IR 05000275/2005006

IR 05000275-05-006; IR 05000323-05-006; January 3 Through February 15, 2005; Diablo Canyon Nuclear Power Plant, Units 1 and 2: Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions

ML050910120
Person / Time
Site:	Diablo Canyon
Issue date:	03/31/2005
From:	Chamberlain D Division of Reactor Safety IV
To:	Rueger G Pacific Gas & Electric Co
References
IR-05-006
Download: ML050910120 (76)

Text

rch 31, 2005

SUBJECT:

DIABLO CANYON POWER PLANT, UNITS 1 AND 2 - NRC PILOT ENGINEERING INSPECTION REPORT 05000275/2005006; 05000323/2005006

Dear Mr. Rueger:

On February 15, 2005, the NRC completed an engineering team inspection at your facility. The inspection was conducted using Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions, and examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. In conducting the inspection, the team examined the adequacy of the facilitys design and design implementation for selected risk significant components and operator actions. The enclosed inspection report documents the inspection findings, which were discussed on February 15, 2005, with you and other members of your staff during a public exit meeting in San Luis Obispo, California. Following completion of additional review in the Region IV office, a final exit was held by telephone with you and other members of your staff on March 24, 2005, to provide an update on changes to the preliminary inspection findings.

The team concluded that, in general, the components and systems reviewed would be capable of performing their intended safety functions and that for the most part, sufficient design controls had been implemented for engineering work performed at your Diablo Canyon Nuclear Power Plant, Units 1 and 2. However, the team did identify a number of deficiencies during the course of the inspection which are discussed in the enclosed report.

The team found that your design basis is meticulously documented in most cases.

Our reviews indicated that appropriate surveillance tests were well-coordinated with the design basis to appropriately demonstrate that equipment continued to perform as it was intended.

Your engineering documents generally showed a clear policy of conservatism in your approach to engineering. The team also found that your staff is experienced, proficient, and knowledgeable of your design basis and practices.

Pacific Gas and Electric Company -2-Based on the results of this inspection, the NRC has identified eight issues that were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC has also determined that violations are associated with six of these issues.

These violations are being treated as noncited violations, consistent with Section VI.A of the Enforcement Policy. These noncited violations are described in the subject inspection report. If you contest the violation or significance of these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Diablo Canyon Nuclear Power Plant, Units 1 and 2 facility.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Dwight D. Chamberlain, Director Division of Reactor Safety Dockets: 50-275; 50-323 Licenses: DPR-80; DPR-82

Enclosures:

Inspection Report 05000275/2005-006; 05000323/2005-006 w/Attachment Supplemental Information

REGION IV==

Dockets: 50-275; 50-323 Licenses: DPR-80; DPR-82 Report No.: 05000275/2005006; 05000323/2005006 Licensee: Pacific Gas and Electric Company Facility: Diablo Canyon Nuclear Power Plant, Units 1 and 2 Location: 7 1/2 miles NW of Avila Beach Avila Beach, California Dates: January 3 through Feburary 15, 2005 Team Leader: N. O'Keefe, Senior Reactor Inspector - Team Leader Inspectors: J. Hanna, Senior Resident Inspector, Project Branch C T. McKernon, Senior Operations Engineer G. George, Reactor Inspector Accompanying J. Leivo, NRC Contract Inspector Personnel: W. Sherbin, NRC Contract Inspector G. Skinner, NRC Contract Inspector Approved By: Dwight D. Chamberlain, Director Division of Reactor Safety i Enclosure

SUMMARY OF FINDINGS

IR 05000275/2005-006; 05000-323/2005-006; January 3 through February 15, 2005; Diablo

Canyon Nuclear Power Plant, Units 1 and 2: Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions.

This inspection was conducted by a team of four NRC inspectors and three NRC contract inspectors. The team identified eight findings. The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

A. Integrated Assessment

• The team concluded that, in general, components and systems were capable of performing their intended safety functions. Design controls were sufficient in areas examined by the team. The design basis was well documented and coordinated with surveillance tests used to demonstrate that equipment continued to perform as it was intended. Engineering documents showed a clear policy of conservatism and the addition of adequate margins. The team also found that your staff is experienced, proficient, and knowledgeable of your design basis and practices. Also, several examples were noted where calculations relied upon data which did not have adequate technical basis, although none of these examples resulted in any findings of more than very low safety significance.

Cornerstone: Mitigating Systems Cornerstone

Green.

A noncited violation was identified for inadequate corrective action to address an on-going problem with emergency core cooling system gas voiding in the common suction crossover line. The licensee had a sustained history of gas voiding in emergency core cooling system piping, which had the potential to lead to failure of the centrifugal charging pumps or safety injection pumps during the switchover from cold-leg recirculation to hot-leg recirculation during a loss-of-coolant accident. The team concluded that the corrective actions taken by the licensee focused on managing the symptom of the problem rather than finding and eliminating the cause of the voiding.

This finding constituted a performance deficiency because the licensees corrective actions did not determine the cause nor prevent recurrence of gas voiding in the emergency core cooling system. Consequently, the licensee had operated the plant for years with the potential for gas voiding, which could affect one or more redundant trains of the emergency core cooling system. This issue was more than minor because it affected the Mitigating System cornerstone objective of equipment reliability, in that, voiding of the piping could cause mitigating equipment to fail. This finding was determined to be of very low safety significance (Green) during a Phase 1 significance determination process, since the finding was a design or qualification deficiency that iv

was confirmed to not have resulted in a loss of function in accordance with Generic Letter 91-18. This finding is being treated as an additional example of Noncited Violation 05000275/2004005-05, since the corrective actions for that violation are not yet complete and were expected to correct this issue. (Section 4OA5.2.1.3)

Green.

A finding was identified associated with the minimum flow settings for the auxiliary feedwater pumps. NRC Bulletin 88-04 identified that many pump minimum flow values were too low because they did not account for flow instability concerns. The team identified that when the licensee addressed this operating experience item, they did not properly verify the minimum flow settings with the pump manufacturer in accordance with the bulletin. A new analysis performed during the inspection by the manufacturer concluded that the existing minimum flow settings did not allow continuous operation. The manufacturer recommended an increased monitoring and maintenance schedule for the existing minimum flow values in order to promptly detect degradation.

This issue was entered into the licensees corrective action program under Action Request A0631659.

This finding represented a performance deficiency because the licensee did not verify with the manufacturer that the minimum flow settings for the auxiliary feedwater pumps were acceptable. As a result, the auxiliary feedwater pumps were operated since 1988 with an increased potential for unusual wear and aging without establishing increased monitoring and maintenance, or other compensating actions. This issue was more than minor because it affected the equipment reliability objective of the Mitigating Systems cornerstone. This finding was determined to be of very low safety significance (Green)during a Phase 1 significance determination process, since the performance deficiency was confirmed not to result in a loss of function in accordance with Generic Letter 91-18.

(Section 4OA5.3.1)

Green.

A noncited violation was identified for inadequately translating design requirements into calculations used to demonstrate the capabilities of the pressurizer power operated relief valve backup accumulators. The calculation was found to contain a number of non-conservative errors and did not contain the most current acceptance criteria from accident analyses. As a result, this calculation failed to demonstrate that the backup nitrogen accumulators could operate the pressurizer power operated relief valves for the required number of cycles. Failure to properly demonstrate that design requirements for the number of power operated relief valve cycles needed to respond to an inadvertent safety injection actuation were satisfied through a design calculation was a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. This issue was entered into the licensees corrective action program under Action Requests A0631420, A0630719 and A0630740.

The failure to adequately assess and document the capability of the backup accumulators to provide enough gas to operate the power operated relief valves through the required number of cycles was a performance deficiency. This issue was greater than minor because it was similar to Example 3.i in Manual Chapter 0612, Appendix E, v

in that, calculations had to be performed to demonstrate that the system could satisfy the accident analyses. This finding affected the Mitigating System cornerstone. This finding screened as having very low safety significance (Green) during a Phase 1 significance determination process, since the issue was confirmed to not have resulted in a loss of function in accordance with Generic Letter 91-18. (Section 4OA5.2.1.7)

Green.

A finding was identified for modifying the diesel fuel oil transfer system without properly assessing the resulting net affect on reliability from introducing a new failure potential associated with new active components. As a result, the licensee rejected a small design change, which would have eliminated the failure mode when it was recognized that failure of the new pressure control valves could fail the train. Because the failure potential was not fully assessed, the licensee decided not to implement a change that would have eliminated the impact of the failure, nor were the pressure control valves subject to any preventive maintenance to ensure their reliability. This issue was entered into the licensee's corrective action program under Action Request A0630383.

The failure to properly assess the net effect on system reliability and risk due to the positive and negative effects of this modification, or to mitigate or eliminate a new failure mode created by the modification was a performance deficiency. This issue is more than minor because it affected the design control attribute of the Mitigating Systems cornerstone objective to assure the reliability and capability of equipment needed for accident mitigation. This finding was determined to be of very low safety significance (Green) during a Phase 1 significance determination process, since the performance deficiency was confirmed not to result in a loss of function in accordance with Generic Letter 91-18 based on test results. (Section 4OA5.2.1.4.b.1)

Green.

A noncited violation was identified for failure to demonstrate that load sequencing would satisfy regulatory requirements. The team identified that a single postulated fault occurring during load sequencing with offsite power available could restart load sequencing timers in all three engineered safety features buses and result in a more limiting scenario than previously analyzed by the licensee. This could result in overlaping starting transients for motors that were intended to start separately, which was not evaluated in existing calculations. The combined effects of this could cause later starting times for safety-related loads, potentially affecting system performance assumed in accident analyses. Failure to demonstrate that the system could perform as required considering a single fault was a violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control. This issue was entered into the licensee's corrective action program under Action Request 0630036.

This failure to demonstrate through analyses that the electrical distribution system was capable of performing its required function following a single postulated fault was a performance deficiency. This issue was more than minor because it affected the Mitigating System cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a design basis accident. The licensee was subsequently able to demonstrate that there would be no loss of safety function even considering the effects of a fault as described above. Therefore, this finding was determined to be of very low safety significance (Green) in Phase I of the significance determination process. (Section 4OA5.2.1.17)vi

Green.

A noncited violation was identified for not having a procedure to cross-tie fuel oil transfer trains in response to certain failures, contrary to the design and licensing basis of the system. The design and license basis of the diesel fuel oil transfer system credited the capability to cross-tie trains in order to meet requirements to maintain the system function and be able to withstand a worst-case single failure. The team identified that the licensee did not have a procedure or training to accomplish this task.

Failure to incorporate design and licensing requirements into plant procedures was a violation of 10 CFR Part 50, Appendix B, Criterion III. This issue was entered into the licensees corrective action program under Action Requests A0630010 and A0630015.

The failure to have a procedure needed to meet the design and license basis of the fuel oil transfer system was a performance deficiency. This finding was more than minor because it impacted the Mitigating Systems cornerstone objective of procedure quality to ensure the capability of the system, in that, the system would not be capable of supplying the emergency diesel generators for the required 7-day mission time in the event of a single failure. The team concluded that this would not result in a loss of function in accordance with Generic Letter 91-18; since procedures direct monitoring of fuel capacity, operators would be aware of the need for action for the following reasons:

1) there should be a relatively long time available to detect and correct the problem (in excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), 2) the expected actions are not complex, and 3) existing procedures require monitoring of the remaining fuel oil capacity during extended diesel runs. Therefore, this finding was determined to be of very low safety significance (Green) in Phase 1 of the significance determination process. The licensee took prompt compensatory measures to ensure the full mission time could be met. (Section 4OA5.2.1.4.b.1)

Green.

A noncited violation was identified for inadequate design control because the licensee did not properly account for vortex prevention in the calculation used to determine the usable volume in the diesel fuel oil storage tank, which could cause the pump to ingest air. The licensee was unable to locate a technical basis for this part of the calculation. The team independently calculated that 4.1 inches was necessary, compared to the 2.0 inches used in the calculation. The licensee performed a similar calculation and reached the same conclusion, which reduced the tanks' unusable volumes by a little less than 1,000 gallons in this 50,000 gallon tank. Failure to properly account for the unusable fuel oil storage tank volume necessary to prevent vortexing was a violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control." This issue was entered into the licensee's corrective action program under Action Request A0629779.

The failure to properly evaluate and document the unusable volume of the diesel fuel oil storage tank needed to prevent vortexing and ingesting air into the transfer pump was a performance deficiency. Through calculations, the licensee was able to demonstrate that there was sufficient available margin in both the tank capacity and the existing technical specification requirement to account for this without affecting operability or necessitating a technical specification change. This finding affected the Mitigating Systems cornerstone. The issue is more than minor because it was similar to Example 3.i of Appendix E to Manual Chapter 0609, since it was necessary to vii re-perform a calculation to determine whether the existing condition was acceptable.

The finding was determined to be of very low safety significance (Green) during Phase 1 of the significance determination process, since there was available margin in the tank capacity and technical specification minimum required volume and it was confirmed not to involve a loss of function of the system in accordance with Generic Letter 91-18. (Section 4OA5.2.1.5)

Green.

A noncited violation was identified for inadequate design control, because Calculation STA-135, Auxiliary Feedwater System, Revision 2, which was intended to demonstrate that the auxiliary feedwater pumps have adequate capacity to meet their design basis, did not correctly identify the highest pressure under which the pumps needed to function. Specifically, the calculation did not account for the dynamic pressure loss between the feedwater inlet ring and the main steam safety valves. The licensee was able to perform an analysis that concluded the pumps had sufficient flow margin at the new pressure. Failure to properly translate the peak pressure against which the auxiliary feedwater pumps must deliver the required flow rate was a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. This issue was entered into the licensees corrective action program under Action Request A0630804.

The failure to document the capability of the auxiliary feedwater pumps to deliver the required flow at the maximum possible pressure was a performance deficiency. The issue is more than minor because a calculation was needed to determine whether the existing condition was acceptable, consistent with Example 3.i of Appendix E to Manual Chapter 0609. This issue affected the Mitigating Systems cornerstone. Because there was available margin in the pump capacity, this issue was confirmed not to involve a loss of function of the system in accordance with Generic Letter 91-18. Therefore, the finding was determined to be of very low safety significance (Green) during Phase 1 of the significance determination process. (Section 4OA5.2.1.6)

C. Licensee-Identified Findings None.

viii

REPORT DETAILS

1R04 Equipment Alignment

.1 Partial System Walkdown

a. Inspection Scope

The inspectors conducted partial walkdowns of the following five risk-significant systems to verify that they were in their proper standby alignment as defined by system operating procedures and system drawings. During the walkdowns, inspectors examined system components for material conditions that could degrade system performance. In addition, the inspectors evaluated the effectiveness of the licensees problem identification and resolution program in resolving issues, which could increase event initiation frequency or impact mitigating system availability.

• On January 5, 2005, the team performed a partial system walkdown of the Units 1 and 2 auxiliary feedwater systems. This walkdown included the majority of the raw water system, since it is designated as an alternate source of water to auxiliary feedwater.

• On January 6, 2005, the team performed a partial system walkdown of the Units 1 and 2 diesel fuel oil transfer system. Subsequently, a timed walkthrough and inspection was conducted for connecting the emergency fuel oil transfer pump to the Unit 1 system.

• On January 6, 2005, the team performed a partial system walkdown of the Units 1 and 2 auxiliary salt water system.

• On January 12, 2005, the team performed a partial system walkdown of the Units 1 and 2 component cooling water system.

• On January 27, 2005, the team performed a partial system walkdown of Centrifugal Charging Pump 1-1 in conjunction with a timed walkthrough for connecting the alternate cooling source to the pump.

b. Findings

No findings of significance were identified.

1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed six inspection samples of operability evaluations. In each case, these were operability assessments made in response to issues the team raised during this inspection. These reviews of operability evaluations and/or prompt operability assessments and supporting documents were performed to determine if the associated systems could meet their intended safety functions despite the potentially degraded or non-conforming status. The inspectors reviewed the applicable technical specification, Codes/Standards, and Updated Final Safety Analysis Report sections in support of this inspection. The inspectors reviewed the following action requests and operability evaluations:

• (Units 1 and 2) diesel fuel oil storage tank capacity calculation did not adequately account for vortex prevention (Action Request A0629779) (further discussed in Section 4OA5.2.1.5)

• (Units 1 and 2) auxiliary feedwater pump net-positive suction head available is less than required in several cases (Action Request A0630009) (further discussed in Section 4OA5.2.1.6)

• (Units 1 and 2) calculations demonstrating that the backup accumulators will provide enough nitrogen to meet pressurizer power operated relief valves missions include errors and non-conservatisms (Action Requests A0630719, A0630780) (further discussed in Section 4OA5.2.1.7)

• (Units 1 and 2) manual actions needed for auxiliary feedwater system single failure qualification (Action Request A0629860) (further discussed in Section 4OA5.2.1.10)

• (Unit 1 and 2) engineering safety feature timing relays subject to resetting during certain faults (Action Request A0630036) (further discussed in Section 4OA5.2.1.17)

• (Units 1 and 2) lack of documentation on tsunami hydraulic effects (Action Request A0630734) (further discussed in Section 4OA5.2.1.22)

b. Findings

No findings of significance were identified.

4OA2 Problem Identification and Resolution

.1 Cross-Reference to Problem Identification and Resolution Findings Documented

Elsewhere in this Report Section 4OA5.2.1.3 describes a noncited violation for inadequate corrective actions to address on-going problems with gas voiding in emergency core cooling system piping over a number of years.

4OA5 Other Activities

Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions.

.1 Inspection Sample Selection Process

In selecting samples for review, the team focused on the most risk significant components and operator actions. The team selected these components and operator actions by using the risk information contained in the licensees probabilistic risk assessment. An initial sample was chosen from these components and operator actions that had a risk achievement worth factor greater than two. These components and operator actions are important to safety since their failure would result in at least a doubling in the plants baseline core damage frequency.

Many of the samples selected were located within the component cooling water, auxiliary salt water, auxiliary feedwater, diesel fuel oil transfer, and off-site power systems. In addition, inspection samples were added based upon operational experience reviews.

A total of 52 samples were chosen for the team's initial review. These samples were assessed to determine whether any low margin concerns existed. For the purpose of this inspection, low margin concerns included original design issues, margin reductions due to modification, or margin reductions identified as a result of material condition issues. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins. Based on the above considerations, 27 of the original samples were selected for a detailed review. An overall summary of the detailed reviews performed and the specific inspection findings identified is included in the following sections of this report.

.2 Results of Detailed Reviews

The team performed detailed reviews of the components, operator actions, and operating experience issues selected. For components, the team reviewed the adequacy of the original design, modifications to the original design, maintenance and corrective action program histories, and all associated operating and surveillance procedures. As practical, the team also performed walkdowns of the selected components to assess material condition and conformance to design. For operator actions, the team reviewed the adequacy of the operating procedures and compared design basis time requirements against actual demonstrated time lines. For the operating experience issues, the team assessed the applicability of the issue to the Diablo Canyon Power Plant and the licensees disposition of the issue. The following sections of the report provide a summary of the detailed reviews, including any findings identified by the inspection team.

This inspection met the intent of, and took credit for, the following inspection procedures. The specific samples reviewed during this inspection are listed in the documents reviewed section at the back of this report.

• 71111.02, Evaluation of Changes, Tests, or Experiments

• 71111.17B, Permanent Plant Modifications

• 71111.21, Safety System Design and Performance Capability

.2.1.1 Alternate Supply of Cooling to Centrifugal Charging Pumps

a. Inspection Scope

The team reviewed the capability to provide an alternate cooling supply to a centrifugal charging pump. This risk-significant manual action allowed restoring makeup to the reactor coolant system and seal cooling to the reactor coolant pumps in the event of a loss of the component cooling water or auxiliary salt water systems. This capability was implemented under Design Change Package M-410009. The team reviewed the modification, and 50.59 evaluation and supporting documentation, including the system's design change memorandum, and performed a walkdown of the centrifugal charging pumps to assess the material condition.

The team observed operators performing a walkthrough of the abnormal operating procedure for establishing backup cooling to the centrifugal charging pumps, Appendix C of Procedure OP AP-11, "Backup Cooling to a Centrifugal Charging Pump,"

Revision 21. The team verified that operators were able to acquire the necessary tools and hoses and complete the in-plant hookups within the 1-hour time limit established in the design documentation.

b. Findings

No findings of significance were identified.

.2.1.2 Single Train Component Cooling Water Capabilities

a. Inspection Scope

The inspectors reviewed mechanical design calculations, piping and instrumentation drawings, and design basis documents associated with establishing or demonstrating heat load capabilities for the component cooling water system when operating with a single train. The calculations that were reviewed included accident analyses performed with single train component cooling water alignment, and interface auxiliary salt water heat load calculations. The team also performed a partial system walkdown of the component cooling water system in order to assess the material condition, operational alignment, and conformance to design.

Additionally, operating procedures, abnormal operating and emergency procedures, which implement steps to reduce or shed heat loads from the component cooling water system during degraded system operation or accidents were reviewed to assess the complexity of manual actions and the time available versus allowable system temperatures.

b. Findings

No findings of significance were identified.

.2.1.3 Emergency Core Cooling System (ECCS) Gas Voiding

a. Inspection Scope

The team reviewed the history of ECCS gas voiding at Diablo Canyon Power Plant.

Specifically, the team inspected previous instances of such gas voiding, the corrective actions taken, and whether they had been effective. The team selected this sample for review based on Diablo Canyon Power Plants historical problems with gas voiding, (including several instances in 2004). The team assessed the potential of large gas bubbles making multiple trains of ECCS equipment inoperable, and the relevance of industry operating experience with ECCS gas voiding. The team also reviewed the modification of the centrifugal charging pump recirculation line orifices performed in 1999 in response to gas voiding.

b. Findings

Introduction.

A Green noncited violation was identified for inadequate corrective action to address an on-going problem with ECCS gas voiding in the common suction crossover line. The licensee had a sustained history of gas voiding in ECCS piping, which had the potential to lead to failure of the centrigugal charging pumps or safety injection pumps during the switchover from cold-leg recirculation to hot-leg recirculation during a loss-of-coolant accident. The team concluded that the corrective actions taken by the licensee focused on managing the symptom of the problem rather than finding and eliminating the cause of the voiding. This finding is being treated as an additional example of a corrective action finding assessed in NRC Inspection Report 50-275/2004-005.

Description.

The team noted that the licensee had a sustained history of gas voiding in ECCS piping. The piping of concern was a high point where gas has accumulated.

Valves 8807A and 8807B were normally closed within this horizontal run of piping, causing it to be stagnant. During a postulated loss-of-coolant accident, the centrifugal charging pumps and safety injection pumps start. During the switchover from cold-leg recirculation to hot-leg recirculation, these valves are opened and flow would rapidly sweep gas voids into the suction of either the centrifugal charging pumps or safety injection pumps, possibly resulting in gas binding or damage to these components.

The team noted that both units had experienced gas voiding problems periodically during the past several years. Please refer to NRC Inspection Report 50-275/99-07 for a previously assessed violation written to address ECCS voiding. The team noted the following recent history of gas voiding:

• February 5, 1998 - voids occurred in cross-over piping, but were incorrectly determined to be acceptable

• March 27, 1998 - voids occurred in cross-over piping, but were incorrectly determined to be acceptable

• September 10, 1998 - small voids occurred in cross-over piping, and were determined to be acceptable

• November 16, 1998 - voids occurred, which exceed design assumptions making either both safety injection pumps or both centrifugal charging pumps inoperable

• October 26, 1999 - two instances occurred of voids in excess of the allowable size; system declared inoperable, Technical Specification 3.0.3 entered while system was vented (Licensee Event Report 99-03)

• September 3, 2000 - small voids occurred in crossover piping, and were determined to be acceptable

• May 14, 2004 - voids occurred in excess of the allowable size; system was declared inoperable, Technical Specification 3.0.3 entered while system was vented

• October 21, 2004 - two occurrences of a void in excess of the allowable size; system declared inoperable, Technical Specification 3.0.3 entered while system was vented

• December 1-2, 2004 - voids of allowable size occurred; system was vented

• December 17, 2004 - voids of allowable size occurred; system was vented The licensees efforts have been directed at managing the size of the bubble and venting it prior to its size increasing to the point where it affected system operability.

The team concluded that the corrective actions taken by the licensee focused on managing the symptom of the problem rather than finding and eliminating the cause of the voiding. This was evident by the following licensee actions:

• Proceduralizing when to check for gas bubble buildup,

• Installing temporary instruments to assist in detecting voids, and

• Installing a permanent hard pipe vent line to vent gas from affected piping to outside the building.

Following the gas voiding events in 1998, the licensee concluded that one of the causes of gas voiding was the piping design. Though this conclusion was reached, no modifications to the piping (other than adding vent valves) were performed. The team noted that the licensee believed the gas was hydrogen from the volume control tank, although they had never taken samples of the void gas to determine the type of gas present. The team noted that for gas voiding events prior to 1998, the licensee had concluded the source of gas was nitrogen from outage-related sources, also without verifying this assumption. Without firm evidence of the type of gas involved, the team was not able to conclude the validity of the licensee's cause analyses. The team noted that in response to the most recent gas voiding problems, the licensee was planning sampling to determine the source of the gas.

The team concluded that this gas voiding represented a significant condition adverse to quality because of the potential effect on multiple trains of safety-related equipment.

The team also reviewed both the internal and external operational experience relevant to this condition. Please refer to Section 4OA5.3.1 of this report for a discussion of relevant industry operational experience.

During discussions with the licensee, the team clarified the situations listed above where the licensee had declared the system inoperable. In each case, operators followed their procedure in declaring the system inoperable. However, the licensee had established an administrative limit which required this action well before calculations would indicate that a pump could be rendered inoperable. Therefore, despite administratively declaring pumps inoperable, the voids observed would not have resulted in a loss-of-safety function. In assessing the impact of a void, the NRC conservatively assumed that the full volume of a void would go to a single pump, since that would have the greatest chance of rendering the pump inoperable.

Analysis.

The team determined that this finding constituted a performance deficiency because the licensees corrective actions did not determine the cause nor prevent recurrence of gas voiding in the ECCS. Consequently, the licensee had operated the plant for years with the potential for gas voiding causing a common mode failure of redundant trains of ECCS equipment. This issue was more than minor because it affected the Mitigating System cornerstone objective of equipment reliability, in that, voiding of the piping could cause mitigating equipment (i.e., pumps) to fail. Using the NRC Inspection Manual Chapter 0609, Phase 1 Screening Worksheet, the finding was determined to be of very low safety significance (Green) since it was a design or qualification deficiency that was confirmed to not have resulted in a loss of function in accordance with Generic Letter 91-18.

Enforcement.

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires that conditions adverse to quality are promptly identified and corrected. Further, the requirement states that in the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition. Contrary to this requirement, from 1998 to present, the licensee did not prevent repeated occurrences of a significant condition adverse to quality wherein gas voiding of piping could challenge the functionality/operability of multiple trains of emergency core cooling equipment.

This violation is being treated as another example of a violation documented in NRC Inspection Report 05000275/2004-005. That violation included specific examples of this larger pattern of inadequate corrective action. Corrective actions for the violation are expected to cover this example, and insufficient time has passed for the licensee to be able to complete those corrective actions. Therefore, this will be treated as an additional example of Noncited Violation 50-275/04-05-05, "Failure to Adequately Correct ECCS Voiding Following Operation of the Positive Displacement Pump."

.2.1.4 Diesel Fuel Oil Transfer System Normal and Backup Capabilities

a. Inspection Scope

The team reviewed design basis documentation, the Final Safety Analysis Report, system drawings, and a failure modes analysis for the diesel fuel oil transfer system. In concert with the review, the team completed a walkdown of the diesel fuel oil transfer system to assess the material condition, operational alignment, and conformance with the design configuration. This included an inspection of the portable, emergency diesel-driven transfer pump and its support equipment. The team also reviewed procedures for operation, surveillance testing, and annunciator response for the diesel fuel oil transfer system. The team also reviewed calculations establishing the minimum capabilities of the diesel fuel oil transfer system and its backup pump. In addition, the team observed operators perform a walkthrough of the operating procedure to install the portable emergency diesel-driven pump to the diesel fuel oil transfer system. The team verified that all the required fittings and hoses were available, that the procedure worked as written, and that the pump could be installed within the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time established by the licensee for this risk-significant manual action.

The team reviewed permanent plant modification Design Change Package M-39858, "Addition of Diesel Fuel Oil Recirculation System and Emergency Fuel Oil Transfer System," Revision 5, and the associated safety evaluation. The team also reviewed Calculation M-805, "EDG Fuel Oil Transfer - PCV 410/411 Failure," Revision 3, which addressed a new failure potential introduced as a result of this modification.

The team reviewed the design, maintenance history, and material condition of several passive components in this system. These included the foot valves (backflow prevention valves) in the suction line, suction strainers and discharge filters, and the transfer pump vault sump drain check valves.

b. Findings

b.1 Modification Review Did Not Balance New Failure Potential With Improved Reliability

Introduction.

A Green finding was identified for modifying the diesel fuel oil transfer system with the intent of improving reliability, but not properly assessing the resulting affect on reliability from introducing a new failure potential associated with new active components. As a result, the licensee rejected a small design change that would have eliminated the failure mode when it was recognized that failure of the new pressure control valves could fail the train.

Background. The team reviewed a modification to the diesel fuel oil transfer system installed in 1990, which was intended to improve its reliability. The modification added recirculation lines to allow the system to be operated continuously during a long-term run of diesel emergency generators, rather than starting and stopping the transfer pump repeatedly. In evaluating whether this change would also introduce a new potential for failure, a calculation concluded that the new pressure control valve could fail open and disable one train. This failure mode did not previously exist, although other existing failure modes could have resulted in loss of function for one train. The 50.59 safety evaluation associated with this modification concluded that a new failure mode was not created on the basis of the latter point. The calculation went on to design a flow orifice, which would eliminate the failure mode by assuring adequate flow to diesel emergency generators even if the pressure control valve failed open. However, this simple change was not implemented based on a narrow position that failure of one train would not fail the function.

As a result, the plant was modified, a new failure potential was introduced, and an attempt to eliminate the problem was rejected, all without assessing the relative safety implications of the choices. As a result, the team concluded that the licensee did not determine whether the net effect of the modification met the goal of improving the reliability of the system.

The team determined that the pressure control valves were not subject to any preventive maintenance. The performance of the valves was demonstrated during in-service testing, and no pressure control valve failures had been experienced since the valves were originally installed.

Assessment. The performance deficiency was failure to properly assess the net effect on system reliability or risk due to this modification (positive affect on pump reliability, negative affect of introducing a new failure mode), and choosing not to eliminate a new failure mode when it involved relatively little effort. The team reviewed test results and concluded that the system reliability had not been reduced because no pressure control valve failures had been experienced. This issue will be treated as a finding: FIN 05000275, 323/2005006-01, Diesel Fuel Oil Transfer Modification Did Not Adequately Assess the Net Reliability Impact.

This issue is more than minor because it affected the design control attribute of the Mitigating Systems cornerstone objective to assure the reliability and capability of equipment needed for accident mitigation. This finding was determined to be of very low safety significance (Green) during a Phase 1 significance determination process, since the performance deficiency was been confirmed not to result in a loss of function in accordance with Generic Letter 91-18. This issue was entered into the licensee's corrective action program under Action Request A0630383.

Enforcement.

No violations of NRC requirements were identified.

b.2 No Procedure for Cross-Tying Fuel Oil Transfer Trains

Introduction.

A Green noncited violation was identified for not having a procedure to cross-tie fuel oil transfer trains in response to certain failures, contrary to the design and license basis of the system.

Description.

The design and license basis of the diesel fuel oil transfer system credited the capability to cross-tie trains. This was necessary in some cases in order to meet requirements to maintain the system function and be able to withstand a worst-case single failure. The team identified that the licensee did not have a procedure or training to accomplish this task.

Each unit had one storage tank and one train of fuel oil transfer equipment. Each train was the primary source of fuel to the day tanks associated with the diesel engine generators in the same unit, and the backup supply to the diesel engine generators in the opposite unit. In order to establish the required redundancy, the licensee credited the capability to cross-tie the trains.

Analysis.

The performance deficiency associated with this finding was that the licensee did not have a procedure to cross-tie trains of diesel fuel oil transfer system, consistent with the design and license basis.

The way the system is designed, it will automatically compensate for failures for several days. The remaining train can supply all diesel engine generators to the limit if its storage tank capacity. However, the mission time for the emergency diesel generators was 7 days, so action may be needed to cross-tie to access fuel from the storage tank associated with a failed train. This issue is more than minor because it affected the mitigating system cornerstone objective of procedure quality to ensure the capability of the system.

The team concluded that this would not result in a loss of function in accordance with Generic Letter 91-18; since procedures direct monitoring of fuel capacity, operators would be aware of the need for action for the following reasons: 1) there should be a relatively long time available to detect and correct the problem (in excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />),2) the expected actions are not complex, and 3) existing procedures require monitoring of the remaining fuel oil capacity during extended diesel runs. Therefore, this finding screened as having very low safety significance (Green) in a Phase 1 significance determination process. The licensee entered this issue into their corrective action program under Action Requests A0630010 and A0630015 and took prompt compensatory measures when this issue was raised, so there was no current safety concern.

Enforcement.

Failure to incorporate design and licensing requirements into plant procedures was a violation of 10 CFR Part 50, Appendix B, Criterion III. Because this issue was of very low safety significance (Green) and it was entered into the licensees corrective action program (Action Requests A0630010 and A0630015), this violation is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000275; 323/2005006-02, No Procedure for Cross-Tying Trains of the Diesel Fuel Oil Transfer System.

.2.1.5 Diesel Fuel Oil Storage Tank Capacity and Modification

a. Inspection Scope

The team reviewed the design basis and license basis documents associated with diesel generator loading, mission time, fuel consumption rates, and fuel oil storage requirements. This included a review of the calculation used to establish the fuel oil storage volume required and available. The team reviewed the technical basis for calibration of the tank level/capacity indication.

The team reviewed the program for maintaining chemistry control in the fuel oil storage and transfer system, including sample results, historical problems and corrective actions. The team also reviewed procedures used for filling, draining, recirculating, sampling, or removing water or sediment from the fuel oil storage tanks.

The team reviewed permanent plant modifications to the system and their associated safety evaluations, Design Change Packages M-049160 and M-49268, "Upgrade DFO Tanks," Revision 0.

b. Findings

Introduction.

A Green noncited violation was identified for inadequate design control because the licensee did not properly account for vortex prevention in the calculation used to determine the usable volume in the diesel fuel oil storage tank.

Discussion. The team identified that the calculation for diesel fuel oil storage tank capacity did not adequately account for vortexing in the suction line, which could cause the pump to ingest air. The licensee was unable to locate a technical basis for the 2.0 inches of unusable tank volume assigned for preventing vortexing. The team independently calculated that 4.1 inches was necessary, using the methodology recommended by the Hydraulics Institute. The licensee performed a similar calculation and reached the same conclusion.

In response, the licensee wrote Action Request A0629779 to increase the unusable volume at the bottom of the tank by 2.1 inches, or a little less than 1,000 gallons in this 50,000 gallon tank. The usable capacity was correspondingly reduced.

Additionally, the team noted that in 1994, the licensee upgraded the system by installing larger, more leak-resistant storage tanks via Design Change Packages M-049160 and M-49268, "Upgrade DFO Tanks," Revision 0. However, configuration changes made during this modification were not reflected in a calculation that was impacted by the modification. Calculation M-821, "Determine If Sufficient Net Positive Suction Head Is Available For Operation Of The Diesel Fuel Oil Transfer Pumps," Revision 3, required the correct elevations and pipe sizes to calculate whether there was adequate net-positive suction head. The team identified that this calculation used the old configuration to calculate the values of available net-positive suction head, and added a qualitative assessment that the tank replacement would have a net improvement.

However, this involved an improvement in net-positive suction head due to larger pipe diameter and a loss of net-positive suction head due to an elevation change. The team concluded that when engineering judgement was used to qualitatively address the change rather than updating the calculation to reflect the new configuration, the calculation no longer had a valid basis. In response, the licensee wrote Action Request A0629779 to correct the calculation. The team determined that there was no safety concern, since the engineering judgement appeared to be correct. However, this was a weak engineering practice, since changes to the design documents were supposed to involve the same quality as the original work.

Analysis.

The performance deficiency associated with this finding was that the licensee had not properly evaluated and documented the unusable volume of the diesel fuel oil storage tank needed to prevent vortexing and ingesting air into the transfer pump.

Through calculations, the licensee was able to demonstrate that there was sufficient available margin in both the tank capacity and the existing technical specification requirement to account for this without affecting operability or necessitating a technical specification change.

The issue is more than minor because it was similar to Example 3.i of Appendix E to Manual Chapter 0609, since it was necessary to re-perform a calculation to determine whether the existing condition was acceptable. Because there was available margin in the tank capacity and technical specification minimum required volume, this issue was confirmed not to involve a loss of function of the system in accordance with Generic Letter 91-18. Therefore, the issue screens as Green during Phase 1 of the significance determination process.

Enforcement.

Failure to properly account for the unusable fuel oil storage tank volume necessary to prevent was a violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for not translating design requirements into a design calculation.

Because this issue was of very low safety significance and it was entered into the licensees corrective action program (Action Request A0629779), this violation is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000275, 323/2005006-03, Diesel Fuel Oil Storage Tank Calculation Did Not Adequately Account for Vortexing.

.2.1.6 Design of Condensate Storage Tank

a. Inspection Scope

During the inspection, the team reviewed the adequacy of the design of the condensate storage tank and its ability to meet the various functions. In particular, the team reviewed the design and licensing basis information used to size the condensate storage tank, the design temperature of the condensate storage tank, along with procedures, surveillance tests, and inspections performed on the condensate storage tanks to verify their condition. Also, since the auxiliary feedwater pumps suction source is normally aligned to the condensate storage tank, the team reviewed the technical bases used to demonstrate that adequate net-positive suction head was available for the auxiliary feedwater pumps.

When the team identified a small number of cases where auxiliary feedwater pump runout was possible for a short period of time, the team reviewed the relay calculation and drawings for overcurrent protection of the auxiliary feedwater pump motors. This was to determine whether pumps were protected and whether auxiliary feedwater pumps would be expected to trip under the postulated conditions.

b. Findings

Auxiliary Feedwater System Calculation Issue With Steam Generator Backpressure

Introduction.

A Green noncited violation was identified for inadequate design control, because the calculation demonstrating that the auxiliary feedwater pumps have adequate capacity to meet their design basis did not correctly identify the highest pressure under which the pumps needed to function. Specifically, the calculation did not account for the dynamic pressure loss between the feedwater inlet ring and the main steam safety valves.

Description.

The team reviewed Calculation STA-135, Auxiliary Feedwater System, Revision 2. The purpose of this calculation was to determine acceptance curves for auxiliary feedwater pump tests, based on flow resistance of the system. These curves were intended to verify that the auxiliary feedwater system test performance is within that assumed in accident analyses. When determining the hydraulic system resistance, the team noted that the calculation did not account for the flow resistance from the steam generator auxiliary feedwater feed ring to the main steam safety valves. Since the safety valves controlled the maximum system pressure during certain transients, the pressure at the auxiliary feedwater pumps would be correspondingly higher.

In response, the licensee performed an analysis that indicated that approximately 5 psi additional backpressure needed to be considered in auxiliary feedwater system hydraulic analyses.

Additionally, the team noted problems with the technical basis and conclusions in Calculation M-826, Auxiliary Feedwater Pumps NPSH, Revision 1. The calculation showed that auxiliary feedwater pumps did not always have adequate net-positive suction head during a specific event. It was further noted that pump performance data curves were extrapolated beyond what was provided by the vendor for both flow and net-positive suction head. Extrapolated data points were used to form conclusions that pump operation without adequate net-positive suction head was satisfactory for up to 10 minutes without any supporting technical basis or verification from the pump manufacturer. The licensee documented this concern in Action Request A0630009.

The licensee was subsequently able to show that adequate net-positive suction head was available, although the calculation needed to be revised to properly demonstrate this. The team considered that determining safety-related pump operability without adequate net-positive suction head, using unverified data extrapolated from vendor-supplied data was a weak engineering practice.

Analysis.

The performance deficiency associated with this finding was that the calculation did not account for the dynamic pressure loss in part of the system, so the calculation did not show that the auxiliary feedwater pumps could deliver the required flow at the maximum possible pressure. The licensee was able to demonstrated by revising the calculation that there was sufficient available margin in the calculation to account for the increased backpressure.

The issue is more than minor because a calculation was needed to determine whether the existing condition was acceptable, consistent with Example 3.I of Appendix B to Manual Chapter 0609. This issue affected the Mitigating Systems cornerstone.

Because there was available margin in the pump capacity, this issue was confirmed not to involve a loss of function of the system in accordance with Generic Letter 91-18.

Therefore, the issue screens as Green during Phase 1 of the significance determination process.

Enforcement.

Failure to properly translate the peak pressure against which the auxiliary feedwater pumps must deliver the required flow rate was a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Because this issue was of very low safety significance and it was entered into the licensees corrective action program ( Action Request A0630804), this violation is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000275; 323/2005006-04, Failure to Use the Highest Pressure In Calculation to Verify Adequate Auxiliary Feedwater Flow.

.2.1.7 Pressurizer Power Operated Relief Valve Modification and Manual Actions to Respond

to Inadvertent Safety Injection Event

a. Inspection Scope

The team reviewed the licensees modification packages, 50.59 evaluation, and supporting license amendment request for the pressurizer power operated relief valves performed in 2004. This modification upgraded two power operated relief valves in each unit and their associated actuation instruments to safety-related in order to credit the valves to respond to an inadvertent safety injection actuation while at power. The licensee wanted to credit these values to increase the margin for operator response time in the accident. The team selected this item based on the risk significance of these components and the apparent low margin between the required number of cycles specified in the Final Safety Analysis Report and the calculated number of cycles, which could be provided by the backup accumulators.

The team reviewed surveillance test procedures to verify that they properly determined operational leakage and that the acceptance criteria were consistent with supporting calculations.

The team also reviewed simulator response data for a scenario that mimicked the design basis time line for an inadvertent safety injection actuation.

b. Findings

Introduction.

The team identified a Green noncited violation for inadequately translating design requirements into calculations used to demonstrate the capabilities of the pressurizer power operated relief valve backup accumulators. The calculation was found to contain a number of non-conservative errors, and the licensee had revised analyses for an inadvertent safety injection actuation in a way that changed the number of required power operated relief valve cycles without updating this calculation. As a result, this calculation failed to demonstrate that the backup nitrogen accumulators could operate the pressurizer power operated relief valves for the required number of cycles.

Description.

The pressurizer was equipped with safety valves and power operated relief valves for over-pressure protection and control. The licensee performed an accident analysis to assess the acceptability of plant response for an inadvertent safety injection actuation. During this event, the safety injection pumps inject water into the reactor coolant system, filling up the pressurizer until manual action is taken to control makeup.

At the same time, a Phase A containment isolation occurs, removing the normal air source to operate pressurizer power operated relief valves and requiring the backup nitrogen accumulators to fill this function. The licensee recognized that the pressurizer fill rate during this event could be higher than calculated in the original analysis if the positive displacement charging pump was initially running, and that the pressurizer might be filled solid before operators controlled makeup. Once solid, pressure would rapidly rise until a relief valve opened. Since the pressurizer power operated relief valves were not safety-related at that time, they could not be credited to mitigate the resulting pressure rise, so safety valves might be challenged. However, the safety valves installed were not rated for water challenges, and may fail after a limited number of cycles. Therefore, to negate the potential problem with operator response, the licensee modified the system to make the power operated relief valves safety related so they could be credited for relieving pressure and avoiding a challenge to the safety valves.

The design basis specified that the accumulators would allow up to 150 power operated relief valve cycles over a 30-minute period. The team reviewed Calculations J-002 and M-009 (used to calculate and verify the required size and capability of the accumulators) to determine whether the power operated relief valves could adequately perform their design function. The team identified a number of problems with the backup accumulator sizing calculations. These calculations used a non-conservatively low minimum operating pressure, which did not account for the proper operation of the two regulators and pressure losses between the accumulator and the power operated relief valve. This had the effect of improperly increasing the number of available open-close cycles. It was also non-conservative in calculating the number of available cycles by not accounting for work done by the gas and in using a volume of the valve actuator, which was less than the actual volume; the calculation used the usable piston volume but did not count the unusable volume in the dome.

Based on these findings, the team concluded that Calculation J-002 did not demonstrate that the power operated relief valves could be operated by the backup accumulators for the postulated number of cycles in response to an inadvertent safety injection actuation. In response to the teams concerns, the licensee determined that the accumulators were not capable of meeting this design basis number of cycles.

The licensee subsequently provided an analysis (Calculation STA-119), which was used to support a technical specification change to make two power operated relief valves safety related. This analysis conservatively showed that up to 93 power operated relief valve cycles were possible during this event using the NRC-approved RETRAN computer code. In July 2004, the NRC approved Amendment Request 171 and 172 (for Units 1 and 2 respectively), based in part on this analysis and the fact that the backup nitrogen accumulators were designed to support 150 power operated relief valve cycles.

The licensee subsequently revised Calculation J-002 to correct the problems discussed above, and were able to demonstrate that the backup accumulators were capable of operating the power operated relief valves through 106 cycles, which exceeded the maximum number of cycles required of 93 cycles.

Based on the above concerns and prior to re-performing the calculation, the team requested that the licensee perform simulator scenarios to demonstrate the number of cycles expected during an inadvertent safety injection event during the first 30 minutes of the event. The simulation mimicked the time line used in accident analysis. The simulator results, which are considered best-estimate rather than worst-case, indicated that far fewer power operated relief valve cycles would occur than predicted in the analysis. This provided the team some assurance that the analysis specifying 93 cycles was conservatively high.

Analysis.

The team determined that the above calculation deficiencies constituted a performance deficiency. This was because the calculations were intended to demonstrate that the backup nitrogen accumulators could support operation of the pressurizer power operated relief valves for the number of cycles needed to prevent challenging a safety valve in the event of an inadvertent safety injection actuation.

However, the calculations did not adequately demonstrate that this capability existed.

This issue was greater than minor because it was similar to Example 3.i in Manual Chapter 0612, Appendix E, in that calculations had to be performed to demonstrate that the system could satisfy the accident analyses. This finding screened as having very low safety significance during a Phase 1 significance determination process, since the issue was confirmed to not have resulted in a loss of function in accordance with Generic Letter 91-18.

Enforcement.

Failure to properly demonstrate that design requirements for the number of power operated relief valve cycles needed to respond to an inadvertent safety injection actuation were satisfied through a design calculation was a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Because this issue was of very low safety significance and it was entered into the licensees corrective action program (Action Requests A0631420, A0630719 and A0630740), this violation is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy:

NCV 05000275, 323/2005006-05, Inadequate Power Operated Relief Valve Accumulator Calculation.

.2.1.8 Component Cooling Water Modification to Prevent Water-Hammer in Containment Air

Coolers

a. Scope

The scope of this inspection was to review the addition of the nitrogen pressurization system to the component cooling water system surge tank. The team verified that the modification to add the nitrogen overpressure addressed the concerns in NRC Generic Letter 96-06, Assurance of Equipment Operability and Containment Integrity During Design Basis Accident. The team reviewed design change packages and the associated 50.59 evaluation. The team also conducted a partial system walkdown of the nitrogen pressurization system and the component cooling water system. The team verified the operability of the nitrogen pressurization system through review of post modification test results and subsequent surveillance test results. The team reviewed calculations and vendor documents to evaluate the limiting capabilities of the nitrogen pressurization system and the systems effects on the component cooling water system.

The team assessed the licensees response to NRC Generic Letter 96-06, Assurance of Equipment Operability and Containment Integrity during Design Basis Accident. As a response to Generic Letter 96-06, the licensee evaluated the susceptibility for water-hammer and two-phase flow in the containment air cooler cooling water system and over-pressurization of piping in containment penetrations. During this review, the team verified the licensees commitments were completed.

b. Findings

No findings of significance were identified.

.2.1.9 Manual Actions to Respond to a Steam Generator Tube Rupture

a. Scope

The team selected manual actions in response to a steam generator tube rupture as a risk-significant, time-critical manual action sample that presented low margin between time required and time available to complete the actions. The team reviewed design margins presented in calculations and accident analyses. The team used the plant reference simulator to run specific scenarios to compare the calculated design margins to actual performance of operators under simulated conditions, accounting for times to perform in-plant local equipment manipulations. For example, the team ran a steam generator tube rupture scenario utilizing the assumptions used in the engineering analysis to assess the actual margin for steam generator overfill. During the scenario, the team recorded manual operator action times for actions outside the simulator.

These times were then validated during walkthroughs of the actions by operators in the plant observed by the team.

The scenario started with the plant at 100 percent power with a maximum decay heat load. A steam generator tube rupture was initiated that rapidly increased to 700 gpm primary to secondary flowrate. The flow control valves for the auxiliary feedwater Pump 1-2 were simulated to fail open upon safety injection signal initiation, such that, the auxiliary feedwater flow to the ruptured steam generator could not be remotely controlled, necessitating operator action to prevent overfilling of the associated steam generators.

b. Findings

No findings of significance were identified.

.2.1.1 0 Auxiliary Feedwater Response to High Energy Line Break in the Auxiliary Feedwater

a. Scope

The team performed an integrated review of plant response, manual operator actions, and auxiliary feedwater equipment capabilities for a high energy line break in the main feedwater and main steam penetration room (Area GE/GW). The integrated event issues will be discussed in this section. Some details are covered in Section 4OA5.2.1.11.

The team selected this topic for inspection because multiple high energy line break sources were available in this area, a high energy line break would create a harsh (high temperature) environment in this relatively small area, and because portions of the auxiliary feedwater system that were needed to mitigate this high energy line break would be exposed to that harsh environment.

The team examined the design and license basis analyses for high energy line breaks in this area. The team reviewed the requirements for environmental qualification for specific components, then reviewed the environmental qualification design files for these components. The team reviewed non-conformance reports and action requests, which documented plant changes and corrective action when compliance with environmental qualification requirements was questioned.

The team evaluated the results of a simulator scenario for a steam line break outside containment in the feedwater and steam line penetration room (Area GE/GW) run with a full compliment shift crew in support of the inspection issues. The scenario involved a specific steam break in the steam supply line to the turbine driven auxiliary feedwater pump with a loss of power to engineered safety feature Bus H. The ability of the crew to implement feed and bleed core cooling was also evaluated, since this was the backup decay heat removal method if all auxiliary feedwater was lost.

b. Findings

No findings of significance were identified.

.2.1.1 1 Electrical and Control Design for Auxiliary Feedwater Level Control Valves

a. Inspection Scope

The team reviewed the electrical and control design, environmental qualification basis, installation, testing, and corrective action history for the auxiliary feedwater electro-hydraulic level control valves. The team reviewed the appropriateness of using pump discharge pressure signals to control the level control valves to provide runout protection for the motor driven pumps, the manual control features, and the failure modes.

The purpose of this review was to confirm that these valves were capable of performing their safety functions in accordance with the design and licensing basis for loss of feedwater, loss of offsite power, loss-of-coolant accident, main steam line break, or high energy line break.

The team reviewed the calculations for the environmental conditions during a high energy line break and assessed the environmental qualification files for the auxiliary feedwater components in Area GE/GW. This was because some components that could be exposed to a harsh environment as a result of a main steam line break or high energy line break event must also function to mitigate this accident. The team also reviewed the basis for exemption of certain auxiliary feedwater components from qualification to a harsh environment, and the assumptions regarding operator action.

The team reviewed selected failure modes and effects that could be associated with these events, including consideration of electrical power dependencies and applicable environmental effects, to determine if the consequences were consistent with the licensing and design basis. The team coordinated this part of the review with the review of simulator scenarios to confirm that the simulator, the applicable emergency operating procedures, and operator training were consistent with the expected plant response, control capabilities, and operator actions for the selected failure scenarios.

The documents reviewed included the Final Safety Analysis Report, auxiliary feedwater design criteria memorandum, vendor manuals, schematic diagrams, and calculations.

The team also performed a partial system walkdown of the auxiliary feedwater system and Area GE/GW, to assess installation configuration, potential hazards to auxiliary feedwater equipment, and material condition. The review also included a sample of data and selected installations associated with hot spot temperature monitoring, which the licensee had implemented to support the basis for component operating temperatures assumed in the environmental qualification program.

The team reviewed non-conformance reports and action requests initiated within the previous 3 years associated with the auxiliary feedwater level control valves in order to assess the material condition and reliability, and corrective actions. The team also reviewed electrical power sources for auxiliary feedwater components to assess whether motive and control power schemes were susceptible to single failure vulnerabilities.

b. Findings

No significant findings were identified.

.2.1.1 2 Alternate Water Supplies to the Auxiliary Feedwater System

a. Inspection Scope

The team reviewed the two principle alternate sources of water to the auxiliary feedwater system. The function of this system was risk-significant for removing core decay heat, and the system mission time exceeded the amount of time the normal source (condensate storage tank) would be able to supply water. Therefore, the NRC had previously approved alternate sources of water which were to be maintained available onsite in sufficient quantity. The team reviewed design and license basis documentation and drawings for the function and equipment. Team members walked down the accessible portions of the systems with the system engineers to assess material condition, equipment alignment, and accessibility of components required to be realigned when shifting to an alternate supply. The team also reviewed procedures used to align two of the alternate water sources. The team also reviewed water purity records, strainer design and maintenance records, and surveillance test procedures for using emergency pumps.

The team reviewed calculations and surveillance tests to determine whether the pumps could be supplied with an adequate supply of water to meet regulatory requirements with sufficient net-positive suction head for the required flow rates.

b. Findings

No findings of significance were identified.

.2.1.1 3 Setpoint Methodology for Selected Safety-Significant Setpoints

a. Inspection Scope

The team reviewed the assumptions, design inputs, and methodology used in the licensees calculations that established the scaling, instrument uncertainty, setpoints, and setpoint margins for the following instrument channels:

• Condensate storage tank low-low level indication/alarm used by operators in determining when to switch to an alternate source of auxiliary feedwater.

• Refueling water storage tank low-low level, used to trip the residual heat removal pumps when aligning the ECCS from the injection phase to recirculation phase of a loss-of-coolant accident.

• Containment narrow and wide range level indication, used by operators, together with refueling water storage tank level, to determine when to manually align the ECCS for post-loss-of-coolant accident recirculation.

The team also reviewed installation details for these instruments, to confirm that the configuration was consistent with the basis of the calculations. For instruments located in containment, the team also reviewed the installation detail drawings to confirm that the instruments would not be vulnerable to post-accident debris or process conditions.

In addition, for a sample of motor operated valves in the auxiliary feedwater system, the team reviewed the adequacy of actuator motor overload protection and the licensees use of thermal overload bypass circuits used to preclude nuisance tripping while the valve is performing its safety function.

b. Findings

No findings of significance were identified.

.2.1.1 4 Design and Testing of Auto-Transfer Features for Offsite Power System

a. Inspection Scope

The team reviewed elementary and logic diagrams, test reports, and calculations for circuits that control the automatic transfer of offsite power sources for the engineered safety feature buses during required events such as a unit trip or accidents. Elementary and logic diagrams were reviewed to determine whether the transfer from station auxiliary power to offsite startup power would occur immediately for unit trip scenarios, and after main generator trip for accident scenarios. The setpoints, time delays and the associated tolerances for voltage relays were reviewed to determine whether the slow transfer scheme would allow sufficient voltage decay to preclude damage to motors, but still avoid spurious transfer to the onsite emergency source. The team also reviewed elementary and logic diagrams, and calculations for the fast transfer of non-engineered safety feature buses to the offsite source to determine whether it would result in spurious actuation of engineered safety feature bus undervoltage protection, or disrupt load sequencing on the engineered safety feature buses.

b. Findings

No findings of significance were identified.

.2.1.1 5 Electrical Bus Work Connector Torquing in High Voltage Electrical Buses

a. Inspection Scope

The team reviewed calculations, procedures, and drawings to determine whether the appropriate corrective actions had been taken for a 12 kV electrical bus failure that occurred at Diablo Canyon Power Plant in May, 2000. This issue had been selected for review by the team due to the on-site electrical distribution bus work being categorized as a Maintenance Rule Category (a)(1) system as a result of failures.

The licensee attributed the May 2000 failure to thermal runaway in the connection due to long-term degradation; however, since components critical to identifying any cause were destroyed when the electrical bus failed, the inspectors verified that the corrective actions were broad and comprehensive to address the relative uncertainty of the presumed cause. Specifically the team reviewed: 1) the scope of the licensees inspections following the event to ensure that potential degradation in other electrical bus work was identified, 2) the inspection results to verify that possible failure mechanisms (e.g., inadequate torquing of bus work connection bolts) were addressed and findings documented, and 3) that appropriate corrective actions were taken when degraded bus work connections were identified. The inspection team also reviewed other actions taken by the licensee including the increased monitoring of bus work temperatures.

The inspection team also performed a review of the operational experience available at the time of the failure to assess the licensee's actions and prior opportunities to identify and prevent similar failures.

b. Findings

No findings of significance were identified.

.2.1.1 6 Battery 12 Sizing Calculations and Manual Actions to Ensure Design Load Life

a. Inspection Scope

The team reviewed the battery calculation for the loss of three diesel generators prepared for probabilistic risk assessment scenario evaluation, and interviewed the site probabilistic risk assessment specialist. The scenario considered in the calculation was beyond the design basis in that it considered the failure of all three diesels. The battery capacity was analyzed for 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> of operation. The team verified that substantial margin was available in battery capacity over the station blackout coping time.

b. Findings

No findings of significance were identified.

.2.1.1 7 Margin Review for engineered safety feature Bus Load, Load Shed, Load Sequencing,

and Breaker Coordination/Fault Protection

a. Inspection Scope

The team reviewed calculations and drawings to determine whether engineered safety feature Bus G loading was within equipment ratings. The team also reviewed calculations, drawings, relay setting sheets and test reports to determine whether engineered safety feature load shed schemes, load sequencing, and bus protection were adequate to assure availability of engineered safety feature loads within the times assumed in the safety analysis, and to prevent spurious tripping of buses. The team reviewed the setpoints and time delays for undervoltage relays used in the load shed scheme, as well as power supplies and setpoints for the discrete timing relays used in motor starting circuits. The team also reviewed surveillance procedures and test reports for time delay relays to determine whether actual setpoints were consistent with the intended design.

b. Findings

Motor Starting Analyses did not Consider Out of Sequence Starting of Motors During Load Sequencing Caused By Fault on the 4160V System

Introduction.

The team identified a Green noncited violation for inadequate design control associated with a failure to demonstrate that postulated limiting load sequencing would satisfy regulatory requirements. The team identified that a single fault occurring during load sequencing with offsite power available could restart load sequencing timers in all three engineered safety feature buses and result in a more limiting scenario than previously analyzed by the licensee.

Description.

The licensee did not analyze the simultaneous starting of multiple large motors during load sequencing, which could result from maloperation of timing relays following a fault. The load sequencing scheme utilized individual timing relays in the circuit breaker control circuits for sequenced loads. The team identified that these timing relays received power from their associated 4160 V buses. Because of this, the timers associated with all three 4160V emergency feedwater system buses are vulnerable to simultaneous maloperation caused by voltage perturbations when these buses are all connected to offsite power. As a result, a fault that causes a large enough voltage dip of sufficient duration (prior to clearing) could re-initiate some or all of the sequence timing relays. The team determined that individual relays had dropout voltages in the range of 5 to 50 percent of rated voltage and that dropout times were slightly shorter than the design total clearing time for a fault of this type. Thus, the team concluded that some relays could re-initiate and some could be unaffected. This could result in overlapping starting transients for motors that were intended to start separately.

Existing calculations did not evaluate the simultaneous starting of multiple motors on a single bus. Overlap of starting transients because of the postulated fault could result in lower voltages at the terminals of the starting motors and longer acceleration times than previously analyzed, potentially affecting system performance assumed in accident analyses.

Since a single fault could adversely affect redundant trains of equipment, an analysis was necessary to demonstrate that a single fault would not prevent satisfactory performance of the minimum Class 1E load required for the safety function.

In response to the teams concerns, the licensee wrote Action Request 0630036 to evaluate the condition described above. A subsequent evaluation concluded that there would be no loss-of-safety function even considering the effects of a fault as described above. Specifically, the action request documented that the limiting times for starting loads was greater than twice the scheduled times, so even if the timer went through two complete cycles, the loads would start in time to accomplish the safety function. Also, the licensee performed preliminary calculations that demonstrated that the electrical distribution system was capable of starting and accelerating multiple motors simultaneously. The team independently reviewed relay calculations and concluded that starting multiple motors would not trip overcurrent relays.

Analysis.

The team concluded that this was a performance deficiency because the licensee failed to demonstrate through analyses that the electrical distribution system was capable of performing its required function following the failure (fault) of a single component. This issue was more than minor because it affected the Mitigating System cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a design basis accident. The issue screened as having very low safety significance in Phase I of the significance determination process, because it involved a design deficiency that was determined not to involve a loss of function in accordance with Generic Letter 91-18.

Enforcement.

10 CFR Part 50, Appendix B, Criterion III, Design Control, requires that measures be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee failed to analyze the effects of an limiting, non-standard load sequencing schedule on redundant safety buses caused by a single failure. Since this finding is of very low safety significance and has been entered into the licensees corrective action program (Action Request A0630036), it will be treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000275; 323/2005006-06, Analyses Did Not Demonstrate Proper Load Sequencing With Timer Anomalies.

.2.1.1 8 Control and Protection for Components that Supply Offsite Power to Engineered Safety

Features Buses

a. Inspection Scope

The team reviewed calculations, drawings, modification packages, maintenance procedures, and vendor data to determine whether buses and transformers that supply power from offsite to engineered safety feature buses were adequately designed and maintained. Specifically, the team reviewed load flow calculations to determine whether loading of buses and transformers were applied within their ratings. The team also reviewed the design of protective relaying for buses and transformers to determine whether equipment was properly protected, and also immune from spurious tripping under expected transient and steady state loading conditions. Particular attention was given to the differential protection scheme for the new startup transformers, which were modified to accommodate new transformer switching schemes.

b. Findings

No findings of significance were identified.

.2.1.1 9 Capabilities for Restoring Offsite Power Following Prolonged Loss of Offsite Power

a. Inspection Scope

The team performed a tour of 500kV switchyard and its associated control center to determine whether the physical condition and arrangement of switchyard, its controls, and power sources, including standby batteries and breaker air supplies, were adequate for restoration activities during station blackout events. The team interviewed switchyard control center operators to determine whether they were familiar with power restoration procedures and whether communication systems and protocols would facilitate coordination of activities with station operators during station blackout events.

The team reviewed procedures governing restoration of power and reviewed electrical one line drawings to ascertain that there was a reliable source of power for the 500kV switchyard control center. The team also reviewed the probabilistic risk assessment analyses relating to restoration of offsite power to assess whether the assumptions and time limits were valid.

b. Findings

No findings of significance were identified.

.2.1.2 0 Review Modification that Replaced Startup Transformers and Installed New Load Tap

Changers

a. Inspection Scope

The team reviewed the modification for replacement of the startup transformers to determine whether the objective of the modification was correctly translated into the final design. Specifically, the team reviewed load flow calculations, drawings, and setting sheets, to determine whether the new design was properly analyzed and implemented to meet the design objective. The team reviewed operating procedures to determine whether new contingencies, such as transformer tap changers out of service, were properly considered. The team reviewed power supplies for the new load tap changers to determine whether motive and control power would be available during low grid voltage conditions when the tap changers would be required to operate, and assessed the failure modes of the modified system. The team also reviewed maintenance and calibration procedures and results for the load tap changer and controllers to determine whether the design basis for the load tap changers was being properly maintained.

b. Findings

No findings of significance were identified.

.2.1.2 1 Electrical Cables Potentially Degraded due to Submergence in Underground Cable

Vaults

a. Inspection Scope

The team reviewed Diablo Canyon Power Plant's corrective action program documentation for underground electrical cables in order to determine whether any risk-significant medium and high voltage cables were potentially degraded due to submergence problems in cable vaults and conduits. This issue was selected for a detailed review by the team because of multiple failures that had occurred in the 1990's at Diablo Canyon Power Plant, as well as some recent cable problems that might have been related. The team reviewed the appropriateness of the design specifications and ratings of the cables, the corrective actions taken to address past problems, and use of operating experience reviews by the licensee.

The team assessed the licensees routine monitoring and inspection program for underground and/or potentially submerged cables. The team also reviewed the effectiveness of the electrical pullbox inspection and dewatering preventative maintenance program for 4kV and 12kV underground electrical cables.

The team also inspected the material condition of underground vaults and cable pull boxes to look for evidence of wetting and water intrusion. This review was performed during the week of January 24, 2005, following unusually heavy and sustained rainfall.

Cables within the inspected vaults were found to be either dry or had acceptably small quantities of water, which did not affect the cables.

The team reviewed the effectiveness of the licensees corrective actions. The team noted that the licensee had not had any failures on medium voltage cables due to water submergence since the corrective actions were taken.

The team also reviewed industry operating experience that was related to submerged cable issues and how the licensee evaluated and addressed those issues.

b. Findings

No findings of significance were identified.

.2.1.2 2 Analysis and Design Features to Withstand Tsunami Effects

a. Inspection Scope

The team reviewed the plants ability to withstand the effects of a tsunami. Team members reviewed design basis and license basis documents, interviewed cognizant engineers about areas of the plant that were potentially susceptible to the effects of a tsunami and the design features intended to address the effects. The team reviewed the procedure used for responding to tsunami warnings to verify that it was practicable and consistent with the plant design basis. Team members conducted a walkdown of the susceptible areas to verify that design features were in good material condition and the related administrative controls were effective.

b. Findings

Diablo Canyon Power Plants design conservatively assumes a tsunami occurs during a combination of the worst tide and storm-induced wave conditions, and uses the worst tsunami ever documented on the California coast. The plant's ability to withstand large waves and the maximum wave height at the intake structure were determined through extensive and detailed scale model wave testing.

However, the team raised a question, which was not documented in the licensees analysis of record. The licensee did not determine what the peak pressure could be in the a cooling water system as a result of the dynamic wave effects.

In response, the licensee performed an operability evaluation, documented in Action Request A0630734, which concluded that the expected dynamic effects should be within the capability of the system. The licensee planned to complete their analysis of record for the design capability of the plant to withstand tsunami effects under Action Request A0630734.

Analysis.

The safety significance of any issues identified upon review of the licensee's analysis update will be determined at that time.

Enforcement.

This issue remains unresolved pending NRC review of further documented analyses by the licensee: URI 05000275/2005006-07; 05000323/2005006-07; Assess Peak Pressure Effects Due to Tsunami.

.3.1 Review of Licensee Response to Industry Operating Experience

a. Inspection Scope

The team reviewed selected operating experience issues that had occurred at other facilities for their possible applicability to Diablo Canyon Power Plant. Five issues that appeared to be applicable to Diablo Canyon Power Plant were selected for a more in-depth review. The issues that received a detailed review by the team included:

• NRC Generic Letter 96-06, Assurance of Equipment Operability and Containment Integrity During Design Basis Accident Conditions.

• NRC Information Notice 88-23, Potential for Gas-Binding High Pressure Safety Injection Pumps During a loss-of-coolant accidents. The team also reviewed other Operational Experience related to and referenced by this document. Refer to Section 4OA5.2.1.3 of this inspection report for a discussion of gas voiding issues at Diablo Canyon Power Plant.

• NRC Generic Letter 90-06, Resolution of Generic Issues 70, PORV and Block Valve Reliability, and Generic Issue 94, Additional LTOP Protection for PWRs.

Refer to Section 4OA5.2.1.7 of this inspection report for a discussion of power operated relief valve operability issues at Diablo Canyon Power Plant.

• Westinghouse Nuclear Service Advisory Letter 93-13 and Supplements.

• NRC Bulletin 88-04 and Information Notice 87-59, both addressing pump to pump interactions and minimum flow.

b. Findings

b.1 Inadequate Response to Operating Experience for Minimum Pump Flow Settings

Introduction.

The team identified a Green finding for inadequate response to industry operating experience regarding establishing minimum flow for the auxiliary feedwater pumps. The team concluded that the licensee recognized that the conditions reported in NRC Bulletin 88-04 were present in auxiliary feedwater pumps because of low settings in the minimum flow lines, but failed to take appropriate actions to minimize and manage, or to eliminate, the potential for pump damage.

Discussion. The team reviewed the licensees response to NRC Bulletin 88-04, "Potential Safety-Related Pump Loss." This Bulletin, in part, identified a concern regarding the adequacy of minimum flow capacities for safety-related centrifugal pumps. The bulletin requested licensees to evaluate the capability of safety related pumps to run long term at minimum recirculation flow rates. The bulletin stated that many licensees had accounted for thermal considerations in setting the minimum recirculation flow rates, but had failed to consider flow instability effects. The latter consideration could necessitate a considerable increase in minimum flow settings.

The team identified no concerns with most safety-related pumps at Diablo Canyon Power Plant. However, the team identified concerns with the auxiliary feedwater pumps. The licensee had concluded that the original, manufacturer-supplied minimum recirculation flows (circa 1974) were adequate to meet the issues discussed in Bulletin 88-04. The motor-driven pumps had a 490 gpm capacity and a 50 gpm minimum flow setting, while the turbine-driven pumps had an 930 gpm capacity with a 50 gpm minimum flow setting. However, Pacific Gas and Electric Company's May 9, 1989, updated response to Bulletin 88-04 indicated that the turbine-driven auxiliary feedwater pumps did not have adequate minimum flow, and that the consequence was potential for unusual wear and aging because of the hydraulic effects during surveillance testing and plant startup and shutdown evolutions. However, no action was taken to adjust maintenance frequencies, or operating or surveillance procedures to minimize or compensate for this.

The team requested documentation to establish the technical basis for the minimum flow settings for the auxiliary feedwater pumps, particularly how they accounted for flow instability, and the licensee was not able to provide any documentation that addressed this issue during the inspection.

The team questioned whether the current settings were reviewed and approved by the pump manufacturer (originally Byron-Jackson, currently owner by Flowserve), as specified in Bulletin 88-04. Westinghouse was able to show that Flowserve had approved a slight increase in the minimum flow setting for the motor-driven auxiliary feedwater pumps in 2001, but could not show documentation for motor-driven or turbine-driven pumps at the time of the Bulleting 88-04 evaluation.

The team reviewed the available documentation and concluded that the existing minimum flow settings for the motor-driven auxiliary feedwater pumps accounted only for thermal effects. Similar documentation was not available for the turbine-driven pumps, but since they were double the capacity of the motor-driven pumps but had the same minimum flow setting, and had been assigned that setting well prior to Bulletin 88-04, it was likely that this setting also did not account for flow instability considerations.

In response to the lack of documentation and the team's concerns, the licensee had Flowserve and Westinghouse perform a new analysis of the auxiliary feedwater pump minimum flow settings in response to NRC Bulletin 88-04. On February 25, 2005, Flowserve concluded the pumps were not currently degraded, but the minimum flow being used did not allow continuous operation. Specifically, Flowserve stated that for the motor-driven pumps (turbine-driven pumps), the minimum flow rate for continuous unrestricted operation was 250 gpm (484 gpm). For intermittent operation with a recommended total accumulation of not more than 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br /> between overhauls, the minimum flow rate was given as 175 gpm (339 gpm). For short periods of operation with a recommended total accumulation of not more than 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> between overhauls, the minimum flow rate was given as 50 gpm (50 gpm). Flowserve went on to state that their review of several years' of test data for the Diablo Canyon Power Plant auxiliary feedwater pumps indicated that there was no adverse trend in performance indicative of degradation, so continued operation was acceptable. However, Flowserve recommended that should the pumps exceed the alert levels in vibration or differential pressure, the pump should be inspected at the next convenient time. The team noted that this action would normally occur when pumps are more degraded, at the required-action level.

Based upon the above, the team made the following conclusions:

• The existing auxiliary feedwater minimum flow settings did not account for the flow instability issues; they were based on thermal considerations only.

• The existing minimum flow settings in the auxiliary feedwater system were not supported by adequate technical documentation.

• The licensee had not contacted the auxiliary feedwater pump supplier to get their minimum flow settings verified, as specified in Bulletin 88-04. When Pacific Gas and Electric Company contacted the supplier during this inspection, restrictive administrative limits were recommended based on the existing minimum flow settings.

• The licensee had assessed the adequacy of the minimum flow settings for auxiliary feedwater pumps with Westinghouse in response to Bulletin 88-04, and concluded that no changes were needed except for residual heat removal and turbine-driven auxiliary feedwater pumps. However, for auxiliary feedwater, no action was taken to ensure that degradation would be monitored and controlled in ways that ensured the reliability of the auxiliary feedwater pumps. The conclusion that the motor-driven auxiliary feedwater pumps had adequate minimum flow was inappropriate.

• The licensee had missed an important opportunity to identify and correct an important operating experience issue in 1988.

Analysis.

This finding represented a performance deficiency because the licensee did not adequately address a degradation mechanism identified in NRC Bulletin 88-04, as required by the station's operating experience program. As a result, the auxiliary feedwater pumps continued to be operated with insufficient minimum flow to avoid unusual wear and aging without establishing increased monitoring and maintenance, or other compensating actions.

This issue was more than minor because it affected the equipment reliability objective of the Mitigating Systems cornerstone. This issue screened as Green during a Phase 1 significance determination process, since the performance deficiency was confirmed not to result in a loss of function in accordance with Generic Letter 91-18. This issue will be treated as a finding in accordance with Manual Chapter 0612: FIN 05000275, 323/2005006-08, Inadequate Response to Operating Experience for Auxiliary Feedwater Minimum Flow.

Enforcement.

No violation of NRC requirements was identified.

b.2 Observations on Operating Experience Weaknesses In reviewing the licensee's response to industry operating experience associated with ECCS gas voiding, the team noted the following issues:

• Information Notice 88-23, Supplement 3, regarding events at Sequoyah stated that Further investigation and analysis by the licensee revealed that hydrogen gas was accumulating in the suction piping of the "B" pump and in the residual heat removal crossover piping to the charging header. The operating experience also stated that The gas came out of solution (in part) due to localized reductions in pressure because of piping elevation differences and eccentric pipe reducers. . . . which closely relates to the licensees current theory of the 2004 events. The information notice also stated that It is important to consider all potential sources of gas intrusion to the ECCS suction piping. The corrective actions the licensee took, as specified in Action Request 214415 and Nonconformance Report DCO-91-TN-N004, focused on volume control tank (VCT) pressure variations and not on the piping elevation differences and eccentric pipe reducers.

• Information Notice 88-23, Supplement 0 regarding an issue at Farley, stated If the local pressure in the piping at some point between the VCT and HPSI pump suction nozzles is less than VCT pressure, the dissolved hydrogen will come out of solution and will not immediately go back into solution even if the pressure downstream from that point is greater than VCT pressure. The licensee believes that the pressure distribution in some elbows and tees downstream from the VCT is such that some hydrogen comes out of solution in those fittings and that these hydrogen bubbles are swept through the pumps without damaging them.

In the suction piping of pump A, however, some of the bubbles are trapped in the vertical section of line that runs to the high point vent. In accordance with a May 17, 1991, letter, PG&E determined that the gas binding problem was not a concern for DCPP since DCPP did not have a similar piping configuration where the bubbles could collect. Where high point did exist in the ECCS piping, venting of the piping using STP M89, . . . was already being done. This response did not address the concern or prevent problems.

• A similar gas intrusion problem in the charging pumps suction at Catawba was analyzed by Diablo Canyon Power Plant in early March 2004, and deemed not to be an issue because numerous barriers have been implemented to minimize the probability of a void impacting the operability of the ECCS, especially at the suction of charging pumps. {Emphasis added.} Refer to Action Request 0601949. This evaluation, performed in April 2004, concluded that the condition was not a quality problem. The team noted that the licensee came to this conclusion one month prior to gas voiding at Diablo Canyon Power Plant that made both trains of ECCS inoperable.

• As discussed in Section 4OA5.2.1.3, the symptoms and causes discussed in these operating experience reports appear to closely correspond to problems being experienced at Diablo Canyon Power Plant. The licensee missed prior opportunities to address these issues when they did not properly assess the relevance of the issues to their plant.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The lead inspector presented the inspection results to Mr. G. Rueger, Senior Vice President, Generation and Chief Nuclear Officer, and other members of the licensee staff on February 15, 2005, at a public exit meeting in San Luis Obispo, California. The team confirmed that proprietary information provided to the team was handled in accordance with NRC policy. Following completion of additional review in the Region IV office, a final exit was held by telephone with Mr. Parker and other members of the licensee staff on March 24, 2005, to provide an update on the inspection findings as discussed at the February 15, 2005, meeting.

ATTACHMENT: Supplemental Information ATTACHMENT

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

A. Afzali, Supervisor, Probabilistic Risk Assessment Group

T. Baldwin, Manager, Engineering

C. Belmont, Director, Nuclear Quality, Analysis, and Licensing

M. Burgess, Supervisor, Component Engineering

K. Bush, Supervisor, Engineering

S. Chesnut, Director, Engineering Services

C. Dougherty, Senior Engineer, Regulatory Services

D. Jacobs, Vice President, Nuclear Services

C. Joyce, Engineer, Nuclear Quality Assurance and Licensing

S. Ketelsen, Manager, Regulatory Services

J. Knisley, Shift Manager, Operations

D. Miklush, Director, Strategic Projects

D. Oatley, Vice President and General Manager, Diablo Canyon Power Plant

L. Parker, Supervisor, Regulatory Services

G. Reimers, Engineer, Electrical Design

P. Roller, Director, Operations Services

G. Rueger, Senior Vice President, Generation and Chief Nuclear Officer

B. Terrell, Supervisor, Corrective Action Program

J. Tompkins, Director, Site Services

D. Vosberg, Project Manager, Strategic Projects

L. Walter, Manager, Engineering

R. West, Supervisor, Engineering Services

NRC personnel

H. Chernoff, Project Manager, Office of Nuclear Reactor Regulation

T. Jackson, Resident Inspector, Diablo Canyon Power Plant

S. Jones, Acting Section Chief, Plant Systems Branch, Office of Nuclear Reactor Regulation

D. Loveless, Senior Reactor Analyst, Region IV

D. Proulx, Senior Resident Inspector, Diablo Canyon Power Plant

G. Sanborn, Allegation Coordinator Enforcement Staff, Region IV

G. Shukla, Project Manager, Office of Nuclear Reactor Regulation

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000275, 323/2005006-07 URI Assess peak pressure effects due to tsunami (Section 4OA5.2.22)

1-A Attachment

Opened and Closed

05000275, 323/2005006-01 FIN diesel fuel oil transfer modification did not adequately assess reliability impact (Section 4OA.2.1.4.b.1)

05000275, 323/2005006-02 NCV No procedure for cross-tying trains of the diesel fuel oil transfer system (Section 4OA5.2.1.4.b.2)

05000275, 323/2005006-03 NCV diesel fuel oil storage tank calculation did not adequately account for vortexing (Section 4OA5.2.1.5)

05000275, 323/2005006-04 NCV Failure to use the highest pressure in calculation to verify adequate auxiliary feedwater flow (Section 4OA5.2.1.6)

05000275, 323/2005006-05 NCV Inadequate power operated relief valve accumulator calculation (Section 4OA5.2.1.7)

05000275, 323/2005006-06 NCV Analyses did not demonstrate proper load sequencing with timer anomalies (Section 4OA5.2.1.17)

05000275, 323/2005006-08 FIN In complete action for setting auxiliary feedwater pump minimum flow values (Section 4OA5.3.1)

Discussed

50-275/04-05-05 NCV Failure to adequately correct ECCS voiding following operation of the positive displacement pump (Section 4OA5.2.1.3)