IR 05000458/2016009

NRC Special Inspection Report 05000458/2016009

ML16133A174
Person / Time
Site:	River Bend
Issue date:	05/12/2016
From:	Cale Young NRC/RGN-IV/DRP/RPB-C
To:	Maguire W Entergy Operations
Warnick G
References
IR 2016009
Download: ML16133A174 (54)

Text

May 12, 2016

SUBJECT:

RIVER BEND STATION - NRC SPECIAL INSPECTION REPORT 05000458/2016009

Dear Mr. Maguire:

On February 4, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of the circumstances surrounding an unplanned reactor trip and subsequent loss of shutdown cooling, which occurred on January 10, 2016, at the River Bend Station. Based upon the risk and deterministic criteria specified in NRC Management Directive 8.3, NRC Incident Investigation Program, the NRC initiated a special inspection in accordance with Inspection Procedure 93812, Special Inspection. The basis for initiating the special inspection and the focus areas for review are detailed in the Special Inspection Charter (Attachment 2 of the enclosed inspection report). Based on this initial assessment, the NRC sent an inspection team to your site on February 8, 2016.

On April 14, 2016, the NRC completed its special inspection and discussed the results of this inspection with Mr. M. Chase, Director, Regulatory Assurance and Performance Improvement, and other members of your staff. The inspection team documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented four findings of very low safety significance (Green) in this report.

All of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the NRC Enforcement Policy.

If you contest the violations or significance of these non-cited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the River Bend Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the River Bend Station. In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Gregory G. Warnick, Chief Project Branch C Division of Reactor Projects

Docket Nos.: 50-458 License Nos.: NPF-47

Enclosure:

Inspection Report 05000458/2015009

w/ Attachments:

Supplemental Information Special Inspection Charter

REGION IV==

Docket:

05000458 License:

NPF-47 Report:

05000458/2016009 Licensee:

Entergy Operations, Inc.

Facility:

River Bend Station, Unit 1 Location:

5485 U.S. Highway 61N St. Francisville, LA 70775 Dates:

February 8 through April 14, 2016 Inspectors:

M. Bloodgood, Operations Engineer C. Cowdrey, Operations Engineer R. Deese, Senior Reactor Analyst S. Makor, Acting Senior Resident Inspector B. Parks, Acting Resident Inspector Approved By:

Gregory G. Warnick, Chief Project Branch C Division of Reactor Projects

-2-

SUMMARY OF FINDINGS

IR 05000458/2016009; 02/08/2016 - 04/14/2016; River Bend Station; Special inspection for the loss of shutdown cooling on January 10, 2016.

The inspection activities described in this report were performed between February 8 and April 14, 2016, by inspectors from the NRCs Region IV office. Four findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (Green,

White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609,

Significance Determination Process. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Initiating Events

Green.

The team reviewed a self-revealing, non-cited violation of Technical Specification 5.4, Procedures, for the licensees failure to correctly implement Procedure SOP-0031,

Residual Heat Removal System, Revision 326. SOP-0031, Attachment 5, Step 5.4.1, required that a retractable sheathed banana jumper be used when bypassing the 135-psi SDC isolation. Instead, the licensee used a standard banana jumper, which resulted in a short circuit and inadvertent closure of Valves E12MOV-F008, Shutdown Cooling Suction Valve, and E12MOV-F053A, Shutdown Cooling Injection Valve. This caused a loss of decay heat removal. This issue was entered into the licensees corrective action program as Condition Report CR-RBS-2016-0210. Corrective actions included revising Procedure SOP-0031 to include actions to de-energize the applicable valves while bypassing the 135-psi shutdown cooling isolation.

The failure to use the correct jumpers as specified in Procedure SOP-0031 was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the human performance attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the shorting of contacts resulting from the use of incorrect jumpers caused a loss of shutdown cooling and decay heat removal. The team evaluated the finding using NRC Inspection Manual Chapter 0609, Appendix G, Attachment 1, Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings. When applying Exhibit 2 - Initiating Events Screening Questions, the team determined the loss of residual heat removal event did not occur when the refuel cavity was flooded, and therefore it required a risk evaluation using the Appendix G, Attachment 3, Phase 2 Significance Determination Process Template for Boiling Water Reactors during Shutdown. The analyst determined that a modified but still conservative Phase 2 quantitative estimate in combination with qualitative and deterministic insights led to a final conclusion that the finding was of very low safety significance (Green).

The finding has a field presence cross-cutting aspect within the human performance area because the licensee failed to promptly correct deviations from standards and expectations.

Specifically, the licensee failed to correct deviations from standards and expectations during the performance of the pre-job brief and ensure proper communication and oversight is maintained in the control room during risk significant evolutions [H.2]. (Section 2.11.a)

Green.

The team reviewed a self-revealing, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to establish measures to assure that corrective action is taken to preclude repetition of a significant condition adverse to quality. Specifically, following a November 27, 2015, reactor scram, the licensee failed to implement corrective actions associated with the alternate power lineup of the reactor protection system buses to preclude repetition of a significant condition adverse to quality during the January 9, 2016, reactor scram. This issue was entered into the licensees corrective action program as Condition Report CR-RBS-2016-0180. Corrective actions included supplying reactor protection system bus A from the normal power source on January 12, 2016.

The failure to assure corrective actions are promptly taken for a significant condition adverse to quality to preclude repetition of a reactor scram associated with both buses being affected by a switchyard voltage transient was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the human performance attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensees failed to implement corrective actions to address grid instabilities following the November 27, 2015, reactor scram to preclude the January 9, 2016, reactor scram. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, the team determined that this finding is of very low safety significance (Green) because it did not involve the loss of mitigation equipment or a support system.

This finding has an evaluation cross-cutting aspect within the problem identification and resolution area because the licensee failed to thoroughly evaluate the cause of the November 27, 2015, reactor scram and ensure that the resolution addresses causes and extent of conditions commensurate with their safety significance [P.2]. (Section 2.11.c)

Green.

The team identified a non-cited violation of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, for the licensees failure to adequately assess the increase in risk that may result from proposed maintenance activities. Specifically, the team identified that since 2012, the licensee failed to adequately assess the risk of simultaneously powering both reactor protection system buses from the alternate power sources, which resulted in an increased risk of a reactor scram due to grid instabilities. This issue was entered into the licensees corrective action program as Condition Report CR-RBS-2016-3176. Corrective actions included revising Procedure SOP-0079, Reactor Protection System, to include precautions to address the increased risk associated with supplying both reactor protection system buses from the alternate power source.

The team determined that the licensees failure to adequately assess the increase in risk associated with simultaneously powering both reactor protection system buses from the alternate power sources was a performance deficiency. The performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the performance deficiency resulted in an increased risk of a reactor scram due to grid instabilities. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 1, Initiating Events Screening Questions, a detailed risk evaluation was required since the finding resulted in a reactor scram and main steam isolation valve closure. The finding was evaluated using Inspection Manual Chapter 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process, Flowchart 1, Assessment of Risk Deficit, dated May 19, 2005, to assess the significance of the finding. A senior reactor analyst estimated the incremental core damage probability deficit to be 2.0E-7 and the incremental large early release probability deficit to be 4.0E-8. Since this incremental core damage probability deficit was less than 1E-6 and the incremental large early release probability deficit was less than 1E-7, the analyst used Flowchart 1 to determine the finding was of very low safety significance (Green).

This finding has a conservative bias cross-cutting aspect within human performance area because the licensee determined that powering both reactor protection system buses from the alternate source instead of the motor generator sets was safe even though the motor generator sets are the preferred source and provide protection against grid perturbations

[H.14]. (Section 2.11.d)

Cornerstone: Mitigating Systems

Green.

The team reviewed a self-revealing, non-cited violation of Technical Specification 5.4, Procedures, for three examples of the licensees failure to establish sufficient procedural guidance. Specifically, the licensees operations and radiation protection procedures did not provide sufficient direction to plant personnel to expeditiously establish a reactor vessel vent path, restore from a loss of shutdown cooling, and perform time sensitive entries into radiologically controlled areas. This issue was entered into the licensees corrective action program as Condition Reports CR-RBS-2016-0210, CR-RBS-2016-0370, and CR-HQN-2016-0132. Corrective actions included revising the applicable procedures.

The failure to establish adequate procedural guidance in accordance with Regulatory Guide 1.33 was a performance deficiency. Specifically, Procedures GOP-0002, Power Decrease/Plant Shutdown, Revision 72, and AOP-0051, Loss of Decay Heat Removal,

Revision 313, failed to provide adequate direction to operations personnel to expeditiously establish a reactor vessel vent path and recover shutdown cooling following an isolation.

Additionally, Procedure EN-RP-101, Access Control for Radiologically Controlled Areas,

Revision 11, failed to provide adequate guidance to perform time sensitive entries into radiologically controlled areas. This performance deficiency is more than minor, and therefore a finding, because it is associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to ensure that adequate procedural direction was provided to operations personnel following a loss of shutdown cooling. This resulted in a delay in the restoration of shutdown cooling and plant heatup.

The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix G, Shutdown Operations Significance Determination Process. Using Inspection Manual Chapter 0609, Appendix G, Attachment 1, Exhibit 3,

Mitigating Systems Screening Questions, the team determined that the finding is of very low safety significance (Green) because it: (1) affected the design or qualification of a mitigating structure, system, or component, and (2) the structure, system, or component maintained its operability and functionality. A cross-cutting aspect is not being assigned to this finding due to the timing of the performance deficiency not being indicative of current licensee performance. (Section 2.11.b)

REPORT DETAILS

Basis for Special Inspection On January 9, 2016, at 2050, the plant entered Mode 4 following an automatic reactor scram that had occurred at 0237. On January 10, 2016, at 0247, the plant was operating in Mode 4 with reactor coolant system temperature at 128°F and residual heat removal (RHR) system train A in service in shutdown cooling (SDC) mode. In accordance with the licensees standard operating procedure for the RHR system when the unit is in Mode 4 or 5, the licensee was performing an activity to install a jumper to bypass the 135-psi SDC isolation function, which serves to protect the RHR system from an overpressure condition while in service. During the jumper installation, due to human performance errors, a fuse blew which caused the repositioning of several components in the system. This included inadvertent closure of the RHR SDC outboard suction isolation valve (Valve E12MOV-F008) and the RHR pump A SDC injection valve (Valve E12MOV-F053A). RHR pump A tripped on an anticipatory low suction pressure, as expected. This sequence of events resulted in a loss of SDC.

The licensee initiated actions to restore SDC by reopening Valves E12MOV-F008 and E12MOV-F053A by local manual operation. Operations personnel started RHR pump A and completed the RHR system alignment for the SDC mode of operation. The RHR system was restored to operation in the SDC mode on January 10, 2016, at 0401 (a total of 74 minutes after the loss occurred). Reactor coolant temperature increased from 128°F to 196.7°F during the loss of SDC. Initial follow-up by the resident inspectors determined that a vent path to atmosphere from the reactor vessel was not established at the time of the event. A vent path was subsequently established at 0001 on January 11, 2016.

Management Directive (MD) 8.3, NRC Incident Investigation Program, was used to evaluate the level of NRC response for this event. In evaluating the deterministic criteria of MD 8.3, NRC staff determined that the event included a loss of the RHR systems ability to operate in the SDC mode to remove decay heat from the reactor due to a fault that affected the condition of multiple system valves. Additionally, NRC staff identified concerns pertaining to licensee operational performance both leading up to and in response to the event. Specifically, operations personnel failed to use the most up-to-date procedural guidance and used incorrect test leads while installing a jumper to remove the automatic overpressure protection for the RHR system, which led to an electrical fault that caused a loss of system function. Additionally, operations personnel considered both RHR SDC subsystems as remaining operable to meet technical specifications throughout the event, and reactor coolant system temperature increased to the point where the plant was within a few degrees of making an inadvertent mode change to Mode 3. The preliminary Estimated Conditional Core Damage Probability was determined to be 7E-6.

Based on the deterministic criteria and risk insights related to the loss of SDC, Region IV management determined that the appropriate level of NRC response was to conduct a special inspection.

This special inspection was chartered to identify the circumstances surrounding this event and review the licensees actions to address the causes of the event. An additional charter item was included to review plant and operator response to the reactor scram that preceded the event.

The team used NRC Inspection Procedure 93812, Special Inspection, to conduct the inspection. The inspections included field walkdowns of equipment, interviews with station personnel, and reviews of procedures, corrective action documents, and design documentation. A list of documents reviewed is provided in Attachment 1 of this report; the Special Inspection Charter is included as Attachment 2.

Inspection Results

2.1 Charter Item 2: Develop a complete sequence of events related to the loss of SDC event on January 10, 2016. The chronology should include plant cooldown and transition to SDC, the events leading to the loss of SDC, and the licensees actions to restore SDC.

a. Inspection Scope

The team developed and evaluated a timeline of the events related to the loss of SDC event on January 10, 2016. This included plant cooldown and transition to SDC, the events leading to the loss of SDC, and the licensees actions to restore SDC. The team developed the timeline, in part, through a review of corrective action documents, station logs, post event statements and interviews with station personnel.

b. Findings and Observations

The team created the following timeline during their review of the events related to the loss of SDC that occurred on January 10, 2016.

Date/Time Activity January 9, 2016 0237 Reactor scram due to fault in the Fancy Point switchyard resulting in a degraded voltage on both reactor protection system (RPS)buses.

0527 Entered General Operating Procedure (GOP), GOP-0002, Power Decrease/Plant Shutdown, Revision 72.

1937 Placed E12-PC002A, RHR pump A, in the SDC mode of operation. Reactor coolant temperature is 311 degrees F.

Cooldown rate set at less than 85 degrees per hour. Reactor coolant temperature band is 200-300 degrees F.

2050 The licensee entered Mode 4.

January 10, 2016 0148 Feed Pump Level 8 jumpers removed per GOP-0002.

0243 Commenced installation of the jumper for bypassing the 135-psi SDC isolation as directed per the SDC protection plan.

Inadvertent closure of Valves E12MOV-F008 and E12MOV-F053A due to an electrical short during jumper installation. Received Division I and 4 Nuclear Steam Supply Shutoff System isolation and RHR Pump A Discharge Pressure HI/Low alarms.

Entered Abnormal Operating Procedure AOP-0051, Loss of Decay Heat Removal, Revision 313. Both recirculation pumps are running in slow speed to provide for adequate coolant circulation. Reactor water Level is greater than the minimum for natural circulation. Reactor coolant system (RCS) temperature rises at approximately 1°F per minute.

0250 Operator dispatched to manually open Valve E12MOV-F008.

Radiation protection (RP) support required for entry.

0252 Opened breaker for Valve E12MOV-F008.

0315 The RHR Pump A Discharge Pressure HI/Low alarm cleared.

0319 Completed fill and vent of RHR loop A. RHR A pressure indicates 40 psig. The licensee did not observe any air during the venting.

0326 Licensee discussed restoration of RHR A instead of shifting to RHR B after opening Valve E12MOV-F008. The licensee determined that the most effective method to restore SDC would be to re-start RHR pump A and manually open Valve E12MOV-F053A.

0329 The breaker is open for Valve E12MOV-F053A.

0334 The control room received a report that operations personnel entered the main steam tunnel to open Valve E12MOV-F008.

0340 RHR pump A is ready to start.

0351 Valve E12MOV-F008 is open.

0352 Commenced manually opening Valve E12MOV-F053A.

0401 Started RHR pump A with Valve E12MOV-F053A at 20 percent open. Reactor coolant temperature is 196.7 F.

0402 Reactor coolant temperature is observed lowering.

0412 The licensee exited Procedure AOP-0051. Reactor coolant temperature is 175.8 F and lowering.

0424 Valve E12MOV-F053A is fully open.

The inadvertent closure of the Valves E12MOV-F008 and E12MOV-F053A due to an electrical short during jumper installation is further discussed in Sections 2.3 and 2.11.a of this report.

The team determined that the licensee failed to provide adequate procedural guidance to operations personnel during the plant shutdown and following the loss of shutdown cooling which delayed the restoration of shutdown cooling. This is further discussed in Sections 2.7 and 2.11.b of this report.

2.2 Charter Items 3: Review the licensees root cause analysis and determine if it is being conducted at a level of detail commensurate with the significance of the problem.

a. Inspection Scope

The team reviewed the licensees root cause evaluations for the January 9, 2016, reactor scram and January 10, 2016, loss of SDC. The team reviewed corrective action procedures, met with members of the root cause team, and reviewed corrective actions associated with prior related events:

1. Reactor scram due to voltage drops resulting from an off-site phase to phase

ground in November 2015. (CR-RBS-2015-8463)

2. Loss of SDC due to an electrical short during installation of 135-psi SDC isolation

jumpers in 1994. (CR-RBS-1994-0830)

The procedures reviewed by the team included quality related Procedure EN-LI-118, Cause Evaluation Process, Revision 22, and quality related Procedure EN-LI-102, Corrective Action Program, Revision 25.

b. Findings and Observations

The team determined that the significance level of both events required a root cause evaluation. The licensee performed the root cause evaluations to the appropriate level commensurate with the significance of the problem and in accordance with Procedure EN-LI-118.

1. Root Cause Evaluation for January 9, 2016, Reactor Scram

The team reviewed the root cause evaluation, documented in Condition Report CR-RBS-2016-0180, for the January 9, 2016, reactor scram. In addition, the team reviewed the root cause evaluation, documented in Condition Report CR-RBS-2015-8463, for the November 27, 2015, reactor scram.

Following the November 2015 reactor scram, the licensee developed the following problem statement and presented it to the Condition Review Group (CRG) on December 8, 2015.

At 04:35 on 11/27/15 while at 100 percent power, a fault occurred on Fancy Point switchyard breaker YWC-OCB20620, resulting in a loss of RSS#1 and a reactor scram.

The licensee determined that the following interim action would address the cause of the loss of Reserve Station Service (RSS) #1 and a reactor scram.

Breaker YWC-OCB20620 has been removed from service and both RSS lines were returned to service. YWC-OCB20620 is being replaced to restore full functionality to Fancy Point. No other breaker of the type that faulted are installed at Fancy Point.

The root cause evaluation for the November 27, 2015, reactor scram (CR-RBS-2015-8463) reviewed the causes associated with having both RPS buses powered from the alternate power source (480/120 VAC regulating transformer)instead of the normal power source (Motor-Generator (MG) sets). During the performance of the root cause evaluation, the licensee identified that both RPS buses were powered from the alternate source instead of the normal source at the time of the scram. The licensee revised the problem statement and presented it to the CRG on December 22, 2015. The revision to the statement stated:

At 04:35 on 11/27/15 while at 100 percent power with both Reactor Protection System (RPS) buses supplied by the alternate source, a fault occurred in the Fancy Point switchyard, resulting in a loss of RSS#1 and a reactor scram.

During the December 22, 2015, CRG meeting, the licensee identified interim action associated with the Electrical Protection Assembly (EPA) breakers supplying the RPS buses from the alternate supply. System Design Criteria SDC-508, Reactor Protection System Design Criteria, Revision 2, states that the EPA breakers provide protection to prevent damage to the RPS safety related components from voltage and frequency anomalies. The EPA breakers disconnect the RPS buses from the power sources when voltage and/or frequency anomalies occur.

The team determined that the interim actions did not address the cause of the reactor scram due to degraded RPS bus voltage as a result of the fault in the Fancy Point switchyard. Specifically, the focus on the EPA breakers did not address the vulnerability of short duration grid disturbances resulting in a reactor scram. The licensee maintained both RPS buses powered from the alternate supply until the scram on January 9, 2016.

The licensees root cause evaluation (CR-RBS-2016-0180) for the January 9, 2016, reactor scram focused on determining why the licensee did not take sufficient action to prevent the January 9, 2016, reactor scram following the November 27, 2015, reactor scram. The licensee determined the root cause of the failure to take sufficient actions following the November 27, 2015, trip as:

..the management team was conditioned by the previous event when making the critical decision without understanding all options to mitigate the risk.

The team reviewed the licensees determination that the above root cause led to a subsequent scram event by allowing for plant restart after the November 27, 2015, scram in the same configuration that made the plant vulnerable to grid disturbances and by not establishing immediate/interim actions to preclude recurrence of the event pending completion of the evaluation.

The licensees root cause evaluation included a review of Procedure EN-FAP-LI-001, Condition Review Group, Revision 5, to determine what guidance is provided for development and review of interim actions. Section 3.3, CRG Preparation Process states, Site Condition Reports initiated since the CRG agenda was posted will be reviewed at CRG for potential immediate actions. Examples of Condition Reports that require immediate action are an un-safe condition or other adverse condition that challenges the sites operational performance or a human safety issue that could cause injury.

The licensees analysis did not identify any other discussion in Procedure EN-FAP-LI-001 of responsibilities or expectations for creating or for CRG approving the interim actions. The licensee developed a corrective action to enhance two procedures. The corrective action recommended changing Procedure EN-FAP-LI-001 to establish a more structured process to identify and evaluate if interim actions specifically manage risk during the evaluation of an issue. A revision to Procedure EN-OM-119, On-Site Safety Review Committee, Revision 12, established a more structured process to evaluate risk when making critical decisions.

The team reviewed the licensees procedures and identified guidance in Procedure EN-LI-102, Section 5.4[6], which states that the CRG has the following responsibility:

(h) Assigns any immediate or interim actions that may be required to minimize the consequences of a condition and/or to determine extent of condition.

The team concluded that procedural guidance existed that described CRG responsibilities related to the assigning of interim actions.

The team reviewed the licensees corrective actions (CR-RBS-2015-8463) in response to the alignment of RPS bus power supplies during the November 27, 2015, and January 9, 2016, events. The licensee identified the following corrective actions:

• Restored RPS A bus to the normal supply on January 12, 2016.

• Restored RPS B bus to the normal supply on January 17, 2016.

• Revise Procedure SOP-0079, Reactor Protection System, Revision 33, to address the precautions and limitations associated with powering both RPS buses from the alternate power supply.

The team determined that the corrective actions associated with restoring the RPS buses to the normal power supply are reasonable to address the vulnerability of grid disturbances resulting in a reactor scram. Additionally, the January 9, 2016, reactor scram would have been prevented if the corrective actions had been implemented following the previous (November 2015) reactor scram.

The team reviewed corrective actions identified by the licensee to revise Procedure SOP-0079 and concluded that a precaution associated with powering both RPS buses from the alternate power supply was already included in the procedure prior to these scram events. Section 2.8 of the procedure stated:

With the reactor online, the preferred power source for the RPS buses is the Motor Generator Sets due to the superior protection from unintended actuations caused by voltage transients. While not the preferred lineup, simultaneously supplying both RPS buses from the alternate sources is allowed if required by emergent plant conditions.

The team reviewed the procedures revision history and determined that this precaution resulted from a corrective action in a condition report from 2012 (CR-RBS-2012-0949). The team did not identify any precautions or limitations in Procedure SOP-0079 of the risk associated with the alignment of both RPS buses to the alternate sources.

Further discussion of performance deficiencies related to the corrective actions following the November 27, 2015, reactor scram and risk associated with supplying both RPS buses from the alternate power source are documented in Sections 2.11.c and d of this report.

2. Root Cause Evaluation for January 10, 2016, Loss of SDC

The team reviewed the Root Cause Evaluation, documented in Condition Report CR-RBS-2016-00210, for the January 10, 2016, loss of SDC event. In addition, the team reviewed Condition Report CR-RBS-1994-0830 for a similar 1994 loss of SDC event.

The root cause evaluation identified two root causes and two contributing causes for the January 10, 2016, loss of SDC event.

The licensee identified the following root causes:

• The failure to sustain corrective actions to prevent reoccurrence from a 1994 loss of SDC event.

• The failure to use the correct type of jumper resulting in creation of an unintentional path to ground during the installation of a jumper to bypass the RHR A 135-psi SDC isolation signal.

The licensee, as part of the corrective actions for the root causes, revised Procedure SOP-0031, Residual Heat Removal System, to include requirements to open the breakers for Valves E12MOV-F008, E12MOV-F009, E12MOV-F053A and E12MOV-F053B during the installation and removal of the jumpers for bypassing the 135-psi SDC isolation. This corrective action matched a previous corrective action for a procedure revision that had been implemented following a loss of SDC event in 1994. This previous procedure revision was subsequently replaced in 2001 with a procedural requirement for the use of retractable sheath jumpers. This is further discussed in Section 2.8.b.1. of this report.

The licensee identified the following contributing causes:

• The breakdown of operator standards, specifically, procedural use and adherence and supervisory oversight.

• The failure to internalize significant operating experience.

The licensee, as part of the corrective actions for the contributing causes, established expectations for 100 percent Senior Reactor Operator observation of all manipulations in the control room. The team determined that this corrective action originally existed as part of the River Bend Recovery Plan LO-RLO-2015-00157, September 2015 Revision. The action associated with Corrective Action 98 required that all manipulations performed in the main control room will be observed. Corrective Action 240 of the recovery plan required that this observation strategy be re-evaluated after 30 days for effectiveness and evaluated for adjustment. Following this re-evaluation, the licensee incorporated the resulting actions into Standing Order 308, Operations Leadership, Revision 5, which stated that main control room manipulations will be observed based upon risk significance as prescribed by the Shift Manager. The inclusion of the actions into Standing Order 308 closed Corrective Action 240 of the site recovery plan. The team determined that this action failed to ensure adequate oversight during the pre-job brief and installation of the 135-psi SDC isolation jumpers.

This corrective action is further discussed in Section 2.6 of this report.

2.3 Charter Item 4: Determine the causes for the unexpected loss of SDC that was experienced during installation of a jumper to bypass the 135-psi SDC isolation function.

a. Inspection Scope

The team conducted interviews with operations personnel and an Assistant Operations Manager on shift during the loss of SDC event. Additionally, the team reviewed operating procedures, administrative procedures, condition reports, post event statements, and the root cause evaluation associated with the loss of SDC, as well as plant conditions that contributed to the event.

b. Findings and Observations

The team reviewed the events associated with the unexpected loss of SDC that occurred while bypassing the 135-psi SDC isolation for the RHR A system in accordance with Procedure SOP-0031, Attachment 5. On January 10, 2016, at 0243, the plant experienced a loss of SDC due to the closure of Valves E12MOV-F008 and E12MOV-F053A. The closure resulted from an electrical short that was inadvertently introduced during the installation of a jumper to bypass the 135-psi SDC isolation for Valve E12MOV-F008.

The team identified that the licensee performed a pre-job brief at approximately 1849 on January 9, 2016, with the operating crew, with the exception of the Control Room Supervisor, for the installation of the protection plan for SDC per Procedure SOP-0031. The licensee conducted a brief using the pre-job checklist from Procedure EN-HU-102, Human performance Traps and Tools, Attachment 9.5, Low Risk, Revision 14. This checklist is used for briefings of low risk consistent with an online level of risk vice a shutdown level of risk. The licensee determined that the risk for the evolution should have been identified as a high level due to the scope of the activity. This would have required more operator oversight during the activity and potentially identified the use of the improper jumper.

Procedure OSP-0022, Operations General Administrative Guidelines, Revision 86, Section 4.4, states that, The individual who is performing the activity is responsible to adequately review the procedure, to fully understand what he/she is doing, and to be cognizant of all limitations, precautions and requirements. Operations personnel installing the jumper conducted the brief with supervisor oversight by the Field Supervisor and managerial oversight by an Assistant Operations Manager. During the brief, operations personnel discussed the potential for an engineered safety feature actuation because the circuit is energized but did not discuss any past relevant operating experience related to bypassing the 135-psi SDC isolations.

Procedure SOP-0031, Attachment 5, references Licensee Event Report (LER) LER-94-0018, Loss of Shutdown Cooling Due to Inadvertently Dropped Lead. The team identified during interviews that operations personnel involved in the activity did not know about this LER, which described the same loss of SDC event in 1994, until after the January 2016 event. The team concluded that the licensee missed an opportunity to identify potential impacts of performing the jumper installation.

Procedure SOP-0031, Attachment 5, required that a retractable sheath banana jumper be used to bypass the 135-psi SDC isolation. The team identified during interviews that operations personnel were not familiar with a retractable sheath banana jumper and used a standard banana jumper for the procedure. Operations personnel stated that a standard banana jumper has been used previously to perform this evolution. The standard banana jumper allowed for the inadvertent shorting of the contacts during the installation of the jumper. During the review of the 1994 loss of SDC event, the team identified that corrective actions to prevent recurrence initially included implementing a procedure revision to require that the circuit be de-energized during installation of the jumpers. The licensee subsequently changed this procedural guidance to require the use of the retractable sheath banana jumpers instead of de-energizing the circuit. These past corrective actions are further discussed in Section 2.8 of this report.

Lack of communication and command and control contributed to the loss of SDC event. The classification of the risk of the jumper installation activity as low instead of high did not emphasize the appropriate oversight requirements for this evolution.

Additionally, during interviews the team identified that operations personnel failed to effectively communicate the installation of the jumper for the 135-psi SDC isolation.

Operations personnel stated that they reported installing jumpers to the Control Room Supervisor, who did not attend the initial brief, and who acknowledged understand jumpers. The Control Room Supervisor stated that he thought the jumpers meant the feed system level 8 jumpers, which the logs identified as being removed at 0148. Standing Order 308, Revision 10, states, in part, that all main control room manipulations will be observed based on risk significance as prescribed by the Shift Manager, and that command and control must always be maintained.

The Field Supervisor, Shift Manager, and Assistant Operations Manager, present during the pre-job brief, provided oversight outside the main control room for other operations during the installation of the jumpers. The poor communication resulted in failing to notify the Shift Manager and the Assistant Operations Manager of the 135-psi SDC isolation jumper installation.

Further discussion of the performance deficiencies associated with the failure to use the correct jumper is documented in Section 2.11.a of this report.

2.4 Charter Item 5: Evaluate the licensees actions with regard to technical specification limiting conditions for operation applicability and reportability for the loss of SDC event.

a. Inspection Scope

The inspection team conducted interviews with operations personnel and an Assistant Operations Manager on shift during the loss of SDC. Additionally, the team reviewed control room logs, condition reports, and the licensees operability determination contained in Condition Report CR-RBS-2016-00210. The team reviewed multiple trends for reactor coolant temperatures to establish whether the plant had changed operating modes. The team reviewed the plants technical specifications (TS) and bases; NRC Inspection Manual Chapter 0326, Operability Determinations & Functionality Assessments for Conditions Adverse to Quality or Safety, dated December 3, 2015; and NUREG-1022, Event Reporting Guidelines:

10 CFR 50.72 and 50.73, Revision 3, to determine the appropriateness of the licensees decision to maintain a determination of operable for the RHR A and B SDC subsystems and the reactor vessel level low containment isolation instrumentation throughout the event. Further, the team assessed the licensees decision to not report the event per 10 CFR 50.72.

b. Findings and Observations

The team reviewed the licensees technical specifications related to the January 10, 2016, loss of SDC event. At the time of the event, the licensee was in Mode 4 with both recirculation pumps operating in slow speed. The inadvertent isolation resulted in a trip of RHR pump A due to interlocks associated with Valve E12MOV-F008.

This resulted in a loss of SDC for the plant.

Technical Specification 3.4.10, Residual Heat Removal Shutdown Cooling System - Cold Shutdown, requires that two RHR SDC subsystems shall be operable, and, with no recirculation pump in operation, at least one RHR shutdown cooling subsystem shall be in operation. The licensees technical specification basis for TS 3.4.10 identifies an operable SDC subsystem as one operable RHR pump, two heat exchangers in series and the associated piping and valves. Each SDC subsystem is considered operable if it can be manually aligned (remotely or locally) in the SDC mode for removal of decay heat. The team determined that the operating crew had sufficient evidence to determine that an electrical fault concurrent with the failed jumper installation resulted in the RHR A SDC loop isolation. The crew received isolation actuation indications and a concurrent report of a flash in the cabinet during the attempted jumper installation. The crew immediately suspected a blown fuse and asked the available Instrumentation and Controls technicians to investigate.

Therefore, the inspection team determined that, at the time of the system isolation, the operating crew had a reasonable expectation that the RHR SDC valves had closed on an electrical isolation signal and could still be operated manually in the field.

An RHR A loop low discharge pressure alarm came in due to the RHR pump A trip.

Following the alarm, operations personnel verified that RHR loop A remained filled and vented in accordance with the alarm response procedure. The licensee did not observe any air from the system during the venting, which confirmed that the system remained full. Additionally, the licensee performed a visual inspection on the RHR pump A breaker and determined that no abnormal conditions existed. Therefore, the team concluded that the RHR pump A could be started and be able to perform the SDC function.

Throughout the event, the licensee remained in compliance with TS for all other modes of RHR operation required in Mode 4. The inspection team determined that the licensees technical specifications and bases supported a determination that RHR A and B SDC subsystems remained operable.

Per TS 3.3.6.1, Primary Containment and Drywell Isolation Instrumentation, Mode 4 operations require two operable reactor vessel level low channels, both of which input into the same trip system. Additionally, one of the isolation valves (E12MOV-F008 or E12MOV-F009) must be operable and capable of receiving an isolation signal from the operable trip system. The team reviewed the licensees operability assessment and determined that the Division 2 instrument channels were operable and capable of sending an isolation signal to Valve E12MOV-F009, thereby meeting the TS 3.3.6.1 requirements.

The inspection team reviewed 10 CFR 50.72 and NUREG-1022, Event Reporting Guidelines: 10 CFR 50.72 and 50.73, to assess reportability for the event. The isolation did not meet the description of a valid system actuation as defined by NUREG-1022, and therefore did not meet the reportability requirements of 10 CFR 50.72(b)(3)(iv). Additionally, the team determined that the RHR SDC function remained operable and RHR Low Pressure Core Injection mode remained available to support the RHR safety function; therefore, the reportability requirements of 10 CFR 50.72(b)(3)(v) were not met. Finally, the team verified, by review of the Recirculation Suction Temperature from Surveillance Test Procedure STP-050-0700, RCS Pressure/Temperature Limits Verification, Revision 306, Data Sheet 1, RCS/Reactor Pressure Vessel Heat-up/Cooldown Rate, and RHR heat exchanger inlet temperature chart recorders that an unplanned mode change to Mode 3 had not occurred. The licensee issued an Event Notification, EN-51784, per 10 CFR 50.73(a)(1) for an invalid actuation of a containment isolation signal that affected more than one plant system (RHR and Reactor Plant Sampling System) for the January 10, 2016, event.

The inspectors determined that the licensee met all applicable reporting requirements associated with this event.

2.5 Charter Items 6: Evaluate the licensees program to address equipment/component deficiencies and degradation, and classification of the conditions as operator workarounds/burdens.

a. Inspection Scope

The inspection team reviewed the licensees program for identification, tracking, and resolution of Operator Workarounds (OWA), Operator Burdens (OB), and Control Room Deficiencies (CRD). After reviewing the work order for repairing the broken banana jack associated with the 135-psi SDC isolation jumper installation, the team assessed the priority placed on the work order and whether the deficiency should have been included as an OWA, OB, or CRD. Finally, the team assessed the progress that the licensee had made in terms of addressing their backlog in these areas.

b. Findings and Observations

The team reviewed the trends associated with OWAs and OBs, which indicated that the licensee has been successful in resolving rising trends in these areas. The team noted that there remains a significant number of CRDs as compared to the OWAs and OBs. The team reviewed CRDs to evaluate whether OWAs and OBs are being correctly classified in accordance with station procedures. The team identified the following items improperly classified.

• The dampers for the 1B battery exhaust fans have shown a propensity to remain open after the fans are secured. If the running fans damper remains open after a trip, the standby fan will end up recirculating air in reverse through the running fans ventilation line. To preclude this possibility, the licensee has taken the standby fan out of a standby configuration, so that the fan will not automatically start on a loss of the running fan. If the running fan trips, operators are required to locally verify that the running fans damper is shut prior to starting the standby fan. The condition meets the definition of an operator burden per Procedure EN-FAP-OP-006, Operator Aggregate Impact Index Performance Indicator, Revision 2.

• The Division I isolation breaker for the south bus of offsite power is not remotely operable from control. Abnormal Operating Procedure AOP-0004, Loss of Offsite Power, Revision 53, instructs operators to close the breaker in the process of restoring offsite power. This requires that operations personnel operate the breaker locally from the Fancy Point switchyard. The condition therefore meets the definition of an operator workaround per Procedure EN-FAP-OP-006.

These issues have been documented in the licensees corrective action program as Condition Report CR-RBS-2016-02447.

The identification of the incorrectly classified OWA and OB above poses a challenge to the licensees indications of success in resolving rising trends in this area.

Additionally, the team identified several CRDs with no scheduled work date, suggesting that these deficiencies did not receive the priority that the CRD program is intended to place on them.

The team questioned the priority placed on the work order for the broken banana jack associated with the loss of SDC. In March 2015, the licensee generated a work order to repair the damaged banana jack. The licensee did not complete the repairs to the banana jack until January 12, 2016.

Two reactor scrams occurred during this time, each of which required the installation of the jumpers as part of the shutdown protection plan. The team identified no justifiable reason as to why the banana jack could not have been repaired sooner.

The failure to repair the broken banana jack resulted in the licensee being forced to write a last-minute change notice in order to allow for the use of a mini-grabber style jumper following the reactor scram in November 2015. On January 10, 2016, operations personnel did not identify the active change notice during the brief or actual performance of the 135-psi SDC jumper installation. The team determined that this constituted a procedural acceptance of a known equipment deficiency that should have been addressed by appropriate work order prioritization.

The team determined that the work order for the broken banana jack did not meet the threshold for any of the three specialized tracking programs. The team determined that the use of a different style jumper did not constitute a significant burden, especially when the mini-grabber jumper is commonly used in the implementation of emergency operating procedures. It is expected that licensed operations personnel should be proficient in their use. Additionally, the team determined that the deficiency did not contribute to the event, as operations personnel did not attempt to plug the jumper into the broken banana jack. The team concluded that the event would not have occurred if operations personnel had used the correct jumper.

2.6 Charter Items 7 and 9: Review this event as it relates to the negative trend in Operator Fundamentals as documented in Inspection Report 05000458/2015004 and the adequacy of associated corrective actions taken by the licensee. Review the extent of corrective action program contributors to the loss of SDC event.

a. Inspection Scope

The team reviewed the licensees Station Recovery Plan the licensees proposed and implemented corrective actions to address the negative trend in Operator Fundamentals.

b. Findings and Observations

The team determined that the implementation of the following corrective actions, at their present state of completion, did not provide sufficient actions to prevent the human performance errors that led to the loss of SDC. The licensee implemented the following corrective actions as part of River Bend Station Recovery Plan LO-RLO-2015-00157, September 2015 Revision, to address operator performance.

1. Corrective Actions 90 and 250 established an Equipment Operator Performance

Matrix. The performance matrix uses a grading criteria to monitor an individuals level of performance to help identify personnel that need additional mentoring/coaching. The purpose of this program is to provide a way to ensure that when two operations personnel with low rankings work together, additional management oversight of their work is provided. At the time of the event, the proposed program had been developed and implemented for non-licensed equipment operators, but was in the planning stages for licensed operators. Had the program been in place for licensed operators, it could have provided an opportunity for the licensee to be alerted to the need for additional management oversight of the jumper installation activity.

2. Corrective Action 94 developed a performance indicator to track and trend crew

performance. The team identified that the performance indicator consists of a compilation of written exams, observation quality, system health, incidents, condition reports, schedule adherence, human performance, component mispositions, and tagging errors. These inputs provide a performance indicator of Green, Yellow, or Red. Following discussions with the licensee, the team determined that the performance indicators are for trending and that the licensee did not establish any corrective actions for a crew that reaches the different action levels. Additionally, the team observed that during the root cause evaluation the licensee determined that the operating crew that was on-shift at the time of the event had multiple issues with communication, weakness in teamwork, and haste prior to the loss of SDC event.

3. Corrective Action 98 implemented a risk-ranking method of performing

management oversight. The corrective action requires a minimum of two field observations per shift to be performed by shift management and that all manipulations performed in the main control room by operations personnel be observed. Corrective Action 240 evaluated the observation strategy after 30 days. The team identified that following the re-evaluation the licensee established directions for the required observation in Standing Order 308.

Standing Order 308 identified three actions for observation of operator performance:

• Main control room manipulations will be observed based on risk significance as described by the Shift Manager. Command and Control must always be maintained as well as peer checking.

• A minimum of two field observations are required per shift with a priority on observing risk significant activities.

• The Shift Manager retains the authority and the responsibility to defer an activity if the crew is unable to provide the required oversight of the activity.

The team reviewed the licensees corrective actions associated with the root cause evaluation for the loss of SDC. The team identified that the licensee revised Standing Order 308 to require the observation of all manipulations in the main control room consistent with the original corrective action identified in the Station Recovery Plan.

The team determined that the licensee met the requirements of the field observations; however, neither the Shift Manager nor the control room supervisor chose to observe the jumper installation, even though an increased risk of a loss of SDC existed. The oversight of the jumper installation might have led the licensee to identify and correct the procedural compliance deficiencies that resulted in the loss of SDC. The team identified additional external operating experience related to SDC risk, as discussed in Section 2.10 of this report.

2.7 Charter Item 8: Evaluate the licensees compliance with, and adequacy of, procedural guidance to establish and/or maintain a reactor system vent path during plant shutdown operations.

a. Inspection Scope

The team evaluated the direction contained within plant operating procedures to determine whether sufficient emphasis existed on establishing a reactor coolant system vent path once vacuum is broken and steaming to the main condenser is secured during a plant shutdown. Specifically, the team reviewed Procedure GOP-0002, Power Decrease/Plant Shutdown, including a recent procedure revision implemented after the event. Additionally, the team evaluated other procedural guidance utilized by the plant staff during the loss of SDC event, interviewed operations personnel present during the event, and reviewed corrective actions for the event.

b. Findings and Observations

On the day of the event, operations personnel utilized Procedure GOP-0002 as the overall guidance document for shutdown of the plant. Step 70 of the procedure directs operations personnel to secure discharging steam to the main condenser and break condenser vacuum when RHR SDC is used for plant cooldown. Procedure GOP-0002 did not provide direction to operations personnel to establish a reactor coolant system vent path until later in the procedure. Step 76 directs operations personnel to open the reactor head vents at less than 190°F and contains a NOTE stating:

To prevent erroneous level indications and inadvertent vessel pressurization, the vessel is maintained vented until the vessel head piping is removed.

The licensee did not establish the vent path prior to the loss of SDC on January 10, 2016. Following the loss of SDC, operations personnel developed a plan to back out of Step 70, reestablish condenser vacuum, and steam to the condenser using the main steam drains; however, the licensee did not accomplish this prior to the restoration of SDC at 0401 on January 10, 2016. On January 11, 2016, operations personnel established a vent path using the reactor head vents per Step 76. This delay resulted in the reactor vessel remaining in an unvented condition during cooldown for almost 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. As noted in Step 76, this resulted in a potential for erroneous level indication and inadvertent vessel pressurization when the vessel is not maintained vented.

Prior to the arrival of the Special Inspection Team, the licensee revised GOP-0002 to provide a caution that a reactor vessel vent path should be established expeditiously after breaking vacuum and moved Step 76 to an earlier place in the procedure (Step 71). This change is consistent with the guidance provided in Procedure SOP-0011, Main Steam System, Revision 30, Section 6, System Shutdown, which directs operation personnel to line up reactor head vents WHEN reactor vessel water temperature is less than 190°F prior to a later step that directs closing the Main Steam Isolation Valves (MSIVs) when required by GOP-0002. The licensee entered this into their corrective action program in Condition Report CR-RBS-2016-0573.

Upon the loss of SDC, operations personnel transitioned to Procedure AOP-0051, Loss of Decay Heat Removal. Step 5.1.3 stated:

IF the in-service loop of Shutdown Cooling has been lost due to a component failure in RHR or SWP System, THEN place the redundant loop in Shutdown Cooling per SOP-0031, Residual Heat Removal.

Procedure SOP-0031, Residual Heat Removal System, described actions to place a RHR loop into shutdown cooling but did not provide specific instruction on restoration following a loss of SDC. Operations personnel did not consider the closure of the isolation valves to be a component failure since they could be manually operated, and proceeded past this step. Step 5.1.5 directed the crew to refer to Procedure OSP-0041, Alternate Decay Heat Removal, for determining the method of alternate decay heat removal.

The purpose for Procedure OSP-0041 is to demonstrate the operability of at least one alternate method of decay heat removal for each inoperable required RHR SDC loop within one hour of inoperability and to establish alternate cooling, if necessary.

This procedure is not applicable to the conditions during the time of the event since the licensee considered both RHR A and B SDC as operable. Therefore, Procedures AOP-0051 and OSP-0041 essentially provided no guidance to operations personnel as to how to respond to the inadvertent isolation of the operating SDC loop. Regulatory Guide 1.33, Quality Assurance Program Requirements, Revision 2, references ANSI N18.7-1976/ANS-3.2, Administrative Controls and Quality Assurance for the Operations Phase of Nuclear Power Plants, for the contents of an adequate procedure. ANSI N18.7-1976/ANS-3.2 Section 5.3 states that procedures shall include appropriate quantitative and qualitative acceptance criteria and shall provide an approved preplanned method of conducting operations. Section 5.3.1, Procedure Scope, states that each procedure shall be sufficiently detailed for a qualified individual to perform the required function without supervision.

The team conducted interviews with operations personnel and established that they determined that manual operation of the SDC isolation valves and starting RHR A pump provided the most expeditious restoration of SDC. The licensee considered placing RHR loop B in service in SDC mode due to RHR pump B SDC injection valve still being able to be operated from the control room. However, the crew identified that the normal startup procedure in Procedure SOP-0031 requires RHR loop B to be warmed up to within 100°F of reactor coolant temperature prior to placing the system in SDC mode. Operations personnel determined that the difference in temperature between the reactor coolant temperature and RHR loop B temperature would be greater than 100°F and require a warm up. Operations personnel decided that restoring the RHR A loop would be most expeditious due to meeting the differential temperature requirement, and utilized portions of the system startup procedure in Procedure SOP-0031 to reestablish the RHR loop A in SDC mode. Due to the extended time required to access and open Valve E12MOV-F008, as discussed below, operations personnel developed a one-time change notice to Procedure SOP-0031 to allow starting the RHR pump A with Valve E12MOV-F053A only 20 percent open. The licensee determined that this action was necessary due to the potential entry into Mode 3 because of the time required to fully open the valve and the rate of increase in reactor coolant temperature due to the loss of SDC. Three Senior Reactor Operators evaluated and approved the change notice in accordance with Procedure RBNP-001, Development and Control of RBS Procedures, Revision 36, to ensure that minimum flow requirements for the pump would be met during pump start. Operations personnel started RHR Pump A and restored SDC with reactor coolant temperature at 196°F. The licensee entered the lack of procedural guidance into their corrective action program in Condition Report CR-RBS-2016-0467.

When the licensee determined that manual/local operation of Valve E12MOV-F008 would be required to restore either RHR loop, the licensee dispatched operations personnel to make preparations to enter a locked high radiation area to open the valve. Ultimately, it took operations personnel, accompanied by a Shift Manager qualified Senior Reactor Operator, 44 minutes to proceed through the Radiologically Controlled Area (RCA) control point and gain access to the steam tunnel. Through interviews with the licensees radiation protection (RP) staff, the team concluded that the RP staff did not provide an expeditious method for entry into the locked high radiation area as described in the precautions/limitations listed in Section 5.1 of Procedure EN-RP-101, Access Control for Radiologically Controlled Areas, Revision 11. Precautions 11 and 12 in Section 5.1, state that, during an emergency:

• Individuals qualified in radiation protection procedures OR personnel continuously escorted by such individuals may be exempt from the requirement for a Radioactive Work Procedure (RWP) or equivalent while performing their assigned duties provided they are otherwise following plant procedures for entry to, exit from and work in such areas.

• Plant personnel may bypass the normal RCA entry/exit process.

The team determined that the RP staff thought that these precautions are only used during activation of the site emergency plan. The procedure did not provide any specific guidance for expedited RCA access for the condition identified during the January 10, 2016, event. The licensee entered this into their corrective action program in Condition Report CR-HQN-2016-00132.

Further discussion of the performance deficiencies associated with the failure to provide adequate procedures is documented in Section 2.11.b of this report.

2.8 Charter Item 10: Evaluate internal events similar to the loss of SDC event and associated causes (e.g. LER 94-018-00, EA-97-497 and LER 2015-002-00), and the effectiveness of any actions taken by the licensee in response to the internal events.

a. Inspection Scope

The team reviewed the licensees cause evaluations, condition reports, and corrective actions associated with the following internal events.

1. LER 94-018-00

The team reviewed the licensees Condition Report CR-RBS-1994-0830 developed in response to the June 23, 1994, loss of SDC event. This event resulted from an electrical short created by a dropped lead while removing jumpers installed to bypass the 135-psi SDC isolation per Temporary Procedure TP-94-0010, Shutdown Cooling Reliability During Refuel Outages. The licensee determined that the root cause of the event was personnel error, due to a technician dropping one end of the jumper. This resulted in a short circuit and caused an isolation of SDC and subsequent trip of RHR pump A. The licensee also identified three other LERs issued in 1994 that resulted in engineering safety feature actuations due to the mishandling of test leads.

The team reviewed the corrective actions associated with Condition Report CR-RBS-1994-0830 and identified that the licensee implemented the following corrective actions:

a. Immediate Corrective Action

• Replace the blown fuse and re-establish SDC and complete the restoration of the RHR system per Procedure TP-94-0010.

b. Corrective Actions

to Prevent Recurrence

• The licensee implemented enhancements of the human engineering aspects associated with the banana jacks and jumpers used for the procedure.

• The licensee issued Procedure TP-94-0010, Revision 1, to re-sequence the steps in the procedure to de-energize Valves E12MOV-F053A/B and E12MOV-F008/9 during the installation and removal of the jumper installed or bypassing the 135-psi SDC isolation.

The team reviewed the status of the corrective actions implemented by the licensee for Condition Report CR-RBS-1994-0830 and observed the following timeline.

• In May 1998, the licensee added the directions for installing the 135-psi SDC isolation jumpers as Attachment 5 of Procedure SOP-0031, Revision 35.

• In October 1999, the licensee developed Procedural Action Request PAR SOP-0031R34CM-1, to make bypassing the 135-psi SDC isolations less difficult and more reliable. This resulted in the addition of procedural guidance to use retractable sheath banana jumpers and the removal of the additional steps to open the breakers identified as corrective actions in Condition Report CR-RBS-1994-0830. The recommendation for the procedural changes eliminated limiting condition for operations entries and removed the operational limitations associated with installing the jumpers. In February 2001, the licensee issued SOP-0031, Revision 36, incorporating these changes.

The team determined that the changes to the corrective actions developed and implemented as part of Condition Report CR-RBS-1994-0830 are less robust than the original actions. Specifically, the licensees removal of the requirements to de-energize the valve during jumper installation resulted in vulnerability to a loss of SDC event due to a fault induced by improper jumper installation. As a result of the January 2016 event, the licensee changed Procedure SOP-0031 to implement the original corrective actions identified in 1994.

2. EA-97-497

The team reviewed two LERs associated with previous NRC enforcement actions: LER RBS-1997-006-00 and RBS-1997-008-00.

The licensee submitted LER 1997-006 due to an inadvertent mode change from Mode 4 to Mode 3 during the post modification testing of the alternate heat removal function of the existing Suppression Pool Cooling and Cleanup System.

The licensee captured actions for LER 1997-006 in Condition Report CR-RBS-1997-1390. The licensee identified the following as the most direct contributors to the event:

a. The failure to reference and use the time-to-boil curves.

b. The failure to recognize that reactor water cleanup (RWCU) temperature is not representative of the average coolant temperature under the existing plant conditions.

The corrective actions taken as part of this condition report implemented actions to address the monitoring and control of reactor coolant temperature during shutdown. This included actions to procedurally identify a temperature monitoring point, enhance time to boil and heat-up rate curves, and add amplifying discussions in the technical specification basis for SDC. The team reviewed these actions and determined that the actions are still being implemented by the licensee.

The licensee submitted LER 1997-008 due to the inadvertent closure of the RHR SDC inboard isolation valve which resulted from inadequate administrative controls. The licensee captured actions for LER 1997-008 in Condition Report CR-RBS-1997-1737. The licensee identified the following as the root causes for the event:

a. Organizational Standards - Less than adequate standards, policies, or administrative controls.

b. Immediate Supervision - Less than adequate supervision during the work activity.

c. Work Practice - Error Detection Method - System alignment not verified prior to task performance due to habit intrusion. The operator failed to take into account current plant condition when restoring the system per the procedure.

The team reviewed the licensees corrective actions to incorporate a protection scheme and procedural guidance for establishing protection for the SDC capability of the plant. This incorporated actions to identify SDC component protection requirements to support the reliable operation of the SDC system.

The team determined that the protection scheme is still in effect in Procedure OSP-0037, Shutdown Operations Protection Plan, Revision 34. The root causes dealing with Immediate Supervision and Work Practices are similar to causes identified during the root cause evaluation associated with the January 10, 2016, loss of SDC event.

3. LER 2015-002-00

The team reviewed Condition Report CR-RBS-2015-01783 generated by the licensee in response to the May 7, 2015, partial loss of offsite power and valid start signal for the Division 2 Emergency Diesel Generator. Contractor personnel inadvertently shorted across two lugs and energized the trip circuitry which resulted in the loss of the Reserve Station Service (RSS) #2 offsite power source.

The licensee identified one apparent cause as inadequate work practices. The inadequate work practices consisted of the failure of the workers to take actions to mitigate the potential effects of adverse conditions at the work site identified during the pre-job brief. The licensee identified one contributing cause of inadequate supervisor oversight, since the supervisor could have provided the additional barrier to ensure that the electricians took all available precautions prior to performing the voltage check.

Short term corrective actions completed by March 28, 2015, consisted of:

a. A human performance review and coaching for the electricians involved in the event.

b. All hands stand down by the contractor to reinforce Human Performance Expectations.

c. Senior management observations focusing on standards, process and supervision risk recognition and mitigation.

The licensee identified longer term corrective action to address the inadequate supervisor oversight. Corrective actions required a brief of all contractor supervision on oversight expectations and scheduling of contractor management paired observations to focus on standards, process, and supervisor risk recognition and mitigation prior to the licensees next scheduled outage. These corrective actions are specific to the oversight of contractor maintenance. The team did not identify where the licensee identified or implemented any corrective actions from this event to include licensee personnel.

2.9 Charter Item 11: Review the licensees cause determination for the reactor scram that occurred on January 9, 2016, and determine whether the alignment and response of plant systems, and operator response, was appropriate.

a. Inspection Scope

The team reviewed the root cause evaluation associated with the reactor scram on January 9, 2016. As part of this review, the team looked at the reactor protection system (RPS) response to the degraded bus voltage resulting from a phase to phase fault on the line from the Big Cajun to the Fancy Point switchyard. In addition, the team reviewed operations personnel actions following the scram and subsequent entry into Procedure GOP-0002. The team reviewed plant procedures, operator logs, plant parameter trends, condition reports, operations personnel recollection forms, and documentation from the On-site Safety Review Committee following the January 9, 2016, reactor scram.

b. Findings and Observations

The team reviewed the root cause evaluation for the January 9, 2016, reactor scram.

The team determined that the scram resulted from a degraded voltage condition on both RPS buses resulting from a phase to phase fault on the line from Big Cajun to Fancy Point switchyard. At the time of the event, the alternate power supply from the switchyard were aligned to supply both RPS buses instead of the normal supply to the RPS buses from the RPS Motor Generator (MG) sets. The phase to phase fault resulted in a voltage drop to approximately 35 percent of normal voltage for 89.9 milli-seconds on the Big Cajun line. Due to the alignment of the RPS buses to the alternate power supply, voltage on both RPS buses dropped to approximately 40 volts, which resulted in the actuation of several components supplied by the RPS bus. Included in these components are the scram solenoids, MSIV solenoids, and other associated relays. The lowering voltage resulted in a full MISV isolation and reactor scram.

The team reviewed a similar reactor scram that occurred on November 27, 2015, which resulted from a similar degraded RPS bus voltage. During the November 27, 2015, event, RPS voltage dropped to approximately 60 volts for approximately 65 milli-seconds. This higher voltage and shorter duration resulted in only the reactor scram occurring and not the MSIV isolation.

The lowering voltage is consistent with the design of the alternate power supplies for the RPS buses. The alternate supply consists of 480/120 VAC regulating transformers. The transformers are designed to maintain output voltage to within 3 percent over an input range of -15 percent to +10 percent of nominal voltage.

Therefore, the voltage drops observed during both of the scrams is beyond the capacity of the transformers regulating capacity. The normal power supplies to the RPS buses are the RPS motor generator sets. The motor generators are designed with high inertia flywheels so that voltage will be maintained within 5 percent of the rated value for one minute following a total loss of power. Both of the reactor scrams would have been prevented if the licensee maintained at least one of the RPS buses on the normal power supply.

Additionally, the team identified that the licensee took almost two hours to reopen an MSIV. The licensee stated that the MSIV recovery could have been completed in a shorter amount of time if operations personnel selected the maximum allowed differential pressure of 200 psid per System Operating Procedure SOP-0011, Main Steam System, instead of the preferred value of 50 psid specified in the procedure.

The opening of the MSIV earlier could have reduced the impact on reactor vessel level changes and suppression pool level resulting from the operation of the safety relief valves for pressure control.

The team reviewed control room logs and operations personnel recollection forms and determined that operations personnel performed the appropriate procedurally directed actions following the reactor scram.

The team identified performance deficiencies associated with the corrective actions following the November 27, 2015, reactor scram and risk associated with supplying both RPS buses from the alternate power source in Sections 2.11.c and d of this report.

2.10 Charter Item 12: Evaluate pertinent industry operating experience and potential precursors to the loss of SDC event, and the effectiveness of any action taken by the licensee in response to operating experience.

a. Inspection Scope

Inspectors examined industry events that shared similarities with the event in question and evaluated the licensees actions in response to those events.

b. Findings and Observations

Inspectors reviewed 19 industry-wide events that occurred in the last five years that were similar to the event in question. Inspectors verified that the licensee processed each event in accordance with the requirements of site operating experience program procedures. One of these issued events required licensee action.

Inspectors verified that the licensee took the required action for the report, which required a documented written response.

Inspectors additionally reviewed licensee corrective actions in response to an industry-wide operating experience report issued in 2009 to address deficiencies in shutdown safety practices, including the key function of decay heat removal. The report offered a set of twelve recommendations to help sites reduce the frequency of events that adversely impact shutdown safety functions.

Of these twelve recommendations, inspectors observed that two are specifically applicable to the event in question:

• Recommendation that senior managers at the site be actively involved to challenge and oversee the execution of work activities with elevated risk.

• Recommendation that the site reinforce the expectation that Shift Managers maintain overall responsibility for control of key shutdown safety functions, to include release and closure of outage and system work windows.

The licensee responded to the recommendations by implementing corrective actions that entailed changing the responsibility sections of two site procedures that govern shutdown safety: Procedures EN-OU-108, Shutdown Safety Management Program, and OSP-0037, Shutdown Operations Protection Plans. The team checked to verify that the licensee had a process to ensure that the contents of these procedures are adequately promulgated to operations personnel. Inspectors noted that such a process did not exist for Procedure EN-OU-108. Additionally, the team noted that the evolution which led to the event lacked sufficient oversight from senior managers. The inadequate overall method for implementing these recommendations contributed to the lack of oversight during the event. The team concluded that implementation of the recommendations in the form of changes to high-level procedures, rather than in the form of changes to procedures that maintain clear accountability for each step completed, contributed to an insufficient implementation of the recommendations in actual crew practice.

2.11 Specific findings identified during this inspection.

a. Failure to Use the Correct Jumper While Bypassing 135-psi SDC isolation

Introduction.

The team reviewed a Green, self-revealing, non-cited violation of Technical Specification 5.4, Procedures, for the licensees failure to correctly implement Procedure SOP-0031, Residual Heat Removal System, Revision 326.

SOP-0031, Attachment 5, Step 5.4.1, required that a retractable sheathed banana jumper be used when bypassing the 135-psi SDC isolation. Instead, the licensee used a standard banana jumper, which resulted in a short circuit and inadvertent closure of Valves E12MOV-F008, Shutdown Cooling Suction Valve, and E12MOV-F053A, Shutdown Cooling Injection Valve. This caused a loss of decay heat removal.

Description.

On January 10, 2016, the licensee performed Procedure SOP-0031, 5, to bypass the RHR Loop A 135-psi SDC isolation. Procedure SOP-0031, Step 5.4.1, required the use of a retractable sheath banana jumper between the banana jack at TB0057 Terminal 12 and the banana jack at TB0011 Terminal 11.

Instead of the retractable sheath jumper, the licensee used a standard banana jumper. When operations personnel attempted to insert the standard banana jumper in the first terminal, the jumper created a short resulting in Valves E12MOV-F008 and E12MOV-F053A closing. This resulted in the trip of RHR pump A and loss of SDC. During interviews with operations personnel, they stated that at the time of the event they were not familiar with the different types of banana jumpers and that Instrumentation and Controls technicians normally performed the jumper installations.

The team identified three contributing causes to the event. The licensee conducted a pre-job brief but did not identify the appropriate risk to require supervisory oversight during the installation of the jumpers. During the pre-job brief the licensee did not identify internal operating experience from a similar event in 1994. The licensees poor communications resulted in supervision being unaware of the installation of the jumper for the 135-psi SDC isolation. These items are further discussed in Sections 2.3 and 2.8 of the report.

Following the jumper installation and unexpected loss of SDC, the licensee entered Procedure AOP-0051, Loss of Decay Heat Removal. Operations personnel verified sufficient core flow with both recirculation pumps running in slow speed to assure accurate coolant temperature indication and reactor water level above the minimum required to support natural circulation. The licensee calculated a heat-up rate of approximately 1°F per minute at the time of the loss of SDC. The licensee restored SDC after 77 minutes using RHR Loop A.

Analysis.

The failure to use the jumpers specified in Procedure SOP-0031 was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the human performance attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the shorting of the contacts resulting from using the incorrect jumpers closed Valves E12MOV-F008, Shutdown Cooling Suction, and E12-MOVF053A, Shutdown Cooling Injection.

This performance deficiency subsequently caused a loss of shutdown cooling and decay heat removal.

Phase 1 Screening The team evaluated the finding using NRC Inspection Manual Chapter 0609, Appendix G, Attachment 1, Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings. When applying Exhibit 2 - Initiating Events Screening Questions, the team determined the loss of residual heat removal event did not occur when the refuel cavity was flooded, and therefore it required a risk evaluation using Appendix G, Attachment 3, Phase 2 Significance Determination Process Template for Boiling Water Reactors during Shutdown.

Preliminary Phase 2 Analysis The event occurred in the early time window of an outage with a time-to-boil at the onset of the event of approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. A sufficient reactor coolant system (RCS) vent path did not exist to prevent pressurization of the vessel above residual heat removal (RHR) shutoff head had shutdown cooling been lost. These conditions placed the plant in Plant Operational State (POS) 1 per NRC Inspection Manual Chapter 0609, Appendix G, Attachment 3, Phase 2 Significance Determination Process Template for Boiling Water Reactor during Shutdown. The event represented a loss of shutdown cooling (initiating event likelihood = 0) and was evaluated using Worksheet 4 of Manual Chapter 0609, Appendix G, Attachment 3, SDP Worksheet for a BWR Plant - Loss of Operating Train of RHR (LORHR) in POS 1 (Head On).

The analyst assumed that operators would have been able to restore a train of residual heat removal (RHR) and its support systems before shutoff head of the RHR pumps would be reached. The time to reach shutoff head was assumed to be greater than one hour. RCS pressure and level, as well as RHR temperature (when RHR was in service), flow, and pressure indications, were available and functional, as was the RHR low flow and RCS low level alarms. Nominal operator credit was given for 1) manually starting the RHR C or Low Pressure Core Spray pump concurrent with opening an RCS vent path; 2) manually injecting via a high pressure source and steaming out the safety relief valves; and 3) manually venting containment and maintaining a long term inventory source for an injection system.

As directed by Appendix G, during Phase 2 analysis no recovery credit is given.

However, credit for restoring a train of RHR was applied.

These assumptions yielded an estimate of core damage frequency in the middle of the White (low to moderate safety significance) range. Phase 2 analysis is by design conservative analysis. Based on this conservative analysis, the analyst determined more refinement was needed to appropriately determine the safety significance of the finding. Therefore, the analyst performed a modified Phase 2 analysis.

Modified Phase 2 Analysis In the preliminary analysis above, no credit was given for automatic starts of Low Pressure Core Spray, RHR C, or High Pressure Core Spray, even though these systems would auto start on low reactor vessel water level. Also, the automatic depressurization system was available for automatic actuation on high pressure as it was in the Not Inhibited mode.

The analyst used the above information to refine the Phase 2 analysis. The analyst replaced the nominal values for manual low pressure injection and manual high pressure injection with representative failure probabilities for automatic injection and automatic depressurization system actuation in the core damage sequences in Worksheet 4.

This refinement yielded an estimate of core damage frequency that was in the low White range. The analyst then considered the additional qualitative considerations to more fully risk-inform the final significance determination.

Qualitative Considerations Recognizing conservatisms in the modified Phase 2 analysis, the analyst considered qualitative criteria including defense-in-depth that existed to further inform the analysis. These qualitative inputs included:

• As previously quantified, mitigation capability was available with two trains of low pressure coolant injection, one train of high pressure coolant injection, and one train of low pressure core spray available for automatic injection;

• Additional non-quantified mitigation considerations included:

• The condensate, fire water, and RHR service systems were available and could have been used after operators aligned the systems;

• The control rod drive system was running and could have been optimized by operators with simple system adjustments to start another pump and maximize system flow;

• Two paths to restore the residual heat removal system were available:

o Manually opening the valves which shut (the path taken during the event)o Replacing the blown fuse which caused the event with a functional fuse;

• Extensive time margin (approximately six hours to uncover the core) was present before the condensate storage tank would become depleted without operator action to throttle injection flow. In addition, core damage would not occur at the point the core uncovered. Therefore, there was additional time margin to core damage. The additional time margin would lower assumed human error probabilities;

• The main steam isolation valves were open, and operator actions to align drain valves and establish condenser vacuum were available to vent the reactor vessel, if needed;

• The performance deficiency had no other effect on safety margin; and

• The performance deficiency did not affect other equipment Consequently, the analyst determined that the modified but still conservative Phase 2 quantitative estimate in combination with the above discussed qualitative and deterministic insights led to a final estimate of very low safety significance, i.e.,

Green.

The finding has a field presence cross-cutting aspect within the human performance area because the licensee failed to promptly correct deviations from standards and expectations. Specifically, the licensee failed to correct deviations from standards and expectations during the performance of the pre-job brief and ensure proper communication and oversight is maintained in the control room during risk significant evolutions. [H.2]

Enforcement.

Technical Specification 5.4.1.a, requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 4.e of Appendix A to Regulatory Guide 1.33, Revision 2, requires that procedures for energizing, filling, venting, draining, startup, shutdown, and changing modes of operation should be prepared, as appropriate, for the shutdown cooling and reactor vessel head spray systems. The licensee established System Operating Procedure SOP-0031, Residual Heat Removal System, Revision 326, to meet the Regulatory Guide 1.33 requirements. Step 5.4 of Procedure SOP-0031 requires operations personnel to connect a retractable sheath banana jumper between terminals 12 and 11 to bypass the RHR Loop A 135-psi SDC isolation.

Contrary to the above, on January 10, 2016, operations personnel failed to connect a retractable sheath banana jumper between terminals 12 and 11 to bypass the RHR Loop A 135-psi SDC isolation. Specifically, the licensee used a standard banana jumper, which resulted in inadvertant closure of the shutdown cooling suction and discharge valves and a loss of decay heat removal. The licensee entered this into their corrective action program as Condition Report CR-RBS-2016-0210. Corrective actions to restore compliance included revising Procedure SOP-0031 to include actions to de-energize the applicable valves while bypassing the 135-psi SDC isolation. Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/20160009-01, Failure to Follow Procedure While Installing Jumpers for Shutdown Cooling.

b. Failure to Establish Adequate Procedural Guidance

Introduction.

The team reviewed a Green, self-revealing, non-cited violation of Technical Specification 5.4, Procedures, for three examples of the licensees failure to establish sufficient procedural guidance. Specifically, the licensees operations and radiation protection procedures did not provide sufficient direction to the plant personnel to expeditiously establish a reactor vessel vent path, restore from a loss of SDC, and perform time sensitive entries into radiologically controlled areas.

Description.

The team reviewed the following three examples of the licensee failure to establish sufficient procedural guidance.

• The team reviewed Procedure GOP-0002, Power Decrease/Plant Shutdown, Revision 072. Procedure GOP-0002, Step 70, directs operations personnel to secure steaming to the main condenser and break condenser vacuum once RHR shutdown cooling has been established. This action isolates the vent path for the reactor vessel to the main condensers. Procedure GOP-0002, Step 76, provides guidance to establish a vent path via the reactor head vent when the reactor coolant temperature reached 190°F. The guidance in the procedure failed to ensure the completion in a timely manner of the step once reactor coolant temperature lowered to less than 190°F. A note in Step 76 stated:

To prevent erroneous level indications and inadvertent vessel pressurization, the vessel is maintained vented until the vessel head piping is removed.

The lack of vent path resulted in an increase in risk during the loss of SDC. The increased risk resulted from the potential for an inadvertent reactor vessel pressurization above the RHR pump shutoff head. Prior to the January 10, 2016, loss of SDC, reactor coolant temperature lowered to 136°F without establishing a vent path. On January 11, 2016, the licensee aligned the reactor head vent to provide a vent path per Step 76. This resulted in approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without a vent path established for the reactor vessel.

• The team reviewed Procedure AOP-0051, Loss of Decay Heat Removal, Revision 313. The procedure failed to provide guidance to control room operators on how to respond to an isolation of the in-service RHR shutdown cooling loop during cooldown. Procedure AOP-0051, Step 5.1.3, directs aligning the other loop of RHR for SDC if a component failure occurred in accordance with Procedure SOP-0031 Residual Heat Removal. The procedure did not provide guidance for an inadvertent isolation of the system in which both trains are affected. This required operations personnel to determine the actions required to restore SDC and select the applicable section of Procedure SOP-0031. Regulatory Guide 1.33, Quality Assurance Program Requirements, Revision 2, references ANSI N18.7-1976/ANS-3.2, Administrative Controls and Quality Assurance for the Operations Phase of Nuclear Power Plants, for the contents of an adequate procedure. ANSI N18.7-1976/ANS-3.2, Section 5.3, states that procedures shall include appropriate quantitative and qualitative acceptance criteria and shall provide an approved preplanned method of conducting operations. Section 5.3.1, Procedure Scope, states that each procedure shall be sufficiently detailed for a qualified individual to perform the required function without supervision. The inspectors determined that procedure SOP-0031 did not provide a preplanned method of sufficient detail to restore the SDC system. The time spent developing a plan, in the absence of any specific procedural direction, contributed to the heat-up of the reactor coolant system.

• The team reviewed Procedure EN-RP-101, Access Control for Radiologically Controlled Areas, Revision 11. The access control procedure did not provide sufficient guidance to the control point radiation protection (RP) technician to support urgent entry into a locked high radiation area for the purposes of manually operating a valve required for the restoration of shutdown cooling.

Specifically, Section 5.1, Steps 11 and 12 of the procedure established vague guidance on urgent entry into radiologically controlled areas. However, during the loss of shutdown cooling event on January 10, 2016, it took operations personnel and RP control point personnel 44 minutes to gain access to Valve E12MOV-F008, RHR SDC Outboard Suction Isolation Valve. With reactor coolant temperature rising at 1 degree per minute, this delay resulted in additional heat-up that could have been avoided with more explicit direction on when and how to permit expedited entry into a locked high radiation area.

Analysis.

The failure to establish adequate procedural guidance in accordance with Regulatory Guide 1.33 was a performance deficiency. Specifically, Procedures GOP-0002 and AOP-0051 failed to provide adequate direction to operations personnel to expeditiously establish a reactor vessel vent path and recover SDC following an isolation. Additionally, Procedure EN-RP-101 failed to provide adequate guidance for RP staff to perform time sensitive entries into radiologically controlled areas. This performance deficiency is more than minor, and therefore a finding, because it is associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to ensure that adequate procedural direction was provided to operations personnel following a loss of shutdown cooling. This resulted in a delay in the restoration of shutdown cooling and plant heatup. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix G, Shutdown Operations Significance Determination Process. Using Inspection Manual Chapter 0609, Appendix G, Attachment 1, Exhibit 3, Mitigating Systems Screening Questions, the team determined that the finding is of very low safety significance (Green) because it:

(1) affected the design or qualification of a mitigating structure, system, or component, and

(2) the structure, system, or component maintained its operability and functionality. A cross-cutting aspect is not being assigned to this finding due to the timing of the performance deficiency not being indicative of current licensee performance.

Enforcement.

Technical Specification 5.4.1.a, requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Section 2.i and j of Appendix A of Regulatory Guide 1.33, Revision 2, requires that procedures should be prepared, as appropriate, for plant shutdown to hot standby and hot standby to cold shutdown. Section 6.h requires procedures for combating a loss of shutdown cooling. Section 7.e.(1)requires procedures for access control to radiation areas including a radiation work permit system. Contrary to the above, as of January 11, 2016, the licensee failed to ensure that adequate written procedures were established for: plant shutdown to hot standby and hot standby to cold shutdown; combating a loss of shutdown cooling; access control to radiation areas including a radiation work permit system.

Specifically, the licensee failed to ensure that sufficient procedure guidance was established to expeditiously align a reactor vessel vent path during plant shutdown, respond to an inadvertent isolation of RHR shutdown cooling, and perform time sensitive entries into radiologically controlled areas for the purposes of restoring shutdown cooling. Additionally, weaknesses in Procedures GOP-0002, AOP-0051, and EN-RP-101, combined to contribute to the extended period of time that the plant was without shutdown cooling and a reactor vessel vent path. The licensee entered this into their corrective action program as Condition Reports CR-RBS-2016-0210, CR-RBS-2016-0370, and CR-HQN-2016-0132. Corrective actions to restore compliance included revising the above procedures. Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/20160009-02, Failure to Establish Adequate Procedural Guidance.

c. Failure to Implement Corrective Actions to Prevent the Recurrence of a Reactor Scram Due to Grid Disturbances.

Introduction.

The team reviewed a Green self-revealing, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to establish measures to assure that corrective action is taken to preclude repetition of a significant condition adverse to quality. Specifically, following a November 27, 2015, reactor scram, the licensee failed to implement corrective actions associated with the alternate power lineup of the reactor protection system (RPS) buses to preclude repetition of a significant condition adverse to quality during the January 9, 2016, reactor scram.

Description.

On November 27, 2015, River Bend Station experienced a reactor scram due a single phase fault in the Fancy Point switchyard with both RPS buses powered from their alternate power supplies (480/120 regulating transformer) at the time of the event. The fault resulted in a voltage drop to approximately 67 VAC on both RPS buses for 65 milli-seconds. The degraded voltage resulted in both of the RPS B Scram contactors dropping out and a sealed-in half scram from the RPS B Trip System. Approximately 65 milli-seconds after the onset of the fault, the appropriate circuit breaker in the switchyard opened to clear the fault. This resulted in the loss of Reserve Station Service (RSS) #1 and a loss of power to the RPS A bus. The loss of power to the RPS A bus resulted in a half scram signal from the RPS A Trip System.

On November 28, 2015, the licensee determined that, due to reliability issues associated with the MG sets used as the normal power sources for the RPS buses, that both RPS buses would remain powered from the alternate power source for the reactor startup. The licensee performed the reactor startup while the RPS buses remained powered from the alternate source.

The licensee performed a root cause evaluation (CR-RBS-2015-8463) for the November 27, 2015, reactor scram in accordance with Procedure EN-LI-118, Cause Evaluation Process, Revision 22. The licensee classified the condition report as Significance Category A. Significance Category A, per Procedure EN-LI-102, Corrective Action Program, Revision 25, is described as:

Adverse Conditions with High significance due to high risk, high actual or potential consequences. The condition requires a root cause evaluation and corrective actions to preclude repetition.

On December 22, 2015, the Condition Review Group approved a revised root cause evaluation problem statement and interim action to protect the Division 1 and Division 2 alternate Electrical Protection Assembly (EPA) breakers.

The team concluded that the interim action did not address the cause of the reactor scram due to degraded RPS bus voltage. Specifically, protecting the EPA breakers helped to ensure continuity power supply to the RPS buses but did not address the problem of RPS functionality being impacted by grid instability. The inspectors noted that this represented a second missed opportunity to implement corrective actions associated with scram vulnerabilities while powering both RPS buses from the alternate power source. The licensee maintained both RPS buses powered from the alternate supply.

At 0237 on January 9, 2016, River Bend Station plant experienced a second reactor scram resulting from a fault associated with the Fancy Point switchyard with both RPS buses aligned to their alternate power supply. The fault resulted in an approximate voltage drop to 35 percent of normal voltage for 89.9 milli-seconds on two phases at the Fancy Point switchyard. The voltage drop resulted in half scrams on both RPS A and B Trip Systems and a main steam isolation valve (MSIV)isolation.

Following the reactor scram and MSIV isolation, the plant experienced a Level 8 isolation due to high reactor water level. This resulted in a trip of the running reactor feed pumps. At 0245, the licensee started Reactor Feed Pump C and restored feed to the reactor. Additionally, they established pressure control via the Safety Relief Valves discharging to the suppression pool. At 0429, the licensee opened the MSIV for Main Steam Line D and commenced a plant shutdown in accordance with Procedure GOP-0002.

Analysis.

The failure to assure corrective actions are promptly taken for a significant condition adverse to quality to preclude repetition of a reactor scram associated with both buses being affected by a switchyard voltage transient was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the human performance attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensees failed to implement corrective actions to address grid instabilities following the November 27, 2015, reactor scram to preclude the January 9, 2016, reactor scram. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP)for Findings At-Power. Using Inspection Manual Chapter 0609 Appendix A, the team determined that this finding is of very low safety significance (Green) because it did not involve the loss of mitigation equipment or a support system.

This finding has an evaluation cross-cutting aspect within the problem identification and resolution area because the licensee failed to thoroughly evaluate the cause of the November 27, 2015, reactor scram and ensure that the resolution addresses causes and extent of conditions commensurate with their safety significance. [P.2]

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that for significant conditions adverse to quality, the licensee establish measures to assure that corrective action is taken to preclude repetition.

Contrary to the above, from November 27, 2015, to January 9, 2016, the licensee failed to establish measures to assure that corrective action was taken for a significant condition adverse to quality to preclude repetition. Specifically, following the November 27, 2015, reactor scram, the licensee failed to implement corrective actions to address a significant condition adverse to quality and preclude repetition of a plant scram due to grid instabilities affecting both RPS buses. The licensee entered this into their corrective action program as Condition Report CR-RBS-2016-0180. On January 12, 2016, the licensee supplied power to RPS bus A from the normal power source to restore compliance. Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2016009-03, Failure to Implement Corrective Actions to Prevent the Recurrence of a Reactor Scram Due to Grid Disturbances.

d. Failure to Adequately Assess Risk During Motor Generator Set Unavailability

Introduction.

The team identified a Green non-cited violation of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, for the licensees failure to adequately assess the increase in risk that may result from proposed maintenance activities. Specifically, the team identified that since 2012, the licensee failed to adequately assess the risk of simultaneously powering both RPS buses from the alternate power sources, which resulted in an increased risk of a reactor scram due to grid instabilities.

Description.

On November 27, 2015, while both RPS buses were aligned to the alternate power source, River Bend Station experienced a reactor scram due to a single phase fault in the Fancy Point switchyard. The fault caused a 65 milli-second voltage transient causing a voltage drop on both RPS buses. On January 9, 2016, another fault in the Fancy point switchyard caused an 89.9 milli-second grid transient causing a voltage drop on both RPS buses. Both of these events resulted in a reactor scram.

As a result of these events, the inspectors reviewed the protection system design criteria, drawings, procedures, and licensing basis to verify the adequacy of the protective strategy. The team also reviewed the licensees practices for assessing and managing risk, per 10 CFR 50.65(a)(4) and as described in the bases for TS 3.0.6, for periods when both RPS buses were aligned to the alternate power source.

The River Bend Station utilizes a quantitative, level-1 probabilistic safety analysis (PSA) computer model named Equipment Out of Service Monitor (EOOS). Licensee Procedure ADM-0096, Risk Management Program Implementation and On-line Maintenance Risk Assessment, Revision 316, implements the requirements of 10 CFR 50.65(a)(4) and provides guidance on how and when to perform risk assessments using quantitative and qualitative tools.

Section 5.3 of Procedure ADM-0096, Risk Assessment Overview, states the following regarding use of the EOOS computer model:

The Risk Assessment Program is a Risk-Informed Program, not a Risk Tool Based Program. This means that the quantitative results provided by the EOOS software must be blended with the qualitative guidance, in order to provide a complete risk picture of the situation. Decisions should never be made based on the EOOS quantitative results alone...Qualitative factors (such as industry operating experience, personnel judgment, etc.) must also be used for fully assessing the effects of equipment out of service on plant risk.

Contrary to this, the licensee found the change from the normal RPS bus power source lineup to the alternate source lineup to be below the level of detail in EOOS and made no changes to the overall risk assessment because of the limitations of the PRA model.

The team reviewed Procedure ADM-0096 for guidance on limitations of the PRA model and noted section 5.2.3 stated the following:

When the quantitative assessment tool is not available or the assessment scope is outside the scope of the EOOS risk monitor, qualitative assessments shall be performed.

The team also reviewed NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4A. Section 11.3.7.1 of NUMARC 93-01 discusses establishing action thresholds based on qualitative considerations.

...This [qualitative] approach typically involves consideration of the following factors from the assessment:

• Duration of out-of-service condition, with longer duration resulting in increased exposure time to initiating events...

• The number of remaining success paths (redundant systems, trains, operator actions, recovery actions) available to mitigate the initiating events... The above factors can be used as the basis for establishment of a matrix or list of configurations and attendant risk management actions.

The team also noted that the original plant design contained a single transfer switch for both RPS buses, and that the normal position aligned both buses to the motor generator sets. The single switch was later replaced with one transfer switch for each RPS bus, which allowed each bus to be independently selected to either its normal or alternate supply. Along with this change, a note was added to Drawing GE-944E981, Elementary Diagram - RPS MG Set Control System. The note stated, Only one

(1) RPS bus at a time is to be powered from an alternate source except during shutdown when it is permissible for both buses to be powered from alternate sources at the same time.

In 2012, Engineering Change (EC) 40848 established the acceptability of powering the RPS bus from an alternate source and removed the note in GE-944E981. The licensee concluded that EC 40848 did not change the normal lineup.

Specifically, in EC 40848, the licensee stated that:

EC 40848 establishes the acceptability of this lineup and removes the previously mentioned note from the Elementary Diagram.

Aligning both RPS buses to the alternate supplies is not the normal lineup. EC 40848 does not change the normal lineup. When RPS buses are aligned to the alternate supplies, protection from switching transients is provided by the alternate supply power line conditioners. Protection of safety related components is provided by the alternate supply electrical protection assemblies. Therefore EC 40848 does not adversely affect the design function or the method for controlling or performing the design function of the RPS power supply described in the UFSAR.

EC 40848 also specified that aligning both RPS buses to the alternate source is acceptable for emergent plant conditions, and that alternate supply power line conditioners (transformers) provide protection from switching transients. The inspectors observed, however, that the alternate supply electrical protection assemblies are for sustained degraded voltages and do not afford any protection for momentary transients. The motor generator sets are designed to maintain voltage for a minimum of one second following a loss of power, whereas the transformers have a one cycle (0.017 seconds) response time. The response time of the transformers did not provide a buffer from a switchyard voltage transient and allowed RPS bus voltage to drop in rapid succession following a grid transient. As a result, on November 27, 2015, the plant did not show protection for inadvertent reactor scrams due to short duration grid transients.

The inspectors also noted that two additional licensee documents contained applicable information and guidance regarding RPS bus power supply alignment.

System Design Criteria SDC-508, Reactor Protection System Design Criteria, Revision 2, stated that the RPS Power Supply is designed to prevent auxiliary power system switching transients from causing an inadvertent reactor scram due to a transient disturbance of power to the reactor scram logic. This protection is normally accomplished by the RPS MG sets. Procedure SOP-0079, Reactor Protection System, Revision 33, stated in the precautions and limitations section, With the reactor online, the preferred power source for the RPS buses is the Motor Generator Sets due to the superior protection from unintended actuations caused by voltage transients. While not the preferred lineup, simultaneously supplying both RPS buses from the alternate sources is allowed if required by emergent plant conditions.

From November 19, 2014, until January 9, 2016, unresolved reliability issues associated with the RPS MG sets resulted in the licensee maintaining an alignment of both RPS buses to the alternate power sources for significant time periods, a condition for which the licensee failed to perform an adequate risk assessment. From February 2015 to January 9, 2016, the root cause evaluation performed under CR-RBS-2015-8463 noted that both RPS buses were aligned to the alternate power source for 196 days. The team determined that the licensee failed to adequately include the qualitative risk considerations referenced above when assessing the risk associated with establishing and maintaining an alignment to the alternate power source for the RPS buses for a prolonged period, which was not consistent with the design basis and procedural guidance.

Analysis.

The team determined that the licensees failure to adequately assess the increase in risk associated with simultaneously powering both RPS buses from the alternate power sources was a performance deficiency. The performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Initiating Events and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the performance deficiency resulted in an increased risk of a reactor scram due to grid instabilities. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 1, Initiating Events Screening Questions, a detailed risk evaluation was required since the finding resulted in a reactor scram and main steam isolation valve closure.

Using Section 7 of Inspection Manual Chapter 0612 Appendix E, Examples of Minor Issues, the team determined that the risk assessments failure to account for (at least qualitatively) the loss or significant, uncompensated impairment of a key operating or shutdown safety function provided a further basis for the performance deficiency being more than minor. Specifically, the licensees failure to account for the increased risk associated with grid instabilities having an adverse effect on components powered from the RPS buses represented a significant, uncompensated impairment.

The team also determined that the licensees failure to consider the factors associated with qualitative risk assessment from Section 11.3.7.1 of NUMARC 93-01 is also consistent with the IMC 0612 Appendix E examples of more than minor performance deficiencies associated with the Maintenance Rule.

The finding was evaluated using Inspection Manual Chapter 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process, Flowchart 1, Assessment of Risk Deficit, dated May 19, 2005, to assess the significance of the finding. The analyst used the Standardized Plant Analysis Risk model for River Bend Station, Revision 8.20, run on SAPHIRE, Version 8.1.2, to estimate the incremental core damage probability deficit. In this estimate, the analyst assumed that the licensee powered both divisions of the reactor protection system from unfiltered offsite power, and not the reactor protection system motor generator sets, for 196 days. During this time, power to the reactor protection system was more sensitive to grid perturbations. The analyst assumed that the occurrence of two reactor scrams, one of which resulted in closure of the main steam isolation valves, in those 196 days was representative of the normal occurrence frequency of grid perturbations which would cause these events. From this the analyst derived a new, higher scram and loss of condenser heat sink frequency and applied these higher values to estimate an incremental core damage probability deficit. The new scram frequency applied was 3.7 per year, and the new loss of condenser heat sink frequency was 1.9 per year. Application of these assumptions yielded an incremental core damage probability deficit of 2.0E-7. Incremental large early release probability deficit was estimated using Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, to be 4.0E-8. Since this incremental core damage probability deficit was less than 1E-6 and the incremental large early release probability deficit was less than 1E-7, the analyst used Flowchart 1 to determine the finding was of very low safety significance (Green).

This finding has a conservative bias cross-cutting aspect within human performance area because the licensee found the change from the normal lineup to the alternate sources below the level of detail in EOOS and incorrectly determined that powering both RPS buses from the alternate source instead of the motor generator sets was safe even though the motor generator sets are the preferred source and provide protection against grid perturbations. [H.14]

Enforcement.

Title 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, paragraph (a)(4), requires, in part, that before performing maintenance activities (including but not limited to surveillance, post-maintenance testing, and corrective and preventive maintenance) the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities. Contrary to the above, from 2012, to January 9, 2016, the licensee failed to adequately assess and manage the increase in risk that may result from proposed maintenance activities before performing maintenance activities.

Specifically, the licensee failed to assess the increase in risk associated with performing maintenance activities for significant time periods while in the system configuration of powering both RPS buses form the alternate source, which represented an increased risk of an inadvertent reactor scram due to grid instabilities. The licensee entered this into their corrective action program as Condition Report CR-RBS-2016-3176. The licensee implemented corrective actions to revise Procedure SOP-0079 to include precautions to address the increased risk associated with supplying both RPS buses from the alternate power source.

Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2016009-04, Failure to Adequately Assess Risk During Motor Generator Set Unavailability.

4OA3 Follow-up of Events and Notices of Enforcement Discretion

.1 (Closed) Licensee Event Report 05000458/2015-009-00:

Automatic Reactor Scram Due to Partial Loss of Offsite Power Caused by Fault in Local 230kV Switchyard On November 27, 2015, with the plant operating at 100 percent power, an automatic reactor scam occurred following the loss of power to both divisions of the reactor protection system (RPS). This condition resulted from a single phase fault in the local 230kV switchyard. Due to powering both RPS buses from the alternate source, the fault caused a voltage transient on the in-plant switchgear sufficient to trip the scram relays in the Division 2 RPS, resulting in a half scram. The protective relays for the switchyard caused breakers connected to the north 230kV bus to trip causing the reserve station service line number one to de-energize. This resulted in the loss of the Division 1 RPS bus and a full scram. The inspectors reviewed the LER associated with the event and determined that the report adequately documented the summary of the event, including the cause and potential safety consequences. The inspectors issued a Green non-cited violation of 10 CFR 50.65(a)(4) for the licensees failure to adequately access the risk associated with powering both RPS buses from the alternate power source. This finding is discussed in Section 2.11.d of this report. LER 05000458/2015-009-00 is closed.

.2 (Closed) Licensee Event Report 05000458/2016-002-00:

Automatic Reactor Scram and Division 2 Primary Containment Isolation Due to Offsite Grid Electrical Transient On January 9, 2016, with the plant operating at 100 percent power, an automatic reactor scram occurred concurrent with the closure of all main steam isolation valves (MSIV). This condition resulted from an electrical transient caused by a phase-to-phase fault on a 230kV transmission line. Due to powering both RPS buses from the alternate source, the fault caused a momentary decrease in the voltage on both reactor protection buses, which also powered the MSIV control solenoids, resulting in a full reactor scram and MSIV closure. The inspectors reviewed the LER associated with the event and determined that the report adequately documented the summary of the event, including the cause and potential safety consequences. The inspectors issued a Green non-cited violation of 10 CFR Part 50, Criterion XVI, for the licensees failure to take corrective actions to prevent the recurrence of a significant condition adverse to quality. This finding is discussed in Section 2.11.c of this report. LER 05000458/2016-002-00 is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On February 12, 2016, the team debriefed Mr. E. Olson, Site Vice President, and other members of the licensee's staff. The licensee representatives acknowledged the findings and observation presented.

On April 14, 2016, the team conducted an exit meeting with Mr. M. Chase, Director, Regulatory Assurance and Performance Improvement, and other members of the licensees staff. The licensee representatives acknowledged the findings presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

E. Olson, Site Vice President

J. Clark, Manager, Regulatory Affairs

T. Gates, Assistant Manager, Operations

K. Huffstatler, Senior Licensing Engineer

NRC Personnel

S. Makor, Acting Senior Resident Inspector

R. Deese, Senior Reactor Analyst

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Closed

05000458/2015-009-00 LER Automatic Reactor Scram Due to Partial Loss of Offsite Power Caused by Fault in Local 230kV Switchyard(Section 4OA3)

05000458/2016-002-00 LER Automatic Reactor Scram and Division 2 Primary Containment Isolation Due to Offsite Grid Electrical Transient (Section 4OA3)

Opened and Closed

05000458/2016009-01 NCV Failure to Follow Procedure While Installing Jumpers for Shutdown Cooling (Section 2.11.a)

05000458/2016009-02 NCV Failure to Establish Adequate Procedural Guidance (Section 2.11.b)

05000458/2016009-03 NCV Failure to Implement Corrective Actions to Prevent the Recurrence of a Reactor Scram Due to Grid Disturbances (Section 2.11.c)

05000458/2016009-04 NCV Failure to Adequately Assess Risk During Motor Generator Set Unavailability (Section 2.11.d)