IR 05000528/2005012

IR 05000528-05-012; 05000529-05-012; 05000530/2005012; on 09/12/05 - 12/12/05; Palo Verde Nuclear Generating Station, Units, 1, 2, and 3; Supplemental Inspection Report; IP 95002

ML060300193
Person / Time
Site:	Palo Verde
Issue date:	01/27/2006
From:	Mallett B Region 4 Administrator
To:	James M. Levine Arizona Public Service Co
References
EA-04-221, EA-05-051 IR-05-012
Download: ML060300193 (52)

Text

ary 27, 2006

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION - NRC SUPPLEMENTAL INSPECTION REPORT 05000528/2005012; 05000529/2005012; AND 05000530/2005012

Dear Mr. Levine:

On December 12, 2005, the U.S. Nuclear Regulatory Commission (NRC) completed a supplemental inspection using Inspection Procedure 95002, "Inspection For One Degraded Cornerstone Or Any Three White Inputs In A Strategic Performance Area," at your Palo Verde Nuclear Generating Station. The enclosed report documents the results of the inspection, which were discussed on December 16, 2005, with you and other members of your staff.

This supplemental inspection was conducted to review your corrective actions for both of the violations issued to you on April 8, 2005. The first was a violation regarding 10 CFR 50, Appendix B, Criterion III, "Design Control," for the failure to adequately control the designed configuration of the containment sump safety injection suction piping of all three units.

Specifically, a significant portion of this piping was not consistently maintained full of water since initial operation of all three units. In conjunction with this finding, the NRC also issued a Severity Level III violation of 10 CFR 50.59, with a monetary civil penalty, for a previous change to the facility that was performed without required prior NRC approval. Specifically, a station administrative procedure was changed to maintain the condition of the piping drained instead of filled. Your performance, which led to these violations, was determined to be reflective of that of a degraded cornerstone (i.e., degraded Mitigating Systems Cornerstone) in our Action Matrix.

The specific purposes of this inspection, as described in the Objectives Section of Inspection Procedure 95002, were to (1) provide assurance that the root causes and contributing causes for the violations, which resulted in the degraded cornerstone, were understood; (2) independently assess the extent of condition and extent of cause for the violations; and (3) provide assurance that your planned corrective actions were sufficient to address the root causes and contributing causes for the violations and to prevent their recurrence. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Arizona Public Service Company -2-As further detailed in the enclosed report, the NRC concluded that you performed an adequate evaluation and implemented corrective and followup actions necessary to reasonably prevent repetition of the 10 CFR 50.59 Severity Level III violation. Therefore, we have closed this finding. However, the NRC also concluded that, while you performed an adequate root cause evaluation of the Design Control violation, certain corrective actions were incomplete at the time of this inspection. Specifically, the team determined that for each of the root and contributing causes, not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. In addition, some of the corrective actions were narrowly focused, or the implementation of those actions was not fully effective.

Also, the team concluded that criteria and reviews were not established, for auditing or followup, to ensure that corrective actions were effective in improving performance in the affected areas. Consequently, the team did not have assurance that your planned corrective actions were sufficient to address the causes for the performance deficiencies associated with the violation. We request that you inform us in writing once you have completed steps to assure that your corrective actions are of sufficient scope and breadth to address the subject performance deficiencies. The NRC will then perform additional inspections as necessary to assess the effectiveness of your actions. Pending completion of this followup inspection activity, the subject Design Control violation in the Mitigating Systems Cornerstone will remain open.

This inspection report describes four NRC identified and two licensee identified findings of very low safety significance (Green), involving violations of NRC requirements. Additionally, two summary findings are provided to describe our assessment of your evaluation and implementation of corrective actions associated with the 10 CFR 50.59 and Design Control violations, in accordance with NRC Manual Chapter 0612, Appendix C, "Guidance for Supplemental Inspections." Because of the very low safety significance of these violations, and because they were entered into your corrective action program, the NRC is treating these findings as noncited violations consistent with Section VI.A of the NRC Enforcement Policy. If you contest these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at Palo Verde Nuclear Generating Station, Units 1, 2, and 3, facility.

Arizona Public Service Company -3-In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

//RA//

Bruce S. Mallett Regional Administrator Dockets: 50-528; 50-529; 50-530 Licenses: NPF-41; NPF-51; NPF-74

Enclosure:

NRC Inspection Report 05000528/2005012; 05000529/2005012; and 05000530/2005012 w/Attachment: Supplemental Information

REGION IV==

Dockets: 50-528; 50-529; 50-530 Licenses: NPF-41; NPF-51; NPF-74 Report: 05000528/2005012; 05000529/2005012; 05000530/2005012 Licensee: Arizona Public Service Company Facility: Palo Verde Nuclear Generating Station, Units 1; 2; and 3 Location: 5951 S. Wintersburg Road Tonopah, Arizona Dates: September 12 through December 12, 2005 Inspectors: J. Clark, Branch Chief M. Hay, Senior Resident Inspector, Projects Branch E D. Proulx, Senior Reactor Inspector, Engineering Branch 1 S. Sheldon, Reactor Inspector, Division of Reactor Safety, Region III M. Sitek, Resident Inspector, Projects Branch D Accompanying C. Baron, Contractor, Beckman and Associates Personnel:

S. Unekewicz, Sr. Reactor Engineer J. Groom, Reactor Inspector, Nuclear Safety Professional Development Program Approved By: Bruce S. Mallett Regional Administrator i

SUMMARY OF FINDINGS

IR 05000528/2005012; 05000529/2005012; 05000530/2005012; 09/12/05 - 12/12/05; Palo

Verde Nuclear Generating Station, Units 1, 2, and 3; Supplemental Inspection Report;

Inspection Procedure 95002.

This report documents a supplemental inspection by a branch chief, two resident inspectors, two reactor inspectors, accompanied by a consulting engineer and a team assistant. The inspection identified four noncited violations and two findings. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management's review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Cornerstone: Mitigating Systems

C N/A. The U.S. Nuclear Regulatory Commission (NRC) performed this supplemental inspection, in part, to assess the licensees evaluation and corrective actions associated with an inappropriate change to an emergency core cooling system procedure without prior NRC approval. This procedure change rendered portions of the system inoperable because of voiding. This performance issue was previously characterized as a Severity Level III violation of 10 CFR 50.59 and was originally identified in NRC Inspection Report 05000528; 529; 530/2004014. During this supplemental inspection, performed in accordance with Inspection Procedure 95002, the inspectors determined that the licensees evaluation identified the primary root causes of the performance issue to be: (1) The site procedure revision process (01AC-0AP02) was inadequate, in that, the procedure allowed pre-screening of changes that could potentially bypass performing a 10 CFR 50.59 screening for changes to the facility as described in the licensing basis; and (2) The corrective action program implementation was ineffective. The licensee also identified overlap and interface problems between the corrective action program, the engineering evaluation request program, and the instruction change request program. These issues, in conjunction with inadequate training to recognize a corrective action condition, contributed to the failure of station personnel to initiate a corrective action program input document in 1992 for the potential pipe voiding concern. The inspectors concluded that the licensees evaluation and implemented corrective actions were appropriate to reasonably prevent repetition of the 10 CFR 50.59 violation.

Given the licensees acceptable performance in addressing the inappropriate procedure change and 10 CFR 50.59 program deficiencies, the Severity Level III violation is closed. (Section 4OA5.6)

C N/A. The NRC performed this supplemental inspection, in part, to assess the licensees evaluation and corrective actions associated with potential air entrainment into the emergency core cooling system. The licensee failed to incorporate original design requirements into the plant to maintain piping between the containment sump isolation valves filled with water. This performance issue was previously characterized as a 10 CFR 50, Appendix B,

Criterion III, violation having substantial safety significance (Yellow), and was originally identified in NRC Inspection Report 05000528; 529; 530/2004014. The inspectors determined that the licensees evaluation identified a direct cause, nine root causes, and nine contributing causes of the performance issue. The evaluation was also used to develop an extensive list of corrective actions. The inspectors found the licensees methods of evaluation to be appropriate.

The NRC concluded that, while the licensee performed an adequate root cause evaluation of the Design Control violation, certain corrective actions were incomplete at the time of this inspection. Specifically, the team determined that for each of the root and contributing causes, not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. In addition, some of the corrective actions were narrowly focused, or the implementation of those actions was not fully effective. Also, the team concluded that criteria and reviews were not established, for auditing or followup, to ensure that corrective actions were effective in improving performance in the affected areas. Consequently, the team did not have assurance that the planned corrective actions were sufficient to address the causes for the performance deficiencies associated with the violation.

Therefore, the (Yellow) violation (VIO 2004/014-01) will remain open for further NRC review. (Section 4OA5.6)

C

Green.

The inspectors identified a noncited violation of 10 CFR 50, Appendix B,

Criterion III, "Design Control," related to potential air entrainment into the emergency core cooling system suction header from the refueling water tank.

Specifically, the inspectors determined that the water level in the refueling water tank could fall below the level of the tank discharge pipe and associated vortex breaker during the transfer from the refueling water tank to the containment sump during design basis accidents. As a result, air could be drawn into the emergency core cooling system piping under accident conditions. This issue was applicable to both trains of all three units. Contrary to proper design control, engineering personnel failed to effectively implement design requirements to prevent potential air entrainment into the emergency core cooling system.

The inspectors considered this finding to be more than minor, in accordance with NRC Manual Chapter 0612, "Power Reactor Inspection Reports," since it potentially affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences, and it affected the attributes of design and configuration control. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 worksheet, the inspectors determined that the issue was of very low safety significance (Green) because there was no actual loss of safety function. Because the violation was determined to be of very low safety significance and has been entered into the corrective action program as condition report/disposition request (CRDR 2835132), this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy. The inspectors also determined this issue had cross-cutting aspects of human performance. Specifically, the licensees attention to detail was lacking and there was poor inter- and intra-group coordination. (Section 4OA5.1)

C

Green.

The inspectors identified two examples of a noncited violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," for failure to translate the design basis volume of 300,000 gallons of usable volume in the condensate storage tank (CST) and reactor water makeup tank (RWMT) into the stations instructions, procedures, or drawings. Without this information, operators were unaware that Technical Specification minimum levels, specified in feet, may not provide sufficient usable volumes of water for auxiliary feedwater pump operation. Contrary to proper design control, the licensee failed to effectively implement design requirements to ensure operability of the auxiliary feedwater system.

These two examples of a violation affect the Mitigating Systems cornerstone and are more than minor because they were similar to Example 3.I of Manual Chapter 0612, and design calculations were required to be re-performed to assure accident requirements were met. In both instances, the originally calculated available inventory was less than the actual required design basis inventory of 299,700 gallons. Subsequent calculations by engineering personnel, including significant reduction in margins, demonstrated that minimum required volumes in the CST and RWMT were maintained. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 worksheet, the inspectors determined that the issue was of very low safety significance (Green) because there was no actual loss of safety function.

Because the violation was determined to be of very low safety significance and has been entered into the corrective action program as condition report/disposition requests (CRDRs 2839337, 2840186, and 2841773), this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy. The inspectors also determined this issue had cross-cutting aspects of human performance. Specifically, the licensees attention to detail was lacking and there was poor inter- and intra-group coordination. (Section 4OA5.2)

C

Green.

The inspectors identified a noncited violation of 10 CFR 50, Appendix B,

Criterion III, "Design Control," for failure to translate design basis information into the calibration of refueling water tank level instruments. Without this information, operators were unaware that a Technical Specification listed minimum level in this tank may not provide sufficient usable volume of water for emergency core cooling system operation. Specifically, engineers failed to density compensate these instruments for allowable ranges of both temperature and boric acid concentration of the tank. Contrary to proper design control, the licensee failed to effectively implement design requirements to ensure operability of the refueling water tank.

This issue was determined to affect the Mitigating Systems cornerstone and was more than minor based upon review of Example 3.j of Manual Chapter 0612,

Appendix E. The errors were considered more than a minor calculation error because the deficiencies required re-performance of the calculations, significantly reduced the overall margin, and could be applicable to other such instrumentation calculations. However, engineering personnel demonstrated that while there was a loss of margin, there was no actual loss of function because of the inaccuracies in the RWT level instrument calibrations. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 worksheet, the inspectors determined that the issue was of very low safety significance (Green) because there was no actual loss of safety function.

Because the violation was determined to be of very low safety significance and has been entered into the corrective action program as condition report/disposition request (CRDR 2840920), this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy.

(Section 4OA5.3)

C

Green.

The inspectors identified three examples of a (Green) noncited violation of 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings." Specifically, these examples involved the licensees failure to follow a procedure and to provide appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished, consistent with the facilitys administrative procedure for the operability determination process. In the first case an engineer evaluated a concern in a condition report/disposition request without notifying the control room so an operability assessment could be performed. In the other cases, there was inadequate guidance given to operators to address when an operability assessment would be required.

The inspectors considered this finding to be more than minor, in accordance with Manual Chapter 0612, since it potentially affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences, and it affected the attributes of procedure quality and human performance.

However, subsequent evaluations completed by the licensee verified that actual safety functions were not lost in any of these examples. The inspectors performed a Phase 1 significance determination, using NRC Manual Chapter 0609, and determined this issue screens out as having very low safety significance (Green) because a safety function was not lost. Because the violation was determined to be of very low safety significance and has been entered into the corrective action program as condition report/disposition request (CRDR 2838626), this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy. The inspectors also determined this issue had cross-cutting aspects of human performance.

Specifically, the licensees attention to detail was lacking and there was poor inter- and intra-group coordination. (Section 4OA5.4)

Licensee-Identified Violations

Violations of very low safety significance, which were identified by the licensee have been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into licensees corrective action program. These violations and corrective actions are listed in Section 4OA7 of this report.

REPORT DETAILS

4OA5 Other Activities

Inspection Scope In August 2004, the U.S. Nuclear Regulatory Commission (NRC) identified a violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," that involved a failure to adequately control the designed configuration of the containment sump safety injection suction piping at all three Palo Verde Nuclear Generating Station (PVNGS) units.

Specifically, a significant portion of this piping was not consistently maintained full of water since initial operation of all three units. The finding was originally documented in NRC Inspection Report 05000528; 529; 530/2004014 (ADAMS ML050050287). This violation was subsequently determined to be of substantial safety significance (Yellow)through the application of NRC Manual Chapter 0609, "Significance Determination Process." In conjunction with this finding, the NRC also identified a Severity Level III violation of 10 CFR 50.59 for a previous change to the facility that was performed without prior NRC approval. Specifically, a station administrative procedure was changed to maintain the condition of the piping drained instead of filled.

Each year, the NRC conducts integrated assessments of nuclear power plant performance. These assessments are based upon the risk significance of the inspection findings by the NRCs resident and region-based inspectors and the insights gained from the licensee-provided performance indicators. As discussed in a followup letter to our most recent annual end-of-cycle assessment, and the current mid-cycle assessment letter, plant performance for PVNGS was categorized within the Degraded Cornerstone Column of the NRCs Manual Chapter 0305, "Operating Reactor Assessment Program," Action Matrix. This was based on the open (Yellow) finding in the Mitigating Systems Cornerstone. The NRCs performance of this supplemental inspection was based upon the licensees performance, and is consistent with the Action Matrix.

This supplemental inspection was conducted to obtain information for the NRC to determine if the licensee provided reasonable assurance that the problems associated with the degraded Mitigating Systems cornerstone were thoroughly understood, the cause and effects were properly evaluated, and sufficient corrective actions have been taken to prevent recurrence. The inspectors reviewed the licensees actions for completeness, thoroughness, and effectiveness. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. The inspectors also performed focused inspection activities to independently assess the validity of the licensees conclusions. Specific items reviewed are documented in the attachment, or in the following discussions of NRC assessments and findings.

The inspectors primarily used the guidance of Inspection Procedure 95002, "Inspection for One Degraded Cornerstone or Any Three White Inputs In A Strategic Performance

Area," to conduct the inspection. This supplemental inspection was conducted to review the licensees corrective actions for both of the violations issued on April 8, 2005. The specific purposes of this inspection, as described in the Objectives Section of Inspection Procedure 95002, were to

(1) provide assurance that the root causes and contributing causes for the violations, which resulted in the degraded cornerstone, were understood;

(2) independently assess the extent of condition and extent of cause for the violations; and

(3) provide assurance that the licensees planned corrective actions were sufficient to address the root causes and contributing causes for the violations and to prevent their recurrence. This inspection procedure also called for a customized plan to assess the validity of the licensees conclusions. This plan was derived from Inspection Procedures 71111.02, "Evaluations of Changes, Tests, or Experiments," 71111.17, "Permanent Plant Modifications," 71111.21, "Safety System Design and Performance Capability,"

and 71152, "Identification and Resolution of Problems." Specifically, the inspectors reviewed:

• The translation of original design basis requirements into plant procedures, calculations, setpoints, and modifications. Primary emphasis was on mitigating systems

• The licensees processes to maintain and control the design basis of the facility

• Revisions to operating, maintenance, and testing procedures to ensure design and 10 CFR 50.59 aspects were addressed

• Interfaces with operations personnel on evaluations and corrective action program implementation

• The use of operating experience

• How the licensees overall evaluations of the escalated findings, and their proposed corrective actions, addressed all of the previous criteria

.1 Independent NRC Inspection: Refueling Water Tank Voiding

Introduction.

The inspectors identified a (Green) noncited violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," related to potential air entrainment into the emergency core cooling system (ECCS) suction header from the refueling water tank (RWT). Specifically, the inspectors determined that the water level in the RWT could fall below the level of the tank discharge pipe and associated vortex breaker during the transfer from the RWT to the containment sump after an accident. As a result, air could enter the ECCS piping system under accident conditions. This issue was applicable to both trains of all three units.

Description.

During preparation for the this inspection, the inspectors reviewed the transportability analysis included in Condition Report/Disposition Request (CRDR) 2726509, "ECCS Sump Suction Piping Discovered in an Unanalyzed Condition," Revision 1. This report included extent of condition and extent of cause evaluations for the ECCS sump issue (event date July 29, 2004). The inspectors noted this report included the RWT in its scope, but did not address the RWT as a potential

source of air entrainment into the ECCS. The inspectors also noted that the PVNGS design did not include automatic closure of the RWT isolation valves with a recirculation actuation signal (RAS). The inspectors noted that the licensee did not fully understand the plant design basis and the dynamics of the system at the time of a RAS. Based on these observations, the inspectors questioned licensee personnel further on the potential of air entrainment from the RWT into the ECCS.

The inspectors found the applicable design calculation was Calculation 13-MC-CH-201, "Refueling Water Tank (RWT), Hold-Up Tank (HT) and Reactor Make-Up Water Tank (RWMT) Sizing," Revision 6 (issued July 13, 1999). This calculation included an analysis to demonstrate that "the final RWT level following a RAS was adequate, relative to the minimum water level in containment, to ensure that the suction piping would not void and gas-bind the ECCS pumps." The pumps of concern are in the containment spray system (CSS) and safety injection system (SIS). The associated analysis was based on a minimum containment pressure of 23 psia (approximately 8.5 psig). Revision 0 of this calculation (issued April 20, 1979) was also based on a minimum containment pressure of 23 psia. The inspectors questioned whether the 23 psia value was conservative. Engineering personnel stated that more recent "best-estimate" analyses had indicated that the actual minimum containment pressure was 17.5 to 18.5 psia (approximately 3 to 4 psig).

In response to the inspectors questions, engineering personnel initiated CRDR 2835132 on October 6, 2005. This CRDR raised a concern that the original Combustion Engineering (CE) design interface requirements, included in Updated Final Safety Analysis Report (UFSAR), Section 6.3.1.3.M.2, may not "preclude the possibility of drawing air from the RWT to the safeguards pump suction during recirculation" as stated in the UFSAR. This interface requirement stated, in part, "The piping for each safeguards train is designed such that the piping junction of the suction pipe, that runs to the refueling water tank and the containment recirculation sump, is located at least 16 feet below the top of the recirculation containment sump, which is 4 feet below the minimum water level in the containment during recirculation. This provides adequate static hydraulic head margin for the minimum containment pressure of -3.5 psig, as described in Subsection 6.2.1, to preclude the possibility of drawing air from the RWT to the safeguards pump suction during recirculation." The inspectors were concerned that, while this was a design interface requirement, it was intended to be a bounding design consideration for the ECCS, especially during dynamic flow conditions.

Operability Determination (OD) 301, Revision 1, was initiated on October 6, 2005, to address this issue. The operability evaluation concluded the ECCS was operable. It stated, in part, "Engineering believes that further evaluation will demonstrate that with appropriate assumptions for containment pressure and water inventory in the RWT/containment, the minimum water level will remain above the vortex breaker in the RWT which eliminates the potential for air entrainment. Based on this information, reasonable assurance exists that the ECCS is capable of performing its specified design function and therefore remains operable." Operability Determination 301 was approved on October 8, 2005.

The licensee also sought additional engineering assistance from outside organizations, including Westinghouse. On October 11, 2005, engineering personnel were informed

that containment pressure analyses, performed by Westinghouse, were based on an assumed RWT temperature of 120EF. This is the maximum assumed RWT temperature allowed by Technical Specifications, and would be a conservative assumption for containment response calculations evaluating high pressures. However, Westinghouse informed engineering personnel that the maximum RWT temperature was nonconservative for determining the minimum containment pressure under accident conditions. Based on preliminary calculations, the correlation between RWT temperature and minimum containment pressure was: 90EF/ 2.0 psig, 105EF/3.8 psig, and 120EF/4.3 psig. The minimum containment pressure required to prevent uncovering the RWT vortex breaker was 4.3 psig. As stated previously, recent licensee containment modeling determined containment pressure could be approximately 3 to 4 psig, indicating negative margin. As a result, during a licensee management review team meeting, held on October 11, 2005, it was determined that the ECCS of both trains of all three units were outside design bases and were declared inoperable at 1333 hours0.0154 days <br />0.37 hours <br />0.0022 weeks <br />5.072065e-4 months <br />. Units 2 and 3 entered limiting condition of operation (LCO) 3.0.3, "Unanalyzed Condition," and performed orderly shutdowns to Mode 5. Unit 1 was shutdown at this time for scheduled refueling outage activities. Operability Determination OD 301 was subsequently canceled.

On October 17, 2005, the licensee determined that the ECCSs were operable and restart of Units 2 and 3 was approved. The determination that the ECCSs were operable was based on the conclusions of Report FAI/05-107, "The Potential for Air Intrusion and RWT Check Valve Response Following RAS," Fauske & Associates, Inc.,

Revision 0. This report was transmitted to Palo Verde Nuclear Generating Station (PVNGS) in Westinghouse Letter CVER-05-75, dated October 17, 2005. As documented in the operator logs, the report concluded, in part, "The design of the PVNGS SIS and CSS suction piping meets the subject interface requirement and supports operability of the SIS and CSS. Report FAI/05-107 confirms that the PVNGS plants RWT and containment sump arrangements meet the explicit intent of the CE Interface Requirement 4.3.1.1, such that, there is no possibility of air being drawn into the ECCS pumps during continuous recirculation operation. Also using a conservative and limiting approach, Report FAI/05-107 demonstrates that the design, as implemented, meets the objective of the interface requirement during transition to recirculation at the initiation of RAS. Specifically, water level in the RWT suction piping does not drop below the elevation at the top of its junction with the containment sump piping." The operator logs also stated, "Based on the above, a degraded or non-conforming condition did not exist and the emergency core cooling systems at PVNGS have been operable."

On October 17, 2005, the licensee initiated CRDR 2838368 to address the non-conservative assumption in Calculation 13-MC-CH-201 that the containment pressure at the time of RAS would be no less than 8.5 psig.

After detailed review of the licensees operability determination and design calculations, the inspectors questioned the conclusion that "a degraded or nonconforming condition did not exist." The inspectors determined that ECCS design basis analyses including Calculations 13-MC-CH-201, Revision 6; 13-MC-SI-018, "Containment Spray System Interface Requirements Calculation," Revision 6; and 13-MC-SI-017, "Safety Injection System Interface Requirements Calculation," Revision 5 were based on the suction

header piping remaining full of water under post accident conditions. Contrary to this, Report FAI/05-107, Revision 0, predicted that the RWT level would fall below the RWT vortex breaker and that some air would enter the piping system. Although this report concluded that the air would not reach the pump suctions, air entrainment in the piping system was not consistent with the design basis. In addition, the inspectors observed that UFSAR, Section 6.5.2.8, "CESSAR Interface Evaluations," addressed potential air entrainment from the RWT. Subsection (RA) 7.16.1 stated, in part, "In addition, vortexing tendencies within the tank are precluded by a suction cage within the tank, similar in design to the cage installed in the containment emergency sump. The minimum required RWT level and volume are the useful level and volume above the volume that is unusable due to vortex considerations."

In response to these questions, PVNGS personnel concluded that this condition did not conform to the design basis and that additional actions were required to correct the condition. Most of these corrective actions were still in progress at the close of this inspection, under CRDR 2835132. However, the licensee did provide Revision 1 of Report FAI/05-107 to the inspectors, which demonstrated that although air could enter the ECCS suction header, that the resultant void fraction would be below the maximum allowable for safe operation of the pumps. The licensee also described proposed actions of increased training and controls for operators, and a proposed modification to the containment sump isolation valves to operate them automatically from a RAS. The inspectors concluded these actions, if implemented, would contribute to mitigating the degraded condition.

In addition to the noncited violation, the inspectors noted several other performance deficiencies during their document review and interaction with station personnel. Based upon the below listed deficiencies, the inspectors also determined this issue had cross-cutting aspects of human performance. Specifically, the licensees attention to detail was lacking and there was poor inter- and intra-group coordination. These deficiencies are discussed below:

• The inspectors determined that the licensee extent of cause and extent of condition reviews were narrowly focused. The licensee defined very extensive design criteria and features that could be pertinent to the original (Yellow)violation. However, if some design document or interface document addressed the design criteria, the licensee performed no further review. There was not a thorough effort by the licensee to validate the design criteria. This was clearly demonstrated in the RWT voiding issue. Examples included the licensees misunderstanding of the maximum RWT temperature, and their reliance on a Combustion Engineering interface requirement, for piping elevations, to meet all dynamic thermal-hydraulic design criteria for ECCS piping.

• The licensee also noted, in other ongoing programs at the facility, that design basis information was not handled with appropriate attention to detail. Examples included the licensees evaluation statements that their UFSAR validation process, under 10 CFR 50.54(f), was shallow; quality assurance reviews indicated that engineers did not verify reference values or conditions for design calculations; and various design organizations did not interface well with each other for multi-disciplinary issues.

• The inspectors determined that the licensees evaluation of technical issues was iterative, which demonstrated a lack of thoroughness in reviews. The inspectors noted that engineering personnel would address one particular aspect or consideration when a design problem was presented. However, when questioned by the inspectors or engineering management, more discrepancies would be identified by the engineering personnel. The inspectors determined that design engineering personnel were making broad assumptions of criteria in their reviews, and in several cases, were using unverified or unstated assumptions from other groups. An example was the stroke times of the containment sump isolation valves used by design engineers in their RWT required volume calculations. There was no stated basis for the times used, and design engineers could not explain to the inspectors where the values came from. Additionally, other engineering personnel were not challenging these assumptions in peer or supervisory reviews. These organizational and human performance issues caused the inspectors to question the appropriateness of the extent of cause review for the (Yellow) Design Control violation.

• The inspectors noted a lack of communication between organizations, and a lack of attention to detail when coordinating critical design evaluations between organizations. During discussions of this RWT voiding issue, engineering personnel inappropriately described system operation to operators while discussing the operability of ECCS (see Section 4OA5.1). One shift test engineer informed an inspector that on October, 8, 2005, he was told by the operator he was relieving, that "I believe we may be in 3.0.3," based on the emergent RWT voiding issue. The individual apparently did not address this to his crew supervision because he had not had time to reconcile his own questions. Subsequently, the operations crew and the lead shift test engineer reviewed the RWT information, without consulting engineering, and concluded the previous operators questions were not of concern. The inspectors were concerned this demonstrated problem resolution by isolated groups, and did not look across organizational boundaries.

• The inspectors determined that the licensee had a very limited use of operating experience for the RWT issue. The licensee previously identified that ineffective use of operating experience was a contributor to the (Yellow) ECCS violation.

The licensee also had several self-identified findings of ineffective operating experience use in the last year, following reviews of their substantive crosscutting problem identification and resolution issue and their engineering program review. However, during the review of the RWT issue, the licensee did not consider all relevant operating experience. The inspectors brought to the licensees attention a similar finding in 2003 at the Brunswick Nuclear Power Station, and a specific American Society of Mechanical Engineers study for uncovering the RWT vortex breaker at the Donald C. Cook facility in 2001. This study not only included detailed flow modeling of the same system, it partly refuted the original operability determination the licensee performed under OD 301 by stating air would enter the suction piping.

• The inspectors determined that the schedule for effectiveness reviews did not ensure a timely review of the adequacy of corrective actions. Two root causes, and one of the contributing causes, were addressed by a condition report action item (CRAI) 2825679, which at the time of the inspection was already closed.

This corrective action included all-hands communications from senior management to communicate the need for effective questioning attitudes and technical rigor. This corrective action was closed on September 9, 2005, after such meetings were conducted to "emphasize that it is essential that all employees have a strong and effective questioning attitude and technical rigor, and to challenge assumptions and/or any situations which do not seem safe, or per design, or per procedure, or per expectation, or in general do not seem appropriate." The licensee stated this was placed in the effectiveness review process, but that specific review of effectiveness of these actions was not planned until 2006. The inspectors determined that the effectiveness review was untimely in that unacceptable performance continued without additional corrective actions being implemented.

Analysis.

The inspectors determined that the potential of air entrainment into the ECCS suction header from the RWT was a licensee performance deficiency. This condition did not conform to the plant design basis and had not been analyzed. The finding affected the Mitigating Systems cornerstone because of the potential for the safety injection and containment spray systems to be degraded because of air reaching the pump suctions under accident conditions. The inspectors considered this finding to be more than minor, in accordance with NRC Manual Chapter (MC) 0612, "Power Reactor Inspection Reports," since it potentially affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences, and it affected the attributes of design and configuration control. The PVNGS engineering staff had to perform additional analyses, and an operability evaluation because of this condition.

The inspectors determined that the specific accident conditions that could have challenged the ECCS have not existed. The licensee also determined that although potentially degraded, the safety injection and containment spray systems remained operable based on engineering analysis. Using the MC 0609, "Significance Determination Process," Phase 1 worksheet, the inspectors determined that the issue was of very low safety significance (Green) because there was no actual loss of safety function.

Enforcement.

Criterion III, "Design Control," of 10 CFR 50, Appendix B, states that the applicable regulatory requirements and the design basis shall be correctly translated into specifications, procedures, and instructions. Criterion III also states that measures shall be established for the identification and control of design interfaces and for coordination among participating design organizations. Specifically, the licensee failed to effectively translate into station specifications, procedures, and instructions the design requirement to prevent air entrainment into the ECCS system. Because the finding is of very low safety significance and has been entered into the corrective action program as CRDR 2835132, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000528; 05000529;05000530/2005012-01, Improper Design Control for ECCS Sump and RWT Swapover.

.2 Independent NRC Inspection: Auxiliary Feedwater Useable Volume

Introduction.

The inspectors identified a noncited violation, with two examples, of 10 CFR 50, Appendix B, Criterion III, "Design Control," for the failure to translate the design basis usable volume of 300,000 gallons in the condensate storage tank (CST)and RWMT into plant instructions, procedures or drawings. Specifically, Calculation 13-MC-CT-205, demonstrated that 330,000 gallons of usable volume existed in the CST when taking into account vortexing and air entrainment of the auxiliary feedwater pumps, only if operations personnel took action to close the auxiliary feedwater pump minimum flow recirculation valves. However, the inspectors determined that this operator action was not incorporated in normal, abnormal, or emergency operating procedures. Without shutting the valve on low CST level, the licensees calculations revealed that only 292,900 gallons of usable volume existed, which is less than the 300,000 gallons credited in the UFSAR and the Technical Specification Bases.

Technical Specification Bases 3.7.6 also credits 300,000 gallons of usable inventory for auxiliary feedwater usage with the RWMT at 26 feet. With instrument uncertainties and vortexing concerns, Calculation 13-JC-CH-0214 verified that only 273,000 gallons of usable inventory were available with the RWMT at 26 feet.

Description.

As part of the licensees extent of cause/condition review for the (Yellow)violation, the licensee generated a matrix that detailed if statements in the UFSAR were reflected in calculations, design basis manual, Technical Specifications, and implementing procedures. As with the previously described RWT potential voiding issue (Section 4OA5.1), the inspectors questioned whether the licensee thoroughly reviewed design considerations, or simply accepted that a design aspect was already mentioned in a reference document. Section 9.2.6 of the UFSAR stated that the CST had a usable volume of 300,000 gallons plus 30,000 gallons to support 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> at hot standby followed by a cooldown to 350EF at 75EF per hour. This volume requirement was based on the NRC Branch Technical Position RSB 5-1, "Alternate Safe Shutdown Analysis,"

which required a usable CST volume adequate to support 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> at hot standby followed by a cooldown to conditions that allow shutdown cooling to be initiated.

Technical Specification 3.7.6 required that the CST be at 29.5 feet. The bases for Technical Specification 3.7.6 stated that the 29.5 feet level in the CST is based on having 300,000 gallons of usable volume to support an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> hold in Mode 3 (Hot Standby) followed by a cooldown to shutdown cooling entry conditions (350E) at 75EF per hour. The inspectors also determined that previous to PVNGSs conversion to Improved Technical Specifications in 1996, the Technical Specification value was the volume of the tank instead of the level. Therefore, it would be incumbent on the licensee to continue to demonstrate the relationship between the tank volumes and required minimum levels for Technical Specifications.

The inspectors determined that the licensee only performed an initial review of the CST volume requirements, with no additional validation. Because of concerns with the licensees calculations associated with the RWT, on October 17, 2005, the inspectors questioned engineering personnel to determine if the CST volume calculations had been similarly verified.

Following the inspectors questioning, engineering personnel reviewed Calculation 13-MT-CT-205, Revision 3, which established the amount of available CST

inventory. The inspectors determined that, in 1994, this calculation revealed that the usable volume of the CST was based on ensuring that adequate net positive suction head was available to the auxiliary feedwater pumps, taking into account pump vortexing, and air entrainment. The calculated level initially corresponded to 25 feet in the CST. However, engineering personnel noted that this level did not sufficiently address air entrainment when the minimum flow recirculation valve was open and did not account for instrument uncertainty. With 25 feet of CST inventory, Calculation 13-MT-CT-205 determined that 270,000 gallons of usable inventory existed in the CST. This was less than the credited 300,000 gallons.

On April 4, 1992 engineering personnel generated Engineering Evaluation Request (EER) 89-AF-048 to disposition the recommendations from the calculations.

Engineering personnel recommended that the Technical Specification minimum level be revised to 29.5 feet. The EER stated that with the auxiliary feedwater minimum flow recirculation valve open, the usable CST volume at 29.5 feet corresponded to a volume of 292,900 gallons (less than the 300,000 gallons of usable inventory credited in UFSAR, Section 9.2.6, and Technical Specification 3.7.6). To resolve this concern, engineering personnel initiated Instruction Change Request (ICR) 38795 to the Operations Department to request that the minimum flow recirculation valves for the auxiliary feedwater pumps be closed when CST level approached 6.5 feet. This was to prevent air entrainment of the auxiliary feedwater pumps. If the minimum flow recirculation valve is closed then the air entrainment concerns no longer existed, ensuring the 300,000 gallons plus 30,000 gallons of reserve inventory for a total usable volume of 330,000 gallons in the CST. Operations responded to ICR 38795 by stating that closing the auxiliary feedwater pump minimum flow recirculation valves was not advisable because it could lead to pump damage, so that the recommended action when CST level approached 6.5 feet was to switch to the alternate water source (RWMT). The corrective action, including the usable volume question, was then closed by operations personnel without further resolution of the discrepancies.

In May 2001, Calculation 13-MC-CT-205 was updated to incorporate the calculation results and conclusions of EER 89-AF-048. Again, the inspectors found that no further verification was performed to ensure that the design basis was met or that previously described operator actions were incorporated into procedures.

In December of 2001, Calculation 13-MT-CT-205 was revised to determine if the amount of usable volume was adequate to support power uprate of Unit 2 from 3876 to 3990 million watts-thermal (MwT). With the revised reactor thermal power, engineering personnel calculated that 299,700 gallons of usable inventory were necessary to support 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> in Mode 3 followed by a cooldown at 75E per hour to 350E. Since Calculation 13-MC-CT-205 stated that the CST had a usable volume of 330,000 gallons (assuming operator actions to shut the minimum flow recirculation valves), engineering personnel believed that no further procedure or design basis actions were necessary with respect to CST inventory to support the Unit 2 power uprate. The inspectors considered this another missed opportunity to address the CST usable volume discrepancy. The inspectors noted that without crediting the operator action to shut the minimum flow recirculation valves, the usable inventory in the CST (292,900 gallons) was less than that necessary to meet the design basis (299,700 gallons) to support the Unit 2 power uprate. In September 2003, the NRC issued Amendment 149 to the Unit 2 operating

license, approving an uprate to 3990 MwT. Similarly, the licensee submitted power uprate license amendment requests for Units 1 and 3 in July 2004, also with no change to the required CST level or inventory. The failure to incorporate operator action into procedures to ensure adequate CST volume, or other actions such as requiring swapover to the RWMT, was the first example of a violation of 10 CFR 50, Appendix B, Criterion III. The licensee initiated CRDR 283927 to enter this item into the corrective action system.

The licensee determined that resolving the CST inventory discrepancies, by incorporating the operator action to shut the minimum flow recirculation valves upon low CST level, was not a prudent action because it could result in damage to the operating auxiliary feedwater pumps. Therefore, engineering personnel revised the applicable calculations for the amount of water necessary to support the cooldowns, through the removal of available margin, and intended to revise the Technical Specification Bases to support these calculations. In addition, the licensee revised the calculations to more accurately determine the unusable volume because of air entrainment. When these new calculations were completed, engineering personnel determined that 300,000 gallons are currently available, and that less that 292,900 gallons of water is necessary for all accident scenarios and to meet the UFSAR requirement to support 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> in Mode 3 followed by a cooldown to shutdown cooling entry conditions. These calculation revisions demonstrated there was no actual loss of safety function.

On October 23, 2005, following discovery of the discrepancies with the usable volume of the CST, the inspectors questioned the usable volume of the RWMT. The RWMT is the Technical Specification referenced alternate source of water to the CST. Technical Specification 3.7.6 allows the RWMT to be used as an alternative source of water for the auxiliary feedwater pumps, for up to seven days of the CST being inoperable, but does not address being used in conjunction with the CST (i.e., available volume from both tanks). Additionally, Technical Specifications stated that the CST and the RWMT must each have minimum volumes of 300,000 gallons to be declared operable. The licensee reviewed Calculation 13-JC-CH-0214 that verified the usable volume of the RWMT when used as a backup auxiliary feedwater source of water. The licensee noted that the calculations for the usable volume in the RWMT, when taking into account vortexing, air entrainment, and instrument uncertainties, revealed that 26 feet in the RWMT corresponded to only 273,000 gallons. The licensee initiated CRDR 284173 to enter this item into the corrective action system. The licensee performed revised calculations (including instrument uncertainty and vortexing concerns) and determined that the minimum level for the RWMT to serve as a backup source for the CST was 28 feet, which demonstrated the Technical Specification Bases was nonconservative.

However, the inspectors noted that the RWMT was administratively controlled by a non-surveillance procedure to greater than 33 feet. The licensee plans to revise surveillance procedures and the Technical Specification Bases to require the RWMT to be greater than 28 feet to be declared operable for supplying the auxiliary feedwater system. The licensee performed a review and found no examples in which the RWMT was credited for the CST and the level was less than 28 feet. The failure to adequately translate the design basis into procedures, by requiring 28 feet in the RWMT, is a second example of violation of 10 CFR 50, Appendix B, Criterion III.

Based upon a review conducted after the inspectors questioning, the licensee identified another minor design control issue with respect to the usable inventory for the CST.

Review of calculations for the feedwater line break revealed that the vendor calculations assumed a cooldown from Mode 3 to only 400EF, while the design basis, UFSAR and Technical Specification assumed a cooldown to 350EF. The inspectors considered this to be a minor violation of 10 CFR 50, Appendix B, Criterion III, for inadequate design control. With this assumption, Westinghouse calculated that 253,000 gallons of water were necessary to support the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> hold and subsequent cooldown. The licensee contacted the vendor to perform the proper calculation with the UFSAR and design basis cooldown to 350EF. The revised calculations resulted in a increased required inventory to approximately 270,000 gallons. However, this was less than the available 300,000 gallons. Therefore, the issue was similar to Example 3.I of MC 0612, in which only a minor reduction in margin was noted and the amount of water was sufficient to meet the design basis. Thus, the failure to implement adequate design controls for the feedwater line break analysis is considered an additional minor example of the violation, and is not subject to enforcement action.

In addition to the noncited violation, the inspectors noted several other licensee performance deficiencies during their document review and interaction with station personnel on this issue. The inspectors also determined this noncited violation had cross-cutting aspects of human performance. Specifically, attention to detail was lacking and there was poor inter- and intra-group coordination. These deficiencies are discussed below:

• The licensee established key systems and design parameters for review under the evaluation of the (Yellow) ECCS finding, consistent with Inspection Procedure 95002 criteria. Both the safety injection system and the auxiliary feed system were selected for these key reviews. Similar to the RWT voiding issue (Section 4OA5.1), the inspectors found several deficiencies in an area that was specifically reviewed by the licensee.

• The inspectors determined that the licensees evaluation of technical issues was iterative. The inspectors noted that engineering personnel would address only a particular aspect or consideration of a design problem. Specifically, during the review of CST and RWMT calculations, inspectors identified multiple problems, during several successive meetings, over the period of a week. This was done because the licensee relied on unstated or inaccurate assumptions in the evaluation, and accepted unverified design criteria from other groups. When additional discrepancies were raised by the inspectors, the licensee required additional rounds of evaluation. The similar organizational and human performance issues in this area, to the original finding, demonstrated lack of effectiveness in the extent of cause review for the (Yellow) ECCS voiding issue.

• The inspectors determined that the effectiveness reviews did not ensure timely review of the adequacy of corrective actions. Two root causes and one of the contributing causes of the (Yellow) ECCS voiding issue were addressed by a condition report action item (CRAI 2825679), which at the time of the inspection was already closed. Similar to that described with the RWT voiding violation (Section 4OA5.1), this corrective action appeared to be ineffective in that

engineering evaluations for the CST and RWMT issues lacked thorough and critical reviews.

• The inspectors found multiple examples of design control findings, and failures to communicate and coordinate design issues between organizations. The inspectors concluded that the licensee had not effectively addressed cross-cutting aspects of problem identification and resolution.

Analysis.

These two examples of a violation affect the Mitigating Systems cornerstone and are more than minor because they were similar to Example 3.I of MC 0612, and design calculations were required to be re-performed to assure accident requirements were met. In both instances, the originally calculated available inventory was less than the actual design basis inventory of 299,700 gallons required for Unit 2 (and Units 1 and 3 after power uprate) to support the assumed 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> at hot standby followed by a cooldown to 350EF at 75EF per hour. Subsequent calculations by engineering personnel, including significant reduction in margins, demonstrated that minimum required volumes in the CST and RWMT were maintained. Using the MC 0609, "Significance Determination Process," Phase 1 worksheet, the inspectors determined that the issue was of very low safety significance (Green) because there was no actual loss of safety function.

Enforcement.

Title 10, CFR 50, Appendix B, Criterion III, states, in part, that the applicable regulatory requirements and the design basis shall be correctly translated into specifications, procedures, and instructions. Contrary to this requirement, two examples were identified where applicable regulatory requirements, and the design basis, were not adequately translated into specifications, procedures, and instructions.

Specifically, in Example 1, Technical Specification 3.7.6 and its bases, required 300,000 gallons of usable inventory in the CST, but Calculation 13-MT-CT-205 required an operator action (closing the auxiliary feedwater minimum flow recirculation valve) that was not translated into procedures to ensure that the design basis CST inventory was available. In Example 2, Technical Specification 3.7.6 credited the RWMT as the alternate source of water if the CST was inoperable. The bases for Technical Specification 3.7.6 stated that 300,000 gallons of usable inventory were available at 26 feet, but Calculation 13-JC-CH-0214 (as revised) stated that a level of 28 feet in the RWMT was required for 300,000 gallons to be available. Although an original design calculation error was made in 1992, the licensee missed several recent opportunities in 2004 and 2005 to resolve these discrepancies. Because the two noncited violation examples were of very low safety significance and have been entered into the corrective action program as CRDRs 2839337, 2840186, and 2841773, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000529/2005012-02, Improper Design Control for CST and RWMT Usable Volume to Auxiliary Feedwater.

.3 Independent NRC Inspection: Refueling Water Tank Instrument Calibration

Introduction.

The inspectors identified a (Green) noncited violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," related to improper design calculations used to calibrate RWT level instruments. Specifically, the inspectors determined that the RWT level instruments were not properly compensated for either the effects of the

tanks Technical Specification allowable range of temperature, or the tanks allowable Technical Specification range of boric acid concentration. Therefore, the indications to the operators, and the automatic RAS could be in error. This affected both trains of indication on all three units.

Description.

The inspectors selected a review of instrumentation for the RWT under the independent inspection portion of Inspection Procedure 95002. Errors in design basis assumed volumes could lead to earlier than anticipated voiding of the RWT discharge piping and, therefore, an earlier onset to potential air entrainment into ECCS piping.

The inspectors found that Section 5.3 of design Calculation 13-JC-CH-0209, Revision 6, which was specified to address these uncertainties, was inappropriately deleted in a previous calculation revision. Design engineers subsequently provided calculations to the inspectors that showed how the effects were compensated for in the RWT instrument calibration. However, the inspectors noted that compensation was unidirectional, in that, temperature compensation was performed for only the highest design temperature of the RWT, and that solution density was only compensated for the highest concentration of boron in the RWT. The inspectors verified that the RWT has UFSAR design ranges of 40 to 120EF for temperature, and 4000 to 4400 ppm for boron concentration. The inspectors also verified that the RWT has both maximum and minimum design volumes for various UFSAR accident assumptions, thus, requiring the instruments to account for bi-directional uncertainties. The inspectors found this to be another example of engineering personnel either not understanding, or missing, important design interface requirements needed to properly address design calculations.

Engineering personnel were subsequently able to demonstrate that the calculations could be adjusted for this uncertainty without the RWT instruments being declared inoperable. The licensee initiated CRDR 2840920 to address the corrective actions of this issue, including the review of similar systems where bi-directional uncertainties may not have been addressed.

Analysis.

The inspectors determined that the engineering personnels failure to include proper design basis information in the calibration of RWT level instrumentation was a performance deficiency. This issue was determined to affect the Mitigating Systems cornerstone and was more than minor based upon review of Example 3.j of MC 0612, Appendix E. The errors were considered more than a minor calculation error because the deficiencies required re-performance of the calculations, significantly reduced the overall margin, and could be applicable to other such instrumentation calculations.

However, engineering personnel demonstrated that while there was a loss of margin, there was no actual loss of function because of the inaccuracies in the RWT level instrument calibrations. Using the MC 0609, "Significance Determination Process,"

Phase 1 worksheet, the inspectors determined that the issue was of very low safety significance (Green) because there was no actual loss of safety function.

Enforcement.

Title 10, CFR 50, Appendix B, Criterion III, "Design Control," states that the applicable regulatory requirements and the design basis shall be correctly translated into specifications, procedures, and instructions. Contrary to this requirement, the licensee failed to translate the design basis into specifications, procedures, and instructions. Specifically, the licensee did not include the UFSAR and Technical Specification minimum and maximum ranges of temperature and boric acid concentration into level instrument calibration design calculations and procedures.

Because the finding is of very low safety significance and has been entered into the corrective action program as CRDR 2814209, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000528; 05000529;05000530/2005012-03, Improper Design Control for RWT Level Instrument Calibration.

.4 Independent NRC Inspection: Operability Determinations

Introduction.

The inspectors identified three examples of a (Green) noncited violation of 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings."

Specifically, the licensee failed to follow a procedure and to provide appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished, consistent with the facilitys administrative procedure for the operability determination process. These deficiencies resulted in several failures to perform timely or required operability determination evaluations by operations personnel following identification of degraded or nonconforming conditions.

Description.

The inspectors evaluated the licensees operability determination process in order to assess the effectiveness of corrective actions developed for engineering and operations interface problems. These problems were identified by the licensee as contributing factors of both the (Yellow) Design Control and 10 CFR 50.59 violations.

The inspectors noted there were a number of deficiencies identified with the operability evaluation process during the special inspection of the original issue in August 2004.

NRC inspectors also observed similar problems in 2005. As described in NRC Special Inspection Report 05000528; 05000529; 5000530/2004014, a number of deficiencies were identified involving the failure to implement the operability determination process in accordance with procedural guidance. These identified deficiencies involved:

(1) engineering personnel failing to immediately inform the shift manager of the affected units after identifying that a voided condition could adversely affect the operability of the high pressure safety injection and CSS pumps;

(2) the licensee operated the facility without a reasonable assurance of operability;

(3) operations personnel did not implement a continuous operability determination process;

(4) operations personnel did not declare the SIS and CSS inoperable even though mounting evidence suggested the final analysis would conclude equipment would not perform its intended safety function; and

(5) operations personnel did not perform an initial operability determination for the as-found conditions of the SIS and CSS.

The inspectors reviewed several CRDRs that documented degraded or non-conforming conditions in order to conduct this assessment. This was done, in accordance with Inspection Procedure 95002, to ensure previous corrective actions for the (Yellow)

ECCS finding were properly addressed. In a limited sample size, the inspectors identified several examples where implementation of the operability determination process was inadequate. The inspectors determined that these deficiencies were a result of the failure to follow the procedural guidance and ambiguous/inadequate procedural guidance. The inspectors determined that these deficiencies resulted in the failure to perform operability determinations for the following examples of identified degraded or nonconforming conditions:

• The inspectors reviewed CRDR 2822162, dated August 12, 2005. The CRDR addressed the omission of a design basis requirement from the design basis manual and associated plant procedures. Updated Final Safety Analysis Report, Section 6.3.1.3, stated, in part, that no single failure shall allow the compressed nitrogen system delivery pressure (to the safety injection tanks) to exceed 700 psig. The CRDR identifed that the nitrogen supply relief valve setpoint was 725 psig, which exceeded the 700 psig limitation. The licensee concluded that the condition would not over-pressurize the safety injection tanks because they were provided with adequate relief valves, with setpoints of 700 psig.

The inspectors questioned if the 725 psig nitrogen supply relief valve was adequately sized to provide relief of the nitrogen air system to prevent over-pressurizing safety-related parts of the system. Following review of this question, engineering personnel determined that the relief valve capacity was not adequate and could result in over-pressurization of nitrogen system containment isolation valve, J-GAA-UV0001, and associated piping. The licensee added this newly identified deficiency into the corrective action process as a revision to CRDR 2822162, even though it involved a different degraded condition.

Subsequently, the inspectors questioned if this condition had been reviewed for operability by operations personnel. Engineering personnel stated that the technical justification for operability was included in the revised action item, but that the issue had not been reviewed by operations.

As a result of these discussions, on October 28, 2005, operations personnel were informed of this nonconforming condition by engineering personnel and an operability determination was performed for the potential over-pressurization condition. The inspectors reviewed the technical basis for operability and also concluded that integrity of the containment isolation valve and piping would be maintained for this nonconforming condition.

The inspectors noted that Administrative Procedure 90DP-0IP10, "Condition Reporting," Revision 21, stated that if a condition is a nonconforming condition or degraded condition that may affect the ability of a system, structure, or component to perform its safety function the originator shall immediately notify the shift manager of the affected unit(s). Additionally, Administrative Procedure 40DP-90P26, "Operability Determination," Revision 14, stated that all site personnel are to promptly notify the shift manager upon discovery of any degraded/nonconforming condition potentially impacting a system, structure, or component. The inspectors determined that engineering personnel failed to follow procedural guidance to promptly notify the shift manager of the potential over-pressurization condition in order to evaluate the operability of affected structures, systems, or components (SSC).

• The inspectors identified that the licensee failed to perform an operability determination prior to plant restart on October 18, 2005, for a nonconforming condition involving potential air entrainment into the ECCS suction piping from the RWT following a RAS, as described in Section 4OA5.1 of this report. On October 11, 2005, Units 2 and 3 were shut down based on this condition having the potential to adversely affect the operability of the SIS and CSS. While the

units were in a shutdown condition, the licensee performed an analysis that determined the affected systems would not be adversely affected by entrained air, however, the inspectors noted that this analysis concluded that air would be entrained into the systems suction piping constituting a nonconformance with the facility licensing basis. The facility licensing basis assumed that the piping systems would be maintained filled with water and that this condition would remain throughout a loss of coolant accident (LOCA) as demonstrated by the systems available net positive suction head analysis.

The inspectors determined the licensee inappropriately concluded that the analysis supported the facility licensing basis resulting in the failure to consider it a nonconforming condition. Additionally, licensed operators informed the inspectors that the facility procedural guidance did not require an operability determination for this issue because the analysis that was performed demonstrated there was no adverse impact affecting the ability of the systems to perform their specified safety function. Specifically, Administrative Procedure 40DP-9OP26, "Operability Determination," Revision 14, Section 3.1.2, states, that "entry into the operability determination process is not required for degraded/nonconforming conditions that do not impact a specified safety function." The inspectors determined that an operability determination was required for this nonconforming condition since it placed the facility in an unanalyzed condition departing from that described in the UFSAR and departing from the design basis net positive suction head calculations that assumed the piping systems would be maintained full of water.

Additionally, the inspectors noted that Administrative Procedure 40DP-9OP26, "Definitions and Abbreviations," Revision 14, Section 4.0, stated that the definition of operability determination is the process of determining whether or not an identified degraded or nonconforming condition has an impact on the operability of Technical Specification related SSCs and all necessary support systems required to perform the SCCs specified safety function. This definition supported the inspectors conclusion that an operability determination was warranted to evaluate the identified nonconforming condition. Therefore, the inspectors determined that the ambiguity in the licensees operability determination process contributed to their failure to perform an operability determination.

• The inspectors reviewed CRDR 2822116, which was initiated on August 12, 2005 (19 days). This CRDR was initiated by engineering personnel following a system walkdown of the Unit 2 safety injection system. The CRDR documented two concerns. The first concern questioned the condition of the oil in containment spray pump Motor 2MSIAP03. The CRDR documented that there had been a history of contaminated oil or the use of incorrect oil being added to those pumps and motors. The second concern documented a "severe" packing leak on high pressure safety injection Valve 1JSIBUV0626.

The inspectors noted that both of the concerns documented in the CRDR potentially impacted the ability of an SSC to perform its specified safety function.

As a result, the potentially degraded conditions should have been processed

through the licensees operability determination process. The inspectors noted that the CRDR was not sent to the control room for review until August 31, 2005.

As previously discussed, Administrative Procedure 90DP-0IP10, Revision 21, stated that if a condition is a nonconforming condition or degraded condition that may affect the ability of an SSC to perform its safety function the originator shall immediately notify the shift manager of the affected unit(s). Additionally, the inspectors noted that the control room only addressed the operability of the potentially degraded containment spray pump motor oil and not the degraded high pressure safety injection valve. An engineering evaluation of both conditions was performed and documented in the CRDR on September 2, 2005, where it was determined that operability of the components was not adversely impacted.

The inspectors reviewed Procedure 40DP-9OP26, Revision 14, which addresses when the operability determination process should be implemented. The inspectors determined that the procedural guidance for when an OD is necessary was inadequate. Section 1.2 of the procedure stated that the OD process is entered when the ability of an SSC to perform its specified safety function is questioned. However, Section 3.1.2 stated entry into the OD process is not required when degraded or nonconforming conditions do not impact a specified safety function. Finally, Section 3.2 required entry into the OD process when the control room review of a CRDR cannot readily evaluate the impact on an SSCs ability to perform its specified safety function. The inspectors interviewed various personnel from operations and engineering in order to assess how those groups implemented the OD procedure. The interviews revealed that there was an inconsistent understanding of the phrase "impact a specified safety function." Some personnel indicated that they believed that the phrase meant a complete loss of a safety function as opposed to the degradation of a function. The examples previously cited in this section all question the ability of an SSC to perform its specified safety function or, at a minimum, this ability was not able to be readily evaluated. Either of the conditions required entry into the OD process as described in Sections 1.2 and 3.2 of Procedure 40DP-9OP26. The interpretation by some personnel that the specified safety function was not impacted by these conditions prevented entry into the OD process as described in Section 3.1.2 of Procedure 40DP-9OP26. The inspectors also concluded that the procedure lacked guidance or reference to Regulatory Information Summary 05-020, "Revision to Guidance Formerly Contained in NRC Generic Letter 91-18," (Part 9900 Guidance).

Analysis.

The inspectors determined that the licensees failure to follow and properly implement the station equipment operability procedure was a performance deficiency.

The inspectors considered this finding to be more than minor, in accordance with MC 0612, since it potentially affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences, and it affected the attributes of procedure quality and human performance. However, subsequent evaluations completed by the licensee verified that actual safety functions were not lost in any of these examples.

The inspectors performed a Phase 1 significance determination, using MC 0609, and

determined this issue screens out as having very low safety significance (Green)because a safety function was not lost.

Enforcement.

Title 10, CFR 50, Appendix B, Criterion V, states that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, and that appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Specifically, the inspectors determined that Administrative Procedure 40DP-90P26, "Operability Determination,"

Revision 14, was not followed and did not specify appropriate acceptance criteria.

Because the finding is of very low safety significance and has been entered into the corrective action program as CRDR 2838626, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000528; 05000529;05000530/2005012-04, Failure to Properly Implement Station Procedure for Equipment Operability (Technical Specification 5.4.1.a).

.5 Corrective Action Effectiveness

.a Scope of Review Consistent with Section 02.03 of NRC Inspection Procedure 95002, the team performed inspections to determine that appropriate corrective action(s) were specified for each root/contributing cause or that there was an evaluation that no actions was necessary; determine that the corrective actions have been prioritized with consideration of the risk significance and regulatory compliance; determine that a schedule has been established for implementing and completing the corrective actions; and determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

.b Corrective Actions for Severity Level III 10 CFR 50.59 Violation The inspectors reviewed the licensees corrective actions associated with the Severity Level III violation for an improper 10 CFR 50.59 evaluation of a change to the plant, resulting in the previously mentioned voided condition. The inspectors determined that the licensee performed a comprehensive evaluation of the 10 CFR 50.59 issue, including overall deficiencies identified with the program. The evaluation identified the primary root causes of the performance issue to be

(1) The procedure revision process (01AC-0AP02) was inadequate, in that, the procedure allowed pre-screening of changes that could potentially bypass performing a 10 CFR 50.59 screening for changes to the facility as described in the licensing basis; and

(2) CRDR program implementation was broadly ineffective. The licensee also identified overlap and interface problems between the CRDR, EER, and ICR programs in conjunction with inadequate training to recognize a CRDR condition contributed to the failure of personnel to initiate a CRDR in 1992 for the RAS piping concern.

The licensees root-cause evaluation, and extent of cause/condition reviews, noted a number of previous procedural and human performance vulnerabilities with the 10 CFR 50.59 processes. These vulnerabilities accounted for most of the licensees failures in this area. The inspectors noted that recently completed corrective actions, focused on the 10 CFR 50.59 process, implemented revised station procedures, and

provided mandatory training on handling of changes, test, and experiments. These changes brought the licensees process in very close alignment with the regulatory requirements of 10 CFR 50.59 and with industry standards such as Nuclear Energy Institute 96-07, "Guidelines for 10 CFR 50.59 Implementation." The inspectors attended licensee training sessions and critically reviewed station procedures for evidence of remaining vulnerabilities. The inspectors did not find any concerns with the licensees current program. Therefore, the inspectors concluded that corrective actions were effectively developed and implemented for the Severity Level III violation of 10 CFR 50.59 requirements.

The inspectors had a minor concern with the licensees extent of condition and extent of cause reviews for the previous 10 CFR 50.59 screening and evaluation process. This review was conducted on a limited sampling, based on statistical criteria, to review a representative group of such changes. A body of 116 previous changes were reviewed.

The licensees success criteria was established as there being no missed evaluations requiring prior NRC approval. While the licensee did meet this criteria in their sampling, they also identified 11 cases where they missed performing screenings. While the inspectors agreed with this concept from a risk and statistical approach, they concluded that the process still left the licensee vulnerable to having missed older screenings.

However, the underlying requirement of 10 CFR 50.59 is to perform evaluations for issues that may require prior NRC approval. Neither the licensee nor the inspectors had examples of a missed screen leading to a missed evaluation. The inspectors noted that the licensee may want to consider further historical reviews for missed screenings and evaluations during ongoing efforts in design engineering reviews, UFSAR validation, and system safety function inspections.

.c Corrective Actions for Yellow Design Control Violation The inspectors noted there was some confusion regarding the "problem statement" used in this evaluation. The official problem statement was, "The ECCS suction piping was supposed to be filled with water, but was inappropriately voided." The inspectors were concerned this statement was too narrowly focused to adequately investigate all of the potential performance deficiencies of this issue. However, the inspectors found that a more appropriate statement, "are there any physical or procedural conditions in the plant that differ from the conditions assumed in the plant design basis" was actually being used by many of the licensees groups investigating the issue. While this would appear to be only an administrative issue, it did not align with the "iterative" process described in the licensees root-cause methods (i.e., to loop back through the process with subsequently identified problems). In conjunction with this, some problems from this evaluation were worked in parallel to other programmatic issues and corrective actions that were ongoing at PVNGS (e.g.: human performance, engineering performance, corrective actions, etc.). Specific examples included finding problems with the UFSAR while doing system reviews for the ECCS violation, and interface issues between operations and engineering personnel in regard to equipment operability determinations. While the inspectors concluded that appropriate corrective actions were

identified for the ECCS violation, they could not determine whether the violation evaluation, or another site review process, was responsible for implementing the appropriate actions. Therefore, both the licensee and the inspectors had difficulties in assessing the overall resolution of issues, from the problem evaluation process, through implementation of corrective actions.

The inspectors noted the licensee identified the failure to effectively use operating experience as one of the contributing causes of this issue. The inspectors found additional examples of the failure to use available operating experience, as demonstrated under the RWT voiding issue (Section 4OA5.1). The inspectors also found additional examples of human performance issues identified in the evaluation that were contributors to the findings of this inspection. Of particular concern were additional examples of a lack of inter- and intra-group communications regarding engineering design issues as they pertained to equipment design and operability. Specifically, even after management communications with operations and engineering personnel regarding attention to detail, equipment operability, and critical thinking regarding equipment issues, the inspectors observed additional cases where this was not adopted by station personnel (reference CRAIs 2825677, 2825678, and 2825679). These additional cases were evident in all four of the NRC identified noncited violations of this inspection. The additional examples of poor communication of technical issues during this inspection led the inspectors to conclude that these attributes are ongoing deficiencies at PVNGS. At the time of the inspection, the inspectors could not conclude whether this was because of inappropriate corrective actions, or whether additional time was needed for the corrective actions to take effect. In either case, the inspectors concluded that the licensee did not adequately demonstrate the effectiveness of these corrective actions.

Some corrective actions were developed with no direct evidence of plans to periodically review for continuing problems, or to determine if additional or different corrective actions needed to be implemented. Based upon the inspectors review, and interviews with station personnel, it was determined that the licensee was dealing with such deficiencies by channeling them back into the corrective action program. The NRC has identified there are substantive cross-cutting issues with PVNGSs corrective action program that are currently being addressed by the licensee. Also, the licensee described, in both this and the 10 CFR 50.59 issue evaluation, that there were a number of contributing issues stemming from the corrective action program. The inspectors noted that the licensee had not established additional direction or methods (i.e.,

contingencies) to deal with ineffective corrective actions from this significant condition investigation.

One specific example of this was evident in CRAI 2785352. The action was, "verify objective evidence (e.g., inspection, surveillance, or completion of fill and vent procedure) that demonstrate the suction lines are filled in each unit and are being maintained in a filled condition while operability requirements dictate." This action was in response to the ECCS voiding violation to ensure the piping between the inboard and outboard containment isolation valves remained filled with water. The measure of success was that no excessive or abnormal air was vented from the system. However, the inspectors noted that since the original Priority 2 corrective actions to fill the pipe (CRDR 2726509, Direct Cause 1) were closed in December of 2004, at least three

CRDRs had been entered into the corrective action program for excessive venting problems in this piping. However, there did not appear to be any specific mechanism to feed results of the corrective action program back into the evaluation of the Yellow finding, or into the assessment of effectiveness of the corrective actions for the Yellow finding. The inspectors were concerned that this could lead to corrective actions being taken independent of the original finding, or potentially being lowered in priority and closed to another process because there was no tie to the significant condition. In response to questions from the inspectors, the licensee stated that effectiveness reviews for this attribute (CRAI 2785352) were not due until February 2006. Therefore, the inspectors could not determine that appropriate success criteria have been developed for determining the effectiveness of these corrective actions to prevent recurrence. Also, in some cases it did not appear that the licensee considered effectiveness reviews to be a part of the corrective action process. The inspectors noted these reviews were not assigned, or maintained at, a priority commensurate with the issue. Therefore, the inspectors could not determine that corrective actions had been prioritized with consideration of the risk significance and regulatory compliance.

The licensee identified approximately 90 corrective actions associated with the Yellow finding. While scope and content of these actions would appear to be appropriate from a technical or logical point of view, further efforts are required to determine if they are effective (especially towards preventing repetition of the root causes). Specific examples include actions developed to improve attention to detail of personnel, actions to implement management expectations for engineering design, calculation reviews, and actions to develop appropriate thresholds for trend reviews. Also, while the corrective actions themselves were considered high priority, the licensee considered effectiveness reviews to be very low priority (Priority 4), consistent with that given to action enhancements. Such priority classification did not require completion ties to the original corrective actions and could allow closure without the formal reviews required for corrective actions to prevent recurrence. Again, coupled to the importance of the issue, and the fact that the licensee and the NRC have identified ongoing areas of concern with the corrective action program, the inspectors were concerned with the adequacy of followup to some important corrective actions. Some of the corrective actions were recently implemented, and effectiveness reviews were not yet formulated. An example of this is the development of human performance error codes for binning CRDRs with specific categories of engineering human performance errors or deficiencies. The inspectors found that personnel had a rough concept of doing this in the future, but they did not have any plan or resources established to do so. Overall, the inspectors could not determine, with some confidence, that these actions will prove to be effective in preventing repetition of the original issue.

The inspectors concluded that some of the attributes the licensee already established for acceptance of corrective actions for this issue, either by effectiveness reviews or by corrective action tracking and trending, did not appear to be appropriate. Examples of such attributes included "no licensee event reports written for failure of a system safety function" because of missed design interfaces (CRAI 2785362), or "no negative trends for significant or noteworthy events" (CRAI 2825633). The inspectors considered the acceptance criteria too high in that other issues of concern, such as system degradation or unanalyzed conditions, should also initiate a review of corrective actions. Another example was the use of terms that lacked content in the acceptance criteria. Repeated

use of the term "rigor" was applied to various corrective actions and even program changes (CRAI 2825632). It was described that an action or program lacked "rigor,"

that additional "rigor" would be added, and that effectiveness reviews would ensure "rigor" had been increased. The inspectors did appreciate the fact that many of the corrective actions were new, and that some actions are overlapping with other activities at PVNGS. The inspectors also understood that, for some of these issues, the licensee will need additional development or maturity of the actions to come to effectiveness conclusions. However, at the time of the inspection, the inspectors could not determine that measures of success have been developed for determining the effectiveness of all of the corrective actions to prevent recurrence.

.6 Assessment of Licensee Evaluations and Conclusions

a. The NRC performed this supplemental inspection, in part, to assess the licensees evaluation and corrective actions associated with an inappropriate change to an emergency core cooling system procedure without prior NRC approval. This procedure change rendered portions of the system inoperable because of voiding. This performance issue was previously characterized as a Severity Level III violation of 10 CFR 50.59 and was originally identified in NRC Inspection Report 05000528; 529; 530/2004014. During this supplemental inspection, performed in accordance with Inspection Procedure 95002, the inspectors determined that the licensees evaluation identified the primary root causes of the performance issue to be:

(1) The site procedure revision process (01AC-0AP02) was inadequate, in that, the procedure allowed pre-screening of changes that could potentially bypass performing a 10 CFR 50.59 screening for changes to the facility as described in the licensing basis; and

(2) The corrective action program implementation was ineffective. The licensee also identified overlap and interface problems between the corrective action program, the engineering evaluation request program, and the instruction change request program.

These issues, in conjunction with inadequate training to recognize a corrective action condition, contributed to the failure of station personnel to initiate a corrective action program input document in 1992 for the potential pipe voiding concern. The inspectors concluded that the licensees evaluation and implemented corrective actions were appropriate to reasonably prevent repetition of the 10 CFR 50.59 violation.

Given the licensees acceptable performance in addressing the inappropriate procedure change and 10 CFR 50.59 program deficiencies, the Severity Level III violation (VIO 2004/014-01) is closed.

b. The NRC performed this supplemental inspection, in part, to assess the licensees evaluation and corrective actions associated with potential air entrainment into the emergency core cooling system. The licensee failed to incorporate original design requirements into the plant to maintain the containment sump suction piping filled with water. This performance issue was previously characterized as a 10 CFR 50, Appendix B, Criterion III, violation having substantial safety significance (Yellow), and was originally identified in NRC Inspection Report 05000528; 529; 530/2004014. The inspectors determined that the licensees evaluation identified a direct cause, nine root causes, and nine contributing causes of the performance issue. The evaluation was also used to develop an extensive list of corrective actions. The inspectors found the

licensees methods of evaluation to be appropriate. Additionally, the inspectors found that the corrective actions generally matched the causal factors.

The team determined that for each of the root and contributing causes, not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. In addition, some of the corrective actions were narrowly focused, or the implementation of those actions was not fully effective.

Also, the team concluded that criteria and reviews were not established, for auditing or followup, to ensure that corrective actions were effective in improving performance in the affected areas. Consequently, the team did not have assurance that planned corrective actions were sufficient to address the causes for the performance deficiencies associated with the violation. Therefore, the Yellow violation (VIO 2004-014-01) will remain open pending further NRC review.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On December 16, 2005, the NRC inspectors leader presented the results of the supplemental inspection, conducted under Inspection Procedure 95002, to Mr. J. Levine, Executive Vice President of Generation, and other members of his staff.

The licensee acknowledged the findings presented. The inspectors noted that while proprietary information was reviewed, none would be included in this report.

4OA7 Licensee Identified Violations

The following violations of very low significance (Green) were identified by the licensee and are violations of NRC requirements which meet the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600, for being dispositioned as noncited violations.

.1 The licensee identified several violations of 10 CFR 50.59, "Changes, Tests and

Experiments," or the accompanying Station Procedure 93DP-0LC07, "10 CFR 50.59 and 72.48 Screening and Evaluations," during their investigation of the Severity Level III violation. These were associated with failures to follow the station procedure, or the guidance of 10 CFR 50.59 when reviewing potential changes, tests, or experiments at PVNGS. The inspectors reviewed the following items and verified the issues were not greater than very low safety significance (Green), were not repetitive, and were entered into licensees corrective action program. Missed or improperly performed screenings and evaluations were also verified to not require prior NRC approval.

.a The licensee identified that a change to Procedure 73ST-9SI06, "Containment Spray Pumps and Check Valves - Inservice Test", changed the minimum Containment Spray pump miniflow flowrate from 150 gpm to 132 gpm. This change was made to support the flowrate change specified in Calculation 13-JC-SI-0231. Two 10CFR 50.59 Screenings (S-04-0310 and S-05-0225) were performed to support the changes to these two documents. Both screenings concluded that there was no adverse impact from the change; subsequently, no 50.59 evaluation was conducted. A subsequent review of these two screenings by the licensee found no reference to UFSAR section 6.5.2.7, paragraph

(A)7.13.13. This paragraph stated "Each CS pump bypass flow line shall be capable of passing 150 gpm with its CS pump operating at design operating conditions." The licensee has subsequently changed the CS pump miniflow back to the original 150 GPM. This finding was documented in CRDR 2829177.

.b The licensee identified multiple 10 CFR 50.59 Screenings that were not performed. Subsequent screenings by the licensee revealed no revisions that should have received a 10 CFR 50.59 evaluation. These include:

• A revision to Procedure 36ST-9SI04, "Safety Injection/Shutdown Cooling System Instrumentation Surveillance Test Train A," was made in 2004 with inconsistent instructions for testing the shutdown cooling valve interlocks. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2800782.

• A revision to 41ST-1DG02, "Diesel Generator B Test," was made in 1993 that reduced a pressure acceptance value in the non-conservative direction without a source document reference. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2799463

• A revision to Procedure 73ST-9SI10, "HPSI Pumps Miniflow Inservice Test," was made in 2001 that inadvertently removed steps from the procedure. The procedure in error was never physically implemented before the error was discovered. The error was corrected upon discovery. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2792530.

• A revision to Procedure 43ST-3AF02, "Auxiliary Feedwater Pump AFA-P01 Operability Test," was made in 1994. The procedure revision specified new operational guidance for the pressurizer. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2809070.

• A revision to Procedure 36ST-9AF02, "Post Accident Monitoring Auxiliary Feedwater Flow Instrument Calibration," was made in 2001 based on calculation revisions made in 1997, 1998, and 2000. Instruments were calibrated with revised acceptance criteria and a 10 CFR 50.59 screening was not performed for either the surveillance test revision or the 1998 and 2000 calculation revisions (the 1997 calculation revision did have a 10 CFR 50.59 screening performed). The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2788278.

• A revision to Procedure 41OP-1EW01, "Essential Cooling Water System Train A," was made in 2000 that deleted a component from a table requiring verification of adequate cooling flow. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2807325.

• A revision to Procedure 40OP-9SI02, "Shutdown Cooling Initiation," was made in 2004 that deleted a requirement for containment pressure to be less than 0.5 psig when checking the RAS sump level. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2810735.

• A revision to Procedure 40OP-9DG02, "Emergency Diesel Generator B,"

was made in 1999 that allowed the diesel to be shutdown without resetting safety signals. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2810830.

• A revision to Procedure 74OP-9SP01, "Manual Chemical Additions to the ESPS," was made in 1999 that added extra steel skid basins were added to the plant. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2810961.

• A revision to Procedure 41OP-1SI03, "Safety Injection Tank Operations,"

was made in 1987 that changed the operation of the HPSI system during Safety Injection Tank fill. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2812165.

• A revision to 41OP-1SI01, "Shutdown Cooling Initiation," was made in 1995 that changed the LPSI pump operating temperature band from a high temperature limit of 300E F to a limit of 350E F. In addition, the shutdown cooling initiation time following a tornado damage event was changed from 10.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. The change received no 10 CFR 50.59 screening and the issue was documented in CRDR 2812185.

.c Criterion XI, "Test Control," of 10 CFR 50, Appendix B, requires that a test program be established to assure that all testing required to demonstrate that structures, systems and components will perform satisfactorily in service.

Contrary to this, the licensee identified cases where test programs were not established. The inspectors reviewed the following items and verified the issues were not greater than very low safety significance (Green), were not repetitive, and were entered into the licensees corrective action program.

• The licensee identified that required performance tests on the instrument air system have not been performed. The Instrument Air Design Basis Manual, Table 3.1, "System Performance Parameters and Limits,"

provides specifications and acceptance criteria for the purpose of defining the air quality in terms of clean, dry, and oil free, and table 8.1, "Design Requirements," lists ISA S7.3, "Quality Standard for Instrument Air," as the standard for establishing performance limits for the delivery of clean, dry oil free air. Procedure 73MT-9IA01, "Instrument Air System Quality Testing," implements the testing requirements specified in the design standard for establishing the instrument air system capability for delivering clean, dry and oil free air. The licensee identified that the last

three consecutive semi-annual repetitive task work orders have been either waived or cancelled and the last successful performance of this test procedure was in the fall of 2003. This finding was documented in CRDR 2813390.

• UFSAR Table 9.5-8, "Diesel Generator Fuel Oil Storage and Transfer System Design Specifications," stated the diesel fuel oil day tank has a capacity of 1,170 gallons. Additionally Section 9.5.4.2.3, "Diesel Generator Fuel Oil Day Tanks," stated each diesel generator fuel oil day tank has a capacity of 1170 gallons. Contrary to this requirement, engineering design reference document Drawing M018-218, Rev. 12 indicated each tank only had a capacity of 1100 gallons. The discrepancy is a result of an incorrect volumetric calculation that uses the outer tank dimensions. The licensee plans to submit a license amendment and update the UFSAR to address the discrepancy. This finding was documented in CRDR 2825638.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Bauer, Department Leader, Regulatory Affairs

P. Borchert, Director, Work Management

D. Carnes, Director, Nuclear Assurance

P. Carpenter, Unit Department Leader, Operations

C. Churchman, Director, Engineering

S. Coppock, Department Leader, System Engineering

J. Copsey, Department Leader, Employee Concerns

E. Dutton, Section Leader, Performance Improvement

C. Eubanks, Vice President, Operations

D. Fan, Department Leader, Design Mechanical Engineering

J. Gaffney, Director, Radiation Protection

T. Gray, Radiological Services Department Leader, Radiation Protection

J. Hesser, Director, Emergency Services

P. Kirker, Unit Department Leader, Operations

D. Leech, Department Leader, Nuclear Assurance

J. Levine, Executive Vice President, Generation

D. Marks, Section Leader, Regulatory Affairs - Compliance

D. Mauldin, Vice President, Engineering and Support

M. McGhee, Unit Department Leader, Operations

M. Muhs, Department Leader, Maintenance

M. Radsprinner, Section Leader, Systems Engineering

T. Radtke, Director, Operations

F. Riedel, Director, Nuclear Training

G. Schiavonne, Manager, Human Resources

J. Scott, Section Leader, Nuclear Assurance

C. Seaman, Director, Regulatory Affairs

M. Shea, Director, Maintenance

D. Smith, Plant Manager, Production

M. Sontag, Department Leader, Nuclear Assurance

E. Sonn, Lead Investigator, Nuclear Assurance

D. Straka, Senior Consultant, Regulatory Affairs

R. Stroud, Senior Consultant, Regulatory Affairs

J. Taylor, Department Leader, Operations Support

T. Weber, Section Leader, Regulatory Affairs

D. Wheeler, Section Leader, Nuclear Assurance

Attachment

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000528;

05000529; NCV Improper Design Control for Emergency Core Cooling

05000530/2005012-01 System Sump and Refueling Water Tank Swapover (Section 4OA5.1)

05000529/2005012-02 NCV Improper Design Control for Condensate Storage Tank and Reactor Water Makeup Tank Usable Volume to Auxiliary Feedwater (Section 4OA5.2)

05000528;

05000529; NCV Improper Design Control for Refueling Water Tank Level

05000530/2005012-03 Instrument Calibration (Section 4OA5.3)

05000528;

05000529; NCV Failure to Properly Implement Station Procedure for

05000530/2005012-04 Equipment Operability (Technical Specification 5.4.1.a)

(Section 4OA5.4)

05000528;

05000529; FIN Summary Finding. 95002 Inspectors Assessment of

05000530/2005012-05 IR2004-14 Severity Level III Violation for 50.59 Issue (Section 4OA5.6.a)

05000528;

05000529; FIN Summary Finding. 95002 Inspectors Assessment of

05000530/2005012-06 IR2004-14 (Yellow) 10CFR50, App B, Criterion III Violation (Section 4OA5.6.b)

Closed

05000528;

05000529; VIO Failure to Obtain Prior NRC Approval for a Change to the

05000530/2004014-04 Facility Involving Maintaining a Significant Segment of Containment Sump Safety Injection Recirculation Piping Void of Water

Discussed

05000528;

05000529; VIO Failure to Maintain Design Control of Containment Sump

05000530/2004014-01 Recirculation Piping Attachment