IR 05000361/2008006

From kanterella
Jump to navigation Jump to search
IR 05000361-08-006 & 05000362-08-006 on 01/08/08 - 04/24/2008 for San Onofre
ML081430656
Person / Time
Site: San Onofre  Southern California Edison icon.png
Issue date: 05/22/2008
From: Hay M
NRC/RGN-IV/DRP/RPB-D
To: Rosenblum R
Southern California Edison Co
References
FOIA/PA-2011-0157 IR-08-006
Download: ML081430656 (31)
v • d • e


Text

UNITE D S TATES NUC LEAR RE GULATOR Y C OMMIS SI ON May 22, 2008

SUBJECT:

SAN ONOFRE NUCLEAR GENERATING STATION - NRC SPECIAL INSPECTION REPORT 05000361/2008006; 05000362/2008006

Dear Mr. Rosenblum:

On April 24, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your San Onofre Nuclear Generating Station facility. This inspection examined activities associated with the load swings that occurred on Emergency Diesel Generator 3G002 during surveillance testing on December 22, 2007. On this occasion, indications of a diesel load swing were seen in the control room and heard locally during a surveillance test, but the problem was not immediately understood by your staff. As a result, the diesel generator was inoperable for over 8 days before station personnel declared it inoperable after more severe load swings caused a failed surveillance test. The NRCs initial evaluation satisfied the criteria in NRC Management Directive 8.3, NRC Incident Investigation Program, for conducting a special inspection. The basis for initiating this special inspection is further discussed in the inspection charter, which is included in this report as Attachment 2. The determination that the inspection would be conducted was made by the NRC on January 7, 2008, and the inspection started on January 8, 2008.

The enclosed inspection report documents the inspection findings, which were discussed on January 15, March 25, and again on April 24, 2008, with members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents two NRC identified findings of very low safety significance (Green). The two findings involved issues concerning the failure of your processes and staff to promptly and thoroughly evaluate equipment response following the event. These issues are similar to those identified following the instrument air event documented in NRC Inspection Report 05000361/2007013 and 05000362/2007/013 (ADAMS ML072950104), indicating that continued focus in this area is warranted. The NRC is concerned about the occurrence of this event and the less than adequate follow-up conducted by your staff, and will conduct follow-up baseline inspections to verify that your corrective actions in response to this inspection are thorough and effective. Both of the findings were determined to involve violations of NRC requirements. Because of their very low safety significance and because they were entered into

Southern California Edison Company -2-your corrective action program, the NRC is treating these findings as noncited violations (NCVs)

consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission Region IV, 612 E. Lamar Blvd., Suite 400, Arlington, Texas, 76011-4125 the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the San Onofre Nuclear Generating Station facility.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Michael C. Hay, Chief Projects Branch D Division of Reactor Projects Dockets: 50-361; 50-362 License: NPF-10; NPF-15

Enclosure:

Inspection Report 05000361/2008006 and 05000362/2008006 w/Attachments Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Significance Determination Evaluation

REGION IV==

Dockets: 50-361, 50-362 Licenses: NPF-10, NPF-15 Report: 05000361/2008002 and 05000362/2008002 Licensee: Southern California Edison Co. (SCE)

Facility: San Onofre Nuclear Generating Station, Units 2 and 3 Location: 5000 S. Pacific Coast Hwy.

San Clemente, California Dates: January 8 through April 24, 2008 Inspectors: C. Osterholtz, Senior Resident Inspector, Project Branch D, DRP S. Makor, Resident Inspector, Project Branch D, DRP J. Nadel, Reactor Inspector, Engineering Branch 1, DRS D. Loveless, Senior Reactor Analyst Approved By: Michael C. Hay, Chief Project Branch D Division of Reactor Projects-1- Enclosure

SUMMARY OF FINDINGS

IR 05000361/2008006, 05000362/2008006; 01/08/08 - 04/24/08; San Onofre Nuclear

Generating Station, Units 2 and 3; Special Inspection in response to uncontrolled load swings and a manual shutdown of the Unit 3 Train A Emergency Diesel Generator 3G002 on December 31, 2007.

The report covered a 5-day period (January 08-12, 2008) of onsite inspection, with in-office review through April 24, 2008, by a special inspection team consisting of one senior resident inspector, one resident inspector, one reactor inspector, and one senior reactor analyst. Two findings were identified. The significance of most findings is indicated by its color (Green,

White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRCs management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

Summary of Event The NRC conducted a special inspection to better understand the circumstances surrounding an inoperable diesel generator that had to be manually shutdown on December 31, 2007, due to uncontrolled load swings. In accordance with NRC Management Directive 8.3, NRC Incident Investigation Program, it was determined that this event involved failures in systems used to mitigate the effects of an actual event, involved potential adverse generic implications, and had sufficient risk significance to warrant a special inspection.

NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green.

The inspectors identified a Green noncited violation of 10 CFR Part 50,

Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure of operations personnel to meet operability determination procedural requirements following unexplained load swings on Emergency Diesel Generator 3G002. Specifically, operations personnel failed to evaluate the operability of the diesel, per procedure, once a degrading condition had been identified. The licensee entered this issue in their corrective action program as Action Request AR 071201393.

The inspectors determined that the failure to follow SONGSs Procedure SO123-XV-52, Revision 7, Functionality Assessments and Operability Determinations, constituted a performance deficiency and a violation.

The inspectors determined that the violation was more than minor because it is associated with the mitigating systems cornerstone attribute of human performance and it affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The failure to identify the degraded condition associated with Emergency Diesel Generator 3G002 led to operation of Unit 3 with an inoperable diesel for approximately 9 days. Furthermore, the inspectors determined that the cause of the violation is related to the crosscutting area of problem identification and resolution because the licensee did not thoroughly evaluate the problem, including not properly classifying, prioritizing, and evaluating for operability a condition adverse to quality P.1(c).

In accordance with Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the inspectors concluded the violation was of very low safety significance (Green) because it did not represent an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time.

Green.

The inspectors identified a Green noncited violation of Technical Specification 5.5.1.1 for an inadequate monthly Surveillance Test Procedure SO23-3-3.23, Diesel Generator Monthly and Semi-Annual Testing, Revision 30.

The licensee failed to provide adequate guidance for evaluating momentary transients while performing emergency diesel generator surveillance testing. The licensee entered this issue in their corrective action program as Action Requests AR 071201393.

The failure to have a proper procedure in place for emergency diesel generator surveillance testing was considered a performance deficiency. The inspectors determined that the violation was more than minor because it is associated with the mitigating systems cornerstone attribute of human performance and it affected the cornerstone objective of ensuring availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The failure to fully understand the statement regarding momentary transients contributed to the delayed identification of a degraded condition associated with the Emergency Diesel Generator 3G002. The inspectors determined that the cause of the violation is related to the crosscutting area of human performance because operations personnel did not use conservation assumptions in decision making. Specifically, the operations personnel did not understand what the reference to momentary transients meant and failed to evaluate the statement in the procedure further in the face of uncertainty. The procedure indicated that momentary transients might be acceptable and operations personnel made the decision to accept the guidance without proper investigation H.1(b).

In accordance with Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the inspectors concluded the violation was of very low safety significance (Green) because it did not represent an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time.

Licensee-Identified Violations

None.

REPORT DETAILS

1.0 SPECIAL

INSPECTION SCOPE

The NRC conducted a special inspection to better understand the circumstances surrounding an inoperable diesel generator that had to be manually shutdown on December 31, 2007, due to uncontrolled load swings. The Unit 3 Emergency Diesel Generator 3G002 was manually shutdown during a surveillance test, in which the diesel had been instrumented with test equipment, in order to better understand erratic operation that had been first noted 9 days earlier. During the test, control room operators noticed severe oscillations in diesel generator output load and were forced to manually shutdown the diesel. In accordance with NRC Management Directive 8.3, it was determined that this event had sufficient risk significance to warrant a special inspection.

The team used NRC Inspection Procedure 93812, Special Inspection Procedure, to conduct the inspection. The special inspection team reviewed procedures, corrective action documents, operator logs, design documentation, maintenance records, and plant computer system data for all four diesel generators. The team interviewed various station personnel regarding the event. The team reviewed the licensees trouble shooting plan, root cause analysis report, past failure records, extent of condition evaluation, immediate and long term corrective actions, and industry operating experience. A list of specific documents reviewed is provided in Attachment 1 and the charter for the special inspection is included as Attachment 2.

1.1 Event Summary On December 22, 2007, Unit 3 Emergency Diesel Generator 3G002 was paralleled to the grid for a monthly surveillance test. Toward the end of the test, while the diesel generator was still paralleled to the grid and loaded, the control room operator noted a perturbation on the diesel generator megawatt meter in the control room. Operators in the diesel generator room also reported hearing indications that the diesel had experienced a brief load swing.

Immediately after the event, licensee personnel reviewed several sources of data to better understand what had happened. It was recognized quickly that the Southern California Edison/San Diego Gas and Electric (SCE/SDGE) interchange meter, which measures power flow through the plant switchyard, showed a minor perturbation in grid loading that appeared to coincide with the diesel load swings. Licensee personnel also reviewed data from the diesel generator itself in the form of eight transducers that send real time data about various operating parameters (two wattage, two amperage, two voltage, two kVAR) to control room meters (including the wattage meter where the perturbation was first noted) as well as the plant computer for retrieval later. The plant computer data showed that the diesel load dipped approximately 25 percent. This load change was seen on each transducer data plot. In their review of this data, licensee personnel noted that a single wattage Transducer JT8020 showed a faster more spiking response trace than the other transducers, which showed a step change in load. They also noted that the 25 percent load dip occurred earlier in time on Transducer JT8020 than on the other data traces. At the time, it was not understood why Transducer JT8020 did not match the other transducer data plots.

The licensee performed an immediate operability determination using the above information as inputs. They also considered a statement in the monthly diesel surveillance procedure that reads, momentary diesel generator load transients outside the load range do not invalidate this test. Based on the satisfactory completion of the surveillance test and the belief that a grid disturbance may have been responsible for the diesel load swing, the licensee determined that the diesel generator was operable. The immediate operability determination did contain the directive, a more thorough review of the transient is in order.

On December 23, 2007, licensee personnel attempted to verify the grid disturbance theory by contacting the SCE Grid Control Center operators, who reported that no grid disturbances were noted during the test. Data from the Unit 3 main generator was also reviewed to look for any perturbations in output to the grid and none were found. A review of computer data of switchyard voltage on December 22 also turned up with no indications of a perturbation on the grid. A review of digital fault recorder records revealed no triggers during the time of the event. Data from past surveillance runs for all diesels were reviewed and no similar load swings were found.

A second look at the transducer data from the December 22, 2007, Emergency Diesel Generator 3G002 surveillance test did reveal two additional brief swings in load that had not been previously identified. They occurred at 12:55 and 12:58 p.m. The SCE/SDGE interchange meter showed a small disturbance around the same time as these spikes but, like all readings on the interchange meter, the resolution of the data was insufficient to establish a definitive correlation.

Still under the theory that a grid disturbance had been responsible for the load swings, operations personnel repeated the monthly surveillance test of Emergency Diesel Generator 3G002 on December 23, 2007, to provide confirmation that a grid disturbance had caused the load swings. During this test, there were no indications of a grid disturbance on the interchange meter and the operators reported no visual or audible indications of a load swing. Operators noted that Transducer JT8020 data plot showed short duration spikes in load while the other transducer plots were flat during this test. Operations and engineering personnel reviewing the data determined (incorrectly) that the indications on Transducer JT8020 were the result of an unreliable transducer and a work order was initiated to replace Transducer JT8020.

Based on the above information, the licensee determined that the megawatt swings on December 22, 2007, were the result of a grid disturbance as originally thought. The prompt operability determination performed on December 23, 2007, again determined that the diesel generator was operable.

During Christmas week, starting on Monday December 24, station managers continued to question the problems with Emergency Diesel Generator 3G002 that had occurred over the previous weekend. Engineering personnel continued to pursue information on grid disturbances to explain the diesel generator load swings. However, these efforts were delayed due to the Christmas holiday.

On Friday, December 29, 2007, licensee management decided to instrument the diesel generator and perform a 4-hour test run. Engineering personnel determined that spikes noted on Transducer JT8020 on December 23, 2007, were accurate. The spikes only appeared on Transducer JT8020 due to its unique sampling rate. Licensee

management decided to continue to consider the diesel generator operable without consulting the operations shift manager, or any on shift operations personnel.

The 4-hour run occurred on December 31, 2007. During the run the diesel was manually shutdown by operators due to uncontrolled load swings. It was later determined that a reverse power relay had tripped during the test. The instrument data from the test pointed to a problem in the speed probe circuit. Investigating the speed probe, the licensee found an amphenol connection in the line to the speed probe where one wire lead completely separated upon disassembly. It was later determined that the soldered joint was flawed. The flaw appeared to be caused by insufficient solder flux possibly combined with insufficient time and/or temperature during soldering.

Engineering personnel later determined this to be a manufacturing defect that had degraded over time.

The time line below describes the major events starting with the erratic diesel operation noted on December 22, 2007.

Saturday, December 22, 2007

  • 1:19 p.m. - After almost 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of full loading, control room operators noticed a dip in diesel generator load. The load returned to normal after approximately 10 seconds.
  • The perturbation occurred on the diesel generator megawatt meter, which is fed directly by wattage Transducer JT8020.
  • MVAR and amperage swings were also observed.
  • Operations personnel reported hearing the load/frequency change in the diesel generator room.
  • Initial concerns were mentioned that a grid disturbance could be responsible for the load swing. This was based on a 20-30 MW grid system disturbance, recorded on the SCE/SDGE switchyard interchange recorder, which appeared to coincide with the diesel load swing.
  • A review of the Unit 3 main generator showed no corresponding perturbation in megawatts, amperage, or voltage. At the time, it was questioned as to whether a short perturbation near the diesel buses would be felt on the main generator due to its larger mass/size.
  • Licensee personnel performed a review of computer point data from five transducers measuring diesel generator variables, three separate amperage transducers (one for each phase) and two wattage transducers. They noticed

that around the time of the load swing, five of the transducers showed an identical square shaped dip (duration: 10 seconds) in the process variable they measured (all three amperage and one wattage) while Transducer JT8020 wattage showed a more spiking response that did not match the other trace in time (it happened before the drop on the other four traces). As a result, they discounted Transducer JT8020 data as being unreliable.

  • The load swing on the transducer data is from 4.6 MW to 3.4 MW (26 percent) for 10 seconds.
  • The IOD is based on two inputs: The belief that the grid disturbance noted on the interchange recorder could have caused the load swing and a note in the Technical Specification Surveillance Requirement SR 3.8.1.3 which states, Momentary load transients outside the load range do not invalidate this test.
  • The IOD did state that, a more thorough review of the transient is in order.

Sunday, December 23, 2007

  • 1:30 a.m. - The Edison Grid Control Center was contacted and reported no significant grid disturbances at the time of the event. The grid operators looked in the log book and noted no entries describing significant grid disturbances during the December 22, 2007, surveillance test.
  • Engineering personnel requested to run the diesel again so that grid conditions could be monitored and the transducer outputs could be compared to the December 22, 2007, test.
  • 9: 30 a.m. - The licensee repeated the monthly load test to provide confirmation that the megawatt swings on December 22 were due to a grid disturbance.
  • There were no grid disturbances noted on the SCE/SDG&E interchange meter during the test and operations personnel reported no unexpected sounds from the diesel.
  • Wattage Transducer JT8020 on the diesel generator displayed seven to nine spikes during this second surveillance test, but they were smaller and shorter in duration. However, the other five transducers showed no corresponding step load changes similar to those seen during the first test.
  • A review of Transducer JT8020 data from the December 22, 2007, surveillance test revealed two additional megawatt perturbations at 12:55 and 12:58 p.m.
  • The SCE/SDGE interchange meter showed a second small disturbance during the period in question but, like the first disturbance noted on this meter, the resolution of the recorder made it impossible to establish a definitive correlation.
  • As a result of the original thinking about the unreliability of Transducer JT8020 as compared to the other five transducers, the licensee decides to put in a maintenance order to replace the faulty transducer.

Monday, December 24, 2007

  • The Edison Grid Control Center was contacted again and the licensee obtained computer data of grid conditions. They validated no significant grid disturbances north of the plant at the time of the December 22, 2007, surveillance test. The grid engineers suggested contacting SDG&E to validate grid conditions in the San Diego territories.
  • Licensee personnel attempted to contact the diesel generator/speed control governor vendor but the vendor engineer was on vacation.

Tuesday, December 25, 2007

  • The licensee decides that further attempts to contact people for support (grid, vendor, in house experts) would be unsuccessful on Christmas day.

Wednesday, December 26, 2007

  • The licensee was able to contact SDG&E Grid Engineering and confirmed that there were no significant grid disturbances south of the plant on December 22, 2007.
  • SDG&E was able to provide a grid frequency chart from a substation close to SONGS (better information would have been available from a grid frequency recorder in the SONGS control room, but it was not functional).
  • Licensee personnel investigated the possibility of water intrusion into the fuel by reviewing chemical samples and determined that the fuel was satisfactory.
  • Licensee personnel again contacted the diesel vendor (ESI) and were successful. However, he was not familiar with any known problems that could explain the load swings on Emergency Diesel Generator 3G002.

Thursday, December 27, 2007

  • Thursday night, a licensee engineer talks to plant computer engineers about the way the computer processes the data from the diesel transducers.
  • The licensee engineer discovers that Transducer JT8020 is sampled ten times per second and archived by the plant computer at a 1-second sample rate. The other five transducers are also archived at a 1-second sample rate, but because the source for those five signals only updates once every 7.5 seconds, the computer point will be unchanged until that update.
  • This explained why the other five transducers didnt line up in time with Transducer JT8020 on December 22, 2007.
  • Doubts in the first two tests are further confirmed based on information from multiple different experts that a grid disturbance sufficient to cause a 10-second diesel load swing would be expected to impact the main generator in some way and no disturbance was ever seen on the main generator during any test.
  • 7 p.m. - These two revelations are disseminated in an email by the licensee engineer for consideration during the management briefing to be held on December 28, 2007.

Friday, December 28, 2007

  • The licensee begins to question the December 23, 2007, surveillance test based on new information that megawatt Transducer JT8020 was reliable.
  • There were nine instances of megawatt spikes on Transducer JT8020 during the December 23, 2007, surveillance test (although the spikes are smaller and briefer than during the December 22, 2007, surveillance test).
  • The worst spike on the December 23, 2007, surveillance test was a drop in megawatts from 4.6 kW to 4.1 kW (11 percent) and lasted less than 2 seconds.
  • No spikes were found on comparable transducers for the other three diesels for the last monthly surveillance test.
  • A review of control room log entries and a re-review of computer data again showed no large loads started on the diesel Busses 3A04 and 3A06 during the December 22, 2007, Emergency Diesel Generator 3G002 MW transient.
  • 1 p.m. - Engineering personnel provided a presentation to licensee management to discuss findings and make recommendations.
  • Concerns were raised by some managers at the meeting regarding the current operability status of the diesel.
  • The on-shift control room personnel were not present in the meeting and were not informed about the new information discussed at the meeting or the concerns of some management personnel as to the operability status of the diesel.
  • Engineering personnel recommended running Emergency Diesel Generator 3G002 again as soon as possible to determine the cause of the load swings.

Saturday, December 29, 2007

  • The licensee formulated a test plan to monitor the diesel run with test equipment installed so that as much information as possible could be obtained.
  • The original plan called for the diesel run to begin on Saturday night, but due to delays in the preparation of test equipment, it was moved back to Sunday morning.

Sunday, December 30, 2007

  • Engineering personnel requested another monitoring point and this delayed the test again.
  • 9:30 p.m. - The diesel was loaded for a four hour run.

Monday, December 31, 2007

  • 12:22 a.m. - Control room operators notice large load swings on the diesel, noting that the MW meter went to zero and jumped back to full load. Operators attempt to shed loads in an effort to stabilize the diesel but the load oscillations continued unabated and therefore operators decided to secure the machine.
  • The installed test equipment records a disruption in the speed probe signal, leading the licensee to investigate the governor and the speed probe.
  • As a part of their investigation, the licensee removes the speed probe and an Amphenol connector attached to it.
  • The speed probe is sent to a vendor facility for testing.
  • The Amphenol is taken to a test stand and disassembled. When the coupling nut is unscrewed, one of the two wire leads falls out of the shell.
  • It appeared that the solder joint itself was not completely fused (cold joint). As such, the connection was likely held in place by the mechanical force of the connector for the life of the component until it failed.

Tuesday January 1, 2008

  • Per Technical Specification requirements, the licensee performs a surveillance run on Emergency Diesel Generator 3G003 to rule out a common cause failure condition. No problems are noted.

1.2 Operator Response The team assessed the response of the control room operators to the failure of Emergency Diesel Generator 3G002. The team reviewed operator logs, plant computer data, and strip charts to evaluate operator performance in coping with the event and transient; verified that operator actions were in accordance with the response required by plant procedures and training; and verified that the licensee identified and implemented appropriate corrective actions associated with personnel performance problems that occurred during the event. The team also conducted interviews with each of the control room operators who were on shift during the event.

The inspectors concluded that operations personnel reacted as expected with the information that they were provided. Through interviews with control room personnel, the inspectors noted a general weakness in the operators understanding of the design and integrated operation of the plant computer system data and current status of the diesel generator. As an example, several operators were unaware that there was doubt as to the validity of the diesels operability.

The inspectors concluded the operators understanding of the event on December 22 and their ability to diagnose and respond to future events involving a diesel generator failure, were complicated by the sparse level of communication with engineering, unavailability of a frequency recorder, and failing to understand statements in the operability and surveillance procedures.

The licensee initiated a root cause evaluation to assess the above issues related to the operator response and posttrip review for the December 22, 2007, diesel generator event as part of Action Request AR 071201393.

1.3 Root Cause Evaluation The licensee performed two separate root cause evaluations for the diesel generator failure that occurred on December 22, 2007. The inspectors reviewed the accuracy and thoroughness of the licensee cause determination as described in the root cause evaluation, Evaluation of rigor and timeliness of 3G002 Operability and Root Cause Evaluation of Momentary Load Changes During Emergency Diesel Generator 3G002 Monthly Surveillance Testing, performed as part of Action Request AR 071201393. The licensees root cause evaluation used events and causal factors analysis and failure modes and effects analysis to evaluate the insufficient soldering joints, the use of operating experience at the site, and the implementation of the preventive maintenance program with the diesel generator.

In the first of two root cause evaluations, the licensee analyzed the failure of the speed sensors to operate properly, in addition to the strategy for maintaining the speed sensors. The licensee visually inspected the speed sensor assembly and did not uncover any abnormal finding, other than what appeared to be a light deposit of shiny material on the bracket supporting the speed probes. The same deposits were identified on two other diesel generators and, during troubleshooting activities, the shavings were found to contain a chromium-iron alloy. It was also noted that the face of the speed probe removed during troubleshooting activities had rub marks. The licensee concluded

that the Speed Probe A3 was supplied with a degraded soldered joint and the physical evidence showed that the probe recently contacted the gear teeth.

The licensee also reviewed the gap settings for the speed sensors and identified that prior to the December 22, 2007, event that the as-found settings were found under their specified limits. The analysis concluded that the cause of the settings being found under the specified limits was due to inadequate procedural guidance that was vague with respect to the speed sensor gap settings. To address the extent of condition, the Speed Probe A3 was disassembled and inspected for inadequate solder connections. In addition, all of the speed probes and switches for each diesel were included in the extent of condition.

The planned corrective actions for the physical event included reviewing and revising Procedure SO23-II-11.156, Diesel Generator Electric Governor Test and Calibration, Revision 4, so it would include guidance to set the gap settings adequately. The licensee also planned to inspect the connections associated with the other emergency diesel generators to provide assurance that inadequate solder did not exist on the other emergency diesel generators.

The second part of the root cause evaluation dealt with the human performance aspect.

Specifically, it focused on the rigor and timeliness of the Emergency Diesel Generator 3G002 operability determination. The root cause evaluation emphasized that there were things not understood by plant staff and clarified these items. One is that an operability determination is not a one-time event, but a continuous process that is re-evaluated every time there is new information. The second point clarified that the operating crew is responsible for the overall control of the facility operation and should be aware of the status that may affect plant operations. Additionally, the control room shift manager has the sole responsibility for the operability determination. The third and final point discussed Technical Specification surveillances and the fact that satisfactory performance of a surveillance does not necessarily guarantee operability.

The licensee assessed the actions of the staff following the diesel failure and determined that the data should have been re-evaluated on December 27, 2007, and that communication was inadequate. The inspectors determined that unqualified individuals made the operability determination rather than trained and qualified personnel.

The corrective actions that were indicated included developing operability assessment training so that all stakeholders are trained on general expectations, clarify and strengthen steps for notifying the control room shift manager of abnormal conditions, add key issues in requalification training, and update surveillance procedures to provide guidance to review recorded data and assess momentary transients. The root cause also discussed the frequency recorder that was out of service that could have been used to support the information regarding grid fluctuations.

The root cause evaluation continually indicated that operations, specifically the shift manager needs to be responsible for operability calls, but provided no specifics or corrective actions to ensure that the shift manager receive all information, including differing professional opinions, in order to make a thorough and educated assessment.

The inspectors noted that the root cause evaluation did not specifically address the lack of engineering support during the original surveillance test run on December 22, 2007.

The inspectors concluded that the control room shift manager cannot make sound

operability calls without engineering support when anomalies occur during surveillance testing.

The inspectors expressed concern with the fact that it took two months for the licensee to complete the human performance part of the root cause evaluation and that some details were not addressed fully. For instance, the meeting where plant attendees discussed the operability call was briefly commented on. The inspectors noted that in some cases, the causes identified in the root cause evaluation tended to be associated with a single, broad corrective action such as strengthen site standards. While the inspectors did not disagree with the intent of the corrective action, the generalized language left the method of implementation open to interpretation and complicated the ability of the stations assessment organization to perform effectiveness reviews. In these cases, the inspectors concluded a set of specific, focused, and measurable corrective actions may have been more appropriate.

1.4 Industry Operating Experience (OE) and Potential Generic Issues During the late 1980s and early 1990s, a significant amount of OE identified instances where facilities had experienced transients and/or trips due to failures of soldered joints.

The inspectors performed searches of operating experience databases and other sources to identify reports of similar problems, both inside and outside the nuclear industry. The licensee documented their review of the industry OE in their corrective action program (CAP) as Independent Safety Engineering Group Operating Experience Evaluation, dated January 22, 1992. In this review, the licensee evaluated the identified causes and corrective actions from the OE and determined that soldering at SONGS was loosely controlled and better training was necessary for welders at the facility.

However, the licensee asserted in their evaluation that failures due to inadequate fit-up or solder penetration typically occur within a relatively short time frame after startup.

2.0 SPECIAL INSPECTION FINDINGS 2.1 Failure to Follow Procedure SO123-XV-52, Functionality Assessments and Operability Determinations The inspectors identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings involving the failure to meet operability determination procedural requirements following unexplained load swings on Emergency Diesel Generator 3G002. Specifically, operations personnel failed to evaluate the operability of the diesel, per procedure, once a degrading condition had been identified.

On December 22, 2007, operations and engineering personnel at SONGS were faced with an emergency diesel generator that exhibited off-normal behavior during a surveillance test. Licensee personnel missed several opportunities to identify the problem as a degraded condition and when evidence of the problem finally was understood, the licensee failed to enter their operability process. Consequently, 9 days after the initial surveillance test, while testing for a third time, the diesel had to be manually shutdown due to large load swings. As such, licensee personnel failed to follow their operability procedure, which requires that degraded conditions be identified and the operability of the associated equipment assessed.

The NRC special inspection team interviewed the on-shift control room shift manager, the senior technical analyst, and a number of other individuals involved. The actions taken by control room and engineering staff discussed below are based on these interviews and other information obtained from the licensee.

During a routine monthly surveillance test on December 22, 2007, Emergency Diesel Generator 3G002 experienced a load swing. The perturbation in load was confirmed by control room operators, who saw megawatts dip on the diesel load digital meter in the control room. The load swing was also confirmed by operators in the diesel area, who reported hearing the engine frequency change and then return to normal. The surveillance was completed without further incident after the momentary load perturbation.

Control room operators began investigating the load perturbation immediately. The shift manager looked first at the SCE/SDGE interchange meter, an analog strip chart recorder of power flow through the switchyard, because switchyard power perturbations had been responsible for diesel load swings in the past. The recorder showed a small perturbation around the same time the diesel perturbation was noted.

The diesel perturbation was verified by looking at archived data stored in the plant computer system (PCS). PCS data is readily available to operators in the control room and it is used frequently by them to support their operational duties. The PCS data, which is also referred to as R-time data, includes two diesel generator wattage parameters, one KVAR parameter, and three amperage parameters. The data revealed that megawatts had dropped from 4.6MW to 3.4MW for approximately 10 seconds and then returned to normal. However, one wattage parameter, designated Transducer JT8020, did not show the same step change seen in the other five parameters, one of which should be a measure of the same wattage. The Transducer JT8020 plot was spiking more than the step change seen in the other five parameters and the load perturbation happened earlier in time on Transducer JT8020 plot than on the other five, all of which lined up very closely. Furthermore, operators noted two other shorter perturbations on Transducer JT8020, which occurred earlier in the surveillance run. The other five parameters did not show a load change at those two points. Operators did not understand the reasons for these discrepancies, but it was suspected at the time that Transducer JT8020 was unreliable because it was the only parameter out of all six that did not match the rest.

Control room personnel also noted that the surveillance procedure has a statement that also appears verbatim as a note in the Technical Specification Surveillance Requirement for the monthly test; it reads: momentary transients outside the load range do not invalidate this test. This note, combined with an otherwise uneventful surveillance test in which all the acceptance criteria were met, was a large part of the basis for the IOD.

The control rooms IOD concluded that the diesel was operable. This conclusion was based on the belief that a grid disturbance had been responsible for the load perturbation and on the high confidence by operations personnel that a satisfactory surveillance test result meant the diesel was operable. The IOD did recognize that a more thorough review of the transient is in order and an action was initiated to investigate further. To that end, engineering personnel were called in and continued to investigate through the night.

Due to the heavy reliance on the satisfactorily completed surveillance test in the IOD, it is worth noting that the Operability Determination Procedure has guidance that was not properly considered by the staff. Attachments 6 and 7 to Procedure SO123-XV-52, Functionality Assessments and Operability Determinations, Revision 7, are titled, Immediate Operability Guidance and Prompt Operability Guidance, respectively.

Each attachment has an identically worded section titled, Meeting Surveillances Does Not Prove Operability If There Is Evidence To The Contrary. This section is a verbatim copy of language in NRC Part 9900 Technical Guidance titled, Operability Determinations & Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety. The section discussed that, while surveillances are usually sufficient to demonstrate operability, this is not always the case when problems that may not affect the passing of the surveillance acceptance criteria are discovered during a test. An example is given where a degrading trend is identified but the surveillance test is still acceptable, an operability determination that relied on more than just the satisfactory surveillance would be required. At this point, the evidence to the contrary was not well understood by the licensee, but it is worth noting that a skeptical philosophy of prove-why-its-operable rather than prove-why-its-inoperable combined with this procedural guidance could have led to a successful result earlier in the sequence of events.

On December 23, 2007, engineering and operations personnel again examined the PCS data that had been reviewed after the surveillance test on December 22, 2007. The PCS receives data from a variety of sources, including data from direct field inputs and from the qualified safety parameter display system (QSPDS) which is the safety related portion of the accident monitoring system. The difference between how these two data sources are handled by the PCS and the understanding of that difference by plant personnel were key contributing factors to the missed opportunities on December 22 and December 23.

The major differences in the accuracy and frequency of data point Transducer JT8020 as opposed to the other five points were caused by the way each point was processed.

Point Transducer JT8020 is fed directly into the PCS through a 12-bit analog to digital converter and it is calibrated to within 1 percent of scale. The other five points are transmitted asynchronously to the QSPDS via a 19.2KB fiber optic modem and then transmitted to the PCS from there, undergoing a whole number truncation. Furthermore, because it is a direct field input, point Transducer JT8020 is updated at a rate of 10 times per second. The frequency of the transfer from the QSPDS to the PCS of the other five points is approximately 7.5 seconds. The PCS automatically archives all these data points for 9 days at a one-second sampling rate, beyond that the data is resampled at a 1-minute rate and saved until 90 days. For this reason, all PCS plots less than 9 days old correctly display a sampling rate and an archive rate equal to one second at the top of each graph. This led operators to believe that all the plotted data represented an equal 1-second update rate. Thus, the displayed sampling and archiving rate of once per second was accurate; but because five of the parameters in question are only sent to PCS from QSPDS once every 7.5 seconds, this causes the PCS to essentially sample the same value approximately 7 times until QSPDS sends a new value and then that value will be sampled 7 times etc. This is in stark contrast to parameter Transducer JT8020, which is the only one that is fed directly to PCS, meaning it has a true once per second update rate.

By December 23, 2007, engineering personnel had been unable to definitively verify that a grid disturbance had actually occurred at the same moment in time that the diesel load swing occurred during the previous days surveillance test. In fact, if using the interchange recorder, due to the resolution of the recorder, it would not have been possible to establish a correlation between the same moment in time on both the PCS diesel data and the grid data. However, the grid disturbance explanation was still the accepted account for the load swings seen during the test. In order to be sure, engineering requested that operations run another test. On December 23, 2007, a second surveillance test was performed and grid conditions were monitored closely. No perturbations on the grid were seen during the test. The R-time data was examined and parameter Transducer JT8020 showed 7-9 discrete load swings of very short duration. However, the other five parameters showed load constant during the test with no perturbations. Licensee personnel, due to their lack of a complete understanding of these data, assumed that since five of the parameters showed no load perturbations that those must be correct and Transducer JT8020 must be defective. Accordingly, a maintenance work order was created to replace Transducer JT8020. The prompt operability determination (POD) performed after this second surveillance test concluded the diesel was still operable. At this point, the lack of an in depth understanding of the PCS data being used to support another operability determination resulted in reinforcing the incorrect assumptions behind the previous tests IOD.

In reality, Transducer JT8020 was the only parameter giving useful information, while the 7.5 second transfer frequency caused any transient shorter than 7.5 seconds to be invisible to the other five parameters. Licensee personnel continued to investigate the perturbations after the second surveillance test on December 23, 2007. Engineering personnel continued to gather additional data and consulted additional experts as the licensee delved deeper into the grid disturbance theory. However, resources were scarce and many efforts were delayed due to the Christmas holiday. Late on Thursday, December 28, 2007, engineering personnel consulted with individuals on-site who were familiar with the PCS. They learned more about the sources of the R-time data and how it was processed by the PCS. The new information was disseminated that night by email to personnel in operations and engineering in preparation for a management briefing on the diesel that was planned for Friday, December 29, 2007.

At the Friday briefing, the new information about the PCS and Transducer JT8020 was communicated. Some personnel voiced concerns during the meeting that the current operability of the diesel generator needed to be revisited. Meeting agenda notes included an item for discussion which reads, we need to understand (again) why 3G002 is operable today. The briefing concluded that there was enough uncertainty about prior decisions and events that it would be prudent to run the diesel for a third time, fully instrumenting it with test equipment so that any problem could be investigated.

However, the control room shift manager was not informed of the operability concerns discussed at the meeting. The managers present at the meeting made operability decisions without informing the on-shift personnel actually responsible for such decisions. Thus, the operability determination from December 23, 2007, continued to be the basis for operability and the diesel remained declared as operable. At least some personnel understood at this time that Transducer JT8020 data was in fact reliable, meaning an increasing number of unexplained load perturbations had occurred during each of the prior two surveillance tests. However, the implications of this information were not fully understood, in terms of operability, and it was never communicated to operations staff in a complete manner. Further complicating the efforts on December 29

was the fact that the operations crew on-shift in the control room and the ones present in the meeting did not include any of the managers that were involved with the original issue. The failure to revisit the diesels operability status per procedure by informing responsible personnel was of particular concern to the inspectors given that all the correct information needed to identify the degraded condition was known to plant personnel.

Due to delays in the efforts to instrument the diesel fully before the planned third run, it did not occur until the early morning of December 31, 2007. Thus, the conclusion of the first two operability determinations remained in place and no new challenges to diesel operability were brought forward. During the third surveillance test, the degraded condition, an inadequate solder joint in the diesel governor speed probe circuit, caused the diesel to undergo load swings in excess of full rated power and the machine had to be manually shut down.

2.2 Inadequate Surveillance Test Procedure, Diesel Generator Monthly and Semi-Annual Testing The inspectors identified a noncited violation (NCV) of Technical Specification 5.5.1.1, for failure to provide adequate guidance in a procedure required by Regulatory Guide 1.33, Appendix A, specifically for the licensees failure to provide adequate guidance when evaluating momentary transients.

It is important that procedures for activities affecting quality to include appropriate quantitative and qualitative acceptance criteria. Specifically, during a monthly surveillance test on December 22, 2007, the control room operators implemented the Surveillance Test Procedure SO23-3-23, Diesel Generator Monthly and Semi-Annual Testing, Revision 30, which stated in Section 3.0 Synchronizing and Loading Guidelines under item 3.11 that Momentary DG Load transients outside load range do not invalidate the tests for Tech Spec. SR 3.8.1.3. Toward the end of the test, while the Emergency Diesel Generator 3G002 was still paralleled to the grid and loaded, the control room operator noted a perturbation on the diesel generator megawatt meter in the control room and operators in the diesel generator room also reported audible indications that the diesel generator had experienced a brief load swing.

Control room operators immediately investigated the load perturbation by looking at the SCE/SDGE interchange meter. The interchange meter is an analog strip chart recorder of power flow through the switchyard and it was noted that there was a small perturbation around the same time as the diesel perturbation. Based on the interchange meter and the fact that the surveillance test procedure, Diesel Generator Monthly and Semi-Annual Testing, SO23-3-3.23, Revision 30, that stated in Section 3.0 (Synchronizing and Loading Guidelines) under item 3.11 that Momentary DG Load transients outside load range do not invalidate the tests for Tech Spec. SR 3.8.1.3, the control room operators considered the surveillance satisfactory.

In fact, the load swing anomalies were noted, attributed to grid disturbance, and Emergency Diesel Generator 3G002 remained operable while additional data was collected. For 9 days following the initial surveillance test, licensee personnel did not identify the degraded condition until the diesel failed on December 31, 2007, when Emergency Diesel Generator 3G002 was tripped and declared inoperable by operations due to uncontrolled load swings.

The statement regarding momentary transients in the surveillance procedure contributed to and was a large basis for the IOD on December 22, 2007. Operations personnel believed that the diesel was operable and that the grid disturbance was responsible for the load perturbation.

When the NRC special inspection team interviewed the control room shift manager, the senior technical analyst, and others involved, it was noted that the statement Momentary DG Load transients outside load range do not invalidate the tests for Tech Spec. SR 3.8.1.3 was not fully understood. None of the individuals interviewed could tell what that statement meant and acknowledged that they did not fully understand what it meant.

Additionally, the Technical Specifications Surveillance Requirement 3.8.1.3, note 2, also stated that, Momentary transients outside the load range do not invalidate this test.

Furthermore, the original Technical Specification Bases stated, Note 2 states that momentary DG load transients because of changing bus loads do not invalidate this test.

Similarly, momentary power factor transients above the limit will not invalidate the test.

The original wording referred to droop mode transient on bus or grid and the new version does not specify the type of momentary transient. This detailed guidance had been removed from the surveillance test procedure and resulted in a broad statement that was not clear to operators.

3.0 ASSESSMENT 3.1 Failure to Follow Procedure SO123-XV-52, Functionality Assessments and Operability Determinations.

The inspectors determined that the failure to follow SONGS Procedure SO123-XV-52, Functionality Assessments and Operability Determinations, Revision 7, constituted a performance deficiency and a violation. The inspectors determined that the violation was more than minor because it is associated with the mitigating systems cornerstone attribute of human performance and it affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The failure to identify the degraded condition associated with Emergency Diesel Generator 3G002 led to operation with an inoperable diesel for approximately 9 days. Furthermore, inspectors determined that the cause of the violation is related to the crosscutting area of problem identification and resolution because the licensee did not thoroughly evaluate the problem, including not properly classifying, prioritizing, and evaluating for operability a condition adverse to quality

P.1(c).

In accordance with Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the inspectors concluded the violation was of very low safety significance (Green)because it did not represent an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time. The licensee has entered this into their CAP as AR 071201393.

3.2 Inadequate Surveillance Test Procedure, Diesel Generator Monthly and Semi-Annual Testing The inspectors determined that the Surveillance Test Procedure SO23-3-3.23, Diesel Generator Monthly and Semi-Annual Testing, Revision 30, was inadequate and that a performance deficiency existed since the surveillance procedure did not provide sufficient guidance for analyzing load perturbation and this resulted in a violation. The inspectors determined that the violation was more than minor because it was associated with the mitigating systems cornerstone attribute of human performance and it affected the cornerstone objective of ensuring availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The failure to fully understand the statement regarding momentary transients contributed to the delayed identification of a degraded condition associated with Emergency Diesel Generator 3G002. Furthermore, the inspectors determined that the cause of the violation was related to the crosscutting area of human performance because the licensee did not use conservative assumptions in decision making. Specifically, the licensee did not understand what the reference to momentary transients meant and failed to evaluate the statement in the procedure further in the face of uncertainty. The procedure said momentary transients were acceptable and the licensee made the decision to accept the guidance H.1(b).

In accordance with Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the inspectors concluded the violation was of very low safety significance (Green)because it did not represent an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time. The licensee entered this into their CAP AR 071201393.

4.0 ENFORCEMENT 4.1 Failure to Follow Procedure SO123-XV-52, Functionality Assessments and Operability Determinations 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by procedures, and that the activities shall be accomplished in accordance with these procedures.

Procedure SO123-XV-52, Functionality Assessments and Operability Determinations, Revision 7, requires deficiencies be evaluated against selected performance parameters for the purpose of determining the operability of the associated equipment or a documented basis for why a condition is not a degradation (6.5.1.3.3 and 6.6.2.1).

Contrary to the above, on December 22, 23, and 29, 2007, operations personnel failed to evaluate the operability of Emergency Diesel Generator 3G002 after evidence of improper operation on the first two dates and after a degraded condition was known to exist at the last opportunity on December 29, 2007. Licensee personnel failed to use a conservative methodology in their decision making process given that they decided not to formally revisit the operability of the diesel generator before the third surveillance test.

This violation is of very low safety significance and has been entered into the licensees CAP as AR 071201393, thus it is being treated as a NCV consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000362/2008006-01, Failure to Follow Operability Procedure.

4.2 Inadequate Surveillance Test Procedure, Diesel Generator Monthly and Semi-Annual Testing Technical Specification 5.5.1.1 requires, in part, that procedures be established for nuclear activities according to Regulatory Guide 1.33, Appendix A. Surveillance Test Procedure SO23-3-3.23, Diesel Generator Monthly and Semi-Annual Testing, Revision 30, prescribed the methodology and acceptance criteria for determining whether the diesel generator passed or failed its monthly surveillance test. Contrary to the above, the licensee failed to make a conservative declaration based in part on a statement that they did not fully understand. This decision was based on guidance in the surveillance procedure that contributed to the inadequate assessment of the load perturbation on Emergency Diesel Generator 3G002. This violation is of very low safety significance and has been entered into the licensees corrective action program as AR 071201393, thus it has been treated as a non-cited violation consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000362/2008006-02, Inadequate Surveillance Test Procedure.

5.0 MEETINGS, INCLUDING EXIT On January 16, 2008, and March 25, 2008, the results of this inspection were presented to R. Ridenoure, Vice President Nuclear Generation, and other members of your staff who acknowledged the findings. Additionally on April 24, 2008, the final results of this inspection were presented to J. Reilly, Vice-President, Engineering and Technical Services, and other members of your staff who acknowledged the findings. The inspector confirmed that no proprietary material was examined during the inspection.

ATTACHMENT 1:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

V. Arora, Engineer, Nuclear Oversight
B. Ashbrook, Manager, Emergency Preparedness
D. Axline, Technical Specialist, Nuclear Regulatory Affairs
D. Breig, Manager, Engineering Standards and Excellence
B. Corbett, Manager, Health Physics
B. Culverhouse, Manager, Site Support Services/Offsite of Emergency Preparedness
J. Dahl, Operations Manager
D. Deglopper, Technical Specialist, Health Physics Planning
D. Dick, Supervisor, Chemistry
G. Fausett, Supervisor, Shielding Program, Health Physics
J. F. Fee, Manager, Emergency Preparedness
K. Gallion, Supervisor, ALARA, Health Physics
S. Gardner, Engineer, Nuclear Regulatory Affairs
J. Hirsch, Manager, Maintenance
K. Johnson, Manager, Design Engineering
M. J. Johnson, Manager, Support Services
L. Kelly, Engineer, Nuclear Regulatory Affairs
M. Kelly, Engineer, Nuclear Regulatory Affairs
R. Nielsen, Supervisor, Nuclear Oversight
A. Martinez, Manager, Health Physics Operational Support
C. McAndrews, Manager, Nuclear Oversight and Assessment
L. Pepple, Technical Specialist, Health Physics Planning, Health Physics
N. Quigley, Manager, Mechanical/Nuclear Maintenance Engineering
J. Reilly, Vice-President, Engineering and Technical Services
R. Richter, Engineering Supervisor, Fire Protection
T. Remick, Fuels Engineer
R. Ridenoure, Vice President, Nuclear Generation
M. Russel, Technical Specialist, Regulatory Projects, Health Physics
A. Scherer, Manager, Nuclear Regulatory Affairs

S, Sewell, Technical Specialist, DWP Program, Health Physics

A. R. Shean, Manager, Nuclear Oversight
R. St. Onge, Manager, Maintenance and Systems Engineering
K. K. Strand, Manager, Site Emergency Preparedness
T. Vogt, Manager, Special Projects
D. Wilcockson, Manager, Plant Operations
C. Williams, Manager, Compliance
T. Yackle, Manager, Operations

Nuclear Regulatory Commission

D. Loveless, Senior Reactor Analyst

-1- Attachment 1

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000362/2008006-01 NCV Failure to Follow Operability Procedure (Section 4.0)
05000362/2008006-02 NCV Inadequate Surveillance Test Procedure (Section 4.0)

LIST OF DOCUMENTS REVIEWED

Retrieved from "https://kanterella.com/w/index.php?title=IR_05000361/2008006&oldid=2156825"