-51 Report: 05000313/2009008 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Unit 1 Location: Junction of Hwy. 64 W and Hwy. 333 South Russellville, Arkansas Dates: June 1-30, 2009 Inspector: B. Larson, Senior Operations Engineer Approved By: J. Clark, Project Branch E Division of Reactor Projects-1- Enclosure

SUMMARY OF FINDINGS

IR 05000313/2009008; 06/01/2009-06/30/2009; Entergy Operations, Inc.; Arkansas Nuclear

One, Unit 1; Supplemental Inspection for one White Performance Indicator, Unplanned Scrams per 7000 Critical Hours, in the Initiating Events Cornerstone The U.S. Nuclear Regulatory Commission performed this supplemental inspection to assess the licensees evaluations associated with four unplanned reactor scrams (or trips) that occurred between December 12, 2008 and February 7, 2009. The cumulative effect was that the performance indicator for unplanned scrams per 7000 critical hours crossed the threshold from Green (very low risk significance) to White (low to moderate risk significance) for the first quarter of calendar year 2009. The licensee performed individual root cause evaluations for each of the four reactor scrams. In addition, the licensee performed a common cause analysis to identify any performance and process issues that led to the White performance indicator. During this supplemental inspection, performed in accordance with Inspection Procedure 95001, the inspector determined that for each scram the licensee performed a comprehensive and thorough evaluation in which specific problems were identified, an adequate root cause evaluation including extent of condition and extent of cause was performed, and corrective actions were taken or planned to prevent recurrence.

Cornerstone: Initiating Events

Green.

A Green NRC-identified finding was identified for the failure of operations personnel to follow procedures to obtain an Operational Safety Review Committee review and approval prior to restart of the unit where the cause of the trip had not been positively identified. Specifically, on December 13, 2008, and again on December 23, 2008, Unit 1 was restarted without an Operational Safety Review Committee review and approval as required by the Post Transient Review Operating Procedure OP-1015.037, Attachment B. In both cases, the cause of the trip was identified as probable. The issue was not a violation of NRC requirements because the affected activities were not safety related. The licensee entered this issue into their corrective action program as Condition Report CR-ANO-C-2009-01217.

The performance deficiency was greater than minor because it could be reasonably viewed as a precursor to a significant event, as evidenced by the December 20, 2008, manual reactor trip. Using Manual Chapter 0609.04,

Phase 1 - Initial Screening and Characterization of Findings, this finding affects the initiating events cornerstone and is determined to have very low safety significance by NRC management review because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. The finding was determined to have a crosscutting aspect in the area of human performance associated with decision-making H.1(b), in that the licensee made nonconservative assumptions in the decisions to restart the unit after each trip. The licensee failed to conduct sufficient effectiveness reviews to verify the validity of the underlying assumptions (Section 4OA4).

REPORT DETAILS

4OA4 Supplemental Inspection

.1 Inspection Scope

The U.S. Nuclear Regulatory Commission performed this supplemental inspection in accordance with Inspection Procedure 95001, Inspection for One or Two White Inputs in a Strategic Performance Area. The purpose of this inspection was to assess the licensees evaluation associated with the White performance indicator for Unplanned Scrams per 7000 Critical Hours which affected the initiating events cornerstone in the reactor safety strategic performance area. The objectives of this inspection were to provide assurance that the:

• root causes and contributing causes of risk significant performance issues are understood

• extent of condition and the extent of cause of risk significant performance issues are identified

• licensee corrective actions for risk significant performance issues are sufficient to address the root and contributing causes and prevent recurrence This performance indicator crossed the threshold from Green to White following four unplanned reactor scrams that occurred between December 12, 2008, and February 7, 2008. The four unplanned scram events are listed below:

• December 12, 2008, manual reactor trip due to unanticipated Group 7 control rods partially drop into the core

• December 20, 2009, manual reactor trip due to unanticipated Group 7 control rods partially drop into the core

• February 5, 2009, manual reactor trip due to a loss of control rod drive mechanism cooling

• February 7, 2009, manual reactor trip due to a hydrogen fire in the turbine building at the turbine generator hydrogen add station Arkansas Nuclear One, Unit 1 entered the Regulatory Response Column of the NRCs Action Matrix in the first quarter of 2009 as a result of the performance indicator of low to moderate safety significance (White).

The licensee conducted a root cause analysis for each of the two trip events in February 2009 and a combined root cause analysis for the two trip events in December 2008. In addition, Arkansas Nuclear One staff conducted a common cause analysis and an apparent cause evaluation for 55 plant equipment challenges. Eight of these events

were Units 1 and 2 down power and plant shutdown events that occurred during the time from January 2007 to February 2009.

The inspector reviewed the licensees root cause analyses in addition to other evaluations and assessments conducted in support, and as a result, of the root cause analyses. The inspector reviewed corrective actions taken or planned to address the identified causes. The inspector also held discussions with licensee personnel to ensure that the root and contributing causes were understood and corrective actions taken or planned were appropriate to address the causes sufficiently to preclude repetition.

.2.01 Problem Identification

a. Events The performance indicator crossed the threshold from Green to White during the first quarter of 2009 as a result of an unplanned trip on February 7, 2009. Prior plant trips had occurred on December 12, 2008, December 20, 2008, and February 5, 2009. A brief description of each trip from the associated licensee event report and condition report is given below. For each trip, the event was self-revealing.

1. December 12 and 20, 2008, Two Manual Reactor Trips in Response to Abnormal Control Rod Movement Caused by Control Rod Drive Control System Component Degradation (Licensee Event Report 50-313/2008-001-00 and Condition Reports ANO-1-2008-02671 and -02742)

Description.

At 8:55 a.m. on December 12, 2008, following startup from Refueling Outage 1R21, Arkansas Nuclear One Unit 1 was holding stable at 32 percent reactor power in order to perform nuclear instrumentation calibrations. Control room operators received an asymmetric rod alarm and noted an abnormal rod response with reactor power lowering. At this point, operations manually tripped the reactor.

On December 20, 2008, at approximately 12:12 p.m. with Unit 1 at approximately 100 percent power, control room operators received an asymmetric rod alarm and noted abnormal rod pattern on Group 7 with reactor power lowering. Operations then manually tripped the reactor.

Cause.

The licensees root cause analysis identified the following as the most probable root cause for this event:

• Failure of the K1 and/or K2 auto Bus Transfer Relays (Inadequate Preventive Maintenance): These relays are original equipment and were degraded. The licensee had no preventive maintenance or replacement strategy for these relays. A failure of these relays could have caused the abnormal control rod response. The licensee considered this the most likely reason for the abnormal control rod operation. However, the licensee did not have sufficient information available to conclusively reach this determination.

The following was identified as a possible root cause for this event:

• Failure of the Control Rod Programmer Assembly (Inadequate Preventive Maintenance): The programmer assembly presents a single point failure vulnerability and has no preventive maintenance or replacement strategy in place. The failure of the 15 V power supply would directly cause the failure of the programmer main control unit. The licensee did not believe that this failure mode was at fault because the programmer assembly was replaced. However, the licensee could not rule out this potential cause.

2. February 5, 2009, Manual Reactor Trip From Power in Response to a Loss of

Control Rod Drive Cooling Water Flow Due to a Gasket Failure Which Resulted in Air Intrusion into the Intermediate Cooling Water System (Licensee Event Report 05000313/2009-001-00 and Condition Report CR-ANO-2009-0225)

Description.

At 3:24 p.m. on February 5, 2009, Unit 1 reactor was manually tripped due to a loss of control rod drive cooling water flow. This loss of control rod drive cooling water flow was caused by a blown head gasket on the service air compressor C-3A introducing large quantities of air into the nonnuclear intermediate cooling water system. This resulted in cavitation of pump P-33A intermediate cooling water pump and both control rod drive cooling pumps P-79A and P-79B. This loss of control rod drive cooling water flow caused control rod drive temperatures to approach 180oF, the reactor trip criteria for Operating Procedure OP-1203.003, CRD Malfunction Actions Procedure.

Cause.

The licensees root cause analysis identified the following root causes for this event:

• Original Design Inadequate: The Unit 1 service air compressors were cooled by the closed loop intermediate cooling water system. The design utilized the nonnuclear side of intermediate cooling water as the compressor's cooling water supply. This cooling system was also used to cool the control rod drive motors.

When the gasket failed, service air entered the cooling water system and affected control rod cooling.

• Inaccurate Design Documentation/Prints: The torque values specified for the compressor head bolts in Engineering Request ER-ANO-2001-1268-000 were not correct.

On September 21, 2007, C-3A SA compressor cylinder head gasket leak was repaired per Work Order WO-85415. The work order rebuilt the compressor and included replacing several gaskets (including head gaskets), filters, and piston rings. This work order included Engineering Request ER-ANO-2001-1268-000 which specified torque values (92 foot-pounds) that were a little over half the values specified by the compressor vendor, Ingersoll-Rand (160 foot-pounds).

Conversations with the vendor on February 23, 2009, revealed that the vendor torque values are critical to obtaining proper sealing of the gaskets. Incorrect torque values provided by the engineering request led to inadequate sealing of the gaskets separating the air passages from the water passages.

The following items were identified as contributing causes:

• Vulnerability Not Recognized: The event narrative cites many instances of air intrusion in to intermediate cooling water from these water cooled air compressors. When Unit 1 relied on the original instrument air compressors as the primary air source, Operations would continually vent the intermediate cooling water system. Venting intermediate cooling water became a normal mode of operation rather than fixing the cause of air intrusion. Both Units 1 and 2 installed air cooled instrument air compressors to relieve the dependence on the original air compressors. However, both units chose to depend on the yard air compressor and then a temporary air compressor rather than replace the original service air compressors. Use of the yard compressors in lieu of the installed service air compressors allowed the vulnerability of an air intrusion event to go unrecognized.

• Maintenance Performed Incorrectly: Work Order-85415 rebuilt C-3A in 2007 and referenced Technical Manual TDI075 130. Pages 20 and 21 of the technical manual discussed checking the tightness of the bolts and nuts at specific intervals after compressor operation (at 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />; at 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />; and at 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />). The work order documentation provides no evidence that these hot re-torque steps were performed. Not performing the hot re-torque steps could have contributed to gasket failure. However, the hot re-torquing would have been to the lower torque values.

3. February 7, 2009, Manual Reactor Trip in Response to a Fire at the Main Generator

Hydrogen Addition Station Caused by a Personnel Error (Licensee Event Report 50-313/2009-002-00 and Condition Report ANO-1-2009-0254)

Description.

The inadvertent disassembly of a hydrogen addition valve (H2-109) created an uncontrolled release of hydrogen gas which led to a hydrogen burn/fire resulting in a personnel hazard and significant equipment damage. An auxiliary operator had inappropriately utilized a torque-amplifying device (pipe wrench) to help reposition the valve open. However, the valve was already open and the operator inadvertently disassembled the valve. Hydrogen gas then leaked rapidly from the system. A fire initiated and operators manually scrammed the reactor from 90 percent power. This issue is addressed in NRC Inspection Reports 05000313;368/2009002.

Cause.

The licensees investigation identified the following root cause for this event:

• The Auxiliary Operator Did Not Apply Training Practices when Performing Task: When confronted with the inability to move the hydrogen skid valve by hand, the operators should have sought supervisory assistance prior to using a torque amplifying device (pipe wrench) on the valve. In addition, the operators attempted to open the valve first, when they were trained to attempt to close the valve first to verify the position. Finally, the operators failed to properly self-check when attempting to open the valve. Consequently, the operator did not notice that the valve bonnet was unscrewing from the valve body.

• Uniqueness of Valve Design Not Recognized: Another contributing cause was the failure to recognize the unique design of valve H2-109. The inside auxiliary operator stated in the human performance error review that there was a lack of specific knowledge of valve H2-109. The operator was not familiar with how the valve bonnet was threaded to the body and did not recognize the potential to disassemble the valve.

• Use of Tool Not Designed for Job: The use of a pipe wrench as a torque amplifying device was not the correct tool for the job. The pipe wrench was used because a valve wrench would not work on the handwheel of Valve H2-109. The handwheel is solid design with two holes in the top of the handwheel. The correct tool for this type handwheel is a Ford type wrench.

• Procedure Step Not in Accordance with Writer's Guide: Discovered during the interview process was the misconception on verifying a valve open. The inside auxiliary operator stated that the instruction to verify a valve open means you are required to open the valve. This is not in accordance with Operating Procedure OP-1015.030, Revision 9, Operations Procedure Writer's Guide, B, which defines Verify as To confirm that a condition exists and if it does not to take the necessary action to establish that condition. The inside auxiliary operator misconceptions led to the belief that valve H2-109 required opening.

b. Determination of how long the issue existed and prior opportunities for identification

The performance indicator crossed the threshold from Green to White during the first quarter of 2009 as a result of an unplanned trip on February 7, 2009. For the individual trips, the prior opportunities for identification are discussed below:

1. December 12 and 20, 2008, Two Manual Reactor Trips in Response to Abnormal

Control Rod Movement Caused by Control Rod Drive Control System Component Degradation Following the December 12, 2008, trip, the licensees investigation identified the Group 7 programmer as the most likely cause for the dropping and relatching of the Group 7 control rods. Although a direct definitive cause was not determined, the licensee thought the condition to be bounded by the programmer assembly due to the redundant nature of the control rod drive system and the single point vulnerability of the Group 7 programmer with respect to Group 7 control rods. The licensee discounted the automatic bus transfer as a potential cause as it provides power to all the group programmer assemblies and none of the other group programmers were affected.

Operating experience indicated a failure of the automatic bus transfer would result in an impact to all the programmer assemblies and result in dropping all control rods in Groups 5, 6, 7, and 8. After replacement of the Group 7 programmer, the plant was restarted.

Following the December 20, 2008 trip, the licensee expanded their failure modes analysis to include areas that required a typical and multiple failure modes and added additional resources to the failure modes analysis team. The second failure modes analysis effort and trouble shooting found degraded automatic bus transfer K1 and K2 relay contacts. Although field testing or bench testing of the relays could not

directly replicate the event, the licensee thought analysis and testing of the individual components and known and discovered failure modes supported the conclusion that they had identified the most probable root cause. After the automatic bus transfers were replaced and the Group 7 programmer replaced a second time, the plant was restarted.

The NRC determined that there was a Green finding associated with this issue, as documented in Section 02.01(d)(1) of this inspection report. The inspector concluded that the licensee missed an opportunity to identify the degradation of the automatic bus transfer relays after the December 12, 2008, trip.

2. February 5, 2009, Manual Reactor Trip From Power in Response to a Loss of Control Rod Drive Cooling Water Flow Due to a Gasket Failure Which Resulted in Air Intrusion into the Intermediate Cooling Water System The licensees investigation indicated that the failure of the service air compressor was due to incorrect torque values used during head gasket replacement in September 2007. The investigation also identified numerous prior events of air intrusion into the intermediate cooling water/component cooling water systems dating back to 1985.

The inspector determined that the licensees evaluation was adequate with respect to identifying how long the issue existed and prior opportunities for identification.

3. February 7, 2009, Manual Reactor Trip in Response to a Fire at the Main Generator

Hydrogen Addition Station Caused by a Personnel Error The licensees investigation identified that a concern with the use of valve wrenches and other torque amplifying devices without formal approval or risk analysis existed in June 2008. A corrective action plan was implemented and included a review of procedure requirements for torque amplifying devices and a review of industry operating experience and restrictions associated with use of valve wrenches or torque amplifying devices. Based on these reviews, the licensee issued interim guidance on the use of torque amplifying devices in the form of a standing order in August 2008. In December 2008 a change to Operating Procedure OP-1015.001, Conduct of Operations, was issued that restricted the use of torque amplifying devices.

The inspector determined that the licensees evaluation was adequate with respect to identifying how long the issue existed and prior opportunities for identification.

c. Determination of the Plant-Specific Risk Consequences and Compliance Concerns Associated with the Issue

1. December 12 and 20, 2008, Two Manual Reactor Trips in Response to Abnormal

Control Rod Movement Caused by Control Rod Drive Control System Component Degradation For the December 12, 2008, trip, the licensee determined that although Group 7 control rods relatched and began to withdraw, prompt operator action to perform a manual reactor trip prevented any automatic protective setpoints from being approached. At the time of the trip, the nuclear overpower trip setpoint was set lower than normal (40 percent vs 104.9 percent) while performing physics testing following startup from

Refueling Outage 1R21 refueling outage. Posttrip plant response was normal with no complications and the plant stabilized in Mode 3, hot standby, without incident. All safety systems performed as designed with no automatic safety features actuating.

This event was of minimal safety significance.

For the December 20, 2008, trip, the licensee determined that no outward control rod motion occurred due to the fact that Group 7 control rods relatched at different heights.

This caused an out inhibit associated with the control rod drive system to prevent outward control rod motion. Posttrip transient response for this event was normal with no complications and the plant stabilized in Mode 3, hot standby, without incident. Main steam safety valves lifted for approximately 1 minute as a result of the reactor trip and reseated properly as designed. This was determined to be a normal response since the plant was at 100 percent power prior to the trip. This event was of minimal safety significance.

The inspector concluded that the licensee appropriately documented the risk consequence and compliance concerns associated with the issue.

2. February 5, 2009, Manual Reactor Trip from Power in Response to a Loss of Control

Rod Drive Cooling Water Flow Due to a Gasket Failure Which Resulted in Air Intrusion into the Intermediate Cooling Water System The licensee determined that posttrip responses were normal with all plant systems functioning as expected and with no safety system actuations. This event was of minimal safety significance.

The inspector concluded that the licensee appropriately documented the risk consequence and compliance concerns associated with the issue.

3. February 7, 2009, Manual Reactor Trip in Response to a Fire at the Main Generator

Hydrogen Addition Station Caused by a Personnel Error The licensee determined that systems performed as designed during and after the plant trip. Main steam safety valves did lift as a result of the reactor trip from 90 percent power and reseated properly as designed. Although this event had potential significant personnel safety consequences, the licensee documented that expeditious and appropriate actions taken by operators to minimize the consequences of this event minimized the actual safety significance. A Notice of Unusual Event was declared by the shift manager and reported to the NRC Operations Center.

The inspector concluded that the licensee appropriately documented the risk consequence and compliance concerns associated with the issue.

1.

Introduction.

A Green NRC-identified finding was identified for failure of operations personnel to follow procedures to obtain an Operational Safety Review Committee review and approval prior to restart of the unit where the cause of the trip had not been positively identified. Specifically, on December 13, 2008, and again on December 23, 2008, Unit 1 was restarted without an Operational Safety Review Committee review and approval as required by the post transient review Operating Procedure OP-1015.037, B. In both cases, the cause of the trip was identified as probable. The issue was not a violation of NRC requirements because the affected activities were not safety related.

Description.

At 8:55 a.m. on December 12, 2008, following startup from Refueling Outage 1R21, Arkansas Nuclear One Unit 1 was holding stable at 32 percent reactor power in order to perform nuclear instrumentation calibrations. Control room operators received an asymmetric rod alarm and noted an abnormal rod response with reactor power lowering. At this point, operations manually tripped the reactor.

On December 20, 2008, at approximately 12:12 p.m. with Unit 1 at approximately 100 percent power, control room operators received an asymmetric rod alarm and noted abnormal rod pattern on Group 7 with reactor power lowering. Operations then manually tripped the reactor.

Operating Procedure OP-1015.037, Attachment B, Post Transient Review Approval, contains the statement IF Cause of Trip not positively identified, THEN OSRC approval required. [emphasis added] In both December 2008 trip events, the licensee identified the cause of the trip as probable and did not obtain offsite review committee approval prior to plant restart.

Analysis.

The performance deficiency associated with this finding is the failure of operations personnel to follow procedures to obtain an Operational Safety Review Committee review and approval prior to restart of the unit where the cause of the trip had not been positively identified. The finding is more than minor because it could be reasonably viewed as a precursor to a significant event, as evidenced by the December 20, 2008, manual reactor trip. Using Manual Chapter 0609.04, Phase 1 - Initial Screening and Characterization of Findings, the finding affects the initiating events cornerstone and is determined to have very low safety significance because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. The finding was determined to have a crosscutting aspect in the area of human performance associated with decision making H.1(b), in that the licensee made nonconservative assumptions in the decisions to restart the unit after each trip. The licensee failed to conduct sufficient effectiveness reviews to verify the validity of the underlying assumptions.

Enforcement.

Enforcement action does not apply because the performance deficiency did not involve a violation of regulatory requirements. The finding is of very low safety significance and the issue was addressed in the corrective action program as Condition Report CR-ANO-C-2009-01217: FIN 05000313/2009008-01, Failure to Follow Procedure to Obtain Offsite Review Committee Review Prior to Restart.

2.02 Root Cause, Extent of Condition and Extent of Cause Evaluation a. Evaluation of Systematic Methods Used to Identify Root Cause(s) and Contributing Cause(s)

For the four reactor trip events, the licensee used various data collection and analysis techniques for identifying the root cause. Data collection techniques included data and document reviews, field walkdowns, personnel interviewing and human performance reviews. Analysis techniques included failure modes analysis and common cause

analysis. The inspector concluded that the licensee effectively used accepted root cause determination methods to identify the root and contributing causes for each of the four reactor trip events.

b. Level of detail of the root cause evaluation The licensees root cause evaluations included an extensive timeline of events and employed various techniques to analyze those events, as discussed in the previous section. Although not consistent in format, the licensees root cause evaluations were generally thorough and identified the root causes for two of the four events. A most probable root cause was identified for the two December 2008 reactor trips. For each of the events, the root cause analysis included a sufficient level of detail to determine the actual or probable cause, as well as contributing causes. Concerning the two reactor scrams that were caused by control rod system abnormalities, the licensee did not adequately identify the cause for the first scram prior to restarting the unit and experiencing a second scram. However, the final root cause analysis, following the second trip, appeared adequate.

c. Consideration of prior occurrences of the problem and knowledge of prior operating experience The licensee consistently reviewed their corrective action program and industry operating experience for each of the four events. Sufficient detail of external operating experience was provided such that general conclusions could be drawn from their similarities.

The inspector concluded that overall the licensee took adequate consideration to prior occurrences and knowledge of prior operating experience.

d. Determine that the root cause evaluation addresses the extent of condition and the extent of cause of the problem The licensees evaluations considered the extent of condition and extent of cause for all four events. Where applicable, the licensee identified corrective actions to address identified concerns.

The inspector concluded that the licensees root cause evaluations adequately addressed the extent of condition and extent of causes of this event.

e. Determine that the root cause evaluation, extent of condition, and extent of cause appropriately considered the safety culture components Safety culture is defined as an assembly of characteristics and attitudes within organizations and individuals which establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted by their significance. Each of the four events root cause evaluations were reviewed for safety culture component inclusion. For three of the four events, the licensee concluded there were no indications that a weakness in any safety culture component was a significant contributor to the events. One of the events identified a weakness in the safety culture component of resources. Actions were included in the corrective action plan to address this weakness.

The inspector determined that the licensees root cause evaluations included a proper consideration of whether a weakness in any safety culture component was a root or significant contributing cause.

02.03 Corrective Actions a. Appropriateness of Corrective Actions The inspector reviewed the licensees Corrective Action Plan for each of the four reactor trip events that caused the performance indicator for unplanned scrams per 7000 critical hours to cross the threshold from Green to White. Each plan included immediate, interim and long-term corrective actions.

The inspector determined that the licensees proposed corrective actions were appropriate to address the root causes and contributing causes identified for each event.

b. Prioritization of Corrective Actions Actions of an immediate nature were given the highest priority and accomplished on an acceptable schedule. A schedule of actions to resolve program, design, training, and procedure weaknesses was established. A completion date and a responsible manager were assigned for each corrective action, and these were tracked through the corrective action system.

The inspector concluded that the corrective actions were appropriately prioritized in accordance with Procedure EN-LI-102, Corrective Action Process.

c. Establishment of schedule for implementing and completing the corrective actions The licensee established due dates for the corrective actions in accordance with Procedure EN-LI-102, Corrective Action Process. Some of the due dates were captured in the root cause evaluations; however, all of the due dates reviewed were captured in the corrective action program.

The inspector determined that a schedule had been established for implementing and completing the corrective actions.

d. Establishment of quantitative or qualitative measures of success for determining the effectiveness of the corrective actions to prevent recurrence The licensees root cause analysis and recommended corrective actions were reviewed and approved by the Corrective Action Review Board. Each recommended corrective action was assigned a member of licensee management for responsibility and completion. These actions are to be tracked and trended through the licensees corrective action program.

Additionally, the corrective action program requires the licensee to evaluate the effectiveness of the corrective actions that are identified as corrective actions to preclude recurrence. Each root cause analysis specified an appropriate effectiveness review plan

for any corrective actions identified as corrective actions to preclude recurrence. The effectiveness review plan specifies the method, attributes, success criteria, and timeliness for the review.

The inspector determined that quantitative and qualitative measures of success had been developed for determining the effectiveness of the corrective actions to preclude repetition.

40A6 Management Meetings

Exit Meeting Summary

The inspector presented the inspection results to you and other members of your staff on June 30, 2009. The licensee acknowledged the information presented. The inspector verified that information received from the licensee was not proprietary or that all proprietary information had been returned. The licensee did not identify any proprietary information.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

- 13 - Enclosure

SUPPLEMENTAL INFORMATION

PARTIAL LIST OF PERSONS CONTACTED

Licensee

Brad Berryman, General Manager

David Bice, Acting Manager, Licensing

Jerry Stroud, Systems Engineering

Don Phillips, Work Management

Mark Gohman, Operations

Fred Van Buskirk, Licensing Specialist

NRC

Jeff Josey, Acting Senior Resident Inspector

Jeff Rotton, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

05000313/2009008-01 FIN Failure to Follow Procedure to Obtain OSRC Review Prior

to Restart

Discussed

None

LIST OF DOCUMENTS REVIEWED

CONDITION REPORTS

NUMBER TITLE

CR-ANO-1-2008-02671 Unit 1 Reactor Manually Tripped Due to Abnormal Movement of

Group 7 Control Rods

CR-ANO-1-2008-02742 Unit 1 Reactor Manually Tripped Due to Abnormal Movement of

Group 7 Control Rods

CR-ANO-1-2009-00225 Unit 1 Plant Trip - Loss of CRD Cooling

CR-ANO-1-2009-00254 Hydrogen Fire

CR-ANO-C-2009-00243 ANO Experienced Several Plant Down Powers and Shutdowns in

Past 12 Months

Attachment

LICENSEE EVENT REPORTS (LERs)

LER 2008-001-00 Two Manual Reactor Trips in Response to Abnormal Control Rod

Movement Caused by Control Rod Drive Control System Component

Degradation

LER 2009-001-00 Manual Reactor Trip From Power in Response to a Loss of Control Rod

Drive Cooling Water Flow Due to a Gasket Failure Which Resulted in Air

Intrusion into the Intermediate Cooling Water System

LER 2009-002-00 Manual Reactor Trip in Response to a Fire at the Main Generator

Hydrogen Addition Station Caused by a Personnel Error

PROCEDURES

EN-AD-101-01, NMM Procedure Writer Manual, Revision 5

EN-LI-102, Corrective Action Process, Revision 13

EN-LI-118, Root Cause Analysis Process, Revision 10

EN-LI-118-06, Common Cause Analysis (CCA), Revision 0

EN-LI-119, Apparent Cause Evaluation (ACE) Process, Revision 8

1015.001, Conduct of Operations, Change 073

1015.030, Operations Procedure Writers Guide, Change 009

1015.037, Post Transient Review, Change 010

Attachment