IR 05000275/2010006

IR 05000275-10-006, 05000323-10-006, on 03/29/10 - 07/27/10; Diablo Canyon Power Plant, Biennial Baseline Inspection of the Identification and Resolution of Problems

ML102530453
Person / Time
Site:	Diablo Canyon
Issue date:	09/09/2010
From:	Hay M Division of Reactor Safety IV
To:	Conway J Pacific Gas & Electric Co
References
IR-10-006
Download: ML102530453 (49)

Text

UNITED STATES NUC LE AR RE G UL AT O RY C O M M I S S I O N R E GI ON I V 612 EAST LAMAR BLVD , SU I TE 400 AR LI N GTON , TEXAS 76011-4125 September 9, 2010 John Senior Vice President-Energy Supply and Chief Nuclear Officer PG&E Company P.O. Box 3 Mail Code 104/6/601 Avila Beach, California 93424 Subject: DIABLO CANYON POWER PLANT - NRC PROBLEM IDENTIFICATION AND RESOLUTION INSPECTION REPORT 05000275/2010006 AND 05000323/2010006

Dear Mr. Conway:

On July 27, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed a team inspection at Diablo Canyon Power Plant. The enclosed report documents the inspection findings, which were discussed on April 15, 2010, with Mr. J. Becker, Site Vice President, and other members of your staff and on July 27, 2010, with Mr. K. Peters, Station Director, and other members of your staff.

The inspection examined activities conducted under your license as they relate to identification and resolution of problems, safety and compliance with the Commissions rules and regulations and with the conditions of your operating license. The team reviewed selected procedures and records, observed activities, and interviewed personnel. The team also interviewed a representative sample of personnel regarding the condition of your safety-conscious work environment.

This report documents five NRC-identified findings of very low safety significance (Green).

These finding were determined to involve violations of NRC requirements. However, because of the very low safety significance of these violations and because they were entered into your corrective action program, the NRC is treating these violations as noncited violations consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E. Lamar Blvd., Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at Diablo Canyon Power Plant.

In addition, if you disagree with the crosscutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis

Pacific Gas and Electric Company -2-for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at Diablo Canyon Power Plant.

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Website at www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Michael Hay, Chief Technical Support Branch Division of Reactor Safety Docket: 50-275, 50-323 License: DPR-80, DPR-82

Enclosure:

NRC Inspection Report 0500275/2010006 and 0500323/2010006 w/Attachments

REGION IV==

Dockets: 05000275, 05000323 Licenses: DPR-80, DPR-82 Report: 05000275/2010006 and 05000323/2010006 Licensee: Pacific Gas and Electric (PG&E) Company Facility: Diablo Canyon Power Plant, Units 1 and 2 Location: 7 1/2 miles NW of Avila Beach Avila Beach, California Dates: March 29 through July 27, 2010 Team Leader: J. Drake, Senior Reactor Inspector Team: R. Taylor, Senior Reactor Inspector S. Hedger, Operations Engineer A. Fairbanks, Reactor Inspector T. Brown, Resident Inspector Approved By: Michael Hay, Chief Technical Support Branch Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

IR 05000275/2010006, 05000323/2010006; 03/29/10 - 07/27/10; Diablo Canyon Power Plant,

Biennial Baseline Inspection of the Identification and Resolution of Problems The team inspection was performed by two senior reactor inspectors, a reactor inspector, and a resident inspector. Five Green noncited violations of very low safety significance were identified during this inspection. The significance of most findings is indicated by their color (Green,

White, Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process. The crosscutting aspects were determined using IMC 0310, Components within the Cross-Cutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG 1649, Reactor Oversight Process, Revision 4, dated December 2006.

Identification and Resolution of Problems The team concluded that the notification process facilitates the initiation, tracking, and trending of concerns and that the licensee correctly identified deficiencies that were conditions adverse to quality and entered them into the corrective action program in accordance with the licensees corrective action program guidance and NRC requirements. Prioritization of issues was appropriate. The licensee was inconsistent in the effectiveness of evaluating issues once they were identified. The teams assessment was there was limited effective interdepartmental communication, a lack of cross discipline peer checks, and a failure to assign the appropriate resources to evaluate cross-departmental problems/issues. As a result, the licensees performance in resolving problems and effective utilization of operating experience was negatively impacted. The licensee performed effective quality assurance audits and self-assessments, as demonstrated by self-identification of poor corrective action program performance and identification of ineffective corrective actions. However, because of challenges in performing evaluations, the licensee had difficulty properly addressing some of these issues. Overall the team concluded that implementation of the corrective action program was adequate with improvements warranted.

The team determined that site personnel were willing to raise safety issues and document them in the corrective action program. The team noted that workers at the site felt free to report problems to their management and the NRC, but were reluctant to take safety concerns to the Employee Concern Program. Additionally, the function and processes associated with the Employee Concern Program was not understood by a majority of the personnel interviewed.

Cornerstone: Mitigating Systems

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, involving the failure to maintain adequate design control measures associated with the emergency diesel generating air system.

Specifically, failure of non-seismically qualified air compressor unloader sensing lines during a seismic event could impact the safety function of the emergency diesel generators. Subsequent analysis of the nonconforming condition performed by the licensee determined the piping would not fail during a postulated seismic event. The licensee entered this issue into the corrective action program as Notifications 50307496, 50307497, 50307504, 50307670, 50308204, and 50308824.

The finding was more than minor because it affected the mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Using the Significance Determination Process (SDP) Phase 1 Screening Worksheet for the Initiating Events, Mitigating Systems, and Barriers Cornerstones the finding was potentially risk significant for a seismic initiating event requiring a Phase 3 analysis. The analyst estimated the nonrecovery probabilities for operators failing to isolate air between the receiver and the compressor prior to air pressure depletion, and operators failing to manually open fuel transfer valves to makeup to the diesel day tank. The final quantitative result was calculated to be 1.06 x 10-6. However, using a qualitative evaluation of the bounding assumptions, the analyst determined that the best available information indicated that the finding was of very low risk significance (Green).

The team determined that the finding was reflective of current plant performance because it had been recently identified during the license renewal inspection and had a human performance crosscutting aspect related to decision making because the licensee did not use conservative assumptions when evaluating this nonconforming condition in previous evaluations H.1(b) (Section 4OA2).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, involving the failure to ensure that operators are able to implement specified actions in response to operational events and accidents. Specifically, operators could not achieve actions within the analysis time estimates for the cold leg recirculation phase of a loss of coolant accident response and the steam generator tube rupture response as described in the licensees safety analysis report.

The finding is more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The finding represented a potential loss of a safety function requiring a Phase 2 analysis. Because the probability of human error is not effectively addressed by a Phase 2 analysis, a Phase 3 analysis was performed. The senior reactor analyst reviewed the actual timing of the walkdowns associated with the steam generator tube rupture time critical actions. The analyst determined that, while the licensee failed to meet the specific cooldown timing documented in the Final Safety Analysis Report, the total time to start cooling the reactor was well within the total critical timing of the event. The analyst found no impact on safety in delaying the cooldown of the reactor for one minute given that the other time critical actions were performed more quickly than required. Therefore, the analyst determined that this portion of the finding was of very low safety significance because it does not represent an actual loss of safety function (Green). The senior reactor analyst reviewed the issue related to the assumed action times associated with switching over to containment sump recirculation lineup for their emergency core cooling system pumps during a large break loss of coolant accident. The analyst noted that this time critical action was only required if a large-break loss of coolant accident occurred simultaneously with the failure of an residual heat removal pump to stop automatically, requiring local isolation of the pump. Given that the frequency of the initial conditions for the time critical action are below the Green/White threshold, the change in core damage frequency associated with this finding must be of very low safety significance (Green). The team determined that the finding was reflective of current plant performance because the licensee participated in a recent industry-wide study on time critical operator actions, but did not implement any of the groups recommendations. The finding had a crosscutting aspect in the area of human performance, decision making, because the licensee did not use conservative assumptions in the decision making process related to verifying the validity of the underlying assumptions used to evaluate the feasibility of operators implementing time critical operator actions H.1(b) (Section 4OA2).

• Severity Level IV. The team identified a noncited violation of 10 CFR 50.9(a),

Completeness and Accuracy of Information with multiple examples.

Specifically, information supplied to the NRC in License Amendment Request 01-10, dated February 24, 2010, related to the revision of Technical Specification 3.8.1, "AC Sources - Operating," were not complete and accurate in all material respects. Following NRC questioning of the discrepancies the licensee withdrew the amendment request.

The finding is more than minor because the inaccurate information was material to the NRC. Specifically, this information was under review by the NRC to evaluate specific changes to the surveillance requirements associated with the emergency diesel generators. Following management review, this violation was determined to be of very low safety-significance because the amendment request was withdrawn before the NRC amended the facility technical specifications.

Because this issue affected the NRC's ability to perform its regulatory function, it was evaluated with the traditional enforcement process. Consistent with the guidance in Section IV.A.3 and Supplement VII, paragraph D.1, of the NRC Enforcement Policy, this finding was determined to be a Severity Level IV noncited violation. The finding had a crosscutting aspect in the area of problem identification and resolution associated with the corrective action program because the licensee did not adequately evaluate the extent of condition and take appropriate corrective actions after the NRC identified a similar violation

P.1(c) (Section 4OA2).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, Corrective Action, with two examples for the failure of the licensee to promptly identify and correct nonconforming conditions related to the emergency diesel generators meeting the design basis. The first example resulted from the failure to identify that instrument inaccuracies were not accounted for in the bounding calculations. The second example involved the failure to identify that the worst case loading calculations exceeded the emergency diesel generator operating load limit.

The failure to promptly identify and correct the design deficiencies associated with the emergency diesel generators was a performance deficiency. This finding is greater than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstones objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with Inspection Manual Chapter 0609, Significant Determination Process, the team performed a Phase 1 analysis to analyze the significance of this finding and determined the finding is of very low safety significance because the condition was a design or qualification deficiency confirmed not to result in loss of operability or functionality, did not represent an actual loss of safety function of the system or train, did not result in the loss of one or more trains of nontechnical specification equipment, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. The finding had a crosscutting aspect in the area of human performance, decision making, because the licensee did not use conservative assumptions in the decision making process or conduct an adequate effectiveness review to verify the validity of the underlying assumptions for a safety-significant decision H.1(b) (Section 4OA2).

Green.

The team identified a noncited violation of Technical Specification 5.4.1.a for failure to appropriately evaluate and correct a condition adverse to quality, as instructed by Surveillance Test Procedure P-RHR-A22, Comprehensive Testing of Residual Heat Removal Pump. Specifically, the licensee failed to recognize a deviation in differential pressure towards the alert range, following the February 9, 2008, comprehensive surveillance test of the 2-2 residual heat removal pump. Continued degradation of the 2-2 residual heat removal pump resulted in failure of the October 9, 2009, comprehensive surveillance test due to the differential pressure exceeding the action limit. The licensee entered this issue into the corrective action program as Notification 50308225.

The finding is more than minor because it was associated with the equipment reliability attribute of the Mitigating Systems Cornerstone and it adversely affected the associated cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding in accordance with Inspection Manual Chapter 0609, Significance Determination Process,

Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a for the Mitigating Systems Cornerstone. The finding was determined to be of very low safety significance (Green) because: (1) it was a design or qualification issue confirmed not to result in a loss of operability or functionality; (2) did not represent an actual loss of safety function of the system or train; (3) did not result in the loss of one or more trains of nontechnical specification equipment; and (4) did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. The team determined that this finding had a crosscutting aspect in the area of problem identification and resolution, corrective action program, because the licensee failed to appropriately evaluate the 2009 residual heat removal surveillance test failure such that the resolution identified and corrected the cause of the failure P.1(c)

(Section 4OA2).

Licensee-Identified Violations

None

REPORT DETAILS

4OA2 Problem Identification and Resolution

The team based the following conclusions on a sample of corrective action documents that were initiated during the assessment period, which ranged from November 20, 2008, to the end of the onsite portion of the inspection on April 15, 2010.

.1 Assessment of the Corrective Action Program Effectiveness

a. Inspection Scope

The team reviewed approximately 200 notifications (condition reports), including associated root cause, apparent cause, and direct cause evaluations, from approximately 35,000 notifications that had been issued between November 20, 2008, and April 15, 2010, to determine if problems were being properly identified, characterized, and entered into the corrective action program for evaluation and resolution. The team reviewed a sample of system health reports, operability determinations, self-assessments, trending reports and metrics, and various other documents related to the corrective action program. The team evaluated the licensees efforts in establishing the scope of problems by reviewing selected logs, work requests, self-assessments, audits, system health reports, action plans, and results from surveillance tests and preventive maintenance tasks. The team reviewed work requests and attended the management review committee meetings to assess the reporting threshold, prioritization efforts, and significance determination process, as well as observing the interfaces with the operability assessment and work control processes when applicable. The teams review included verifying the licensee considered the full extent of cause and extent of condition for problems, as well as how the licensee assessed generic implications and previous occurrences. The team assessed the timeliness and effectiveness of corrective actions, completed or planned, and looked for additional examples of similar problems. The team conducted interviews with plant personnel to identify other processes that may exist where problems may be identified and addressed outside the corrective action program.

The team also reviewed corrective action documents that addressed past NRC-identified violations to ensure that the corrective actions addressed the issues as described in the inspection reports. The team reviewed a sample of corrective actions closed to other corrective action documents to ensure that corrective actions were still appropriate and timely. The team considered risk insights from both the NRCs and Diablo Canyon's risk assessments to focus the sample selection and plant tours on risk significant systems and components. The team selected the following risk significant systems: residual heat removal, emergency diesel generators, and 120 Vdc, 480 V, 4160 V, and the off-site power systems. The samples reviewed by the team focused on, but were not limited to, these systems. The team expanded their review to include five years of evaluations

involving the residual heat removal system, the emergency diesel generators, and the off-site power systems to determine whether problems were being effectively addressed.

The team also conducted walkdowns of these systems to assess whether problems were identified and entered into the corrective action program.

b. Assessments Assessment - Effectiveness of Problem Identification The team concluded that the notification process facilitated the initiation, tracking, and trending of concerns and that the licensee correctly identified deficiencies that were conditions adverse to quality and entered them into the corrective action program in accordance with the licensees corrective action program guidance and NRC requirements. The corrective action program procedure has established an appropriately low threshold for entering concerns into the corrective action program.

However, the team found multiple examples of concerns that were not entered into the corrective action program in accordance with the timeliness expectations of Procedure OM7.ID1, "Problem Identification and Resolution," Revision 32.

Examples included:

• An emergency diesel generator starting air system seismic issue was identified during the license renewal audit. A notification was not written until approximately a week later when the resident inspector questioned the status of the concern.

• A timely notification was not generated in response to the resident inspectors concerns related to insufficient documentation to satisfy worst case design basis loading conditions on the emergency diesel generators. Although the residents raised the issue approximately in October 2008, documentation of the issue occurred after a noncited violation was identified (Notification 50163396 was created on January 5, 2009).

• A 230KV power operability issue when cross tied was identified by the NRC on or about November 3, 2008. The first notification that was generated (Notification 50085862) was created on November 18, 2008.

• The resident inspectors identified a concern related to the inability to meet time critical operator action to bring the 500 KV offsite power system online. A notification was not generated until several days after the inspectors identified the concern.

• Multiple seismically induced system interaction issues identified by the resident inspectors were immediately corrected, but were not entered into the corrective action program for trending as required. An apparent reason for this was that the issues were addressed outside the corrective action program through the use of

white papers, or previous evaluations which did not adequately evaluate the concern.

Effectiveness of Prioritization and Evaluation of Issues Prioritization: The prioritization of issues was generally appropriate, however, the team identified eleven notifications that were not prioritized in accordance with the licensees process, ten of these notifications dealt with Time Critical Operator Actions that were inappropriately prioritized because the licensee did not recognize that these time critical operator actions were a part of the licensing basis until it was identified by the NRC.

Evaluations: The licensee was significantly challenged in this area of the corrective action program. This resulted in an adverse impact on the ability of the licensee to effectively resolve some station problems. The teams findings were consistent with the currently open substantitive crosscutting issue related to the quality of evaluations previously identified by the NRC. The team identified that a number of problem evaluation issues were related to nonconservative assumptions used in the decision-making process.

Examples of issues related to poor problem evaluation included:

• Following a residual heat removal Pump 2-2 surveillance, the licensees evaluation of pump performance data failed to appropriately determine the cause of a deviation. In addition, a review of pump performance trends revealed a missed opportunity for the licensee to identify the negative trend.

• During review of time critical operator actions not being met, the training and operations departments concluded that maintaining the function of the various systems involved was adequate. The licensee failed to recognize that the time limits were part of the licensing bases.

• During review of nonseismic piping associated with the emergency diesel generator starting and turbo air systems, the licensee failed to provide adequate design control measures for verifying the emergency diesel generators met the design basis. The licensee incorrectly used a risk analysis to justify not meeting the design seismic criteria, no other corrective actions were implemented.

• During review of a potential emergency diesel generator overload condition, the licensees initial bounding calculation assumed the generators could operate at 60.5 Hz without exceeding their design limits. The team identified that this evaluation failed to account for potential instrument error. When the calculation was re-evaluated, the licensee made several invalid assumptions concerning the diesel generators operating with an elevated frequency. The engineers stated that the higher speed of the diesel would result in the engine producing more horsepower to allow carrying the additional electrical load. Upon questioning by the team, the licensee was not able to provide documentation to support that the limiting component on the diesel generator set was the diesel engine.

Additionally, the licensee failed to recognize that the increased loading on the diesel generators was above the licensed operating limit of 2752 KW.

Effectiveness of Resolution In general, the licensee adequately resolved issues that were entered into the corrective action process. The team concluded that the station had sufficiently identified deficiencies and adverse trends on numerous occasions, performed thorough evaluations, and resolved the deficiencies. The team noted a number of examples where the process was not consistently implemented. These inconsistencies included examples where the significance of issues were downgraded without adequate justification and examples where issues were closed without any corrective actions taken.

Several adverse trends related to security equipment failures were identified by the licensee and entered into the corrective action program between 2006 and 2009 but were closed without adequate evaluation or corrective actions documented.

• Condition Report A0661509 identified an adverse trend on March 9, 2006. The licensee closed the condition report on February 15, 2007, without initiating any corrective actions and referenced Action Request A0687462, written January 30, 2007. Condition ReportA0687462 required an apparent cause evaluation be performed for the adverse trend. However, the licensee downgraded the significance of the condition report and cancelled the apparent cause evaluation. The licensee closed A0687562 without adequate justification.

These issues were addressed as a result of concerns identified during a recent security inspection.

• On October 13, 2008, the licensee identified an adverse trend documented in Notification 50082283. The licensee closed this notification without requiring any actions.

• Notification 50238319 documented an adverse trend on May 5, 2009. This notification requested an apparent cause evaluation be performed. However, the licensee downgraded the significance level and cancelled the evaluation. The justification included a reference to an action plan for correcting the deficiencies.

However, the notification was closed without assigning any specific actions.

Assessment - Overall Effectiveness of Corrective Action Program The team reviewed approximately 200 notifications (condition reports), work orders, engineering evaluations, root and apparent cause evaluations, and related supporting documentation to determine if problems were being properly identified, characterized, and entered into the corrective action program for evaluation and resolution. The team reviewed a sample of system health reports, self-assessments, trending reports and metrics, and various other documents related to the corrective action program. The team concluded that the notification process facilitates the initiation, tracking, and

trending of concerns and that the licensee correctly identified deficiencies that were conditions adverse to quality and entered them into the corrective action program in accordance with the licensees corrective action program guidance and NRC requirements. Prioritization of issues was appropriate. The team identified a number of problems that were not effectively resolved due to inconsistent implementation of effective issue evaluations. Overall, based on these reviews, the inspection team concluded that the implementation of the corrective action program at Diablo Canyon Power Plant Units 1 and 2 was adequate.

.2 Assessment of the Use of Operating Experience

a. Inspection Scope

The team examined the licensees program for reviewing industry operating experience, including reviewing the governing procedure and self assessments. A sample size of 35 out of 146 operating experience notifications that had been issued or evaluated during the assessment period were reviewed to assess whether the licensee had appropriately evaluated the notification for relevance to the facility. The team then examined whether the licensee had entered those items into their corrective action program and assigned actions to address the issues. The team reviewed a sample of root cause evaluations and corrective action documents to verify if the licensee had appropriately included industry-operating experience.

b. Assessment Overall, the licensee appropriately evaluated both internal and external operating experience for relevance to the facility and entered applicable items in the corrective action program. The licensee appropriately used industry operating experience when performing root cause and apparent cause evaluations. The team did identify examples where the licensees evaluation of the operating experience was not thorough, resulting in missed opportunities to identify potential problems.

The following is an example of a missed opportunity that may have prevented an unplanned unit shutdown and unit power reduction. On September 20, 2007, the station experienced an influx of jellyfish at the facility intake resulting in elevated intake screen differential pressures, as documented in Condition Report A0707892. In the condition report, the station biologist stated that This is not an unusual event and can be expected any time during mid-summer through November. Also, PG&E documented in Condition Report A0715663, an evaluation of industry operating experience issued December 17, 2007, which was related to biologics clogging intake structures. This evaluation only considered kelp growth as a potential debris source. On October 21, 2008, plant operators shut down Unit 2 and reduced Unit 1 power to 50 percent following high main condenser differential pressures resulting from jellyfish blockage of the circulating water pump intakes. The NRC concluded that, based on the recommendations of industry operating experience and the stations previous experience, all potential sources, including jellyfish, should have been considered in their

evaluations and appropriate contingence actions planned in advance, similar to the procedures implemented for kelp.

Another example involved the licensees evaluation of NRC Information Notice 2005-24, Nonconservatism in Leakage Detection Sensitivity. The notice stated, in part, The reactor coolant activity assumptions for containment radiation gas channel monitors may be nonconservative. As a result, the containment gas channel may not be able to detect a one gallon per minute leak within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. It is expected that the recipients will review the information for applicability to their facilities and consider actions, as appropriate, to avoid similar problems. The licensees assessment of the information notice concluded that the containment gaseous radioactivity reactor coolant system leak detection system was operable because Once a component or system is established as operable, it is reasonable to assume that it continues to remain operable. Following questions by the NRC regarding an operability concern that the detector may not be calibrated to properly respond to the specified reactor coolant activity the licensee declared the leak detection system inoperable.

.3 Assessment of Self-Assessments and Audits

a. Inspection Scope

The team reviewed a sample of 4 out of 12 licensee self-assessments, surveillances, and audits to assess whether the licensee was regularly identifying performance trends and effectively addressing them. The team reviewed audit reports to assess the effectiveness of assessments in specific areas. The team evaluated the use of self- and third-party assessments, the role of the quality assurance department, and the role of the performance improvement group related to licensee performance. The specific self-assessment documents reviewed are listed in the attachment.

b. Assessment The team concluded that the licensee's audits and assessments were rigorous and identified problems, however the challenge the licensee had with performing evaluations has hindered their ability to resolve these issues. The team observed that the licensee's assessment teams included members with the proper skills and experience to ensure effective self-assessments were conducted. The assessments were all self-critical and identified areas for improvement.

.4 Assessment of Safety-Conscious Work Environment

a. Inspection Scope

The team conducted focus group and individual interviews to assess whether conditions exist which would challenge the establishment of a safety conscious work environment at Diablo Canyon Power Plant. The interviewees represented various functional organizations, with individuals from plant operations, maintenance, engineering, security, radiation protection, and contractors, including supervisory and non-supervisory personnel. The team conducted additional interviews with quality assurance personnel and the manager responsible for the employee concerns program. The team also completed observations of plant activities and reviews of the corrective action and employee concerns programs.

b. Assessment The licensee maintained a safety-conscious work environment. The team determined that individuals were aware of the importance of nuclear safety, stated a willingness to raise safety issues, and had not experienced retaliation in any prior issues raised.

Employees had adequate knowledge of the corrective action program, however, understanding of the employee concerns program was weak and several employees had strong negative feelings about its effectiveness and ability to maintain confidentiality.

The team noted that all of the employee concerns reports for the past 2 years were explicitly related to NRC-referred allegations; the program treated other concerns, both nuclear and nonnuclear safety/quality issues informally.

.5 Specific Issues Identified During This Inspection

a. Inadequate Design Control for the Emergency Diesel Generator

Introduction.

The team identified a Green noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, involving the failure to maintain adequate design control measures associated with the emergency diesel generating air system.

Specifically, failure of nonseismically qualified air compressor unloader sensing lines during a seismic event could impact the safety function of the emergency diesel generators.

Description.

The team identified that the emergency diesel generator auxiliary systems did not comply with General Design Criteria 2, Design Bases for Protection Against Natural Phenomena, and Regulatory Guide 1.29, Seismic Design Classification, design bases. Final Safety Analysis Report Update, Revision 18, Table 17.1-1, Current Regulatory Requirements and PG&E Commitments Pertaining to the Quality Assurance Program, states that PG&E complies with Regulatory Guide 1.29, Revision 3, dated September 1978. Design Criteria 2 requires, in part, that structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomenon such as earthquakes, tornadoes, hurricanes, floods, tsunamis, and seiches without loss of capability to perform their safety functions. Regulatory Guide 1.29,

Section C.3 states, those portions of structures, systems, or components that form interfaces between Seismic Category I and Nonseismic Category I features should be designed to Seismic Category I requirements.

The team identified that the emergency diesel generator starting air system and turbo charger air system air compressors are Design Class II, Nonseismic Category I and not qualified to remain functional during a seismic event. The air compressors are designed with an unloader sensing line that is connected to the Class I air receivers that are seismically qualified. The team postulated that a failure of the line during a seismic event could result in loss of starting air and turbocharger air pressure that could prevent the emergency diesel generators from remaining functional following a design basis earthquake. In response to the teams observations, the licensee performed an operability evaluation. The team reviewed the evaluation and concluded that the emergency diesel generators remained operable and capable of performing their intended safety function. The licensee entered this issue into the corrective action program as Notifications 50307496, 50307497, 50307504, 50307670, 50308204, and 50308824. The team also noted that a significant contributor to the performance deficiency was that the licensee failed to adequately evaluate the condition on previous occasions. An NRC inspection team questioned the design configuration in 1992, as documented in Condition Report A0264203, and again on March 22, 2010, as documented in Condition Report 50305528. The team reviewed other condition reports that also documented similar concerns with the emergency diesel generator air systems and noted that the licensee evaluated the nonconforming condition as a low probability for failure and implemented no corrective actions to address the nonconformance.

Analysis.

The team concluded that the failure of PG&E to implement adequate design control measures for verifying the adequacy of design of the emergency diesel generators was a performance deficiency. This finding is greater than minor because the design control attribute of the Mitigating Systems Cornerstone and the cornerstones objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences was affected. Using the Significance Determination Process Phase 1 Screening Worksheet for the Initiating Events, Mitigating Systems, and Barriers Cornerstones the finding was potentially risk significant based on a seismic initiating event because if the unloader lines were assumed to be completely failed it would degrade one or more trains of a system (emergency diesel generators) that supports a safety system or function. Therefore, a Phase 3 analysis was conducted in accordance with Inspection Manual Chapter 0609, Appendix A, and Determining the Significance of Reactor Inspection Findings for At-Power Situations. The analyst estimated the nonrecovery probabilities for operators failing to isolate air between the receiver and the compressor prior to air pressure depletion (97 percent), and operators failing to manually open fuel transfer valves to makeup to the diesel day tank (4.1 percent). The final quantitative result was calculated to be 1.06 x 10-6. However, using a qualitative evaluation of the bounding assumptions, the analyst determined that the best available information indicated that the finding was of very low risk significance (Green). See Attachment 1 for details associated with the Phase 3 analysis. The team concluded that the finding has a crosscutting aspect in the area of human performance, decision-making, because the licensee did not use

conservative assumptions when evaluating this nonconforming condition in previous evaluations. H.1(b).

Enforcement.

Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires measures be established to assure that applicable regulatory requirements and the design basis be correctly translated into specifications and that design control measures be provided for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, from initial construction until April 13, 2010, PG&E did not establish measures to assure that applicable regulatory requirements and the design basis of the onsite emergency diesel generators were translated into specifications, and failed to ensure that the design was verified. Because this finding is of very low safety significance and was entered into the corrective action program as Notification 50308824, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000275/2010006-01; 05000323/2010006-01, Inadequate Design Control for the Emergency Diesel Generator.

b. Failure of Operators to Meet Time Critical Operator Actions

Introduction.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, involving the failure to ensure that operators were able to implement specified actions in response to operational events and accidents.

Specifically, operators could not achieve actions within the analysis time estimates for the cold leg recirculation phase of a loss of coolant accident and the steam generator tube rupture event.

Description.

As part of a time critical operator action revalidation activity, the licensee evaluated whether operators could meet the assumed action times detailed in their FSAR document and other licensing basis documentation. For two separate events, there were instances where operators were not able to meet these timed actions.

1) On March 10 and 12, 2010, the licensee evaluated the assumed action times associated with mitigating the effects of a steam generator tube rupture. Part of the actions described in FSAR document, Section 15.4.3 (Revision 18) is to initiate a cooldown of the reactor coolant system within 5 minutes of isolating the ruptured steam generator. The times were evaluated with licensed operator groups in the plant simulator. To complete this action, it took the two licensed operator Groups 8.5 and 6 minutes, respectively. This demonstrated that contrary to the above, the licensee did not implement design control measures to verify that this time critical operator action time, as described in their FSAR document, could be adequately met or maintained. PG&E entered the issue into their corrective action program as Notification 50304343.

2) On March 3 and 10, 2010, the licensee evaluated the assumed action times associated with switching the emergency core cooling system pumps suction to the containment sump recirculation lineup during a large break loss of coolant accident.

Part of the actions described in FSAR document, Section 6.3.1.4.4.2 (Revision 18),is to switch from injection mode to recirculation mode in approximately 10 minutes.

The times were evaluated with licensed operator groups in the plant simulator. To complete this action, it took the two licensed operator groups 14.5 and 12 minutes, respectively. This demonstrated that contrary to the above, the licensee did not implement design control measures to verify that this time critical operator action time, as described in their FSAR document, could be adequately met or maintained.

PG&E entered the issue into their corrective action program as Notifications 50303241 and 50304170.

The sites time critical operator action process was revised in September 2009 to include the effort to periodically revalidate assumed operator action times in their licensing basis (OP1.ID2, Revision 2). Prior to this, the licensee had not evaluated their operating crews on a periodic basis to ensure that the FSAR time assumptions could be met.

Based on interviews with staff and review of training materials on how critical tasks were defined on site, evaluation for meeting time requirements in their requalification program was not addressed.

The licensee had past commitments and opportunities for verifying that FSAR operator action times could be met. In the 2006-2007 timeframe, Diablo Canyon was a participant in a pressurized water reactor group effort to develop a Westinghouse plant standard for verifying and revalidating assumed time critical operator actions in the licensing basis. The standard produced from this effort, available in March 2007 (Ref: WCAP-16755-NP, Operator Time Critical Action Program Standard), could have been used by the licensee to modify programs to include industry practices to ensure that time critical operator actions were validated and revalidated.

Following the failures to meet the time critical operator actions detailed above, the licensee evaluated operability for the related systems based on questioning by the inspection team. For the steam generator tube rupture event, they demonstrated that in the scenarios where they failed to meet the time requirements, the ruptured steam generator would not be overfilled (Notification 50304343). In the case of the switchover to cold recirculation lineup, it was determined that: 1) net positive suction head was reduced, but adequate for the emergency core cooling system pump operation, 2) there were no adverse affects to the reactor fuel cooling based on the increased time for emergency core cooling system pump switchover, and 3) there would be sufficient sodium hydroxide added to the containment sump to ensure that assumptions on iodine quantity in containment is within the amounts assumed in the licensing basis (Notification 50309326).

Reviews of these deficiencies by the licensee (Notifications 50304343 and 50309326)resulted in various corrective actions being proposed, including continuing training, more simulator performance evaluations of licensed operator crews, emergency operating procedure changes, and FSAR revisions.

Analysis.

The issue is a performance deficiency because it involved the failure to ensure time critical operator actions could be implemented and it was within the licensees

ability to identify and correct this problem. The team determined that the finding was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding represented a potential loss of a safety function requiring a Phase 2 analysis. Based on no appropriate target in the presolved notebook, a Phase 3 analysis was performed. The senior reactor analyst reviewed the actual timing of the walkdowns associated with the steam generator tube rupture time critical actions. The following table indicates the timing of the event:

TABLE 1 Steam Generator Tube Rupture Time Critical Actions FSAR (Design) Observed Crew 1 Crew 2 Action Action Total Action Total Action Total Stop 5.54 min 5.54 min 2.25 2.25 min 3 min 3 min TDAFW min Isolate 10 min 15.54 min 7 min 9.25 min 7 min 10 min Ruptured S/G Start 5 min 20.54 min 6 min 15.25 min 8.5 min 18.5 min Cooldown The analyst determined that, while the licensee failed to meet the specific cooldown timing documented in the FSAR, the total time to start cooling the reactor was well within the total critical timing of the event for both crews in the validation. The analyst found no impact on safety in delaying the cooldown of the reactor for 1 minute or 3.5 minutes given that the other time critical actions were performed more quickly than required.

Therefore, the analyst determined that this portion of the finding was of very low safety significance because it does not represent an actual loss of safety function (Green).

The senior reactor analyst reviewed the issue related to the assumed action times associated with switching over to containment sump recirculation lineup for their emergency core cooling system pumps during a large break loss of coolant accident.

The analyst noted that this time-critical action was only required if a large-break loss of coolant accident occurred simultaneously with the failure of a residual heat removal pump to stop automatically, requiring local isolation of the pump.

According to the standardized plant analysis risk model for Diablo Canyon 1 and 2, Revision 3.50, the initiating event frequency for a large-break loss of coolant accident is 2.5E-6/year. The probability of a single pump failing to stop upon automatic demand can be approximated using Inspection Manual Chapter 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, Table 4, Remaining Mitigation Capability Credit. Table 4 indicates that the likelihood of a single train failing can be estimated as 1E-2. The frequency of a large-break loss of coolant

accident (IE-LLOCA) occurring simultaneously with the failure to stop of a residual heat removal pump (RHRFTS) can be approximated as follows:

IE-LLOCA

• RHRFTS = 2.5E-6/year

• 1E-2

= 2.5E-8/year Given that the frequency of the initial conditions for the time critical action are below the Green/White threshold, the change in core damage frequency associated with this finding must be of very low safety significance (Green).

The finding was reflective of current plant performance because the licensee participated in a recent industry-wide study on time critical operator actions, but did not implement any of the groups recommendations. The finding had a crosscutting aspect in the area of human performance, decision-making, because the licensee did not use conservative assumptions in the decision- making process or conduct an adequate effectiveness review to verify the validity of the underlying assumptions for a safety-significant decision

H.1(b).

Enforcement.

Title 10 of the CFR, Part 50, Appendix B, Criteria III, Design Control, required that PG&E establish measures to assure that applicable regulatory requirements and the design basis be correctly translated into specifications and that design control measures be provided for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, from approximately March 1991 until April 12, 2010, PG&E did not establish measures to assure that applicable regulatory requirements and the design basis were correctly translated into specifications and that design control measures were provided for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, PG&E failed to assure that operators were proficient and able to perform various operations within the times required in the license and failed to ensure that the time critical operations could be completed by the operators as required by the licensing documents. Because this finding is of very low safety significance and was entered into the corrective action program as Notification 50308824, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000275/2010006-02; 05000323/2010006-02, Failure to Maintain Proficiency of Operators to Meet the Time Critical Operator Actions.

c. Failure to Submit Complete and Accurate Information for a License Amendment Request

Introduction.

The team identified a noncited violation of 10 CFR 50.9 with multiple examples, after PG&E failed to ensure that all information supplied to the NRC with License Amendment Request 10-01, Revision to Technical Specification 3.8.1, AC -

Operation, on February 24, 2010, was complete and accurate in all material respects.

The team concluded that the licensee provided incorrect applicable regulatory

requirements criteria in the license amendment request submitted with PG&E Letter DCL-10-018, dated February 24, 2010.

Description.

By letter, dated February 24, 2010, PG&E submitted License Amendment Request 01-10, Revision to Technical Specification 3.8.1, AC - Operation, related to the revision of Technical Specification 3.8.1, "AC Sources - Operating," Surveillance Requirement 3.8.1.3, Diesel Generator Load Band, Surveillance Requirement 3.8.1.10, Diesel Generator Power Factor and Load Band, Surveillance Requirement 3.8.1.14, Diesel Generator Power Factor and Load Values, and Surveillance Requirement 3.8.1.15 Note 1, Diesel Generator Load Band. While reviewing the request, the team identified the following discrepancies:

Example 1: The request stated that the diesel generator design basis was General Design Criteria (GDC) 24 & 29 (1967). The team found information in various documents which indicated that the diesel generator design basis was the more limiting GDC 17 (1971)since initial plant licensing. In particular, the NRC Safety Evaluation Report, Section 8.0, Electric Power, stated in part:

The Commission's GDC 17 and 18, IEEE Standards including IEEE Criteria for Class IE Electric Systems for Nuclear Power Generating Stations (IEEE Std 308-1971), and Regulatory Guides 1.6, 1.9, 1.32, and 1.41, served as the bases for evaluating the adequacy of the electric power systems of the Diablo Canyon Nuclear Plant, Units 1 and 2. We have reviewed the design of the onsite ac and dc power distribution systems and have determined that the design meets Atomic Energy Commission GDC 17 and 18, IEEE Std 308-1971, and Regulatory Guides 1.6, 1.9, and 1.32.

Example 2: The request stated that PG&E was committed to Regulatory Guide 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants, Revision 2, for diesel generator frequency recovery criteria. The team found the licensee was committed to the more limiting Regulatory Guide 1.9, Revision 0 (Safety Guide 9), for diesel generator frequency recovery criteria.

Example 3: The request stated the limiting diesel generator is Unit 2 Bus F DG 2-3, which has a margin of 45 KW to the 2000-hour rating of 2752 KW (rating based on 60 Hz) at the worst case frequency and voltage variation of 61.2 Hz and 110 percent voltage. The team found that the worst case design generator (DG 2-3) had no margin and was actually overloaded.

Example 4: The request stated that the proposed minimum load limit value of 2750 KW for Surveillance Requirement 3.8.1.14.a will provide assurance of the diesel generators ability to carry 100 percent of

maximum expected accident load since it bounds the maximum expected accident load. The team found that the worst case design generator (DG 2-3) load is 2762 KW which is greater than the maximum load value of the proposed Surveillance Requirement 3.8.1.14.

Example 5: The request stated that the proposed maximum load limit of 2750 KW for the remaining hours of the Surveillance Requirement 3.8.1.14.b endurance test is based on the 2000-hour rating, which envelopes the maximum expected accident load. The team found that the worst case design generator (DG 2-3) load is 2762 KW which is greater than the proposed maximum load of 2750 KW.

The licensee withdrew the license amendment request after the team identified the above discrepancies.

Analysis.

The performance deficiency associated with this finding involved the licensees failure to submit complete and accurate information concerning the diesel generator with respect to licensing bases and loading to support License Amendment Request 01-10. This finding affects the Mitigating Systems Cornerstone and is greater than minor because the NRC relies on licensee to submit complete and accurate information in order to perform its regulatory function. Because this issue affected the NRC's ability to perform its regulatory function, it was evaluated with the traditional enforcement process. Consistent with the guidance in Section IV.A.3 and Supplement VII, paragraph D.1, of the NRC Enforcement Policy, this finding was determined to be a Severity Level IV noncited violation. This finding has a crosscutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee did not adequately evaluate the extent of condition and take appropriate corrective actions after the NRC identified a similar violation P.1(c).

Enforcement.

Title 10 of the CFR 50.9(a) requires, in part, that information provided to the NRC by a licensee shall be complete and accurate in all material respects. Contrary to the above, on February 24, 2010, PG&E failed to ensure that information provided to the NRC was complete and accurate in all material respects. Specifically, the licensee failed to submit complete and accurate information to support the NRCs approval process for License Amendment 01-10. This is a Severity Level IV noncited violation consistent with Supplement VII, paragraph D.1, of the NRC Enforcement Policy.

Because this finding is of very low safety significance and has been entered into the corrective action program as Notifications 50307101 and 50311718, this violation is being treated as a noncited violation consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000275/2010006-03; 05000323/2010006-03, Failure to Submit Complete and Accurate Information for a Requested License Amendment.

d. Untimely and Inadequate Corrective actions for the Emergency Diesel Generators

Introduction.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, with two examples, for the failure of PG&E to implement timely and effective corrective actions to address a previously issued noncited violation regarding the adequacy of the emergency diesel generators to meet the design basis. The first example resulted from the failure to identify that instrument inaccuracies were not accounted for in the bounding calculations. The second example involved the failure to identify that the worst case loading calculations exceeded emergency diesel generator operating load limit.

Description.

The resident inspectors identified in 2008 that Calculation 15-DC was inadequate because the licensee did not analyze for all postulated accidents, did not assume a single limiting failure as required by GDC 17, did not analyze the frequency and voltage variations allowed by Technical Specification 3.8.1, did not incorporate momentary loads consisting of transient inrush currents, relay and solenoid short-time currents, motor starting currents and loading for motor-operated valves, and did not include any manually initiated loads that may be required during accident response.

The first example of the failure to meet the requirements of Criterion XVI involved interim corrective actions to address the inadequacies identified in Calculation 15-DC, which was documented in Notification 50179082 in January 2009. The licensee concluded that operability of the emergency diesel generators was maintained based on procedural requirements limiting the emergency diesel generator frequency to 60.5 Hz. Therefore, 60.5 Hz was used as the worst case frequency, instead of the technical specification allowed 61.2 Hz, to conclude that the emergency diesel generators total compensated load was less than the 2000-hour operating limit of 2752 KW. It was later documented by the licensee in Notification 50307598 that due to instrument inaccuracies, a frequency of 60.5 Hz as indicated in the control room, could actually be as high as 61.2 Hz.

Therefore, the worst case frequency used in the interim corrective action did not account for instrument inaccuracies and did not verify the adequacy of emergency diesel generator design.

The second example of the failure to meet the requirements of Criterion XVI involved Calculation 15-DC, Revision 20, which was completed in June 2009 and addressed the inadequacies of the previous revision of Calculation15-DC. When Calculation 15-DC showed that worst case diesel generator loading, evaluated at 61.2 Hz and 110 percent motor voltage, was 2759 KW for Unit 1 and 2762 KW for Unit 2, the licensee failed to identify and address the fact that the licensed limit for the diesel generators would be exceeded. Revision 18 of PG&Es Updated FSAR, Section 8.3.1.1.13.1, states that emergency diesel generator loading meets the applicable criteria of Regulatory Guide 1.9, Revision 0 (Safety Guide 9). Safety Guide 9 states that the predicted loads should not exceed the smaller of the 2000-hour rating, or 90 percent of the 30-minute rating of the set. The 2000-hour rating of 2752 KW is the smaller of the two, and therefore, PG&Es maximum operating limit. Calculation 15-DC showed that worst case diesel generator loading, evaluated at 61.2 Hz and 110 percent motor voltage, was 2759 KW for Unit 1 and 2762 KW for Unit 2, which exceeded the 2752 KW limit. Additionally,

the operability assessment that was performed was inadequate because it stated that the additional load was acceptable because at a higher rpm, the diesel engine would generate more horsepower and could therefore handle the extra load. However, when the engineers were questioned by the team, the engineers acknowledged that they did not know if the diesel engine horsepower was the limiting aspect of the diesel generator with respect to the electrical load capabilities.

In response to the teams observations, the licensee performed an operability evaluation as documented in Notification 50307598. The team reviewed the evaluation and concluded that the emergency diesel generators remained operable and capable of performing their intended safety function.

Analysis.

The team concluded that the failure of PG&E to implement timely and adequate corrective actions for verifying the adequacy of design of the emergency diesel generators was a performance deficiency. This finding is greater than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstones objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with Inspection Manual Chapter 0609, Significant Determination Process, the team performed a Phase 1 analysis to analyze the significance of this finding and determined the finding is of very low safety significance because the condition was a design or qualification deficiency confirmed not to result in loss of operability or functionality, did not represent an actual loss of safety function of the system or train, did not result in the loss of one or more trains of nontechnical specification equipment, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. The finding had a crosscutting aspect in the area of human performance, decision making, because PG&E did not use conservative assumptions in the decision-making process or conduct an adequate effectiveness review to verify the validity of the underlying assumptions for a safety-significant decision H.1(b).

Enforcement.

Title 10 of the Code of Federal Regulations, Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Contrary to the above, from June 2009 until April 12, 2010, PG&E failed to establish measures to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances were promptly identified and corrected. Specifically, PG&E failed to establish timely and adequate corrective actions to address the adequacy of the emergency diesel generator design because bounding of the worst case diesel generator over frequency did not account for instrument inaccuracies, and worst case loading calculations exceeded the emergency diesel generator operating limit of 2752 KW. Because this finding is of very low safety significance and was entered into the corrective action program as Notifications 50307493, 50307494, 50307598, and 50307755, this violation is being treated as a noncited violation, consistent with Section

VI.A of the NRC Enforcement Policy: NCV 05000275/2010006-04; 05000323/2010006-04, Untimely and Inadequate Corrective Actions for the Emergency Diesel Generators.

e. Failure to Appropriately Evaluate Failed Residual Heat Removal Surveillance Test

Introduction.

The team identified a finding of very low safety significance (Green) that involved a noncited violation of Technical Specification 5.4.1.a because the licensee failed to appropriately evaluate and correct a condition adverse to quality, as instructed by surveillance test Procedure P-RHR-A22, Comprehensive Testing of Residual Heat Removal Pump. Specifically, the licensee failed to recognize a deviation in differential pressure towards the alert range, following the February 9, 2008, comprehensive surveillance test of the 2-2 residual heat removal pump. Continued degradation of the 2-2 residual heat removal pump resulted in failure of the October 9, 2009, comprehensive surveillance test due to the differential pressure exceeding the action limit. The licensee entered this issue into the corrective action program as Notification 50308225.

Description.

The team reviewed the negative differential pressure trend associated with the February 2009 performance of surveillance test Procedure P-RHR-A22 and the subsequent October 2009 test failure. Specifically, the team evaluated the licensees attempts to identify and correct the cause of the degrading trend and subsequent surveillance test failure.

On October 9, 2009, following performance of surveillance test Procedure P-RHR-A22 during Refueling Outage 2R15, the licensee identified that the differential pressure across residual heat removal Pump 2-2 was 135.20 psid. The action high limit is 135.13 psid. Therefore, the measured differential pressure across the residual heat removal Pump 2-2 exceeded this limit. The calculated flow rate for this test was 4190.1 gpm which fell within the acceptable test range of 4211.9 gpm +/- 40 gpm. With pump differential greater than the action high limit, P-RHR-A22 instructs the licensee to, Declare the pump inoperable until either the cause of the deviation has been determined and the condition is corrected, or an analysis is performed and new reference values are established in accordance with ASME OM Code paragraph ISTB-62009(c). The licensee entered the issue into the corrective action program as Notification 50273132.

On October 30, 2009, the licensee re-performed P-RHR-A22 at a higher flow rate (4250.7gpm), resulting in a measured differential pressure of 133.4, which was below the action high limit of 135.13. While the October 30, 2009, performance of the surveillance test met the test acceptance criteria, it did not account for the cause of the previous (October 09, 2009) failure in which the tested flow rate was within the acceptable test range. The notification was closed with no further action.

The team determined that the licensee failed to appropriately evaluate the cause of the October 9 deviation and correct the condition as required by P-RHR-A22. In addition, a review of pump performance trends revealed a missed opportunity for the licensee to identify a negative trend of residual heat removal pump 2-2 performance during the

February 09, 2008, (R14) performance of P-RHR-A22 in which the measured differential pressure increased 2.6 psid from a baseline of 131.2 to 133.8 psid. Further inspection identified that eh licensee had modified the system lineup used to perform the surveillance, but had failed to rebaseline the pump as required by procedure.

Analysis.

The performance deficiency associated with this finding involved the licensees failure to appropriately determine the cause of a deviation and correct the condition associated with residual heat removal Pump 2-2 failed surveillance test. The finding is more than minor because it was associated with the equipment reliability attribute of the Mitigating Systems Cornerstone and it adversely affected the associated cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the Inspection Manual Chapter 0609, Significance Determination Process, Phase 1 worksheets, the finding is determined to have very low safety significance because the finding:

(1) is not a design or qualification issue confirmed not to result in a loss of operability or functionality;

(2) did not represent an actual loss of safety function of the system or train;

(3) did not result in the loss of one or more trains of nontechnical specification equipment; and

(4) did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. The team determined that this finding had a cross-cutting aspect in the area of problem identification and resolution, corrective action program because the licensee failed to appropriately evaluate the 2009 residual heat removal surveillance test failure such that the resolution addressed the cause of the failure. P.1(c)

Enforcement.

Technical Specification 5.4.1.a states in part that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Section 9 of Regulatory Guide 1.33, Revision 2, Appendix A, recommends procedures governing maintenance be written and maintained. Surveillance test procedure P-RHR-A22 requires that out of specification conditions be evaluated, understood and resolved.

Contrary to the above, PG&E did not appropriately evaluate the cause of a deviation and correct the condition associated with the residual heat removal Pump 2-2 failed surveillance test as required by Procedure P-RHR-A22. Because the finding was of very low safety significance and has been entered into the licensees corrective action program as Notification 50308225, this violation is being treated as a noncited violation consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000323/2010006-05, Failure to Appropriately Evaluate Failed Residual Heat Removal Surveillance Test.

4OA6 Meetings

Exit Meeting Summary

On April 15, July 15, and July 27, 2010, the team presented the inspection results to Mr. James Becker, Site Vice President, and other members of your staff. The licensee acknowledged the issues presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

4OA7 Licensee-Identified Violations

None

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Becker, Site Vice President

K. Peters, Station Director

S. Westcott, Engineering, Director

J. Welsch, Operations Director

C. Harbor, Maintenance Director

B. Guldemond, Site Services Director

D. Petersen, QV Director

T. King, Outage Director

L. Parker, Supervisor

T. Garrity, Supervisor

G. Lautt, Supervisor

M. Frantz, Supervisor

T. Baldwin, Manager

J. McDonald, Manager

B. Hendy, Manager

NRC personnel

M. Hay, Branch Chief

M. Peck, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000275/2010006-01; Inadequate Design Control for the Emergency Diesel Generator, NCV

05000323/2010006-01 (Section 4OA2)

05000275/2010006-02; Failure to Maintain Proficiency of Operators to Meet the Time NCV

05000323/2010006-02, Critical Operator Actions (Section 4OA2)

05000275/2010006-03; Failure to Submit Complete and Accurate Information for a NCV

05000323/2010006-03 Requested License Amendment (Section 4OA2)

05000275/2010006-04; Untimely and Inadequate Corrective Actions for the Emergency NCV

05000323/2010006-04 Diesel Generators (Section 4OA2)

Failure to Appropriately Evaluate Failed Residual Heat Removal

05000323/2010006-05, NCV Surveillance Test (Section 4OA2)

Attachment 1