Issue Date: 1/17/02

NRC Inspection Manual IIPB

# Inspection Procedure 95001

Table Of Contents

- 95001-01 Inspection Objective
- 95001-02 Inspection Requirements
- 95001-03 Inspection Guidance
- 95001-04 Resource Estimate

## Inspection for One or Two White Inputs
in a Strategic Performance Area

PROGRAM APPLICABILITY: | 2515

CORNERSTONE: | ALL

INSPECTION BASIS: | The NRC's revised inspection program includes three parts: baseline inspections; generic safety issues and special inspections; and supplemental inspections performed as a result of risk significant performance issues. The inspection program is designed to apply NRC inspection assets in an increasing manner when risk significant performance issues are identified, either by inspection findings evaluated using the significance determination process (SDP) or when performance indicator thresholds are exceeded. Accordingly, following the identification of an inspection finding categorized as risk significant (i.e., white, yellow, or red) via the SDP, or when a performance indicator exceeds the "licensee response band" threshold, the NRC regional office will perform supplemental inspection(s). The scope and breadth of these inspections will be based upon the guidance provided in the NRC's assessment "Action Matrix" and the Supplemental Inspection Table (included in 2515 Appendix B). The supplemental inspection program is designed to support the NRC's goals of maintaining safety, enhancing public confidence, improving the effectiveness and efficiency of the regulatory process, and reducing unnecessary regulatory burden. This procedure provides the supplemental response for one or two White inputs in a strategic performance area. The guidance provided in this procedure was developed with consideration of the following boundary conditions: supplemental inspection will not be done for single or multiple green issues;
| supplemental inspection will not be done for single or multiple green issues; the baseline inspection procedure for identification and resolution of problems is independent of the supplemental response; the inspection requirements contained in this procedure will be completed for each White issue and are the same regardless of whether the issue emanated from a performance indicator or from an inspection finding; new examples of performance issues resulting from supplemental inspections will be evaluated and categorized in a similar manner to that of the baseline inspection program using the significance determination process.

### 95001-01 Inspection Objective

01.01 | To provide assurance that the root causes and contributing causes of risk significant performance issues are understood.
01.02 | To provide assurance that the extent of condition of risk significant performance issues is identified.
01.03 | To provide assurance that licensee corrective actions to risk significant performance issues are sufficient to address the root causes and contributing causes, and to prevent recurrence.

### 95001-02 Inspection Requirements

In order to provide for adequate protection of public health and safety, once a risk significant performance issue is identified, the NRC needs to ensure that licensees take actions to identify the causes of the performance issue and preclude repetition. The most effective and efficient way for the NRC to accomplish this objective is allow the licensee the opportunity to perform their own evaluation of the performance issue, and then perform a review of the licensee's evaluation. The following inspection requirements represent a comprehensive set of attributes related to problem identification, root cause analysis, and establishment of corrective actions.

In order to ensure that the causes of the performance issue are identified and that effective corrective actions are taken to prevent recurrence, it is expected that the licensee's evaluation will generally need to address each of the inspection requirements; however, the depth of the licensee's analysis may vary depending on the significance and complexity of the issue(s). In some cases, the answers to specific inspection requirements will be self-evident with little additional review or analysis required.

In completing this inspection procedure, it is not intended that NRC inspectors perform an independent evaluation of the performance issue, nor is the intent to merely verify that an evaluation has been performed without assessing its adequacy. Rather, inspectors should sufficiently challenge aspects of the licensee's evaluation, as necessary to ensure that the cause(s) of the performance issues have been identified and that appropriate corrective actions have been taken to prevent recurrence. Inspectors may utilize information previously obtained as part of the baseline inspection program to fulfill the inspection requirements; however, the inspection report associated with this inspection should contain the NRC's assessment of the licensee's evaluation for each inspection requirement. The results of this inspection should be documented in accordance with the specific guidance contained in IMC 0612 (formerly 0610*) for documenting supplemental inspections.

Significant weaknesses in the licensee's actions to address the performance issue may be subject to additional agency actions, including additional enforcement actions or an expansion of this procedure as necessary to independently acquire the information necessary to satisfy the inspection requirements. In general, licensees should be given an opportunity to correct any identified deficiencies prior to re-inspection. Also, for inspection findings, the original performance issue will remain open and will not be removed from the action matrix until the weaknesses are addressed and corrected. For significant weaknesses in the licensee's actions to address a performance issue that is associated with a performance indicator, a parallel inspection finding will be opened and given the same color as the PI; however, the finding will not be double counted in the action matrix. Also, for those performance indicators that include fault exposure hours, the provision contained in NEI 99-02 to remove the fault exposure hours after four quarters requires successful closure of any open items identified during this inspection. Programmatic weaknesses associated with the licensee's evaluation of the performance issue will also be documented in the inspection report and additional focus will be given to those areas during the next annual problem identification and resolution baseline inspection.

Should new or additional examples of performance issues (non-programmatic) be identified by this inspection or by the licensee during their evaluation, the new issues will be categorized using the SDP and the corresponding supplemental inspection procedure will be performed. Supplemental inspections will also be performed if additional examples of performance issues are reported via performance indicators (PIs) that result in crossing a new PI threshold. Additional supplemental inspections will generally not be performed if the new or additional examples of performance issues reported via PIs do not result in crossing a new PI threshold.

The following inspection requirements are generally applicable for both single inspection findings and for performance issues reported by PIs that might represent more than one independent event (e.g. four scrams). In the case where the white performance issue is due to multiple events or occurrences, it is expected that the licensee's evaluation would address each of the events or occurrences. This could be accomplished either by doing independent evaluations for each occurrence or by doing one collective evaluation.

02.01 | Problem Identification
| a. Determine that the evaluation identifies who (i.e. licensee, self revealing, or NRC), and under what conditions the issue was identified.
| b. Determine that the evaluation documents how long the issue existed, and prior opportunities for identification.
| c. Determine that the evaluation documents the plant specific risk consequences (as applicable) and compliance concerns associated with the issue.
02.02 | Root Cause and Extent of Condition Evaluation
| a. Determine that the problem was evaluated using a systematic method(s) to identify root cause(s) and contributing cause(s).
| b. Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem.
| c. Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience.
| d. Determine that the root cause evaluation included consideration of potential common cause(s) and extent of condition of the problem.
02.03 | Corrective Actions
| a. Determine that appropriate corrective action(s) are specified for each root/contributing cause or that there is an evaluation that no actions are necessary.
| b. Determine that the corrective actions have been prioritized with consideration of the risk significance and regulatory compliance.
| c. Determine that a schedule has been established for implementing and completing the corrective actions.
| d. Determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

### 95001-03 Inspection Guidance

General Guidance

This inspection procedure is designed to be used to assess the adequacy of the licensee's evaluation of White issues. As such, a reasonable time (generally within 30-60 days) should be allowed for the licensee to complete their evaluation; however, all corrective actions may not be fully completed upon commencement of this procedure. Implementation of these corrective actions may be verified during subsequent baseline inspections such as the annual problem identification and resolution.

The following sections of the procedure are provided as guidance to help the inspector fulfill the specific inspection requirements contained in section 02 above. It is not intended that the inspector verify that the licensee's evaluation of the White issue contains every attribute contained in the inspection guidance section. The intent is that the inspector use the guidance sections of the procedure to look for weaknesses in the licensee's evaluation that might indicate an issue associated with one of the inspection requirements.

Definitions

Root Cause(s) are defined as the basic reason(s) (i.e., hardware, process, human performance), for a problem, which if corrected, will prevent recurrence of that problem.

Contributing Cause(s) are defined as causes that by themselves would not create the problem, but are important enough to be recognized as needing corrective action. Contributing causes are sometimes referred to as causal factors. Causal factors are those actions, conditions, or events which directly or indirectly influence the outcome of a situation or problem.

Repeat occurrences are defined as two or more independent conditions which are the result of the same basic causes.

Common Cause is defined as multiple failures (i.e., two or more) of plant equipment or processes attributable to a shared cause.

Extent of Condition is defined as the extent to which the root causes of an identified problem have impacted other plant processes, equipment, or human performance.

Consequences are defined as the actual or potential outcome of an identified problem or condition.

Specific Guidance

03.01 | Problem Identification
| a. The evaluation should state how and by whom the issue was identified. When appropriate, failure of the licensee to identify the problem at a precursor level should be evaluated. Specifically, the failure of the licensee to identify a problem at an early stage may be indicative of a more substantial problem. Examples would include a failure of the licensee's staff to enter a recognized non-compliance into the corrective action program, or raise safety concerns to management, or the failure to complete corrective actions for a previous problem resulting in further degradation. If the NRC identified the White issue, the evaluation should address why licensee processes such as peer review, supervisory oversight, inspection, testing, self assessments, or quality activities did not identify the problem.
| b. The evaluation should state when the problem was identified, how long the condition(s) existed, and whether there were prior opportunities for correction. For example, if a maintenance activity resulted in an inoperable system that was not detected by post-maintenance testing or by quality assurance oversight, the reasons that the testing and quality oversight did not detect the error should be included in the problem identification statement and addressed in the root cause evaluation.
| c. The evaluation should address the plant specific risk consequences of the issue. A plant specific assessment may better characterize the risk associated with the White issue due to the generic nature of the performance indicators. For conditions that are not easily assessed quantitatively, such as the unavailable of security equipment, a qualitative assessment should be completed. The evaluation should also include an assessment of compliance. As applicable, some events may be more appropriately assessed as hazards to plant personnel or the environment. The inspector's review of the risk assessment should be coordinated with the Senior Reactor Analyst.
03.02 | Root Cause and Extent of Condition Evaluation
| a. The licensee's evaluation should generally make use of a systematic method(s) to identify root cause(s) and contributing cause(s). The root cause evaluation methods that are commonly used in nuclear facilities are:
| Events and causal factors analysis -- to identify the events and conditions that led up to an event; Fault tree analysis -- to identify relationships among events and the probability of event occurrence; Barrier analysis -- to identify the barriers that, if present or strengthened, would have prevented the event from occurring; Change analysis -- to identify changes in the work environment since the activity was last performed successfully that may have caused or contributed to the event; Management Oversight and Risk Tree (MORT) analysis -- to systematically check that all possible causes of problems have been considered; and Critical incident techniques -- to identify critical actions that, if performed correctly, would have prevented the event from occurring or would have significantly reduced its consequences.
| The licensee may use other methods to conduct the root cause evaluations. A systematic evaluation of a problem using one of the above methods should normally include:
| A clear identification of the problem and the assumptions made as a part of the root cause evaluation. For example, the evaluation should describe the initial operating conditions of the system/component identified, staffing levels, and training requirements as applicable. A timely collection of data, verification of data, and preservation of evidence to ensure that the information and circumstances surrounding the problem are fully understood. The analysis should be documented such that the progression of the problem is clearly understood, any missing information or inconsistencies are identified, and the problem can be easily explained/understood by others. A determination of cause and effect relationships resulting in an identification of root and contributory causes which consider potential hardware, process, and human performance issues. For example: |
| -hardware issues could include design, materials, systems aging, and environmental conditions; -process issues could include procedures, work practices, operational policies, supervision and oversight, preventive and corrective maintenance programs, and quality control methods; and -human performance issues could include training, communications, human system interface, and fitness for duty. |
| b. The root cause evaluation should be conducted to an adequate level of detail, considering the significance of the problem.
| Different root cause evaluation methods provide different perspectives on the problem. In some instances, using a combination of methods helps to ensure the analysis is thorough. Therefore, the root cause evaluation should consider evaluating complex problems which could result in significant consequences using multi-disciplinary teams and/or different and complimentary methods appropriate to the circumstances. For example, problems that involve hardware issues may be evaluated using barrier analysis, change analysis, or fault trees. |
| The depth of a root cause evaluation is normally achieved by repeatedly asking the question "Why?" about the occurrences and circumstances that caused or contributed to the problem. Once the analysis has developed all of the causes for the problem (i.e., root, contributory, programmatic), the evaluation should also look for any relationships among the different causes. The depth of the root cause evaluation may be assessed by:
| Determining that the questioning process appeared to have been conducted until the causes were beyond the licensee's control. For example, problems that were initiated by an act of nature, such as a lightning strike or tornado, could have the act of nature as one of the causes of the problem. However, the act of nature would not be a candidate root cause, in part, because the licensee could not prevent it from happening again. However, a licensee's failure to plan for or respond properly to acts of nature would be under management control and could be root causes for the problem. Determining that the problem was evaluated to ensure that other root and contributing causes were not inappropriately ruled out due to assumptions made as a part of the analysis. For example, a root cause evaluation may not consider the adequacy of the design or process controls for a system if the problem appears to be primarily human performance focused. Consideration of the technical appropriateness of the evaluation assumptions and their impact on the root causes would also be appropriate. Determining that the evaluation collectively reviewed all root and contributory causes, for indications of higher level problems with a process or system. For example, a problem that involved a number of procedural inadequacies or errors may indicate a more fundamental or higher level problem in the processes for procedural development, control, review, and approval. Issues associated with personnel failing to follow procedures may also be indicative of a problem with supervisory oversight and communication of standards. Determining that the root cause evaluation properly ensures that correcting the causes would prevent the same and similar problems from happening again or sufficiently minimizes the chances of re-occurrence. Complex problems may have more than one root cause as well as several contributory causes. The evaluation should include checks to ensure that corrections for the identified root causes do not rely on unstated assumptions or conditions which are not controlled or ensured. For example, root causes based upon normal modes of operation may not be valid for accident modes or other "off normal" modes of operation. Determining that the evaluation appropriately considered other possible root causes. Providing a rationale for ruling out alternative possible root cause(s) helps to ensure the validity of the specific root cause(s) that are identified.

c. The root cause evaluation should include a proper consideration of repeat occurrences of the same or similar problems at the facility and knowledge of prior operating experience. This review is necessary to help in developing the specific root and contributing causes and also to provide indication as to whether the White issue is due to a more fundamental concern involving weaknesses in the licensee's corrective action program.

The evaluation should:

- Broadly question the applicability of other similar events or issues with related root or contributory causes.
  For example, root cause evaluations associated with outage activities and safety related systems could include a review of prior operating experience involving off-normal operation of systems, unusual system alignments, and infrequently performed evolutions.
- Assess whether previous root cause evaluations and/or corrective actions missed or inappropriately characterized the issues and what aspects of the prior corrective actions did not preclude reoccurrence of the problem.
  For example, the evaluation should review the implementation of the previously specified corrective actions and a reassessment of the identified root causes to determine process or performance errors which may have contributed to the repeat occurrence.
- Determine if the root cause evaluation for the current problem specifically addresses those aspects of the prior root cause evaluation or corrective actions that were not successfully addressed.
  For example, if during the review of a tagging error that resulted in a mis-positioned valve the licensee determines that a previous similar problem occurred and the corrective actions only focused on individual training, then the root cause for the repeat occurrence should evaluate why the previous corrective actions were inadequate.
- Include a review of prior documentation of problems and their associated corrective actions to determine if similar incidents have occurred in the past.
  For example, the licensee should consider in its review of prior operating experience internal self-assessments, maintenance history, adverse problem reports, and external data bases developed to identify and track operating experience issues. Examples of external data bases may include Information Notices, Generic Letters, and vendor/industry generic communications.
  The inspectors should discuss the problem and associated root causes with other resident, regional, or headquarters personnel associated with the facility to assess whether other similar problems or root causes for dissimilar problems have occurred at the facility that should have been considered.

d. The root cause evaluation should include a proper consideration of the extent of condition of the problem including whether other systems, equipment, programs or conditions could be effected. The evaluation should:

- Assess the applicability of the root causes across disciplines or departments, for different programmatic activities, for human performance, or for different types of equipment.
  For example, the Fire-Protection Organization considered that the root causes identified for the mis-alignment associated with the safety injection system could potentially affect their systems since they shared a common tagging and alignment method with operations. As a result, feedback was provided to the incident review committee to include modification of the Fire-Protection control procedure, and provide formal training to all Fire-Protection personnel.

03.03 | Corrective Actions
| The proposed corrective actions to the root and contributing causes should:
| a. Address each of the root and contributing causes to the White issue and the extent of condition of the issue. The corrective actions should be clearly defined. Examples of corrective actions may include, but are not limited to, modifications, inspections, testing, process or procedure changes, and training. The proposed corrective actions should not create new or different problems as a result of the corrective action. If the licensee determines that no corrective actions are necessary, the basis for this decision should be documented in the evaluation.
| b. Include consideration of the results of the licensee's risk assessment of the issue in prioritizing the type of corrective action chosen. Attention should be given to solutions that involve only changing procedures or providing training as they are sometimes over-utilized. In such cases, consideration should be given to more comprehensive corrective actions such as design modifications. The corrective action plan should also include a review of the regulations to ensure that if compliance issues exist, the plan achieves compliance. Also, the licensee should ensure that:
| c. The corrective actions are assigned to individuals or organizations that are appropriate to ensure that the actions are taken in a timely manner. Also, the licensee should ensure that there is a formal tracking mechanism established for each of the specific corrective actions.
| d. A method exists to validate the effectiveness of the overall corrective action plan. Specifically, a method should be established to measure, either quantitatively or qualitatively, the effectiveness of the corrective actions. Effective methods would include, but are not limited to, assessments, audits, inspections, tests, and trending of plant data, or follow-up discussions with plant staff.

### 95001-04 Resource Estimate

It is estimated that this procedure will take between 16 and 40 man-hours to complete for each White issue. The inspector or inspectors assigned should be familiar with the discipline associated with the subject of the licensee's evaluation. For planning purposes, a resource estimate near the lower end of the scale should be used for licensees with corrective actions programs that have been determined to be thorough during the annual inspection for the identification and resolution of problems. For licensees with corrective action programs that have been previously determined to be ineffective, a resource estimate near the higher end of the scale should be used.

END