Issue Date: 1/17/02

NRC Inspection Manual IIPB


Inspection Procedure 95002


Table Of Contents


Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area

PROGRAM APPLICABILITY: 2515
CORNERSTONES: ALL
INSPECTION BASIS: The NRC's revised inspection program includes three parts: baseline inspections; generic safety issues and special inspections; and supplemental inspections performed as a result of risk significant performance issues. The inspection program is designed to apply NRC inspection assets in an increasing manner when risk significant performance issues are identified, either by inspection findings evaluated using the significance determination process (SDP) or when performance indicator thresholds are exceeded. Accordingly, following the identification of an inspection finding categorized as risk significant (i.e., white, yellow, or red) via the SDP, or when a performance indicator exceeds the "licensee response band" threshold, the NRC regional office will perform supplemental inspection(s). The scope and breadth of these inspections will be based upon the guidance provided in the NRC's assessment "Action Matrix" and the Supplemental Inspection Table (included in 2515 Appendix B). The supplemental inspection program is designed to support the NRC's goals of maintaining safety, enhancing public confidence, improving the effectiveness and efficiency of the regulatory process, and reducing unnecessary regulatory burden.

This procedure provides the supplemental response for one degraded cornerstone or three White inputs in a strategic performance area. The guidance provided in this procedure was developed with consideration of the following boundary conditions:
  • supplemental inspection will not be done for single or multiple green issues;
  • the baseline inspection procedure for identification and resolution of problems is independent of the supplemental response;
  • the inspection requirements contained in this procedure will be completed whenever a degraded cornerstone or three white issues in a strategic performance area is identified and are the same regardless of whether the issues emanated from performance indicators or from inspection findings;
  • new examples of performance issues resulting from supplemental inspections will be evaluated and categorized in a similar manner to that of the baseline inspection program using the significance determination process.

95002-01 Inspection Objective

01.01 To provide assurance that the root causes and contributing causes are understood for individual and collective (multiple white inputs) risk significant performance issues.
01.02 To independently assess the extent of condition for individual and collective (multiple white inputs) risk significant performance issues.
01.03 To provide assurance that licensee corrective actions to risk significant performance issues are sufficient to address the root causes and contributing causes, and to prevent recurrence.

95002-02 Inspection Requirements

The following inspection requirements relate to the minimum set of information that the NRC will generally need to acquire in order to assure that the causes of risk significant performance issues are identified and that appropriate corrective actions are taken to prevent recurrence. While the inspection requirements are generally written to address individual performance issues, the procedure may also be utilized to assess the adequacy of licensee's evaluations associated with multiple performance issues. While these inspection requirements do not necessarily represent NRC requirements for the licensee, significant weaknesses in the licensee's evaluation may require that the NRC conduct additional inspections to acquire the information independently. It is recognized that the depth of the licensee's evaluation may vary depending on the significance and complexity of the issues. In some cases, the answers to specific inspection requirements will be self-evident with little additional review or analysis required by the inspectors. This procedure also requires an independent NRC inspection to inspect the adequacy of the licensee's extent of condition determination. The inspection report associated with this inspection should contain the NRC's assessment of the licensee's evaluation for each inspection requirement.

Significant weaknesses in the licensee's evaluation of the performance issue may be subject to additional agency actions, including additional enforcement actions or an expansion of this procedure as necessary to independently acquire the information necessary to satisfy the inspection requirements. In general, licensee's should be given an opportunity to correct any identified deficiencies prior to re-inspection. Also, for inspection findings, the original performance issue will remain open and will not be removed from the action matrix until the weaknesses in the evaluation are addressed and corrected. For significant weaknesses in the licensee's evaluation of a performance issue that is associated with a performance indicator, a parallel inspection finding will be opened and given the same color as the PI; however, the finding will not be double counted in the action matrix. Also, for those performance indicators that include fault exposure hours, the provision contained in NEI 99-02 to remove the fault exposure hours after four quarters requires successful closure of any open items identified during this inspection. Programmatic weaknesses associated with the licensee's evaluation of the performance issue will also be documented in the inspection report and additional focus will be given to those areas during the next annual problem identification and resolution baseline inspection.

Should new or additional examples of performance issues (non-programmatic) be identified by this inspection or by the licensee during their evaluation, the new issues will be categorized using the SDP and the corresponding supplemental inspection procedure will be performed. Supplemental inspections will also be performed if additional examples of performance issues are reported via performance indicators (PIs) that result in crossing a new PI threshold. Additional supplemental inspections will generally not be performed if the new or additional examples of performance issues reported via PIs do not result in crossing a new PI threshold.

The following inspection requirements are generally applicable for single inspection findings, multiple inspection findings, and for performance issues reported by PIs that might represent more than one independent event (e.g. multiple scrams). The scope of this inspection should include all white or yellow performance issues (inspection findings or PIs) in the associated degraded cornerstone or strategic performance area. For example, if this procedure is being performed due to a yellow PI in the mitigating systems cornerstone, the inspection scope should also include any white PIs or inspection findings in that cornerstone. If the procedure is being performed due to three white PIs in the reactor safety strategic performance area, the inspection scope should include all white PIs in the reactor safety strategic performance area.

In the case where a performance indicator is associated with multiple events or occurrences, or for evaluations of multiple performance issues, it is expected that the licensee's evaluation would address each of the events or occurrences collectively, as well as individually. In those instances where the licensee's evaluation was previously reviewed as part of Inspection Procedure 95001, a re-review of the evaluation during this procedure is not required; however, a review of the licensee's collective evaluation for multiple performance issues would generally need to be performed.

02.01 Problem Identification
a. Determine that the evaluation identifies who (i.e. licensee, self revealing, or NRC), and under what conditions the issue was identified.
b. Determine that the evaluation documents how long the issue existed, and prior opportunities for identification.
c. Determine that the evaluation documents the plant specific risk consequences (as applicable) and compliance concerns associated with the issue(s) both individually and collectively.
02.02 Root Cause and Extent of Condition Evaluation
a. Determine that the problem was evaluated using a systematic method(s) to identify root cause(s) and contributing cause(s).
b. Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem.
c. Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience.
d. Determine that the root cause evaluation included consideration of potential common cause(s) and extent of condition of the problem.
02.03 Corrective Actions
a. Determine that appropriate corrective action(s) are specified for each root/contributing cause or that there is an evaluation that no actions are necessary.
b. Determine that the corrective actions have been prioritized with consideration of the risk significance and regulatory compliance.
c. Determine that a schedule has been established for implementing and completing the corrective actions.
d. Determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.
02.04 Independent Assessment of Extent of Condition and Generic Implications. Perform a focused inspection(s) to independently assess the validity of the licensee's conclusions regarding the extent of condition of the issues. In order to accomplish this objective, the inspection team leader should develop a customized inspection plan using the applicable portions of the inspection procedure(s) listed in Appendix B to Inspection Manual 2515. The objective should be to independently sample performance, as necessary to provide assurance that the licensee's evaluation regarding extent of condition is sufficiently comprehensive. The intent is not to re-perform the licensee's evaluation, but is to assess the validity of the licensee's evaluation by independently sampling performance within the key attributes of the cornerstone(s) that are related to the subject performance issue. The results of the NRC's review of extent of condition should be documented in this inspection report, including the NRC's assessment of the licensee's evaluation in this area.

95002-03 Inspection Guidance

General Guidance

This inspection procedure is designed to be used to assess the adequacy of the licensee's evaluation of risk significant performance issues. As such, a reasonable time (generally within 30-60 days) should be allowed for the licensee to complete their evaluation (or self assessment for multiple performance issues); however, all corrective actions may not be fully completed upon commencement of this procedure. Implementation of these corrective actions may be verified during subsequent baseline inspections such as the annual problem identification and resolution.

The following sections of this procedure are provided as guidance to help the inspector fulfill the specific inspection requirements contained in section 02. It is not intended that the inspector verify that the licensee's evaluation of the performance issues address every attribute contained in the inspection guidance section. The intent is that the inspector use the guidance sections of the procedure to look for weaknesses in the licensee's evaluation that might indicate an issue associated with one of the inspection requirements.

Definitions

Root Cause(s) are defined as the basic reason(s) (i.e., hardware, process, human performance), for a problem, which if corrected, will prevent recurrence of that problem.

Contributing Cause(s) are defined as causes that by themselves would not create the problem, but are important enough to be recognized as needing corrective action. Contributing causes are sometimes referred to as causal factors. Causal factors are those actions, conditions, or events which directly or indirectly influence the outcome of a situation or problem.

Repeat occurrences are defined as two or more independent conditions which are the result of the same basic cause(s).

Common Cause is defined as multiple failures (i.e., two or more) of plant equipment or processes attributable to a shared cause.

Extent of Condition is defined the extent to which the root causes of an identified problem have impacted other plant processes, equipment, or human performance.

Consequences are defined as the actual or potential outcome of an identified problem or condition.

Specific Guidance

Sections 03.01 through 03.03 apply to the licensee's evaluation of both individual and collective issues.

03.01 Problem Identification
a. The evaluation should state how and by whom the issue was identified. When appropriate, failure of the licensee to identify the problem at a precursor level should be evaluated. Specifically, the failure of the licensee to identify a problem before it becomes risk significant may be indicative of a more substantial problem. Examples would include a failure of the licensee's staff to enter a recognized non-compliance into the corrective action program, or raise safety concerns to management, or the failure to complete corrective actions for a previous problem resulting in further degradation. If the NRC identified the performance issue, the evaluation should address why licensee processes such as peer review, supervisory oversight, inspection, testing, self assessments, or quality activities did not identify the problem.
b. The evaluation should state when the problem was identified, how long the condition(s) existed, and whether there were prior opportunities for correction. For example, if a maintenance activity resulted in an inoperable system that was not detected by post-maintenance testing or by quality assurance oversight, the reasons that the testing and quality oversight did not detect the error should be included in the problem identification statement and addressed in the root cause evaluation.
c. The evaluation should address the plant specific risk consequences of the issues, both individually and collectively. A plant specific assessment may better characterize the risk associated with the White issue due to the generic nature of the performance indicators. For conditions that are not easily assessed quantitatively, such as the unavailability of security equipment, a qualitative assessment should be completed. The evaluation should also include an assessment of compliance. As applicable, some events may be more appropriately assessed as hazards to plant personnel or the environment. The inspector's review of the risk assessment should be coordinated with the Senior Reactor Analyst.
03.02 Root Cause Evaluation
a. The licensee's evaluation should generally make use of a systematic method(s) to identify root cause(s) and contributing cause(s). The root cause evaluation methods that are commonly used in nuclear facilities are:
  • Events and causal factors analysis -- to identify the events and conditions that led up to an event;
  • Fault tree analysis -- to identify relationships among events and the probability of event occurrence;
  • Barrier analysis -- to identify the barriers that, if present or strengthened, would have prevented the event from occurring;
  • Change analysis -- to identify changes in the work environment since the activity was last performed successfully that may have caused or contributed to the event;
  • Management Oversight and Risk Tree (MORT) analysis -- to systematically check that all possible causes of problems have been considered; and
  • Critical incident techniques -- to identify critical actions that, if performed correctly, would have prevented the event from occurring or would have significantly reduced its consequences.
The licensee may use other methods to conduct the root cause evaluations. A systematic evaluation of a problem using one of the above methods should normally include:
  • A clear identification of the problem and the assumptions made as a part of the root cause evaluation.

    For example, the evaluation should describe the initial operating conditions of the system/component identified, staffing levels, and training requirements as applicable.
  • A timely collection of data, verification of data, and preservation of evidence to ensure that the information and circumstances surrounding the problem are fully understood. The analysis should be documented such that the progression of the problem is clearly understood, any missing information or inconsistencies are identified, and the problem can be easily explained/understood by others.

    A determination of cause and effect relationships resulting in an identification of root and contributory causes which consider potential hardware, process, and human performance issues. For example:

    -hardware issues could include design, materials, systems aging, and environmental conditions;

    -process issues could include procedures, work practices, operational policies, supervision and oversight, preventive and corrective maintenance programs, and quality control methods; and

    -human performance issues could include training, communications, human system interface, and fitness for duty.
b. The root cause evaluation should be conducted to an adequate level of detail, considering the significance of the problem.
  • Different root cause evaluation methods provide different perspectives on the problem. In some instances, using a combination of methods helps to ensure the analysis is thorough. Therefore, the root cause evaluation should consider evaluating complex problems which could result in significant consequences using multi-disciplinary teams and/or different and complimentary methods appropriate to the circumstances. For example, problems that involve hardware issues may be evaluated using barrier analysis, change analysis, or fault trees.

    The depth of a root cause evaluation is normally achieved by repeatedly asking the question "Why?" about the occurrences and circumstances that caused or contributed to the problem. Once the analysis has developed all of the causes for the problem (i.e., root, contributory, programmatic), the evaluation should also look for any relationships among the different causes.
The depth of the root cause evaluation may be assessed by:
  • Determining that the questioning process appeared to have been conducted until the causes were beyond the licensee's control.

    For example, problems that were initiated by an act of nature, such as a lightning strike or tornado, could have the act of nature as one of the causes of the problem. However, the act of nature would not be a candidate root cause, in part, because the licensee could not prevent it from happening again. However, a licensee's failure to plan for or respond properly to acts of nature would be under management control and could be root causes for the problem.
  • Determining that the problem was evaluated to ensure that other root and contributing causes were not inappropriately ruled out due to assumptions made as a part of the analysis.

    For example, a root cause evaluation may not consider the adequacy of the design or process controls for a system if the problem appears to be primarily human performance focused. Consideration of the technical appropriateness of the evaluation assumptions and their impact on the root causes would also be appropriate.
  • Determining that the evaluation collectively reviewed all root and contributory causes, for indications of more fundamental problems with a process or system. This is particularly true when there is indications of multiple risk significant performance issues.

    For example, a problem that involved a number of procedural inadequacies or errors may indicate a more fundamental or higher level problem in the processes for procedural development, control, review, and approval. Issues associated with personnel failing to follow procedures may also be indicative of a problem with supervisory oversight and communication of standards.
  • Determining that the root cause evaluation properly ensures that correcting the causes would prevent the same and similar problems from happening again or sufficiently minimizes the chances of re-occurrence. Complex problems may have more than one root cause as well as several contributory causes. The evaluation should include checks to ensure that corrections for the identified root causes do not rely on unstated assumptions or conditions which are not controlled or ensured.
    For example, root causes based upon normal modes of operation may not be valid for accident modes or other "off normal" modes of operation.
  • Determining that the evaluation appropriately considered other possible root causes. Providing a rationale for ruling out alternative possible root cause(s) helps to ensure the validity of the specific root cause(s) that are identified.
c. The root cause evaluation should include a proper consideration of repeat occurrences of the same or similar problems at the facility and knowledge of prior operating experience. This review is necessary to help in developing the specific root and contributing causes and also to provide indication as to whether the White issue is due to a more fundamental concern involving weaknesses in the licensee's corrective action program.
The evaluation should:
  • Broadly question the applicability of other similar events or issues with related root or contributory causes.

    For example, root cause evaluations associated with outage activities and safety related systems could include a review of prior operating experience involving off-normal operation of systems, unusual system alignments, and infrequently performed evolutions.
  • Assess whether previous root cause evaluations and/or corrective actions missed or inappropriately characterized the issues and what aspects of the prior corrective actions did not preclude reoccurrence of the problem.

    For example, the evaluation should review the implementation of the previously specified corrective actions and a reassessment of the identified root causes to determine process or performance errors which may have contributed to the repeat occurrence.
  • Determine if the root cause evaluation for the current problem specifically addresses those aspects of the prior root cause evaluation or corrective actions that were not successfully addressed.

    For example, if during the review of a tagging error that resulted in a mis-positioned valve the licensee determines that a previous similar problem occurred and the corrective actions only focused on individual training, then the root cause for the repeat occurrence should evaluate why the previous corrective actions were inadequate.
  • Include a review of prior documentation of problems and their associated corrective actions to determine if similar incidents have occurred in the past.

    For example, the licensee should consider in its review of prior operating experience internal self-assessments, maintenance history, adverse problem reports, and external data bases developed to identify and track operating experience issues. Examples of external data bases may include Information Notices, Generic Letters, and vendor/industry generic communications.

    The inspectors should discuss the problem and associated root causes with other resident, regional, or headquarters personnel associated with the facility to assess whether other similar problems or root causes for dissimilar problems have occurred at the facility that should have been considered.
d. The root cause evaluation should include a proper consideration of the extent of condition of the problem including whether other systems, equipment, programs or conditions could be effected. The evaluation should:
  • Assess the applicability of the root causes across disciplines or departments, for different programmatic activities, for human performance, or for different types of equipment.

    For example, the Fire-Protection Organization considered that the root causes identified for the mis-alignment associated with the safety injection system could potentially affect their systems since they shared a common tagging and alignment method with operations. As a result, feedback was provided to the incident review committee to include modification of the Fire-Protection control procedure, and provide formal training to all Fire-Protection personnel.
03.03 Corrective Action
The proposed corrective actions to the root and contributing causes should:
a. Address each of the root and contributing causes to the White issue and the extent of condition of the issue. The corrective actions should be clearly defined. Examples of corrective actions may include, but are not limited to, modifications, inspections, testing, process or procedure changes, and training.

The proposed corrective actions should not create new or different problems as a result of the corrective action. If the licensee determines that no corrective actions are necessary, the basis for this decision should be documented in the evaluation.
b. Include consideration of the results of the licensee's risk assessment of the issue in prioritizing the type of corrective action chosen. Attention should be given to solutions that involve only changing procedures or providing training as they are sometimes over-utilized. In such cases, consideration should be given to more comprehensive corrective actions such as design modifications. The corrective action plan should also include a review of the regulations to ensure that if compliance issues exist, the plan achieves compliance.
Also, the licensee should ensure that:

c. The corrective actions are assigned to individuals or organizations that are appropriate to ensure that the actions are taken in a timely manner. Also, the licensee should ensure that there is a formal tracking mechanism established for each of the specific corrective actions.

d. A method exists to validate the effectiveness of the overall corrective action plan. Specifically, a method should be established to measure, either quantitatively or qualitatively, the effectiveness of the corrective actions. Effective methods would include, but are not limited to, assessments, audits, inspections, tests, and trending of plant data, or follow-up discussions with plant staff.

03.04 Independent Assessment of Extent of Condition
a. In choosing the inspection procedure(s) to assess the validity of the licensee's conclusions regarding extent of condition, consideration should be given to whether multiple risk significant performance issues have been identified. For those instances where multiple issues have been documented, a broad based inspection(s) which would assess performance across the associated strategic performance area should be considered. If this procedure is being performed due to a single yellow issue, a more focused inspection would likely be appropriate.

Consideration should also be given to the comprehensiveness of the licensee's evaluation(s). In those cases where significant weaknesses are identified in the licensee's evaluation(s) during implementation of paragraphs 02.01 through 02.03 of this procedure, consideration should be given to performing a more in-depth programmatic review of the licensee's corrective action program.

95002-04 Resource Estimate

The resources required to complete this procedure will vary greatly depending upon the specific procedure(s) chosen to independently assess the validity of the licensee's evaluation of extent of condition and generic implications. Generally it would be expected that the procedure could be completed within 40-240 hours.

END