NRC Inspection Manual 0612 Appendix E, Examples of Minor Issues
Examples of Minor Issues
- https://www.nrc.gov/docs/ML2321/ML23214A343.pdf - 10/26/2023
- https://www.nrc.gov/docs/ML1809/ML18093B550.pdf - 10/1/2018
| Appendix | A | B | C | D | E | F | G |
text
Issue Date: 10/26/23 1 0612 App E
NRC INSPECTION MANUAL IRAB
INSPECTION MANUAL CHAPTER 0612 APPENDIX E
EXAMPLES OF MINOR ISSUES
Effective Date: 11/01/2023
This guidance applies to thresholds for the minor and more-than-minor (MTM) determination in
Inspection Manual Chapter (IMC) 0612.
Minor findings and violations are below the significance of that associated with Green SDP
findings and are not the subject of formal enforcement action or normal documentation. Failures
to implement requirements that have insignificant safety or regulatory impact or findings that
have no more than minimal risk should normally be categorized as minor. While licensees must
correct minor violations, minor violations or other minor findings do not normally warrant
documentation in inspection reports and do not warrant enforcement action.
NRC IMC 0612 Appendix B, “Issue Screening,” provides guidance for determining if a finding
should be documented and whether the finding can be analyzed using an SDP. When
determining whether identified issues can be considered MTM, inspectors shall compare the
issue to the examples and guidance in this appendix. Inspector should understand that
equipment inoperability is not a pre-requisite for the PD to be MTM.
The purpose of the following examples is not to create a completely mechanistic determination
process but is to provide direction that would allow the agency as a whole to screen
performance deficiencies in a reasonably consistent manner. There may be instances where a
performance deficiency is judged more than minor notwithstanding the example guidance due to
impacts or circumstances not listed in the examples. When applicable, the finding
documentation should describe the impact. It should be noted the performance deficiencies are
written in this guidance are at a generic level and do not include the actual regulatory
requirement or self-imposed standard. When writing PDs, please follow the guidance in
1. Record Keeping Issues
Example 1.a Post-maintenance testing was performed on ten glycol air handling units
during an outage of a Westinghouse ice condenser facility. All the
required tests were performed, based on statements from licensee
workers, but there was no record that an actual air flow test was
conducted on two of the units.
The performance The licensee failed to document and evaluate test results in accordance
deficiency (PD): with regulatory requirements or self-imposed standards.
Minor if: Even though the record keeping issue is associated with the mitigating
systems cornerstone attributes of equipment performance and procedure
quality it did not adversely affect the associated cornerstone objective.
Specifically, there was reasonable assurance of operability that test
requirements were met as evidenced by actual air flow being satisfactory
and technical specification temperatures being within limits, or the
licensee subsequently performed the required testing with no issues.
Based on indication in the control room, both air handling units had
comparable air flow to those that had documented test results, and the
ice condenser technical specification required air temperatures were all
well-within specification.
MTM if: The PD adversely affected the mitigating systems cornerstone attributes
of equipment performance and procedure quality and adversely impacted
the cornerstone objective. Specifically, during subsequent testing the air
flow was reduced such that reasonable assurance of operability was
called into question, or a significant number of records associated with
the air handling units was missing such that reasonable assurance of
operability was called into question.
Example 1.b The licensee’s surveillance test records were not complete for a
safety-related pump because the operators skipped a page of the
surveillance procedure and failed to record one section of the test.
The PD: The licensee failed to follow the surveillance procedure as written which is
contrary to a regulatory requirement or self-imposed standard.
Minor if: Even though the failure to complete all sections of the surveillance test
procedure is associated with the mitigating systems cornerstone attribute
of human performance it did not adversely affect the associated
cornerstone objective. Specifically, the portion of the test documented,
the last completed surveillance test, and the licensee’s justification to wait
to perform the surveillance test revealed that the equipment performed its
safety function (or the licensee performed the completed surveillance test
satisfactorily once the issue was identified).
MTM if: The PD adversely affected the mitigating systems cornerstone attribute of
human performance and adversely impacted the cornerstone objective.
Specifically, the subsequent surveillance test showed that the equipment
would not perform some safety-related function, or the licensee was
unable to provide adequate justification to wait to perform the surveillance
test, or some test acceptance criteria was not met.
Example 1.c The inspector noted that the licensee did not establish and maintain MOV
program documents such that they adequately described how the
design-basis capability of the MOVs was developed. Specifically, MOV
program documents and procedures were out-of-date, or contained
contradictory or conflicting information, regarding how load sensitive
behavior was applied, how lubricant degradation margin was determined,
or how test data was extrapolated.
The PD: The licensee failed to establish and maintain MOV program documents
which is contrary to a regulatory requirement or self-imposed standard.
Minor if: The PD did adversely affect the mitigating systems cornerstone attributes
of procedure quality but did not adversely impact the cornerstone
objective. Specifically, the incorrect information did not involve
methodology errors or incorrect assumptions. The issue centers on
administrative vulnerability but had not impacted the site.
MTM if: The PD adversely affected the mitigating systems cornerstone attributes
of procedure quality and adversely impacted the cornerstone objective.
Updating MOV program documents and procedures adversely impacted
design margins of effected MOVs and resulted in reasonable doubt with
respect to the availability, reliability, or capability of an MOV.
Note: Since the inspector identified an impact on equipment resulting
from the outdated procedures, the inspector is encouraged to focus the
PD on the equipment issues (see sections 3 and 4 of this document for
examples which address calculational errors/design inconsistencies or
procedure issues) and consider using the outdated procedures as the
cross-cutting aspect.
2. Licensee Administrative Requirement/Limit Issues
Example 2.a While performing a review of a completed surveillance test, the system
engineer determines that operators performing the test had recorded
information incorrectly when determining the leak rate of a power
operated relief valve'’s nitrogen accumulators. When corrected, the actual
check valve leakage exceeded the surveillance leakage rate'’s
acceptance criterion in the surveillance procedures. The surveillance had
been completed a week earlier and the system had been returned to
service.
The PD: The licensee failed to correctly determine the check valve leakage rates
were within the surveillance test acceptance criterion prior to returning the
system to service. This failure is contrary to a regulatory requirement or
self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the error was identified prior to required actions
specified in the procedure. For example, not meeting the acceptance
criterion required additional monthly testing – the error was caught before
missing the additional testing.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the as-left leakage was such that the licensee had to initiate
actions as required by the procedure and the time period specified had
been exceeded. For example, the as-left leakage resulted in increased
testing frequency to weekly, but the issue was identified after a month.
Example 2.b During a refueling outage, the licensee tested a charging pump at full flow
conditions as required every 18 months. Vibration data taken during this
test indicated vibration of 0.324 inches per second (ips), which exceeded
the test procedure administrative limit of 0.320 ips. The procedure
required the surveillance frequency to be increased to every nine months
after exceeding the administrative limit. The licensee failed to identify that
the test result exceeded the administrative limit, so the test frequency was
not increased. Subsequent vibration testing revealed no further vibration
degradation. The acceptance criterion for vibration measurements is
0.325 ips.
The PD: The licensee failed to perform an in-service test in accordance with the
prescribed procedure, contrary to regulatory requirements or self-imposed
standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective. Specifically, the limit was an optional licensee administrative
limit. Alternatively, the problem was identified less than 9 months after
exceeding the administrative limit and the pump was subsequently tested
at the required frequency.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the problem was identified greater than nine months later
and testing to ensure continued reliability of the degrading pump was not
performed at the required frequency.
Example 2.c The licensee missed an hourly update of a state agency during a
declared Unusual Event because of an oversight by the Shift Manager.
The PD: The licensee failed to perform an hourly update of state agencies during
declared emergencies which is contrary to regulatory requirements or
self-imposed standards.
Minor if: The PD did not adversely affect the emergency preparedness
cornerstone objective. Specifically, there was no impact on public health
and safety, and it did not affect the state agency’s ability to function
during the emergency.
MTM if: The PD was associated with the ERO performance attribute of the
emergency preparedness cornerstone and adversely affected the
cornerstone objective to ensure that the licensee is capable of
implementing adequate measures to protect the health and safety of the
public in the event of a radiological emergency. Specifically, there was a
failure in the communication functions committed to in the emergency
plan which affected the state agency’s ability to respond to the
emergency.
Example 2.d During an inspection of silicon foam penetration seals, an inspector noted
that foam extrusion (3/8 inch) from repaired seals was less than the
amount specified in the seal repair procedure (1/2 inch). However, the
silicon foam vendor'’s instructions permit extrusions as little as 1/4¼ inch.
The PD: The licensee failed to perform the seal repair in accordance with the
licensee’s procedure which is contrary to regulatory requirements or
self-imposed standards.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the seal was still functional, and the flood or fire
barrier’s functionality was not affected. Specifically, the silicon foam
vendor'’s instructions permit extrusions as little as 1/4¼ inch.
MTM if: The PD was associated with the protection against external factors (i.e.,
fire) attribute of the mitigating systems cornerstone and adversely
affected the cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to initiating events to prevent
undesirable consequences. Specifically, both the licensee and vendor
procedure requirements were not met, and the as left condition would
have impacted the ability of the seal to perform its function which affected
the flood or fire barrier’s functionality.
Example 2.e The licensee'’s procedure required that heat tracing be energized in the
diesel fire pump room from September 30 to April 30. In December, an
inspector observed that the heat tracing was de-energized. The room
temperature was 68 degrees, maintained by the steam boiler (50 degrees
was the minimum temperature for operations).
The PD: The licensee did not maintain heat tracing energized as required by a
licensee procedure. This is contrary to a regulatory requirement or
self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the temperature had not dropped below the minimum
temperature for operations. Specifically, although heat trace was not
energized, room temperature was not less than 50 degrees during the
exposure period.
MTM if: The PD was associated with the protection against external factors (i.e.,
weather) attribute of the mitigating systems cornerstone and adversely
affected the cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to initiating events to prevent
undesirable consequences. Specifically, the room temperature fell below
the minimum temperature of 50 degrees and stayed below 50 degrees for
enough time where it would have resulted in a measurable reduction in
the equipment’s ability to function when called upon.
Example 2.f An operating procedure requires the shift supervisor to advise the station
manager prior to making any mode changes. A mode change is made
without this notification due to an oversight by the shift supervisor.
The PD: The shift supervisor did not advise the station manager prior to making a
mode change as required by the licensee’s operating procedure, contrary
to a regulatory requirement or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective as this notification was purely administrative in nature and had
no impact on safety equipment and no safety consequences.
MTM if: The PD was not purely administrative in nature and adversely affected
the mitigating systems cornerstone objective by impacting safety
equipment. If the inspector identifies an issue of concern beyond this
missed notification, the inspector should consider pursuing a different PD.
3. Dimensional, Time, Calculation, or Drawing Discrepancies
Example 3.a A temporary modification was installed on one of two redundant
component cooling water system surge tanks to restore seismic
qualification. The calculations were found to contain technical errors, such
as incorrect assumptions regarding length of piping.
The PD: The licensee failed to ensure the calculation supporting a temporary
modification accurately reflected the design which is contrary to a
standard or regulation.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
The errors were non-significant or non-consequential. Seismic
qualification was not in question since the error in length was small and
the available margin easily compensated for the error. (i.e., the conditions
described in the MTM description below were not applicable.)
MTM if: The PD adversely affected the mitigating systems cornerstone objectives.
Specifically, regardless of the conclusion of the operability or functionality
determination, the calculation errors resulted in reasonable doubt about
the equipment’s seismic qualifications, which reduced assurance in the
equipment’s availability and reliability and required the licensee to revise
the calculation (see below) or revise or rework the modification to resolve
the seismic concerns.
For example, if the calculation was revised there would be reasonable
doubt if, the licensee: (a) used a different calculation/approach because
the original approach resulted in unfavorable margin (where “unfavorable
margin” means that had the correct values been used originally, the
licensee’s design process would not have accepted the modification); or
(b) revised assumptions solely to obtain favorable results; or (c) revised
other calculations in order to establish operability or functionality; or
(d) determined the remaining margin fell outside the licensee’s design
process acceptance criteria.
Example 3.b A controlled design drawing shows a plug valve where a ball valve is
actually installed. The service water valve design was changed to a ball
valve to support FLEX to a ball valve, but the licensee failed to update the
drawing.
The PD: The licensee’s failure to ensure the design of service water system was
correctly translated into drawings which is contrary to regulatory
requirements or a self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
The correct valve type (ball) was installed, and the error only involves the
drawing and did not have an adverse impact on other structures,
systems, and components (SSCs).
MTM if: The PD adversely affected the mitigating systems cornerstone objective
to ensure the availability, reliability, and capability of systems that
respond to initiating events to prevent undesirable consequences.
Specifically, this drawing was used to support another modification or
calculation such that the assumption (characteristics) of a plug valve were
carried through to other applications.
Note: If the drawing was correct (that is, a plug valve should have been
installed), the PD should address the incorrect installation – not that the
drawing had an error.
Example 3.c
A licensee procedure required that all valves specified on a locked valve
list be indicated as locked on the plant drawings. The inspectors identified
safety-related valves on the locked valve list that were not indicated as
locked on the plant drawings.
The PD: Activities were not performed in accordance with procedures.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
This is a non-significant drawing discrepancy and this oversight (valves
not indicated as locked on the drawing) only involved the drawing and did
not adversely affect the mitigating systems cornerstone objective by
adversely impacting other SSCs.
MTM if: The PD adversely affected the mitigating systems cornerstone objective
to ensure the availability, reliability, and capability of systems.
Specifically, this drawing was used to support another modification,
calculation, or procedure, and in those applications, the failure to indicate
a locked requirement impacted the reliability of the valve. For example,
during an emergency, this valve may need to be open. Since the drawing
does not indicate the valve is locked, additional time may be needed to
open the valve (obtain a key). In other words, the assumption
(characteristics) of an unlocked valve was carried through to other
applications.
Example 3.d
Technical specifications require that a primary sample to be taken and
analyzed within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of a power change in excess of 20 percent. A
chemistry sample was taken and analyzed within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 35 minutes
after a recent power increase from 60 to 85 percent.
The PD: The licensee failed to take and analyze a primary sample as required by
TS.
Minor if: This is a failure to implement a requirement that has no safety impact;
therefore, did not adversely impact the barrier integrity cornerstone
objectives. The delayed sample did not impact the validity of the sample
when taken. The licensee’s analysis accounted for the delay and results
remained in specification.
MTM if: The PD impacted the barrier integrity cornerstone objective to provide
reasonable assurance that physical design barriers protect the public
from radionuclide releases caused by accidents or events. Specifically,
the sample was delayed to the extent that the sample results were not
reliable. The licensee’s analysis could not account for the delay.
Example 3.e
During construction of a safety-related concrete wall, an imbedded
structural insert is cocked at an angle of 6 degrees. The specification
required plus-or-minus 3 degrees. The worker who placed the insert failed
to use a level as required.
The PD: The licensee failed to install a structural insert in accordance with
licensee procedures.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
The misoriented insert had no safety impact. The licensee determined
(without other action) that the insert could be abandoned in place or that
the as-found condition of the insert is acceptable (i.e., the conditions
described in the MTM description below were not applicable.)
MTM if: The PD adversely affected the mitigating systems cornerstone objective.
Specifically, a safety-related attachment had been made to an
out-of-specification insert and placed in service and:
1. The resulting condition was unacceptable, and the licensee had to
perform a modification or maintenance to compensate for the misaligned insert,
-or2. Regardless of the final operability or functionality, the as-found
condition resulted in reasonable doubt about the equipment’s seismic
qualifications, which reduced assurance in the equipment’s availability
and reliability and required the licensee to revise the calculation (see
below) or revise or rework the modification to resolve the seismic
concerns.
For example, there would be reasonable doubt if when revising the
calculation, the licensee (a) used a different calculation/approach
because the original approach resulted in unfavorable margin (where
“unfavorable margin” means that had the correct values been used
originally, the licensee’s design process would not have accepted the
modification); or (b) revised assumptions solely to obtain favorable
results; or (c) revised other calculations in order to establish operability or
functionality; or (d) determined the remaining margin fell outside the
licensee’s design process acceptance criteria.
Example 3.f
The licensee's flood wall is required to be 12 feet tall. The NRC discovers
that, in one section, the wall is only 11 feet, 10.5 inches tall.
The PD: The licensee failed to maintain the flood wall as described in the UFSAR
(or Physical Security Plan), which states that the height is required to be
12 feet tall.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
The height discrepancy is insignificant. The as-found height, though less
than specified, still meets its function of avoiding spill over or meets
security needs. (Note: In making this determination, the conditions
described in the MTM if section below are not applicable.)
MTM if: The PD adversely affected the mitigating systems cornerstone objective
to ensure the availability, reliability, and capability of systems that
respond to initiating events to prevent undesirable consequences. For
example, in order to justify the as-found condition, the licensee (a) used a
different calculation/approach because the original approach resulted in
unfavorable margin (where “unfavorable margin” means that had the
correct values been used originally, the licensee’s design process would
not have accepted the modification); or (b) revised assumptions solely to
obtain favorable results; or (c) revised other calculations in order to
establish operability or functionality; or (d) determined the remaining
margin fell outside the licensee’s design process acceptance criteria.
Example 3.g
The final safety analysis report (FSAR) states the volume of the refueling
water storage tank is 250,000 gallons. The actual volume is 248,000
gallons.
The PD: The facility was not consistent with the FSAR which is contrary to a
required regulation or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
This is a non-significant dimensional discrepancy. Assuming the accident
analysis calculations used a smaller volume, the as-found volume meets
its function.
MTM if: 1) The PD adversely affected the mitigating systems cornerstone
objective. Specifically, regardless of the conclusion of the operability or
functionality determination, the as-found condition resulted in reasonable
doubt with respect to the availability, reliability, or capability of systems
reliant on this volume. For example:
• The accident analysis assumed a value higher than the as-found and
the actual volume required the licensee to re-perform accident
analysis calculations to assure the accident analysis requirements
were met.
-or-
• The accident analysis assumed a value below the as-found; however,
calculations supporting other SSCs or functions requires a higher
value; thus, requiring the licensee to re-perform calculations to
demonstrate operability or functionality.
In these cases, when the calculation is revised to restore operability,
there would be reasonable doubt if the licensee: (a) revised assumptions
solely to obtain favorable results; or (b) revised other calculations in order
to establish operability or functionality; or (c) determined the remaining
margin fell outside the licensee’s design process acceptance criteria; or
(d) used a different calculation/approach because the original approach
resulted in unfavorable margin, meaning that had the correct values been
used originally, the licensee’s design process would not have accepted
the modification.
-or-
(2) The PD if left uncorrected, would have the potential to lead to a more
significant safety concern. Although the as-found volume was above that
assumed in the accident analysis, the licensee did not have procedural
controls to maintain the level above that required in the accident analysis
and absent NRC intervention the licensee may not have maintained the
capability of the RWST to mitigate a large break loss of coolant accident.
Example 3.h
The licensee used a non-conservative value for condensate storage tank temperature as an input to an accident analysis calculation. The value used was 118 degrees Fahrenheit where the actual value can be as high as 120 degrees Fahrenheit. As a result of this error, there was a slight reduction in the net positive suction head (NPSH) available to the safety injection pumps under accident conditions.
The PD:
The licensee failed to ensure design requirements were correctly translated into calculations in accordance with regulatory requirements or self-imposed standards.
Minor if:
The PD did not adversely affect the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.
The reduction in available NPSH was only a few percent of the available margin and there was no reasonable doubt of operability or functionality. (i.e., the conditions described in the MTM description below were not applicable.)
MTM if:
(1) The PD adversely affected the mitigating systems cornerstone objective. Specifically, regardless of the final operability or functionality, the as-found condition was such that there was reasonable doubt with respect to the capability of systems that take suction from this tank. For example, in evaluating the as-found condition, there would be reasonable doubt with respect to the capability of systems if the licensee:
- (a) used a different calculation/approach because the original approach resulted in unfavorable margin (where “unfavorable margin” means that had the correct values been used originally, the licensee’s design process would not have accepted the modification); or (b) revised assumptions solely to obtain favorable results; or (c) revised other calculations in order to establish operability or functionality; or (d) determined the remaining margin fell outside the licensee’s design process acceptance criteria.
-or-
(2) The PD if left uncorrected, would have the potential to lead to a more significant safety concern. To use this question, the inspector would need to assess whether there is a declining trend in pump performance such that adequate NPSH would not be maintained prior to an action level to address pump performance. In other words, if left uncorrected, the pump would reach a condition such that it may not be able to maintain adequate NPSH to support accident mitigation before the licensee identified the issue.
Example 3.i
In the procedure for safe shutdown of the plant from the alternate control
panel, the licensee annotated that the operators could complete a time
critical task within 10 minutes. It is later determined that the validation
tests showed that completing the required tasks could take as long as
eleven minutes.
The PD: The licensee failed to ensure procedures met design requirements.
Minor if: The PD did not adversely affect the cornerstone objective to ensure the
availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. This was a non-significant
error. The licensee’s accident analysis assumed the actions were
completed in 15 minutes.
MTM if: The PD adversely affected the mitigating systems cornerstone objective.
Specifically, regardless of the results of the final operability or functionality
determination, the discrepancy for the time-critical action resulted in a
condition where there was a reasonable doubt of operability or
functionality of a system or component.
For example, in evaluating the as-found condition, there would have been
reasonable doubt with respect to the capability of system or component if:
10 minutes was assumed in the accident analyses and the licensee was
unable to justify using 11 minutes or greater.
-or The licensee was able to justify the additional time, but, in evaluating the
as-found condition, the licensee: (a) used a different calculation/approach
because the original approach resulted in unfavorable margin (where
“unfavorable margin” means that had the correct values been used
originally, the licensee’s design process would not have accepted the
modification); or (b) revised assumptions solely to obtain favorable
results; or (c) revised other calculations in order to establish operability or
functionality; or (d) determined the remaining margin fell outside the
licensee’s design process acceptance criteria.
Example 3.k
A previously identified body-to-bonnet leak on an RHR valve was
increasing in leak rate. A check valve, downstream of the valve,
separated the cool, low pressure RHR system from the high temperature,
high pressure feedwater system. The check valve also had a known
leakage and was being monitored. In their operability determination, the
licensee addressed the potential impact of leakage outside of
containment and monitored and tracked the quantity to ensure it
remained under the established administrative limits identified in the
operability determination. The inspector raised question on the impact of
the shutdown cooling (SDC) mode of RHR.
The PD: The licensee failed to assess the impact on the SDC mode of RHR in
operability determination x which is contrary to self-imposed standards.
(Note: There are no regulatory requirements to “adequately document”
(Note: In this case, potential PDs include failure to identify a condition
adverse to quality or failure to follow the licensee’s procedure for
documenting operability determinations. In this example, the PD
associated with the licensee’s procedures was selected to demonstrate
conditions for minor or MTM.)
Minor if: The PD did not adversely affect the cornerstone objective to ensure the
availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. Although the licensee did
not have a lot of detail to justify operability associated with the SDC mode
(causing the inspector to question), the licensee did address the mode. In
the end, the system remained operable. Essentially, this issue of concern
is really focused on the paperwork and not on the status of the
equipment.
MTM if: The PD adversely affected the cornerstone objective to ensure the
availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. The inspector identified the
licensee had not addressed the SDC mode such that the operability
conclusion was truly challenged, and the licensee had to perform actions
to continue to demonstrate operability. The outcome of this evaluation is
not a factor in minor or MTM.
Example 3.l
During a review of a licensee’s power operated valve activities, the
inspectors found that the licensee only incorporated test data from their
site when establishing design assumptions and did not include applicable
data from other plants within their fleet or from the nuclear industry. The
inspectors noted the licensee’s procedure stated a suitable testing
program included the results of a minimum population of 15 valves and
that, when available, test results across the fleet would be used in
establishing valve factors. The inspectors noted that the valve factors
used at the site were lower than what was used at other plant sites that
utilized industry data. This led to the inspector to question the valve
factor.
The PD: The licensee did not implement activities that would provide assurance
that specific POVs would meet their design basis functions which is
contrary to a regulatory requirement or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the licensee was able to demonstrate that the site test
data population was sufficiently large to represent the performance
characteristics of the plant POVs. No changes to the POV testing and
maintenance programs for the subject valves were necessary per the site
POV program documents.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the licensee was unable to demonstrate that the site test
data population was sufficiently large to represent the performance
characteristics of the plant POVs. As a result, (for example), (1) factoring
in the fleet data resulted in a reasonable doubt with respect to the
availability, reliability, or capability of plant POVs and the licensee had to
re-perform a number of valve design calculations to demonstrate that they
could meet their design basis functions. or (2) several valves required
additional testing and maintenance per the site POV program documents
because of a loss of margin.
Example 3.m
While reviewing program documents associated with power operated
valves, the inspector noted that the licensee was not applying justified
differential pressure assumptions in calculating the design bases limits for
certain safety-related valves. Specifically, the licensee did not account for
design leakage past pressure isolation valves, which could increase the
differential pressure across several valves. Further review identified five
potentially impacted valves. (Note: at least one valve needs to be
identified.)
The PD: The licensee did not assume pressure isolation valve leakage when
calculating the design basis limits for several safety-related POVs which
is contrary to a regulatory requirement or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective. The differential pressure assumption had a small effect on the
design calculations. Although margin was reduced, the valves did not
need additional testing or preventive maintenance per the licensee’s POV
program documents. In performing the analysis, the conditions described
in the MTM section are not applicable.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective. Specifically,
(1) the final operability determination concluded a valve was inoperable or
nonfunctional; or needed additional maintenance and testing per the site
POV documents; or required interim compensatory actions to maintain
operability/functionality.
-or-
(2) through the process of performing the operability/functionality
determination, there was reasonable doubt regarding the availability,
reliability, or capability of the valves. For example, in evaluating the
as-found condition, there would be reasonable doubt with respect to the
capability of the valves if: the licensee (a) used a different
calculation/approach because the original approach resulted in
unfavorable margin (where “unfavorable margin” means that had the
correct values been used originally, the licensee’s design process would
not have accepted the modification); or (b) revised assumptions solely to
obtain favorable results; or (c) revised other calculations in order to
establish operability or functionality; or (d) determined the remaining
margin fell outside the licensee’s design process acceptance criteria.
Example 3.n
While examining the degraded grid voltage calculations for a
risk-important, safety-related valve, the inspector noted that the licensee
did not have electrical calculations or test data that would support the
settings for thermal overloads protective devices for several safety-related
MOVs. As a result, it was not clear whether these valves would fulfill their
risk-important or safety-related functions during a range of postulated
events. The licensee performed an analysis for each affected valve.
The PD: The licensee failed to ensure the thermal overload protection settings on
safety-related MOVs were adequate to ensure the valves would perform
their function(s) which is contrary to a regulatory requirement or
self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the subject breaker was subsequently found to be in
specification. In performing the analysis, the conditions described in the
MTM section are not applicable or the current MOV testing program did
not need to be modified to address the issue (i.e., the current valve
testing and maintenance program is acceptable, as is.)
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective. Specifically,
(1) the final operability determination concluded a valve was inoperable or
nonfunctional; or needed additional maintenance and testing per the site
MOV documents; or required interim compensatory actions to maintain
operability/functionality.
-or-
(2) through the process of performing the operability/functionality
determination, there was reasonable doubt regarding the availability,
reliability, or capability of the valves. For example, in evaluating the
as-found condition, there would be reasonable doubt with respect to the
capability of the valves if: the licensee (a) used a different
calculation/approach because the original approach resulted in
unfavorable margin (where “unfavorable margin” means that had the
correct values been used originally, the licensee’s design process would
not have accepted the modification); or (b) revised assumptions solely to
obtain favorable results; or (c) revised other calculations in order to
establish operability or functionality; or (d) determined the remaining
margin fell outside the licensee’s design process acceptance criteria.
Example 3.o The inspectors noted the licensee’s safe shutdown analysis credited the
RCIC system for reactor water makeup and decay heat removal for the
alternate shutdown method from the remote shutdown panel (RSP). In
the event of a fire requiring control room evacuation, procedures directed
operators to place RCIC Remote Shutdown Transfer Switches in the
EMERGENCY position at the RSP. This isolated the control circuits for
the RCIC valves from the control room and connected a different set of
control fuses at the RSP for each valve. The new set of control fuses was
fed from a separate 250 volt direct current (VDC) power source.
During the review of MOV 1E51-F022, RCIC Test Bypass to Condensate
Storage Tank, the inspectors noted the main breaker supplied from
250 Vdc Motor Control Center (MCC) 121Y was a 7-Amp breaker, while
the control circuit fuse associated with the valve’s control room circuits
was 10 Amp. The inspectors were concerned that in the event of a control
room fire, fire-induced faults on the control circuits could cause the
associated 7 Amp, 250 VDC breaker to trip upstream of the 10 Amp
protective fuse. If the feed breaker tripped before the control room
protective fuse opened, the associated MOV would lose power for
operation from the RSP until the breaker was reset.
The PD: The licensee failed to ensure that the alternate shutdown capability was
independent of the control room which was contrary to a regulatory
requirement or self-imposed standard.
Minor if: The PD was minor because it did not affect the availability, reliability, and
capability of RCIC in the event of a fire. Specifically,
(1) existing procedures directed operators to reset the affected breakers if
tripped during the transfer and the licensee had demonstrated that the
action to reset the breakers could be performed in a timely manner.
-or-
(2) the licensee verified by walkdown that the breaker was replaced with a
higher rating. As a result, this PD is an administrative error with no
consequence. (Note: Inspector could pursue a PD related to configuration
control.)
MTM if: The PD was associated with the Mitigating Systems Cornerstone attribute
of Protection Against External Events (Fire), and affected the cornerstone
objective of ensuring the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences
(i.e., core damage). Specifically, in the event of a fire in the control room,
fire-induced failures could result in tripping the valve’s power supply
breaker prior to tripping the control power fuse which could impair the
operation of RCIC from the RSP. Actions to reset the associated breakers
were not contained in alternate shutdown procedures or the licensee
could not demonstrate that the action could be performed in a timely
manner.
4. Procedural Errors
Example 4.a A scaffold erected between safety-related plant service water strainers
was wedged tightly between the system piping. No engineering
evaluation was performed to assess the seismic impact of the scaffold.
The PD: The licensee failed to perform an engineering evaluation to assess the
seismic impact of an installed scaffold, contrary to a regulatory
requirement or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because a later engineering evaluation determined that there is
no safety concern. Specifically, this is a procedural error that has no
safety impact.
MTM if: The PD was associated with the design control attribute of the mitigating
systems cornerstone and adversely affected the cornerstone objective to
ensure the availability, reliability, and capability of systems that respond
to initiating events to prevent undesirable consequences. Specifically, the
subsequent engineering evaluation confirmed that the affected pipe would
be subject to seismic induced pipe loads that had not been considered in
the original analysis and increased the probability of pipe failure during
accident mitigation.
Example 4.b While performing a reactor protection system test procedure, an operator
inadvertently operated the bypass switch which caused a single channel
trip condition.
The PD: The operator failed to follow the procedure and adequately self-check to
ensure the right switch was manipulated. This is contrary to a regulatory
requirement or self-imposed standard.
Minor if: The PD did not adversely affect the initiating events cornerstone objective
because this was an insignificant procedural error and there were no
safety consequences.
MTM if: The PD was associated with the human performance attribute of the
initiating events cornerstone and adversely affected the cornerstone
objective to limit the likelihood of events that upset plant stability and
challenge critical safety functions during shutdown as well as power
operations. Specifically, the error caused a reactor trip or other transient.
Example 4.c A valve motor operator was test wired for reading operating current during
testing performed in accordance with Generic Letter 89-10. The valve
was successfully cycled, the data recorded and determined to be within
the acceptable range, and the valve was returned to service. However,
the ammeter used a 0-100 amp scale instead of a 0-10 amp scale as
required by the procedure.
The PD: The licensee failed to follow a test procedure which was contrary to a
regulatory requirement or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because subsequent retest with the proper meter resulted in
satisfactory amperage readings. Specifically, this was a procedural error
that had no impact on safety equipment. The mistake did not result in an
actual equipment problem.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the retest revealed that the valve was returned to service and
because of the inadequate measurement, the licensee did not identify
that the thrust data for the affected MOV was inadequate to perform the
valve function under the limiting design basis event.
Example 4.d During a review of the emergency lighting in the safety injection pump
room, an inspector identified that the lighting was less than FSAR design
levels for operator action.
The PD: The licensee failed to ensure the emergency lighting in the safety
injection pump room was less than the FSAR design levels for operator
action. This is contrary to a regulatory requirement or self-imposed
standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because operators are procedurally required to carry flashlights
and would have no problems functioning in this light condition.
MTM if: The PD was associated with the human performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the degraded lighting condition would significantly impact the
operator’s ability to operate equipment within the safety injection pump
room during implementation of procedures that required manual operator
actions within this room for accident mitigation.
Example 4.e The inspector identified a valve with a missing name-plate; a violation of
plant procedures requiring that all equipment be labeled. This valve
needs to be manipulated as part of an operator time-critical action.
The PD: The licensee did not label plant equipment as required by plant
procedures which is contrary to regulatory requirements or self-imposed
standards. Plant procedures required that equipment be labeled.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because operators referred to the plant drawings and routinely
train on this time-critical action. Specifically, this is a failure to meet
procedural requirements that had no safety impact. The operators used
the drawings and had no trouble identifying the valve location in time to
perform the necessary operator time-critical action.
MTM if: The PD was associated with the human performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, because of the lack of label an improper valve manipulation
occurred that resulted in a plant transient or that rendered a mitigating
system incapable of responding to an initiating event.
Example 4.f A small leak occurs on a welded connection in the diesel generator day
tank causing a slow drip of fuel oil onto the floor in the diesel room.
Maintenance used a sealant to temporarily repair the leak and wrote a
work order for a permanent repair, which was scheduled for the next
outage. Later, the seal failed, and additional leakage occurred, which
dripped on a safety-related solenoid. The licensee subsequently
determined that the wrong sealant was used in the temporary repair.
The PD: The licensee failed to adequately correct a condition adverse to quality
which is contrary to a regulatory requirement or self-imposed standard.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because this is a failure to correct a condition adverse to quality
that had no adverse impact on both the solenoid valve and the diesel
generator.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the inadequate repair led to additional leakage from the day
tank and a safety-related solenoid valve was soaked in fuel oil preventing
the valve from performing its safety function.
Example 4.g The reach rod for a safety-related valve was jammed and could not be
used. However, the valve could be operated manually one level down.
This condition existed for 2 years and, despite complaints from the
operators, it was not fixed. The NRC inspector noted that this
work-around cost about 1 minute in operator response time and
recognized that manual manipulation of this valve was required by certain
off-normal procedures.
The PD: The licensee failed to promptly correct a condition adverse to quality as
required by regulatory requirements or self-imposed standards.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because this is a failure to implement a corrective action that
had little to no safety impact. The valve was accessible during all these
off-normal events and could still be operated and the extra time
requirement would not affect recovery operations.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, there are credible scenarios within the current
abnormal/emergency procedures where access to the effected valve
would be restricted for environmental reasons (heat, radiation, oxygen,
etc.), or a time critical action could not be performed within the timeline
credited in the design basis.
Example 4.h An inspector discovered that 3 of 150 emergency response organization
(ERO) members who are on the duty roster in different functional areas
were not current in their training. The licensee’s emergency plan required
that all members be trained annually.
The PD: The licensee failed to follow and maintain the effectiveness of their
emergency plan which is contrary to regulatory requirements or
self-imposed standards.
Minor if: The PD did not adversely affect the emergency preparedness
cornerstone objective because there are others on the duty roster in each
functional area whose qualifications are current.
MTM if: The PD was associated with the ERO readiness attribute of the
emergency preparedness cornerstone and adversely affected the
cornerstone objective to ensure that the licensee is capable of
implementing adequate measures to protect the health and safety of the
public in the event of a radiological emergency. Specifically, emergency
response personnel qualification lapses occur in such a manner that ERO
minimum staffing positions cannot be staffed by qualified individuals.
Example 4.i An inspector found that the evaluation of the adequacy of emergency
preparedness procedures in the annual audit was not in sufficient depth in
one functional area.
The PD: The licensee did not evaluate the adequacy of EP procedures which is
contrary to regulatory requirements or self-imposed standards.
Minor if: The PD did not adversely affect the emergency preparedness
cornerstone objective because the licensee reviewed the areas
insufficiently covered and found no problems. Specifically, no problems
were identified and the revisions of the procedures that were not audited
addressed improvements identified in drills.
MTM if: The PD was associated with the procedure quality attribute of the
emergency preparedness cornerstone and adversely affected the
cornerstone objective to ensure that the licensee is capable of
implementing adequate measures to protect the health and safety of the
public in the event of a radiological emergency. Specifically, the
procedures that were not evaluated were in a condition that would
adversely affect the licensee’s response to an emergency.
Example 4.j NRC inspectors identified three 10-foot lengths of wood left from a
scaffold disassembled the previous week in the auxiliary feedwater pump
room. The licensee had not completed an engineering evaluation
approving this temporary storage location for transient combustible
materials as required by the fire protection plan.
The PD: The licensee failed to complete an engineering evaluation to compensate
for all transient combustibles in an area which is contrary to regulatory
requirements or self-imposed standards.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because this is a failure to implement a fire protection program
requirement that has little or no safety impact. Specifically, the transient
combustibles could not affect equipment important to safety and did not
exceed any licensing basis requirements. The licensee was able to show
that the transient combustibles were well below the fire hazards analysis
limits.
MTM if: The PD was associated with the protection against external factors (i.e.,
fire) attribute of the mitigating systems cornerstone and adversely
affected the cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to initiating events to prevent
undesirable consequences. Specifically, one of the following occurred:
(a) the fire loading was not within the fire hazard analysis limits; (b) a
credible fire scenario involving the identified transient combustibles could
affect equipment important to safety; (c) the identified transient
combustibles were in excess of those permitted by an NRC safety
evaluation report which formed the licensing basis for the plant; or (d) the
identified transient combustibles adversely affected a combustible free
zone's function to prevent fire spread (e.g., a large fire on one side might
propagate to the other side).
Example 4.k The TS require that one-third of all safety-related molded case circuit
breakers be tested each refueling outage (such that all are tested every
three outages) and that the instantaneous trip currents be recorded for
trending purposes. The NRC inspector found that two outages ago during
testing, the instantaneous trip current for a breaker was not tested due to
the breaker not being listed for the instantaneous trip current test. The
last recorded trip current for this breaker was five outages ago.
The PD: The licensee failed to perform required breaker testing within three
outages as specified by regulatory requirements or self-imposed
standards.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the subject breaker was subsequently found to be in
specification. Specifically, this is a failure to implement a procedural
requirement that has no safety impact. All other tests on the breaker were
satisfactory at the time of testing and the trip current was subsequently
found to be in specification.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, the subject breaker was out of specification and adversely
affected the equipment’s availability, reliability, and/or capability.
Example 4.l The TS require that 10 percent of all safety-related snubbers be tested
each refueling outage and that if one failure occurs, an additional
10 percent sample be tested during the same outage. One snubber in the
original population of 17 snubbers (there are a total of 168 snubbers)
fails, necessitating an additional sample of 17 snubbers. However,
because of an oversight by the licensee, only 16 additional snubbers are
tested with no failures.
The PD: The licensee failed to perform the snubber testing as required by
regulatory requirements or self-imposed standards.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because this is a failure to implement a procedural requirement
that has no safety impact since none of the additional snubbers tested
failed.
MTM if: The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, a failure had occurred in the additional (missed) sample,
necessitating yet another expansion of the sample, and this expansion of
the sample did not occur.
Example 4.m The inspector identified a motor operated valve (MOV) torque switch was
not installed properly. Specifically, the licensee’s procedure to re-install
MOV RH-6833 did not include a step to reset the MOV torque switch to
previously installed torque switch settings. Once identified, the licensee
had to enter an unplanned maintenance window to reset the toque switch.
The PD: The licensee failed to ensure torque switch settings were included in
installation procedures which is contrary to regulatory requirements or
self-imposed standards.
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because the inadequate procedure would not have resulted in
equipment damage. Specifically,
• although not required by the procedure, maintenance worker training
would have the worker set the torque switch to the prior setting
-or-
• the licensee analysis confirmed the worst-case torque switch setting
would not have damaged the valve subcomponents had the valve
actuated.
MTM if: The PD was associated with the procedure quality attribute of the
mitigating systems cornerstone, and it adversely affected the cornerstone
objective. Specifically, regardless of the final operability or functionality,
the as-found condition was such that there was reasonable doubt whether
the valve would have been capable of performing its function had it been
called upon. For example, in evaluating the as-found condition, the
licensee (a) used a different approach because the original approach
resulted in unfavorable margin (where “unfavorable margin” means that
had the correct values been used originally, the licensee’s design process
would not have accepted the modification); (b) revised assumptions solely
to obtain favorable results; (c) revised other calculations in order to
establish operability or functionality; (d) determined the remaining margin
falls outside the licensee’s design process acceptance criteria; (e) had to
replace equipment because of damage or licensee was unable to
demonstrate operability.
5. Work in Progress Findings
Example 5.a Prior to system restoration following a modification, the NRC inspectors
identified that the modification package that replaced the spent fuel pool
cooling system suction piping did not include the siphon because the
engineers failed to identify the requirements of the original design. The
siphon hole was not installed. Due to the location of the piping, a
siphoning event would lower spent fuel pool level below the TS limit, but
not to the point where fuel would have been uncovered.
The PD: The pipe design was not correctly translated into work instructions and
drawings, in accordance with regulatory requirements or self-imposed
standards.
Minor if: The PD, if left uncorrected, would not have led to a more significant safety
concern. Work was still in progress, and it is reasonable to conclude the
PD would have been identified through the post modification testing or
licensee processes prior to the return to service. Therefore, it would not
have been left uncorrected nor would it have adversely affected the
associated cornerstone objectives since the system was would have been
fully restored and able to perform/support any safety function.
MTM if: Work was still in progress; however, it is reasonable to conclude the PD
would not have been identified prior to return to service. The PD, if left
uncorrected, would have the potential to lead to a more significant safety
concern. Specifically, the condition wasn’t identified during post
modification testing or during restoration activities. The performance
deficiency was identified at a point in the process where there were no
more licensee review or approval barriers that could reasonably preclude
the system’s return to service with this design error present. If left
uncorrected, the lack of siphon hole would have the potential to lead to a
more significant safety concern, i.e., could allow the licensee to reach a
condition outside of that allowed by its TS.
The PD if left uncorrected, would have the potential to lead to a more
significant safety concern. Absent NRC intervention the licensee would
not have identified the condition until the spent fuel level decreased to a
point that resulted in an increase in radiation levels in areas frequented by
outage workers and cause unnecessary radiation exposure (e.g., not
ALARA).
Example 5.b During installation of a modification, the licensee failed to follow the
installation procedures and a check valve required for the system to
perform its function is installed backward.
The PD: The licensee failed to install a check valve correctly in accordance with
licensee procedures which is contrary to regulatory requirements or
self-imposed standards.
Minor if: The PD was identified through a planned post modification test, or other
process-driven review, without causing any actual adverse effects to
other operating systems. Therefore, the degraded condition did not
adversely affect the associated cornerstone objectives since the system
caused no adverse interactions and was itself out of service and not
being relied upon at the time of discovery.
MTM if: Prior to system restoration (for example, during the post modification
test), the PD results in an event that adversely affects one of the
cornerstone objectives, such as: impacting the capability of another SSC
or causing an initiating event (e.g., a feedwater transient resulting in a
rapid downpower or reactor scram; or causing an unanticipated
occupational radiation safety hazard by overfilling a tank that creates a
contaminated spill).
Example 5.c A solenoid that did not meet its safety-related procurement specifications
was inadvertently screened through receipt inspection and placed in the
warehouse. When the solenoid was about to be installed during the
maintenance window, an electrician noted that it was not the correct type
called out in the work order instructions.
The PD: The licensee failed to assure that purchased equipment conformed to the
procurement documents in accordance with 10 CFR 50, App B, Criterion
VII, “Control of Purchased Material, Equipment, and Services.”
Minor if: The discrepant solenoid was not installed in the plant and an extent of
condition review confirms the discrepant solenoid was not installed in any
system in the plant. The licensee’s process (last barrier) worked. The PD
had no effect on the associated cornerstone objectives since no SSC in
the plant was impacted.
MTM if: An extent of condition review revealed that this incorrect model solenoid
had already been installed in other trains or systems currently in
operation at the plant, thereby adversely impacting the associated
cornerstone objectives of ensuring the reliability, capability, or availability
of an SSC.
Note: If the extent of condition review indicated a systemic problem in the
procurement area, each case would need to be evaluated for
significance. If the discrepant equipment was not installed in the plant,
this trend would not be more than minor as long as other barriers via the
licensee’s procurement, work management process, or both still existed
to prevent installation of the unqualified material parts into the plant.
Example 5.d The licensee identified indications on the reactor vessel weld RPV-1 while
performing an examination required the ASME Code Section XI. The
licensee detected indications by ultrasonic examination (UT) to be of
acceptable size and returned the reactor vessel weld to service.
Subsequently, the inspectors identified errors in calibration of the UT
examination equipment used by the licensee to size these indications and
were concerned that the indications may not be acceptable.
The PD: The licensee failed to perform an adequate calibration of UT equipment
used to size flaws in on the reactor vessel weld RPV-1 which is contrary
to regulatory requirements or self-imposed standards.
Minor if: The PD did not adversely affect the Initiating Events cornerstone attribute
of equipment performance because when the licensee repeated the UT
examination with appropriate calibrated UT instruments, the verified flaws
met ASME Code Section XI acceptance criteria.
MTM if: The PD adversely affected the Initiating Events cornerstone attribute of
equipment performance and adversely affected the cornerstone objective
because when the licensee repeated the UT examination with appropriate
calibrated UT instruments, the flaws did not meet ASME Code Section XI
and required further analysis or repairs to be accepted for continued
service. The PD adversely affected the Initiating Events cornerstone
attribute of equipment performance and adversely affected the
cornerstone objective because absent NRC intervention, the licensee’s
incorrect application of UT would have likely been repeated and
continued incorrect application of UT would result in missed flaws in the
reactor coolant system resulting in increased likelihood for inservice
failures (e.g., a LOCA).
6. Health Physics
General Screening Criteria: A radiation protection program is composed of several barriers to
ensure adequate protection of occupational and public health and safety through
defense-in-depth. A radiation protection barrier is program element that serves a specific
radiation safety function. For example, procedures provide a barrier whose main function is to
provide employees with sufficient instruction, so they can safely perform their duties as radiation
workers. Other examples of barriers include ALARA plans and controls, radiological surveys
and monitoring, labeling and posting, access controls, and respiratory protection programs.
A minor PD in the implementation of a single radiation protection barrier results in a minimal
reduction in the protection of health and safety. However, a PD that renders a radiation
protection program barrier ineffective, or indicates that a barrier is ineffective, would be
appropriately classified as a more-than-minor PD.
When determining if a PD could reasonably be viewed as a precursor to a significant event,
inspection staff should evaluate whether the PD could have resulted in, or did result in, an
overexposure to a real individual (i.e., a “significant event” is viewed as an exposure beyond the
dose limits contained in 10 CFR Part 20 or other radiation safety-related criteria in section 04.05
of IMC 0309). To determine if an overexposure was a reasonable potential outcome, inspection
staff should consider whether events, as they occurred, or with a minor, realistic alteration of
circumstances (e.g., timing, source strength, distance and shielding), would have resulted in an
over-exposure to a real individual, and not merely whether a series of events could be
postulated that could result in an over-exposure.
When determining if a PD would have the potential to lead to a more significant safety concern,
inspection staff should evaluate if events, as they occurred, or with a minor, realistic alteration of
circumstances, were indicative of a failure of a radiation protection program barrier, or if the PD
resulted in an actual personnel safety concern (e.g., faulty respiratory protection equipment). In
applying this guidance, inspection staff can consider mitigating measures for the deficient
barrier that were in place at the time of occurrence (e.g., use of electronic alarming dosimeter
with appropriately conservative dose rate alarm set points), and (2) the actual radiological risk
introduced by the PD. The radiological risk consists of resultant doses, or doses that could have
reasonably occurred with minor, realistic adjustments to events as they occurred. In general, the
radiological risk is expressed in terms of dose to real individuals; however, in certain
circumstances the risk to health and safety is not adequately reflected in the resulting dose and
thus other factors must be considered in determining the level of radiological risk (e.g.,
magnitude of radiological hazards).
When determining if a PD adversely affected the associated cornerstone objective, inspection
staff should consider whether the PD impacted the effectiveness of a radiation protection
program barrier such that the licensee’s ability to provide adequate protection to a worker or a
member of the public was challenged. These PDs generally result in actual unplanned or
uncontrolled doses to workers or members of the public, or actual unplanned or uncontrolled
releases of radioactive material to the unrestricted area.
Example 6.a A licensee performed a required radiation survey, but the survey was not
documented properly, or a mistake occurred in the documentation of the
survey.
The PD: The licensee failed to document a radiation survey as required by
regulations and/or licensee procedures.
Minor if: The required survey was actually performed, AND the lack of a survey
record did not result in the licensee failing to establish appropriate
radiological controls (e.g., access controls, dosimetry, and respiratory
protection); failing to properly inform workers of the radiation hazard; or
failing to adequately control the release of radioactive material from the
site.
MTM if: The PD had the potential to lead to a more significant radiation safety
concern because of an ineffective radiation program barrier. Specifically,
the lack of a survey record resulted in the licensee not establishing
appropriate radiological controls; not properly informing workers of the
radiation hazard; or not adequately controlling the release of radioactive
material from the site.
Example 6.b Radiation detection instruments (e.g., portable instruments or installed
area radiation monitors) were not calibrated properly, or not response
checked prior to use in accordance with site procedures.
The PD: The licensee did not calibrate or response check radiations protection
instrumentation as required by regulatory requirements or self-imposed
standards.
Minor if: When recalibrated or response checked, the as-found condition of the
instrument was within acceptance criteria for the calibration or response
check, or the instrument provided conservative measurement (i.e.,
over-response), or if the installed area radiation monitor would still have
adequately performed its alarm function.
MTM if: The PD had the potential to lead to a more significant radiation safety
concern because of an ineffective radiation program barrier. Specifically,
when recalibrated or response checked, the as-found condition of the
instrument was not within acceptance criteria for the calibration, or
response check, or if the installed area radiation monitor would not have
adequately performed its alarm function.
Example 6.c Licensee personnel missed a step in the procedure for setting alarm set
points for effluent control/monitoring equipment associated with normal
operations (i.e., non-emergency planning (EP) program activities)
resulting in incorrect set points.
The PD: Licensee personnel did not comply with the procedure for establishing set
points for equipment used for effluent control/monitoring as required by
regulatory requirements or self-imposed standards.
Minor if: The effluent monitor alarm set point would have allowed the
instrumentation to perform its intended function (e.g., trip or alarm
function) to prevent an instantaneous effluent release in excess of the
applicable technical specification instantaneous concentration limit for
liquids or dose rate limits for gases.
MTM if: The PD was associated with the plant facilities/equipment and
instrumentation attribute of the public radiation safety cornerstone and
adversely affected the cornerstone objective to ensure adequate
protection of public health and safety from exposure to radioactive
materials released into the public domain as a result of routine civilian
reactor operation. Specifically, the effluent monitor with its alarm set point
would have failed to perform its intended function (i.e., trip or isolation
function) to prevent an effluent release in excess of the applicable
technical specification instantaneous concentration limit for liquids or
dose rate limits for gases.
Example 6.d A health physics technician provided job coverage or performed a task
that the technician was not fully qualified to perform.
The PD: The licensee did not utilize qualified health physics technicians as
required by regulatory requirements or self-imposed standards.
Minor if: The work performed by the technician (e.g., radiological surveys and
monitoring) provided an adequate level of radiological protection.
MTM if: The PD had the potential to lead to a more significant radiation safety
concern because of an ineffective radiation program barrier. Specifically,
one or more errors of consequence to radiological safety were made by
the technician such that the work performed by the technician did not
provide an adequate level of radiological protection.
Example 6.e An item (e.g., tool, dirt, secondary resin) containing detectable licensed
radioactive material (RAM) was inadequately released from further
radiological control (e.g., item was inadequately surveyed).
The PD: Licensee did not control licensed material as required by regulatory
requirements or self-imposed standards.
Minor if: The follow-up survey concludes that the item contained radioactive
material with a measured dose rate that is indistinguishable from
background (as measured in a low background area, at a distance of
30 cm from the item with a micro-rem per hour-type instrument that
typically uses a 1 inch by 1 inch scintillation detector) and the calculated
dose using a realistic exposure scenario is less than or equal to 1 percent
of applicable public dose limits.
MTM if: The PD is associated with the program and process attribute of the public
radiation safety cornerstone and adversely affected the objective to
ensure adequate protection of public health and safety from exposure to
radioactive materials released into the public domain as a result of routine
civilian nuclear reactor operation. Specifically, an uncontrolled release of
RAM occurred as determined by a follow-up survey with measured dose
rate that is distinguishable from background (as measured in a low
background area, at a distance of 30 cm from the item with a micro-rem
per hour-type instrument that typically uses a 1 inch by 1 inch scintillation
detector) or the calculated dose using a realistic exposure scenario is in
excess of 1 percent of applicable public dose limits.
Note: A PD does not occur in the situation where an item with RAM has been properly
surveyed using appropriate survey techniques, is evaluated as not having detectable
RAM and released, and is later discovered as containing RAM when surveyed using
a more sensitive survey method.
Example 6.f A radiation survey did not identify a radiation area, high radiation area
(HRA) or locked high radiation area (LHRA).
The PD: The licensee did not perform an adequate survey to appropriately post a
Minor if: Radiological conditions existed in the previously unknown radiation area
such that the dose to an uninformed worker (e.g., a worker who had not
been briefed on or reviewed radiological conditions) was unlikely to
exceed an unplanned dose of 10 mrem, OR
For deficiencies occurring in HRAs, all the following conditions were met:
- the accessible dose rate did not exceed 1,000 mrem/hr at 30 centimeters
- all workers with access to the dose rate were wearing electronic alarming dosimeters (EADs) with dose rate alarm setpoints sufficiently low to allow workers to take appropriate actions before encountering dose rates exceeding 100 mrem/hr
- the accessible dose rate was identified by an EAD dose rate alarm
- all affected workers responded to the alarm per licensee procedures MTM if: The PD had the potential to lead to a more significant safety concern because of an ineffective radiation program barrier. Specifically, any of the following occurred:
- the inadequate survey, or failure to survey, resulted in an accessible dose rate that exceed 1,000 mrem/hr at 30 centimeters (i.e., area was an unposted LHRA).
- an unknown radiation area existed, and the dose to an uninformed worker (e.g., a worker who had not been briefed on or reviewed
radiological conditions) was likely to exceed an unplanned dose of 10 mrem
- The inadequate survey, or failure to survey, resulted in an unposted HRA and any of the following conditions were met:
- a worker with access to the dose rate was not wearing an EAD
- the EAD dose rate alarm setpoint was not sufficiently low to allow
workers to take appropriate action before encountering dose rates
exceeding 100 mrem/hr
- A worker was aware of an EAD alarm and did not respond per licensee procedures
Note 1: For the purposes of this appendix, HRAs are defined as areas with accessible dose
rates that are greater than 100 mrem/hour at 30 centimeters but that do not exceed
1,000 mrem/hr at 30 centimeters. Locked high radiation areas (LHRA) are defined as
areas with accessible dose rates greater than 1,000 mrem/hr at 30 centimeters.
Example 6.g A worker improperly entered a posted HRA or LHRA (i.e., not in
accordance with Technical Specifications and plant procedures).
The PD: Licensee personnel did not comply with procedures for entry into an HRA or LHRA.
Minor if: The improper entry occurred in a conservatively posted HRA (i.e., the
highest actual radiation level in the posted area was less than or equal to
100 mrem/hr at 30 cm), OR
The improper entry occurred in an actual HRA (i.e., highest actual
radiation level in the posted area exceeded 100 mrem/hr at 30 cm, but did
not exceed 1000 mrem/hr at 30 cm) and all the following conditions were
met:
- the worker was wearing an EAD
- the EAD dose rate alarm setpoint was sufficiently low to alert workers before encountering dose rates exceeding 100 mrem/hr
- if an EAD alarm was received the worker responded to the alarm per licensee procedures MTM if: The PD had the potential to lead to a more significant safety concern because of an ineffective radiation program barrier. Specifically, an improper entry was made into an LHRA, OR The improper entry was made into an HRA and any of the following conditions were met:
- the worker was not wearing an EAD
- the EAD alarm setpoint was not sufficiently low to alert workers before encountering dose rates exceeding 100 mrem/hr
- A worker was aware of an EAD alarm and did not respond per licensee procedures
Note 1:For the purposes of this appendix, HRAs are defined as areas
with accessible dose rates that are greater than 100 mrem/hour at 30
centimeters but that do not exceed 1,000 mrem/hr at 30 centimeters.
Locked high radiation areas (LHRA) are defined as areas with accessible
dose rates greater than 1,000 mrem/hr at 30 centimeters.
Example 6.h Radiological controls were not established or utilized such that an
unplanned internal exposure occurred or was likely to occur with a minor
alteration of circumstances. The failure may have involved an inadequate
radiological survey, improper ventilation controls, or an individual’s failure
to follow RWP requirements.
The PD: The licensee failed to adequately survey (or implement ventilation
controls or follow licensee procedures) in an area that in a reasonable
exposure scenario could have been the source of internal exposure.
Minor if: The worker did not receive or was unlikely to receive greater than
10 mrem committed effective dose equivalent (CEDE).
MTM if: The PD is associated with the program and process attribute of the
occupational radiation safety cornerstone and adversely affected the
cornerstone objective to ensure adequate protection of the worker health and safety from exposure to radiation from radioactive material during
routine civilian nuclear reactor operation. Specifically, the PD resulted in
inadequately controlled radiological conditions such that the worker
received or was likely to receive greater than 10 mrem CEDE.
Example 6.i PDs occurred in ALARA planning and/or job execution that resulted in the
actual collective dose exceeding the planned (or adequately re-planned),
intended dose for a work activity.
The PD: The licensee’s ALARA planning or radiological controls did not prevent
unplanned, unintended dose for a work activity per regulatory
requirements or self-imposed standards.
Minor if: The actual collective dose was ≤ 5 person-rem, OR the actual collective
dose was greater than 5 rem but did not exceed the planned (or
adequately re-planned), intended dose by more than 50 percent.
MTM if: The PD is associated with the program and process attribute of the
occupational radiation safety cornerstone and adversely affected the
cornerstone objective to ensure the adequate protection of the worker
health and safety from exposure to radiation from radioactive material
during routine civilian nuclear reactor operation. Specifically, the licensee
did not effectively implement procedures or engineering controls to
achieve doses that are ALARA as indicated by actual collective dose
exceeding 5 person-rem AND exceeding the planned (or adequately
re-planned), intended dose by more than 50 percent (e.g., a task planned
for 4 person-rem received 6.1 person-rem, or a task re-planned for 14
person-rem received 22 person-rem).
Note 1: The 10 CFR 20.1101 regulations establish a regulatory requirement to use, to the
extent practical, procedures and engineering controls to achieve doses that are
ALARA. Licensees that establish and maintain ALARA programs and procedural
controls will normally meet this regulatory requirement and will not be in violation of
10 CFR 20.1101 for not reducing doses to an absolute minimum. However, a PD
meeting the MTM criteria can still be dispositioned as inspection finding without an
associated violation.
Note 2: In cases where the licensee arbitrarily divides the radiological work into very small
work activities, or dose estimates were over-estimated for the purpose of avoiding
inspection findings, the criteria can apply to a reasonable grouping of work and
reasonable dose estimates as determined by NRC inspection staff (i.e., consistent
with prior history or industry norms).
Note 3: The expanded work scope could have resulted from several factors related to
additional maintenance or repair that the licensee would not have been reasonably
expected to have foreseen before the work began. Once a work activity is started,
and the expanded work scope is fully understood, it may be necessary to re-plan the
activity and revise the dose estimate. The revised dose estimate should be based on
the full scope of the work had it been known at the time of the initial planning.
Example 6.j A licensee failed to perform environmental monitoring for a significant
liquid or gaseous effluent exposure pathway due to several missed
sample collections or erroneous analyses.
The PD: A licensee failed to conduct adequate environmental monitoring sufficient
to evaluate the relationship between effluent releases and radiation doses
to individuals from principal pathways of exposure.
Minor if: The exposure pathway did not contain radioactivity or radiation levels that
exceeded 10 percent of the 10 CFR 50, Appendix I, section II ALARA
objectives.
MTM if: The PD was associated with the program and process attribute of the
public radiation safety cornerstone and adversely affected the
cornerstone objective to ensure adequate protection of public health and
safety from exposure to radioactive materials released into the public
domain as a result of routine civilian nuclear reactor operation.
Specifically, an inadequately monitored exposure pathway contained
radioactivity or radiation levels that exceeded 10 percent of the 10 CFR 50, Appendix I, section II ALARA objectives (excluding C-14).
Note 1: Per NUREG-1301 and NUREG-1302, the significant liquid effluent exposure
pathways are potable water, aquatic foods, shoreline deposits, and irrigated foods;
and the significant gaseous effluent exposure pathways are noble gas submersion,
inhalation, ingestion and external (direct) radiation. For the purposes of
environmental monitoring programs, the terminology “significant” effluent exposure
pathway and “principal” effluent exposure pathway is interchangeable.
Example 6.k A licensee failed to label a container of licensed material being stored
within the restricted area, as required.
The PD: The licensee failed to ensure that each container of licensed material
bears a label that includes sufficient information to permit individuals
handling or using the containers, or working in the vicinity of the
containers, to take precautions to avoid or minimize exposures.
Minor if: The radiation level from the unlabeled containers did not exceed 5
mrem/hr at 30 centimeters, OR the unlabeled container was in an
adequately posted area and subject to plant procedures to verify
adequate labelling before removal from the posted area.
MTM if: The PD had the potential to lead to a more significant safety concern
because of an ineffective radiation program barrier. Specifically, the
radiation level from the unlabeled container exceeded 5 mrem/hr at
30 centimeters, AND the unlabeled container was not in an adequately
posted area and subject to plant procedures to verify adequate labelling
before removal from the posted area.
Example 6.l A licensee ships radioactive material in correct packaging but with an
error in the shipping papers.
The PD: The licensee did not adequately describe hazardous material in shipping
papers as required by regulatory requirements or self-imposed standards.
Minor if: The error does not impact the emergency telephone number; exclusive
use status; consignee address; identification number; proper shipping
name; hazard class; label (as applicable); physical/chemical form of the
material; the name of each radionuclide; and the error did not exceed
20 percent of the mass, volume or activity of the material.
MTM if: The PD is associated with the program and process attribute of the public
radiation safety cornerstone and adversely affected the cornerstone
objective to ensure adequate protection of public health and safety from
exposure to radioactive materials released into the public domain as a
result of routine civilian nuclear reactor operation. Specifically, the
licensee committed an error in the shipping papers for radioactive
material that impacted the emergency telephone number; exclusive use
status; consignee address; identification number; proper shipping name;
hazard class; label (as applicable); physical/chemical form of the material;
the name of each radionuclide shipped, or the error exceeded 20 percent
of the mass, volume or activity of the material.
Example 6.m The licensee established by procedure an administrative limit of
occupational exposure of 2 rem per year. Documented approval from the
site radiation protection manager (RPM) was required for any individual to
exceed the procedural limit. Contrary to the licensee’s program, an
individual received 2.7 rem in one year without documented approval.
The PD: Licensee personnel did not comply with procedures for personnel
monitoring as required by regulatory requirements or self-imposed
standards.
Minor if: The failure was administrative in nature in that the RPM was involved in
the planning and decision-making associated with exceeding the
administrative limit (i.e., the PD is limited to the documentation associated
with the approval).
MTM if: The PD is associated with the program and process attribute of the
occupational radiation safety cornerstone and adversely affected the
cornerstone objective to ensure adequate protection of worker health and
safety from exposure to radiation from radioactive material during routine
civilian nuclear reactor operation. Specifically, the licensee did not
effectively implement procedures to monitor and control radiation
exposure to workers resulting in an unplanned and uncontrolled exposure
of a worker over the administrative limit.
Example 6.n A licensee intends to use respiratory protection to limit intakes of
radioactive material (i.e., the respiratory protection will not be used to
protect workers from occupational hazards other than airborne radioactive
contamination) and conducts respirator fit testing using a different type of
harness than that which is assigned to workers for use in the field.
The PD: The licensee did not conduct respirator fit testing with the same make,
model, style, and size of respirator that will be used in the field as
required by regulatory requirements or self-imposed standards.
Minor if: The PD does not result in a personnel safety issue resulting from the use
of equipment whose purpose is to limit intakes of radioactive material,
AND the performance deficiency did not impact the required fit factor of
the respirator issued to the worker for use in the field.
MTM if: The PD had the potential to lead to a more significant safety concern
because of an ineffective radiation protection program barrier.
Specifically, the PD resulted in a personnel safety concern resulting from
the use of equipment whose purpose is to limit intakes of radioactive
material, OR the PD adversely impacted the required fit factor of the
respirator issued to the worker for use in the field.
7. Part 37 – Physical Protection of Category 1/Category 2 Quantities of Radioactive Material
General Guidance: Licensee programs to protect category 1 and category 2 radioactive
material, or “Part 37 material,” from theft and diversion consist of several barriers (e.g., access
authorization programs and multiple security provisions), which provide defense-in-depth. An
isolated performance deficiency in the implementation of an element of the licensee’s program
can be considered a minor violation because the existence of multiple barriers would provide
adequate protection of the material. A missing or ineffective element would be considered
more-than-minor because this condition represents a reduction in defense-in-depth.
Administrative issues (e.g., not meeting training documentation requirements) are minor
provided they do not result in the failure of a program element.
Because material in transit is at a higher risk of theft or diversion than material stored at a site in
general, PDs which occur during the transport of category 1 or category 2 material are
more-than-minor unless they are of a purely administrative nature (e.g., failure to document
preplanning or coordination provided such efforts did occur) or they result in a minor impact on
the security of the shipment (e.g., temporary loss of redundant form of communication,
temporary loss of telemetric position monitoring).
Performance deficiencies that are within the scope of EGM-2014-001 are considered minor
violations. However, these performance deficiencies shall be documented in inspection reports
in accordance with IMC 0611, section 0611-12 and, for tracking purposes, issued a new
enforcement action number each time enforcement discretion is granted. In these cases, the
justification for the issue being dispositioned as minor is the very low risk of theft and diversion
associated with large components and robust structures as described in EGM-2014-001.
Note: A PD associated with a licensee’s Part 73 security plan used to provide equivalent
protection for Part 37 materials should be dispositioned using section 14 by a qualified security
inspector.
Example 7.a A licensee allows unescorted access to a category 2, or greater, quantity
of radioactive material to a person whose background investigation was
deficient.
The PD: The licensee’s access authorization program did not ensure that an
individual whose assigned duties require unescorted access to category 1
or category 2 quantities of radioactive material are trustworthy and
reliable.
Minor if: The deficiency did not impact information that was relevant to access
approval and thus would not have changed the licensee’s trustworthiness
and reliability determination.
MTM if: The PD had the potential to lead to a more significant safety concern
because of an ineffective program barrier. Specifically, an unauthorized
person who would not have been granted unescorted access had they
completed the licensee’s access authorization program requirements was
granted unescorted access to category 2, or greater material.
Example 7.b A licensee established a temporary security zone, outside of the
Protected Area (PA) but inside a continuous physical barrier, and the
licensee failed to establish and maintain adequate means of monitoring
and detection.
The PD: The licensee failed to maintain the capability to continuously monitor and
detect without delay all unauthorized entries into its security zones which
was contrary to a regulatory requirement or a licensee standard.
Minor if: The following conditions were met:
- The licensee’s security force regularly surveils (e.g., several times per day), either through direct line of sight or remote visual surveillance the location of the temporary security zone.
- Per the licensee’s procedures, security would be alerted to and respond to an individual who trespasses into temporary security
zones, and * The licensee recognizes and responds to the failure in a timely manner (i.e., within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery).
MTM if: The PD had the potential to lead to a more significant safety concern
because of an ineffective program barrier. Specifically, category 1 or
category 2 material was left unsecured and any of the following conditions
were met:
- The deficient temporary security zone was established in an area not regularly surveilled by the licensee’s security force,
- Security would not be alerted to or respond to a trespasser of the temporary security zone, or
- The licensee does not recognize or respond to the failure in a timely manner (i.e., within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).
Example 7.c The licensee’s Part 37 plan does not describe a physical protection
measure used to protect Part 37 material from theft and diversion, or the
licensee’s Part 37 plan does not describe how a Part 73 measure is used
to provide a level of protection equivalent to Part 37 requirements.
The PD: The security plan failed to describe the measures and strategies used to
satisfy requirements which was contrary to a regulatory requirement or a
licensee standard.
Minor if: The physical protection measure was in place and functional.
MTM if: The PD had the potential to lead to a more significant safety concern
because of an ineffective program barrier. Specifically, the physical
protection measure was not in place or functional.
Example 7.d The licensee did not coordinate with the local law enforcement agency
(LLEA) regarding the protection of category 1 or category 2 material
within the 12-month limits.
The PD: The licensee failed to coordinate with the LLEA at least every 12 months
which was contrary to a regulatory requirement or a licensee standard.
Minor if: The licensee had an existing relationship with the LLEA and coordinated
with the LLEA within an 18-month period.
MTM if: The PD had the potential to lead to a more significant safety concern
because of an ineffective program barrier. Specifically, the licensee had
not coordinated with the LLEA for responding to threats to the licensee’s
facility in over 18 months.
8. Maintenance Rule
Example 8.a During an inspector’s review of the licensee’s 10 CFR 50.65a(3) periodic
evaluations of the site maintenance program, the inspector noted that two
evaluations exceeded the 24 month interval by approximately 2 and
6 months, respectively.
The PD: The licensee did not perform periodic maintenance evaluations with a
periodicity specified in regulatory requirements or self-imposed standards.
Minor if: The objectives of the mitigating systems cornerstone were not adversely
affected because the failure to perform the periodic 50.65(a)(3) evaluation
within the required interval did not adversely affect the balance of
reliability and unavailability and no adjustments to the maintenance
program were warranted.
MTM if: The objectives of the mitigating systems cornerstone were adversely
affected because the failure to perform the periodic 50.65(a)(3) evaluation
within the required interval affected the balance between reliability and
unavailability and adjustments to the maintenance program were
warranted but not completed.
Example 8.b The inspectors identified that during an (a)(3) periodic evaluation, the
licensee failed to include the system unavailability time during TS
required surveillance testing of the emergency diesel generators (EDG).
Although the licensee conducts monthly EDG testing, the EDGs are
unavailable to perform their intended safety function during TS
surveillance testing for a few minutes during each monthly test.
The PD: The licensee failed to consider all unavailability when conducting the
(a)(3) evaluation which was contrary to a regulatory requirement or a
licensee standard.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected since the contribution to unavailability due to the surveillance
testing was insignificant when compared to total unavailability, and it did
not impact the balancing of availability and reliability.
MTM if: The mitigating systems cornerstone objectives were adversely affected
because the contribution to unavailability due to the surveillance testing
was significant enough to affect the balancing determination such that a
change in the maintenance program was warranted.
Example 8.c The inspectors identified that the licensee had not included some
components of the augmented off-gas system within the scope of its
program for implementation of the Maintenance Rule. Failure of these
components could result in a plant transient or scram and are therefore
required to be in scope.
The PD: The licensee failed to scope certain components of the augmented offgas system which could have caused a plant transient or scram if failed,
which was contrary to a regulatory requirement or a licensee standard.
Minor if: Cornerstone objectives were not adversely affected since the licensee
had been performing appropriate preventive maintenance and there were
no equipment performance problems. Had the components been scoped,
the preventive maintenance being performed would demonstrate effective
control of equipment performance and condition as provided in paragraph
(a)(2) of the Maintenance Rule.
MTM if: Cornerstone objectives were adversely affected because effective control
of equipment performance or condition for equipment that should have
been scoped was not demonstrated, for example through performance
criteria that were not met.
Example 8.d In accordance with the guidance of IP 71111.13, inspectors reviewed the
plant’s maintenance risk assessment performed pursuant to
10 CFR 50.65(a)(4) for in progress maintenance activities and identified
that the risk assessment was inadequate. Specifically, one or more of the
following were identified: (a) not all ongoing maintenance activities
affecting SSCs within the licensee’s established (a)(4) scope had been
taken into account; (b) one of the maintenance activities was taking
longer than assumed in the risk assessment; (c) plant
conditions/operations, including TS requirements, were not consistent
with the assumptions used in the risk assessment; or (d) relevant
information provided to the risk assessment tool/process was
inaccurate/incomplete.
The PD: The licensee failed to perform an adequate risk assessment when
required by regulatory requirements or self-imposed standards.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected because the overall corrected risk assessment would not result
in a higher licensee-established risk category and would not require
additional risk management actions (RMAs) under licensee procedures*.
MTM if: The mitigating systems cornerstone objectives were adversely affected
because either: (1) the overall corrected risk assessment would result in a
higher licensee-established risk category or would require additional
RMAs under plant procedures*; (2) the risk assessment failed to correctly
account for (at least qualitatively) the loss or significant uncompensated
impairment of a key operating or shutdown safety or probabilistic risk
assessment function; or (3) the credited function would not have been
maintained due to the failure to identify or implement RMAs.
- Note: Under certain circumstances regarding an assessed risk level, the inspector may
identify RMAs that should be taken which could be contrary to the required RMAs in
accordance with licensee procedures. In such cases, management review is required
for more-than-minor determination, including consultation with the regional
Maintenance Rule subject matter expert and then the Maintenance Rule lead in NRR
if necessary.
Example 8.e In accordance with the guidance of IP 71111.13, inspectors reviewed the
plant’s maintenance risk assessment for in progress maintenance
activities required by 10 CFR 50.65(a)(4) and identified that a risk
assessment had not been performed prior to commencing maintenance
activities or maintenance support activities that increased plant risk.
The PD: The licensee’s failure to perform a risk assessment when required is
contrary to a regulatory requirement or self-imposed standard.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected since the overall elevated plant risk would not put the plant into a
higher licensee-established risk category and would not require RMAs or
additional RMAs under licensee procedures*.
MTM if: The mitigating systems cornerstone objectives were adversely affected
since (1) overall elevated plant risk would put the plant into a higher
licensee-established risk category or would require RMAs or additional
RMAs under plant procedures*, (2) the risk assessment failed to correctly
account for (at least qualitatively) the loss or significant, uncompensated
impairment of a key operating or shutdown safety or probabilistic risk
assessment function, or (3) the credited function would not have been
maintained due to the failure to identify or implement RMAs.
Example 8.f In accordance with the guidance of IP 71111.13, the inspectors reviewed
the plant’s maintenance risk assessment for in progress maintenance
activities required by 10 CFR 50.65(a)(4) and determined that a risk
assessment had been performed when required and was adequate. Upon
inspection of the plant, the inspectors identified that one of the RMAs
prescribed by the licensee, the hanging of protected equipment signs on
entry doors to the 1A EDG room, had not been effectively implemented in
that the signs were not hung.
The PD: The licensee failed to manage risk which was contrary to a regulatory
requirement or a licensee standard.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected. There were no unauthorized individuals in the room, no work
was ongoing and, while protected equipment signs were not hung,
Operations was aware that the 1A EDG was considered protected
equipment as an RMA. Thus, the work control center would have known
the actual protected equipment status of the 1A EDG when determining
whether to authorize activities in the room.
MTM if: The mitigating systems cornerstone objectives were adversely affected.
There were unauthorized individuals in the room, work ongoing in the
vicinity of protected equipment that was not specifically authorized to be
conducted in the vicinity of protected equipment, or Operations was
unaware that the 1A EDG should have been considered protected and
thus may have authorized inappropriate work in the area.
Example 8.g The inspectors identified that the licensee did not properly identify or
process a Maintenance Rule functional failure of an SSC scoped into the
licensee’s Maintenance Rule program and currently in 10 CFR 50.65(a)(2) status.
The PD: The licensee’s failure to properly identify or process a Maintenance Rule
functional failure of an SSC scoped into the Maintenance Rule is contrary
to regulatory requirements or self-imposed standards.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected because, when the Maintenance Rule functional failure is
considered, it is still demonstrated that performance of the SSC was
being effectively controlled through appropriate preventive maintenance
such that the SSC remained capable of performing its intended function
(i.e., the requirements of 10 CFR 50.65(a)(1)/(a)(2) were always met).
MTM if: The mitigating systems cornerstone objectives were adversely affected
because, when the Maintenance Rule functional failure is considered,
performance indicates that the SSC was is not being effectively controlled
through appropriate preventive maintenance, and that the SSC was not
moved to 10 CFR 50.65(a)(1) (i.e., the requirements of 10 CFR 50.65(a)(1)/(a)(2) were not met).
9. Thermal Power Limits
Example 9.a While operating at 99.9 percent rated thermal power (RTP), operators
conducted a pre-planned evolution to swap operating feed pumps.
Operators did not comply with a licensee procedure prerequisite to
reduce thermal power 0.5% below RTP prior to the pre-planned feed
pump swap; which is in place to account for the anticipated 0.2 percent to
0.4 percent increase in thermal power. Upon starting the second feed
pump, thermal power increased to 100.2 percent RTP.
The PD: The licensee did not comply with procedural requirements for reducing
power prior to swapping the feed pumps.
Minor if: The PD was associated with the human performance attribute of the
Barrier Integrity Cornerstone but did not adversely affect the cornerstone
objective of providing reasonable assurance that the fuel cladding
protects the public from radionuclide releases caused by accidents or
events because operators, after realizing that thermal power had
exceeded RTP, promptly decreased thermal power below or at RTP and
thermal power remained bounded by the reactor safety analysis (i.e.
thermal power did not enter an unanalyzed region) and no safety limits
were exceeded.
MTM if: The PD was associated with the human performance attribute of the
Barrier Integrity Cornerstone and adversely affected the cornerstone
objective of providing reasonable assurance that the fuel cladding
protects the public from radionuclide releases caused by accidents or
events because either operators did not recognize that they had
exceeded RTP; operators recognized they exceeded RTP, but did not did
not take adequate or timely action to lower thermal power to or below
RTP due to actions that were not considered willful; fuel integrity limits
were exceeded; or maximum thermal power entered an unanalyzed
region. See Nuclear Energy Institute (NEI) Position Statement, referenced
in RIS 2007-21, Revision 1 (ML090220365) for more guidance.
Example 9.b Following several days of steady state operation at or below RTP,
operators operated the unit in excess of RTP as indicated by the 1-hour
core thermal power (CTP) indication.
To monitor and control reactor power in accordance with the operating
license, operators rely on computer-generated time-averaged indications
of CTP that are updated every 10 seconds, providing running averages
for 15-minute, 1-hour, 2-hour, and 8-hour CTP. A licensee procedure
requires operators to review 15-minute average CTP and make
necessary adjustments to maintain the 1-hour average CTP at or below
RTP. Similarly, it requires operators to review 1-hour average CTP and
make necessary adjustments to maintain the 2-hour average CTP at or
below RTP.
Contrary to this guidance and license RTP requirements, when the
15-minute average CTP indication exceeded RTP, operators did not
make necessary adjustments to maintain 1-hour CTP at or below RTP.
The PD: The licensee did not comply with procedure requirement to monitor
15-minute-, 1-hour-, and 2-hour average CTP and to make timely CTP
adjustments as necessary to maintain 1-hour average CTP within the
RTP limit as required by regulatory requirements or self-imposed
standards.
Minor if: The PD was associated with the human performance attribute of the
Barrier Integrity Cornerstone but did not adversely affect the cornerstone
objective of providing reasonable assurance that the fuel cladding
protects the public from radionuclide releases caused by accidents or
events because even though the 1-hour average CTP exceeded RTP, the
operators completed adequate and timely action to re-establish
compliance with procedure and license RTP requirements.
MTM if: The PD was associated with the human performance attribute of the
Barrier Integrity Cornerstone and adversely affected the cornerstone
objective of providing reasonable assurance that the fuel cladding
protects the public from radionuclide releases caused by accidents or
events. Specifically, one of the following occurred: after the 1-hour
average CTP exceeded the RTP, operators did not take adequate or
timely action to prevent exceeding the 2-hour average CTP from
exceeding RTP; fuel integrity limits were exceeded; or maximum thermal
power entered an unanalyzed region. See NEI Position Statement,
referenced in RIS 2007-21, Revision 1 (ML090220365) for more
guidance.
10. Worker Fatigue
Example 10.a Failure to Limit Work Hour Waivers for Covered Workers As Necessary
For Safety or Security. The licensee is required by regulation or standard
to manage fatigue for covered workers. This includes the number of work
hours, waivers and exceptions, self-declarations, and fatigue
assessments.
The PD: The licensee failed to provide individual waivers when individuals
exceeded working hour guidance which was contrary to a regulatory
requirement or a licensee standard.
Minor if: This incident did not adversely affect a cornerstone objective because it
was reasonably determined not to have demonstrated the potential to
erode the effectiveness of work hour controls.
MTM if: The licensee’s inappropriate use of a waiver adversely impacted a
cornerstone objective. Various cornerstones could become impacted
depending upon the waiver, the work performed, and the consequence of
the issue. For example, the inappropriate use of waivers allowed workers
to become fatigued. Because of the workers fatigue, a maintenance error
was introduced which adversely impacted the function of a safety-related
or risk significant SSC. This adversely affected the equipment
performance and human performance attributes of the mitigating systems
cornerstone objective. Specifically, the configuration error resulted in a
challenge to a critical safety functions and fatigue could not be ruled out
as a contributor.
Example 10.b Failure to Assess Individuals Competency to Perform Duties Prior to
Granting Work Hour Waivers. The licensee is required by regulation or
standard to manage fatigue for covered workers. This includes the
number of work hours, waivers and exceptions, self-declarations, and
fatigue assessments.
The PD: The licensee failed to evaluate fatigue on an individual basis which was
contrary to a regulatory requirement or a licensee standard.
Minor if: The failure to assess a covered worker face to face prior to granting work
hour waivers did not adversely affect a cornerstone objective because it
was reasonably determined not to have demonstrated the potential to
erode the effectiveness of work hour controls.
MTM if: The licensee’s inappropriate use of a waiver adversely impacted a
cornerstone objective. Various cornerstones could become impacted
depending upon the waiver, the work performed, and the consequence of
the issue. For example, a licensed operator, working under a waiver,
without having received a face-to-face assessment, incorrectly
reconfigured a safety-related structure, system, or component. The failure
to assess covered workers face-to-face prior to granting work hour
waivers was associated with the equipment performance and human
performance attribute of the initiating events cornerstone objective.
Specifically, the configuration error resulted in an at-power event that
upset plant stability and challenged critical safety functions and fatigue
could not be ruled out as a contributor.
11. Cybersecurity
Example 11.a NEI 08-09, Appendix A, Section 3.1.6 – Mitigation of Vulnerabilities and
Application of Cyber Security Controls
A critical digital asset (CDA) was classified by the licensee as a direct
CDA and the inspectors discovered that the licensee had inadequately
implemented some of the technical controls in Appendix D of NEI 08-09,
“Cyber Security Plan for Nuclear Reactors”.
The PD: The licensee’s failure to implement the required controls for a direct CDA
as required by regulatory requirements or self-imposed standards.
Minor if: Upon reassessment, the CDA met the criteria for an indirect CDA in
accordance with NEI 13-10 and all the required baseline controls were in
place for an indirect CDA. The PD can also be minor if the CDA met the
criteria for an indirect CDA in accordance with NEI 13-10 and alternate
controls were in place that were commensurate to the required baseline
controls.
MTM if: If the required baseline controls for an indirect CDA were not in place, or
the required Appendix D & E security controls were not in place for a
direct CDA, or adequate alternate security controls were not in place for
either indirect or direct CDA.
Example 11.b NEI 08-09, Appendix D, Section 1.17 – Wireless Access Restrictions
The CSP requires that scans are conducted every 31 days for
unauthorized wireless access points in accessible areas. Inspectors
found that the licensee had missed a scan as required by site procedures,
the scan was required within 31 days, but was not performed until
35 days.
The PD: The licensee failed to follow procedures which was contrary to a
regulatory requirement or a licensee standard.
Minor if: Once the scan was completed, no wireless access points were identified.
This is a failure to implement a requirement that had no safety, security,
or emergency preparedness impact. The scanning delay was not
significant (e.g., less than 25 percent of the required frequency – in this
case less than 7 days) and review of logs indicates that no rogue
connections occurred during the delay period.
MTM if: The PD adversely affected the security cornerstone objective because
multiple scans were being routinely missed or significantly delayed (e.g.,
more than 25 percent of the required frequency – in this case more than
7 days), or because rogue wireless access points were identified after the
scan was conducted or logs were reviewed.
Example 11.c NEI 08-09, Appendix D, Section 4.3 – Password Requirements
The inspector performed an initial review of the cybersecurity control
assessment that was completed for an auxiliary feedwater control system
which was determined to be a direct CDA. During the review, the
inspector observed that the evaluation for the password security control
stated that a password was not required and there was not an alternate
control evaluation performed. The digital device had the capability to store
a password in order to provide protective measures for access control
and multiple threat vectors existed. All other security controls had been
properly evaluated and implemented.
The PD: Failure to implement the required password security control for a direct
CDA as required by regulatory requirements or self-imposed standard.
Minor if: This is an isolated incident and alternate controls were implemented (e.g.,
component was in a locked vital area and had a locked cover protecting
the device from being reconfigured) even though the alternate control
evaluation was not performed and documented in the cybersecurity
control assessment. However, the licensee was able to provide an
evaluation that demonstrated that alternate controls/countermeasures
mitigate the consequences of the threat/attack vectors.
MTM if: The PD adversely affected the security cornerstone objective because
alternate controls were not implemented to protect this device. While the
device was located in a vital area, the device could be reconfigured, or
alternate controls were implemented to protect this device, but the
licensee was not able to provide an evaluation demonstrating that the
alternate controls/countermeasures mitigate the consequences of the
threat/attack vector(s) (mitigated the consequences of an attack the
control was designed to protect).
Example 11.d NEI 08-09, Appendix E, Section 10.3 – Baseline Configuration
The inspector performed a review of the cybersecurity control
assessment for a CDA. The licensee failed to implement the
cybersecurity control E10.3 “Baseline Configuration” which requires
licensees to document and maintain an up-to-date, complete, accurate,
and readily-available baseline for each CDA. When the inspector asked
for the running configuration of software on the CDA, a discrepancy
between the documented baseline configuration and the running
configuration was identified.
The PD: Failure to implement baseline configurations of digital devices within the
scope of 10 CFR 73.54 as required by regulatory requirements or
self-imposed standard.
Minor if: This is an isolated incident and the discrepancy between the baseline and
running configuration was an incorrect parameter – such as a version
number - related to software that did not impact the effectiveness of other
security measures (e.g., vulnerability management). Missing attributes did
not introduce a new vulnerability or an unmitigated vulnerability.
MTM if: The baseline configuration did not list software identified in the running
configuration, the gap was not an isolated incident, or an incorrect version
impacted the effectiveness of other security measures.
Example 11.e NEI 08-09, 4.4 Ongoing Monitoring and Assessment
The inspector performed a review of the cybersecurity control
assessment for a digital device within the scope of 10 CFR 73.54. When
performing verification of implemented security controls, the inspector
identified a security control that should have been implemented on the
digital device but was not. The inspector also determined that the
licensee had provided no documented evidence verifying ongoing
monitoring of the controls for the selected digital device.
The PD: Failure to implement the required verification of the security controls for a
digital device within the scope of 10 CFR 73.54 as required by regulatory
requirements or self-imposed standard. NEI 08-09 4.4 Ongoing Monitoring
and Assessment states “Ongoing assessments to verify that the
cybersecurity controls implemented for CDAs remain in place throughout
the life cycle of the CDA.”
Minor if: If an undetected or unauthorized change to a single security control would
not result in a reduction in the effectiveness in the defense in depth
protective strategy or there are no unmitigated vulnerabilities. An example
would be a reboot of a CDA that resulted in an unneeded application or
service running that had previously been disabled. If the running
application or service did not introduce any known vulnerabilities required
to be assessed per the vulnerability management policy, and other
defense in depth measures – such as a security information and event
management (SIEM) identifying new traffic from a port used by the
application – could mitigate the effect of the change, then the violation
would be minor.
MTM if: The PD adversely affected the security cornerstone objective because
failure to perform ongoing assessments of implemented cybersecurity
controls does not provide adequate protection by not verifying that the
cybersecurity controls implemented for CDAs remain in place throughout
the life cycle of the CDA. Failure to perform ongoing assessments of
cybersecurity controls also does not provide adequate protection for
detecting unauthorized changes to data or software that could adversely
affect safety, security, and emergency preparedness (SSEP) functions.
Example 11.f NEI 08-09, Appendix D, Section 5.1 Removal of Unnecessary Services
and Programs
The inspector performed an initial review of the cybersecurity control
assessment of an engineering workstation between security levels 3
and 4. The review found numerous unnecessary services installed and
not disabled on the workstation.
The PD: The licensee failed to remove and/or disable software components that
are not required for the operation and maintenance of the device which
was contrary to a regulatory requirement or a licensee standard.
Minor if: If the service or program does not introduce an unmitigated vulnerability
on the device. An example would be Server Message Block (SMB) on a
device where the operating system has been patched for the vulnerability.
MTM if: If the licensee has an unnecessary service or program and failure to
implement this control would result in a reduction of the defense-in-depth
protective strategy – such as not establishing an accurate baseline
configuration, not adequately screening vulnerability notices or having the
ability to detect an exploitable vulnerability, not having the ability to
determine that the unnecessary service has been enabled or an
unnecessary port in processing unidentified or unauthorized traffic, etc.
Example 11.g NEI 08-09, Appendix E, Section 5.5 Physical Access Control
The inspector performed a review of the cybersecurity control
assessment and a walkdown of an x-ray machine located in a warehouse
outside of the protected area. The review determined that insufficient
physical security controls were implemented for the x-ray machine.
The PD: Failure to implement controls for CDAs as required by the licensee's
Cybersecurity Plan. Specifically, the licensee failed to implement all
necessary controls for CDAs located outside the protected area.
Minor if: The licensee can demonstrate functionality and adequate defense in
depth protections to determine if the security function provided by the
x-ray machine has been compromised prior to operation. Adequate
alternate controls for a real-time intrusion protection (i.e., automated
detection capabilities) to immediately facilitate dispatching security
personnel to investigate and/or remediate a potential cybersecurity
concern include a combination of the following—physically protecting the
x-ray machine with serialized tamper seal tape, random security guard
patrols, cameras monitored by Site Security 24/7 and/or testing to verify
operability prior to use of searching packages/materials for contraband.
See NEI 08-09 Appendix E.3.6 for the security control “Security
Functionality Verification.”
MTM if: The licensee failed to implement or implemented inadequate alternate
controls to prevent and detect a compromise of near real time detection of
compromise of the security function of the x-ray machine.
Example 11.h NEI 08-09, appendix E, section 12, “Evaluate and Manage Cyber Risk,”
(Vulnerability Management).
The inspector performed a review of the cybersecurity control
assessment for a device within the scope of 10 CFR 73.54. The licensee
stated that they were following NEI 08-09 Addendum 5 for their
vulnerability management process. The inspector determined that the
licensee had not adequately implemented vulnerability assessments.
The PD: Failure to implement a vulnerability management process as required by
regulatory requirements or self-imposed standard.
Minor if: Vulnerability notices for applicable CDA software or firmware are tracked
in the licensee’s vulnerability management process using the periodicity
specified in their cybersecurity plan but the inspection identified an
isolated vulnerability not identified by the licensee.
MTM if: Review of vulnerability notices was based on limited input (i.e., not based
on multiple credible sources) or incorrectly performing vulnerability
assessments using the Common Vulnerability Scoring System (CVSS) as
specified in NEI 08-09 Addendum 5.
12. External Events
Example 12.a During the inspectors’ review of the ignition sources in a given fire area,
the inspectors discovered that the licensee’s fire PRA failed to identify
and evaluate all targets within an ignition source’s zone of influence that
could potentially contribute to the risk analysis of fire scenarios.
The PD: Failure to address the risk contribution associated with all potentially risk
significant fire scenarios for a given fire compartment/area, in the fire PRA
is contrary to regulatory requirements or self-imposed standard.
Minor if: When corrected, the risk significance of fire scenarios in the fire
compartment/area did not increase. The initiating events cornerstone
objective was not adversely affected since the fire protection strategies
for the area/zone remained sufficient even with the error.
MTM if: The fire PRA and the safe shutdown strategy had to be revised to
address the risk contribution associated with the fire scenarios. The
initiating events cornerstone objective was adversely affected because
the actual risk of fire scenarios was not known, and sufficient prevention
and mitigation measures were not in place (i.e., revisions to fire response
procedures or detection or suppression equipment were necessary).
Example 12.b The licensee relocated FLEX equipment as part of refueling outage
preparations because the normal haul path was impacted by outage
equipment staging. The inspectors identified that pre-outage staging and
relocation of FLEX equipment resulted in N and N+1 FLEX equipment
being stored in an unprotected manner, though still functional, for 23 days
without appropriate compensatory protective measures being taken.
The PD: Failure to meet NEI 12-06, Revision 4, which the licensee is committed to
for pre-staging FLEX equipment, is contrary to regulatory requirements or
self-imposed standards.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected. ‘N’ FLEX capability was met with unprotected equipment that
lacked appropriate compensatory measures for less than or equal to
14 days as allowed by NEI 12-06, Revision 4, or ‘N’ FLEX capability was
met though with unprotected equipment with appropriate compensatory
measures that were implemented for less than or equal to 90 days, as
allowed by NEI 12-06, Revision 4.
MTM if: The mitigating systems cornerstone objectives were adversely affected
since equipment unavailability exceeded previously approved limitations
in NEI 12-06, Revision 4. The FLEX equipment was unprotected without
compensatory protective measures for greater than 14 days, was
unprotected with appropriate compensatory protective measures for
greater than 90 days, or both trains were non-functional or unavailable for
greater than 7 days.
Example 12.c The inspectors identified that licensee procedures for FLEX equipment
storage did not ensure that FLEX equipment would be maintained at a
temperature that ensured its likely function when called upon. Specifically,
licensee procedures did not address protection of FLEX equipment from
cold weather in the event of a power loss to the FLEX storage buildings.
NEI 12-06, Section 8.3.1.2, states, in part, “Storage of FLEX equipment
should account for the fact that the equipment will need to function in a
timely manner.
The PD: The licensee did not provide direction on ensuring FLEX equipment
remained protected from cold weather upon a loss of power to the FLEX
storage buildings which was contrary to a regulatory requirement or a
licensee standard.
Minor if: The mitigating systems cornerstone objectives were not adversely
affected since cold weather conditions severe enough to impair the likely
ability of FLEX equipment to function never occurred and are not
expected to occur. A review of meteorological data from the site show
that typical cold weather experienced by the site would not drop FLEX
storage building temperature below the temperature range at which the
equipment would be likely to function when called upon (i.e., the typical
duration for low temperatures would not adversely affect the functionality
of the equipment).
MTM if: The mitigating systems cornerstone objectives were adversely affected
since cold weather conditions sufficient to impair the likely ability of FLEX
equipment to function had occurred, was occurring, or is known to occur
occasionally at the site. Actual FLEX storage building temperatures
dropped below the temperature at which FLEX equipment would be likely
to function when called upon, or typical cold weather experienced by the
site would be cold enough for a sufficient duration to raise reasonable
doubts about the likeliness that FLEX equipment would function when
called upon.
Example 12.d The inspectors identified that cabling associated with two independent
channels of spent fuel pool level instrumentation installed as part of postFukushima requirements, were routed in such a way that they came into
physical contact with each other. The licensee is committed to a design in
which there are two fully independent and redundant spent fuel pool level
monitoring systems that will provide continuous wide range water level
indication.
The PD: The licensee did not maintain two independent spent fuel pool level
monitoring channels in accordance with self-imposed standards.
Minor if: The barrier integrity cornerstone objective was not adversely affected.
The minor contact of the shielded jackets of the coaxial signal cables at a
single point did not impair the function of the spent fuel pool level
instruments. Further, the minor contact would not be expected to
significantly increase the likelihood of a common mode failure due to the
flexible nature of the cables and outer protective layer of the coaxial
cables being resistant to abrasion.
MTM if: The barrier integrity cornerstone objective was adversely affected. The
function of one or more of the spent fuel pool level instrumentation
channels was impaired or there were indications of ongoing damage to
the cables that did not yet impair the function of the spent fuel pool level
instrumentation but would be expected to had the condition not been
identified and corrected. Incorrect or unreliable spent fuel pool level
indication can impair the ability to ensure adequate spent fuel pool
cooling.
13. Service life
Example 13.a In 2005, the licensee assessed (as required by regulatory requirements or
self-imposed standards) a Vendor Bulletin which stated the period of time
that a Molded-Case Circuit Breakers (MCCBs) can be installed without
refurbishment or replacement is 20 years for mild environment
applications. Vendor Bulletin stated that this time interval could be
extended through preventive maintenance, testing, and aging analysis
based on operational usage (number of demands or cycles) and actual
plant conditions. The licensee’s engineering evaluation of the Bulletin
concluded that based on the environmental conditions and usage of the
affected MCCBs, the MCCBs should either be refurbished or replaced
before exceeding 20 years of service. The licensee planned to revise their
MCCB preventive maintenance procedures by 2008 to require
refurbishment or replacement of all MCCBs in safety-related systems
prior to exceeding 20 years of service.
During this inspection (2016), the preventive maintenance procedures
had not been updated thus the affected MCCBs remained in service for
26 to 28 years, well beyond their 20 year refurbishment or replacement
interval. To date, no MCCBs failures have occurred at the licensee’s site.
The PD: The licensee failed to translate MCCB refurbishment/replacement
schedules into maintenance instructions contrary to regulatory
requirements or self-imposed standards.
Minor if: If left uncorrected, it is not reasonable to conclude the PD would have the
potential to lead to a more significant safety concern. Specifically,
• the licensee re-evaluated existing preventive maintenance procedures
and determined the intent of the Vendor Bulletin was met,
-or-
• the licensee re-analyzed the existing engineering evaluation (or
performed a new one after NRC identification of the issue) and
determined the newly calculated time period extended beyond the
expiration of the operating license. In performing the new engineering
evaluation, the conditions in MTM below did not apply.
MTM if: If left uncorrected, the PD has the potential to lead to a more significant
safety concern. Specifically, absent NRC’s intervention, the license’s
failure to establish and perform appropriate preventative maintenance
refurbishments or replacements can lead to in-service component
deterioration and resultant failures of MCCBs to perform their
safety-related functions.
-or
The PD was associated with the equipment performance attribute of the
mitigating systems cornerstone and adversely affected the cornerstone
objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences.
Specifically, exceeding the previously analyzed time period for
replacement or refurbishment caused reasonable doubt on the continual
ability of the MCCBs to perform their safety-related functions. In
re-analyzing the existing engineering evaluation (or in performing a new
one after NRC identification of the issue), the licensee (a) used a different
approach because the original approach resulted in unfavorable margin;
or (b) revised assumptions solely to obtain favorable results; or
(c) revised other calculations in order to establish operability or
functionality; or (d) determined the remaining margin falls outside the
licensee’s design process acceptance criteria. Unfavorable margin means
that had the correct values been used originally, the licensee’s design
process would not have accepted the modification.
Example 13.b The inspectors noted that for the nuclear grade valve actuators,
Limitorque only specified a life expectancy of 40 years or 2000 cycles,
whichever came first. With implementation of extended 20-year plant
licenses, EPRI conducted Limitorque actuator testing to develop a
methodology that may be applied to justify extension of the life of an
actuator to 60 years and 4000 cycles. Licensees referencing this
methodology must implement the conditions specified in the EPRI report
to extend the life of their actuators. The Limitorque actuator fatigue life
extension process requires additional engineering review, analysis, and
thrust evaluation of each actuator to justify the life extension. Limitorque
has approved the use of the EPRI methodology for actuator fatigue life
extension. While reviewing MOV program documents, the inspector noted
that the licensee had extended the service life of its Limitorque MOVs
without a corresponding engineering analysis. The inspector noted the
licensee already entered their period of extended plant operation.
The PD: The licensee failed to analyze the acceptability of extending the service
life of MOV (specific name(s)) which is contrary to 10 CFR 50,
Appendix B, Criterion V, “Instructions, Procedures, and Drawings,” (or for
MOVs, 10 CFR Part 50.55a(b)(3)(ii))
Minor if: The PD did not adversely affect the mitigating systems cornerstone
objective because once performed, the additional engineering review,
analysis, and thrust evaluation of each actuator demonstrated the
actuators met their design basis functions for their extended design life
and the subject valves do not need additional testing or maintenance as a
result of the verification per the site MOV program documents. In
performing the reviews and analysis, the conditions in MTM below did not
apply (i.e., for minor, design assumptions were not changed to obtain
favorable results).
MTM if: (Assuming an actuator exceeded 40 years or 2000 cycles) The PD was
associated with the equipment performance attribute of the mitigating
systems cornerstone and adversely affected the cornerstone objective to
ensure the availability, reliability, and capability of systems that respond
to initiating events to prevent undesirable consequences. Specifically,
(1) the licensee was unable to verify that the valves were operable based
on the assessment of the conditions in the EPRI report; or (2) as a result
of this issue, the licensee now needs to conduct maintenance or testing of
the subject valves per the site MOV program documents; or
(3) regardless of the final operability or functionality, the as-found
condition was such that there was reasonable doubt with respect to the
assurance of availability and reliability. For example, to ensure
qualification, the licensee (a) used a different approach because the
original approach resulted in unfavorable margin (where “unfavorable
margin” means that had the correct values been used originally, the
licensee’s design process would not have accepted the modification); or
(b) revised assumptions solely to obtain favorable results; or (c) revised
other calculations in order to establish operability or functionality; or
(d) determined the remaining margin falls outside the licensee’s design
process acceptance criteria.
(Use if the actuator did not exceed 40 years or 2000 cycles) If left
uncorrected, the valve’s actuator would have been installed beyond its
demonstrated life - challenging the capability and reliability of the valve to
perform its safety function when called upon in a harsh environment
during a design basis accident. Specifically, without NRC identification,
the actuator would likely have exceeded its demonstrated life because the
licensee had not scheduled a replacement prior to the identification and
(1) the licensee was unable to verify that the valves would remain
operable based on the assessment of the conditions in the EPRI report;
or (2) to ensure qualification beyond the 40 years/2000 cycles, the
licensee (a) used a different approach because the original approach
resulted in unfavorable margin (where “unfavorable margin” means that
had the correct values been used originally, the licensee’s design process
would not have accepted the modification); or (b) revised assumptions
solely to obtain favorable results; or (c) revised other calculations in order
to establish operability or functionality; or (d) determined the remaining
margin falls outside the licensee’s design process acceptance criteria.
14. Security
Example 14.a The licensee revised their target set(s) by removing a common element
from multiple sets but failed to provide training to security personnel for
the changes.
The PD: The licensee failed to train security personnel on site specific target sets
as required by 10 CFR Part 73, Appendix B, requirements (Section VI,
C.2(c)(10)).
Minor if: Removal of the target set elements did not affect the defense-in-depth
approach used in the licensee’s strategy to protect against design basis
threats nor would it have reduced the assurance of protection.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the licensee’s protective strategy could deploy or potentially
redirect security personnel to protect the removed target set elements,
leaving other target set equipment unprotected. The defense in depth
approach and assurance of protection against design basis threats was
adversely affected.
Example 14.b The location(s) to disable target set equipment were not identified.
The PD: The licensee failed to document and maintain an adequate process to
develop and identify target sets, to include the site-specific analyses and
methodologies used to determine and group the target set equipment or
elements as required by 10 CFR Part 73.55(f)(1).
Minor if: The location missed was collocated with other target set locations already
considered.
MTM if: The inadequate process to identify target set element locations could lead
to a more significant safety concern. Specifically, if the licensee’s process
does not have guidance to identify alternate locations, as evident through
multiple identified examples, it could result in locations not being
adequately protected, impacting the physical protection program’s ability
to prevent significant core damage and/or spent fuel sabotage.
Example 14.c Target set elements were not identified.
The PD: (a) If the target set element is not currently protected by the protective
strategy:
The licensee failed to analyze and identify site-specific conditions,
including target sets, that may affect the specific measures needed to
implement the requirements of this section and account for these
conditions in the design of the physical protection program as required by
(b) If the target set element(s) is currently protected by the protective
strategy:
The licensee failed to document and maintain an adequate process to
develop and identify target sets, to include the site-specific analyses and
methodologies used to determine and group the target set equipment or
elements.
Minor if: (a) The element of a target set that was missed is currently being
protected by the protective strategy (i.e., by virtue of proximity to other
target set equipment) and the element is being appropriately considered
in the insider mitigation program (i.e., by virtue of proximity of other target
set equipment).
(b) The target set element was not a standalone target set and it was an
isolated incident.
MTM if: (a) The PD adversely affected the security cornerstone objective.
Specifically, the licensee’s target set process did not identify the target set
element, or a standalone target set, to inform the site’s physical protection
program, thereby compromising the protection of target set equipment.
The defense in depth approach and assurance of protection against
design basis threats was adversely affected.
(b) The inadequate process to identify target set elements could lead to a
more significant safety concern. Specifically, if the licensee’s process
does not have guidance to identify target set elements, as evident
through multiple identified examples, it could result in target set elements
not being adequately protected, impacting the physical protection
program’s ability to prevent significant core damage and/or spent fuel
sabotage.
Example 14.d Cyberattacks were not considered in the identification of target sets.
The PD: The licensee failed to consider cyberattacks in the development and
identification of target sets, as required by 10 CFR Part 73.55(f)(2).
Minor if: The licensee’s assessment showed that any identified critical digital
assets not already included in target sets are protected (i.e., by virtue of
proximity to other target set equipment already identified).
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the licensee’s process to identify and develop target sets did
not identify critical digital assets that would compromise the ability of a
target set element to perform its function of preventing significant core
damage or radiological sabotage. The defense in depth approach and
assurance of protection against design basis threats was adversely
affected.
Example 14.e Security personnel were not properly suited, trained, equipped, or
qualified to perform their assigned duties and responsibilities in
accordance with their Commission-approved training and qualification
plan.
The PD: The licensee failed to implement required training requirements for
security personnel in accordance with Part 73, Appendix App B
(section VI.A.2).
Minor if: Security personnel did not receive all the required training; however, they
did not work at a post that required the missed training.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, security personnel were not trained in accordance with
training requirements and performed duties associated with the missed
training.
Example 14.f Licensee did not perform testing of perimeter intrusion detection system
(IDS) using the most likely penetration methods as required by the
security plan.
The PD: The licensee failed to test and verify that security systems and equipment
remained capable of performing their intended security function as
required by 10 CFR 73.55(n)(i).
Minor if: The IDS zone was retested with the most likely penetration method, and it
detected in accordance with requirements.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the IDS zone failed to detect when using the most likely
penetration method.
Example 14.g Licensee failed to add critical personnel to the critical group. This resulted
in critical personnel not receiving periodic clinical interviews and
reinvestigations.
The PD: The licensee failed to ensure critical personnel would receive periodic
clinical interviews as part of their psychological reassessments and
periodic reinvestigations as required by 10 CFR 73.56.
Minor if: None of the affected personnel exceeded the critical group
reinvestigation/reassessment period.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, personnel exceeded the critical group
reinvestigation/reassessment period.
Example 14.h Licensee security personnel, in a ready room or staging area, do not have
all required contingency equipment readily available.
The PD: The licensee failed to ensure that all firearms, ammunition, and
equipment necessary to implement the site security plans and protective
strategy are in sufficient supply, are in working condition, and are readily
available for use as required by 10 CFR 73.55(k)(2).
Minor if: All responders were aware of the location of the equipment and would be
able to retrieve the necessary security equipment in-route to the response
position without exceeding the response timeline as described in the
licensee’s protective strategy.
Not minor if: The PD adversely affected the security cornerstone objective.
Specifically, the responders would not be able to retrieve the necessary
security equipment within the predetermined timeline and the time
difference between the responder timeline and the adversary timeline
precludes the ability to intercede (as determined by the training timelines
to open port, ready weapon, and engage).
Example 14.i Responder’s predetermined timelines were not analyzed or identified.
The PD: The licensee failed to analyze and identify site-specific conditions,
including target sets, that may affect the specific measures needed to
implement the requirements of 10 CFR 73.55 and account for these
conditions in the design of the physical protection program as required by
10 CFR 73.55(b)(4). 10 CFR 73.55(k)(4) requires measures to provide
armed response personnel consisting of armed responders which may be
augmented with armed security officers to carry out armed response
duties within predetermined timelines specified by the site protective
strategy.
Minor if: Upon identification, the licensee was able to demonstrate that the timeline
for the responder to arrive at their defense position would not have
exceeded the adversary timeline and provided adequate time to intercede
(as determined by the training timelines to open port, ready weapon, and
engage).
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the responder’s timeline could exceed the potential
adversary time or did not provide enough time to intercede.
Example 14.j The tactical weapons course of fire did not include all the elements
required by the Commission-approved training and qualification plan. For
example, the licensee did not require tactical reloading while conducting
specific maneuvers, and this was not included in the handgun or rifle
course of fire.
The PD: The licensee failed to conduct weapons training and qualification in
accordance with 10 CFR Part 73, Appendix B, requirements; the
licensee’s training and qualification plan; and associated implementing
procedures.
Minor if: The elements are contained in another course of fire used for qualification
and officers are trained at the same periodicity and proficiency standards
as the tactical weapons training course of fire.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, security personnel are not trained on all the elements
required by the Commission approved training and qualification plan.
Example 14.k Vehicle left unattended/unsecured inside the protected area (PA).
The PD: The licensee failed to exercise control over all vehicles inside the PA to
ensure that they are used only by authorized persons and for authorized
purposes as required by 10 CFR 73.55(g)(3)(i).
Minor if: The vehicle could not reasonably be assumed to have the capability and
opportunity to damage target set or vital equipment.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the vehicle was a large vehicle (i.e., larger than a standard
passenger car or truck that consumers might purchase at a dealership)
and could reasonably be assumed to have the capability and opportunity
to damage target set equipment.
Example 14.l Tours or observations associated with unattended openings or
compensatory measures are not being conducted at the frequency
required by the security plan, procedures, or analyses.
The PD: The licensee failed to conduct tours or observations at the frequency
required by their security plan.
Minor if: The frequency at which tours or observations were being conducted was
sufficient to prevent an adversary from exploiting a vulnerability even
though the frequency did not meet the requirement imposed by the site’s
security plan or procedures.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the frequency at which tours or observations were being
conducted was insufficient to prevent an adversary from exploiting a
vulnerability.
Example 14.m Training program did not simulate the specific conditions of the protective
strategy.
The PD: The training program fails to simulate, as closely as practicable, the
specific conditions under which the individual shall be required to perform
assigned duties and responsibilities as required by 10 CFR 73, Appendix
B, Section VI.A.5.
Minor if: The failure does not reasonably impact the implementation of the
protective strategy, or the training inadequacy has existed for less than 6
months.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the failure reasonably impacts the implementation of the
protective strategy and has existed for more than 6 months.
Example 14.n Vital area (VA) access was not limited to only those who need access.
The PD: The licensee fails to limit access to vital areas to only those individuals
who have a continued need for access to specific vital areas as
documented on their VA access list required by 10 CFR 73.56(j).
Minor if: The issue was an isolated human error that did not adversely affect the
security cornerstone objective.
MTM if: The PD adversely affected the security cornerstone objective.
Specifically, the failure provided VA access to populations of people that
did not actually need it or failed to distinguish access to specific vital
areas.
Example 14.o A document labeled as safeguards information was discovered in an
unsecured location.
The PD: The licensee failed to secure unattended safeguards information in a
locked security storage container in accordance with the requirements.
Minor if: A subsequent review of the document determined that it did not contain
safeguards information or that the information contained in the document
no longer needed to be protected as safeguards. Specifically, the
information was determined to be generic in nature or no longer reflects
the current configuration of the licensee’s physical protection program.
MTM if: The PD adversely affected the security cornerstone objective to provide
assurance that the licensee’s security program used a defense-in-depth
approach and could protect against the design basis threat of radiological
sabotage from external and internal threats. Specifically, a subsequent
review of the document confirmed the presence of current and accurate
safeguards information and the licensee’s failure to properly secure that
safeguards information increased the potential that physical protection
program information associated with the design basis threat common to
all power reactor licensees or associated with site specific considerations
could be compromised.
END
Attachment 1: Revision History for IMC 0612 Appendix E
Commitment
Tracking
Number
Accession
Number
Issue Date
Change Notice
Description of Change Description of
Training
Required and
Completion
Date
Comment Resolution and
Closed Feedback Forms
Accession Number (PreDecisional, Non-Public
Information)
N/A ML031610641
06/24/2003
CN 03-021
Initial issuance of Appendix E to IMC-0612 which
provided numerous new examples of minor
violations in Appendix E.
N/A N/A
N/A ML051400260
05/19/2005
CN 05-014
Appendix E was revised to add minor issue
examples pertaining to maintenance risk
assessments and risk management issues
resulting from baseline inspection procedure IP 71111.13, Maintenance Risk Assessments and
Emergent Work Evaluation. In addition, additional
clarifications have been made to the existing
maintenance rule minor issues examples.
N/A N/A
N/A ML052700276
09/30/2005
CN 05-028
Appendix E was revised to provide additional
examples of cross-cutting aspects and additional
examples of minor findings were added.
N/A N/A
N/A 02/10/2006 Revision history reviewed for the last four years. N/A N/A
N/A ML0607301310
6/22/06
CN 06-015
Appendix E was revised to remove discussion of
cross-cutting aspects of inspection findings. A new
appendix, Appendix F, was created to provide
examples of cross-cutting aspects of inspection
findings which reflected the work by the safety
culture working group.
Yes
07/01/2006
N/A
NA ML070720202
09/20/07
CN 07-029
Appendix E Section 4, Example k (fire loading) was
revised to provide more detail in aid of a minor
versus more-than-minor determination.
N/A ML071560246
N/A ML083040261
07/08/09
CN 09-017
Appendix E was revised to add Health Physics,
Thermal Power, Maintenance Rule, and Worker
Fatigue Examples.
N/A ML083040254
Issue Date: 10/26/23 Att1-2 0612 App E
Commitment
Tracking
Number
Accession
Number
Issue Date
Change Notice
Description of Change Description of
Training
Required and
Completion
Date
Comment Resolution and
Closed Feedback Forms
Accession Number (PreDecisional, Non-Public
Information)
NA ML092190386
08/11/09
CN 09-020
Appendix E, Section 6, Example e: was revised to
correct a logic error in the “Minor because”
paragraph. The example is minor only if both the
activity is indistinguishable from background, and
the dose to an individual was less than 1% of the
occupational or public dose limit.
N/A N/A
N/A ML18093B550
10/01/18
CN 18-033
Appendix E, Section 10 was added to provide
minor and more than minor examples for Cyber
Security Violations
N/A ML18093B551
ML19247C385
12/23/19
CN 19-042
Appendix E went through a major revision to
address feedback forms, OIG 16-A-21
recommendation 2, and Browns Ferry Lessons
Learned Recommendation 13. The examples were
revised to mirror the language in the more-thanminor screening questions in IMC 0612 Appendix B
to illustrate when the examples in Appendix E were
more than minor.
New examples were added in the areas of physical
security, worker fatigue, service life, Part 37 and
external events.
FBF 0612E-1379
FBF 0612E-1431
FBF 0612E-1470
FBF 0612E-1473
FBF 0612E-1546
FBF 0612E-1582
FBF 0612E-1613
Issue Date: 10/26/23 Att1-3 0612 App E
Commitment
Tracking
Number
Accession
Number
Issue Date
Change Notice
Description of Change Description of
Training
Required and
Completion
Date
Comment Resolution and
Closed Feedback Forms
Accession Number (PreDecisional, Non-Public
Information)
FBF 0612E-1615
FBF 0612E-1644
FBF 0612E-1687
FBF 0612E-1695
FBF 0612E-1705
FBF 0612E-1784
FBF 0612E-1789
FBF 0612E-1913
FBF 0612E-1931
FBF 0612E-2036
FBF 0612E-2037
FBF 0612E-2139
FBF 0612E-2140
FBF 0612E-2150
FBF 0612E-2195
FBF 0612E-2213
FBF 0612E-2252
Issue Date: 10/26/23 Att1-4 0612 App E
Commitment
Tracking
Number
Accession
Number
Issue Date
Change Notice
Description of Change Description of
Training
Required and
Completion
Date
Comment Resolution and
Closed Feedback Forms
Accession Number (PreDecisional, Non-Public
Information)
12/10/20
CN 20-070
Incorporated recommendations from two feedback
forms. Removed the abc and xyz in the PDs from the
last revision. Removed the programmatic issue
reference in example 10.b. Revised example 13.a.
Added examples for POV, fire protection, service life
and security. Improved the consistency of the MTM if
statements.
FBF 0612E-1526
FBF 0612E-1723
ML23214A343
10/26/23
CN 23-031
Updated section 11 minor examples for cybersecurity.
Example 11.a was changed to address a violation
relating to security control application because of
incorrect classification of a CDA. New minor examples
were added in the areas of baseline configurations,
ongoing monitoring and assessment, removal of
unnecessary services and programs, physical access
control, and vulnerability management. See
ML23227A094 for regional working group comment
resolution. Clarified note regarding example 5.c.
N/A