IR 05000528/2007011

IR 05000528-07-011; 05000529-07-011; 05000530-07-011; 2/19/07 - 5/25/07; Palo Verde Nuclear Generating Station, Units 1, 2, and 3: Baseline Inspection; NRC Inspection Procedure 71111.21, Component Design Basis Inspection

ML071500445
Person / Time
Site:	Palo Verde
Issue date:	05/30/2007
From:	William Jones NRC/RGN-IV/DRS/EMB
To:	Edington R Arizona Public Service Co
References
IR-07-011
Download: ML071500445 (55)

Text

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, 3 - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000528/2007011; 05000529/2007011; AND 05000530/2007011

Dear Mr. Edington:

On May 25, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Palo Verde Nuclear Generating Station, Units 1, 2, and 3. The enclosed report documents the inspection results, which were discussed on March 23, 2007, with Mr. R. Bement, Vice President, Nuclear Operations, and other members of your staff. On May 25, 2007, an exit teleconference was held with Mr. R. Randels, Director, Design Engineering.

This inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed cognizant plant personnel.

Based on the results of this inspection, the NRC identified four findings that were determined to be more than minor; three of the findings were determined to be violations of NRC requirements. These findings were evaluated under the risk significance determination process as having very low safety significance (Green). The violations are being treated as noncited violations, consistent with Section VI.A of the Enforcement Policy. If you contest the violations or significance of these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Palo Verde Nuclear Generating Station, Units 1, 2, and 3 facility.

On February 20, 2007, the NRC held a public meeting with members of your staff to discuss the progress of your component design basis review program. During that meeting, your staff discussed the scope of several component reviews that had been performed and documented.

Arizona Public Service Company -2-During this inspection the NRC independently selected several components that had been reviewed by your staff and noted numerous issues that had not been identified by your staff.

For example, your staffs review of components associated with the station blackout generators did not identify numerous issues, some of which are documented in this report, that should have been identified as part of your independent component design bases review. Based on our sample review, it is evident that your initial effort in conducting component reviews has not been fully effective. We understand that you are implementing actions to improve the component design basis reviews. The NRC will conduct additional inspections at a later date to assess the effectiveness of your actions.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

William B. Jones, Chief Engineering Branch 1 Division of Reactor Safety Dockets: 50-528, 50-529, 50-530 Licenses: NPF-41, NPF-51, NPF-74

Enclosures:

Inspection Report 05000528/2007011; 05000529/2007011; and 05000530/2007011 w/Attachment Supplemental Information

REGION IV==

Dockets: 50-528, 50-529, 50-530 Licenses: NPF-41, NPF-51, NPF-74 Report No.: 05000528/2007011; 05000529/2007011; 05000530/2007011 Licensee: Arizona Public Service Company Facility: Palo Verde Nuclear Generating Station, Units 1, 2, and 3 Location: 5951 S. Wintersburg Road Tonopah, Arizona Dates: February 19 through May 25, 2007 Team Leader: C. Paulk, Senior Reactor Inspector, Engineering Branch 1 Inspectors: J. Nadel, Reactor Inspector, Engineering Branch 1 J. Reynoso, Reactor Inspector, Engineering Branch 1 T. Stetka, Senior Operations Engineer, Operations Branch Contractors: C. Baron, Mechanical Engineering Contractor, Beckman & Associates S. Kobylarz, Electrical Engineering Contractor, Beckman & Associates Approved By: William B. Jones Engineering Branch 1 Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

IR 05000528/2007011; 05000529/2007011; 05000530/2007011; 2/19/07 - 5/25/07; Palo Verde

Nuclear Generating Station, Units 1, 2, and 3: baseline inspection; NRC Inspection Procedure 71111.21, Component Design Basis Inspection.

The report covered a 5-week period of inspection by six region-based inspectors and two contractors. Three noncited violations and one finding (all Green) were identified. The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Cornerstone: Mitigating Systems

Green.

The team identified a finding involving the implementation of Regulatory Guide 1.155, Station Blackout, Appendix A, for the demonstration of the station backout generator design and system readiness requirements. Specifically, established preventive maintenance tasks did not demonstrate that the coping requirements for the station blackout generator would be met for the approved increase from the 4-hour to 16-hour coping duration that, at the time this finding was identified, would become effective the following month. The licensee has entered this finding into their corrective action program as Palo Verde Action Request PVAR 2982699.

The finding is greater than minor because it would become a more significant safety concern if left uncorrected following the implementation of the 16-hour coping duration.

The finding affected the mitigating systems cornerstone attributes to ensure the availability of the station blackout generators to respond to initiating events necessary to prevent undesirable consequences. Using the NRC Inspection Manual Chapter 0609,

Significance Determination Process, Phase 1 Worksheet, the team determined that this finding had very low safety significance because there was not a loss of system function and it did not involve an external event. The cause of the finding was related to the crosscutting element of decision making associated with human performance for the failure to adequately evaluate the design and system readiness requirements for the station blackout generators for the approved license amendment that, at the time the finding was identified, would, increase the coping period to 16-hours.

(Section 1R21b.1.)

Green.

The team identified a noncited violation of very low safety significance for the failure to implement the design control requirements of Regulatory Guide 1.155, Station Blackout, Appendix A, Criterion 1, Design Control and Procurement Control, to 10 CFR 50.63, Loss of All Alternating Current. Specifically, approved Design Change DMWO 2827452 did not account for key station blackout generator performance parameters that included fuel and lubricating oil consumption rates and required station blackout battery capacity for an increase in the station blackout coping period from 4 to16-hours.

The finding is greater than minor because it would become a more significant safety concern if left uncorrected in that the critical performance parameters for ensuring the station blackout generators would meet the 16-hour coping requirement were not established. The finding affected the mitigating systems cornerstone attributes to ensure the availability of the station blackout generators to respond to initiating events necessary to prevent undesirable consequences. Using the NRC Inspection Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheet, the team determined that this finding had very low safety significance because there was not a loss of system function and it did not involve an external event. The cause of the finding was related to the crosscutting element of decision making associated with human performance for the failure to evaluate the key performance parameters for the station blackout generators for the approved license amendment that increased the coping period to 16-hours. (Section 1R21b.2.)

Green.

The team identified a noncited violation of very low safety significance of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Specifically, the design calculation that determined the minimum containment flood level following a loss-of-coolant accident was not based on the most limiting reactor coolant system break location. The calculated containment flood level was used to verify the adequacy of the available net positive suction head for the emergency core cooling pumps that would take suction from the containment sump during the recirculation phase of a postulated loss-of-coolant accident. The licensee has entered this issue into their corrective action program as Palo Verde Action Request PVAR 2981257.

This finding is greater than minor because this issue required accident analysis calculations to be re-performed to assure the accident requirements were met. The finding affected the mitigating systems cornerstone as related to the availability, reliability, and capability of the emergency core cooling system for post-loss-of-cooling accident. In accordance with Inspection Manual Chapter 0609, Significance Determination Process, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations, the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it did not represent an actual loss of safety function. This deficiency would not have resulted in the emergency core cooling pumps becoming inoperable under the most limiting postulated accident conditions. This finding has cross-cutting aspects associated with corrective action of the problem identification and resolution area to ensure that issues potentially impacting nuclear safety are promptly identified, fully evaluated and that actions are taken to address safety issues in a timely manner. (Section 1R21b.3.)

Green.

The team identified a noncited violation of very low safety significance of 10 CFR Part 50, Criterion XVI, Corrective Actions, for the failure to identify and correct significant conditions adverse to quality involving Target Rock valve failures. The licensee has entered this issue into their corrective action program as Palo Verde Nuclear Generating Station Action Requests PVAR 2984832 and 2985372.

The failure to identify and correct the cause(s) of turbine-driven auxiliary feedwater pump Target Rock solenoid-operated valves was a performance deficiency. This issue is more than minor because it is associated separately with the mitigating systems cornerstone and on one occasion affected the containment barrier integrity cornerstone.

This finding has cross-cutting aspects associated with corrective action of the problem identification and resolution area to ensure that issues potentially impacting nuclear safety are promptly identified, fully evaluated and that actions are taken to address safety issues in a timely manner. (Section 1R21b.4.)

B. Licensee-Identified Findings Violations of very low safety significance, which were identified by the licensee have been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. These violations and corrective actions are listed in Section 4OA7 of this report.

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. As plants age, their design bases may be difficult to determine and an important design feature may be altered or disabled during a modification. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

In addition to performing the baseline inspection, the team reviewed actions taken by the licensee in response to previously identified significant issues associated with engineering performance.

1R21 Component Design Bases Inspection

The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6.

a. Inspection Scope

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed independent calculations to verify the appropriateness of the licensee engineers' conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience information to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components, as well as observing simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions due to modification, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector

input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins.

The inspection procedure requires a review of 15-20 risk-significant and low design margin components, 3 to 5 relatively high-risk operator actions, and 4 to 6 operating experience issues. The sample selection for this inspection was 20 components, 6 operator actions, and 5 operating experience items.

The components selected for review were:

• 13.8kV Bus E-NAN-S03, Breaker S03AB

• 4.16kV Bus E-PBA-S03, protective relaying

• Containment spray pump

• Emergency Battery B

• Emergency core cooling system relief valves

• Essential cooling water pump

• Essential chilled water pump

• High pressure safety injection bypass Valves SI-698/699

• Low pressure safety inject suction Valve SI-651

• Main steam isolation and atmospheric dump valve accumulators

• Motor-driven auxiliary feedwater pumps

• Refueling water storage tank level and temperature

• Shutdown cooling heat exchanger

• Spray pond level

• Start-up transformer

• Station blackout generator - electrical

• Station blackout generator - mechanical

• Turbine-driven auxiliary feedwater pump casing drains

• Turbine-driven auxiliary feedwater pump steam admission bypass valves

• Turbine-driven auxiliary feedwater pump steam traps The selected operator actions were:

• Failure of spray pond pump to start/align auxiliary feedwater pump to refueling makeup water tank

• Failure of station blackout generator to start

• Align auxiliary feedwater pump n suction manually

• Failure of containment spray pump

• Feed with condensate pumps with a failure to depressurize

The operating experience issues were:

• Air-operated valves

• Barton transmitters

• Buried cables

• Very low sulfur diesel fuel

• DC-powered motor-operated valves

b. Findings

b.1. Demonstration of Conformance to Design and System Requirements for the Alternate ac Power Sources Required for Station Blackout Coping Capability

Introduction.

The team identified a finding of very low safety significance (Green) for not effectively demonstrating the station blackout generator conformance with design and system requirements, for the pending increase in the station blackout coping duration, as provided by Regulatory Guide 1.155, Station Blackout, Appendix A, Quality Assurance Guidance and Non-Safety Systems and Equipment.

Description.

Regulatory Guide 1.155, Station Blackout, Section C.3.3.5, states, in part, that the alternate ac power source should have sufficient capacity to operate the systems necessary for coping with a station blackout for the time required to bring and maintain the plant in safe shutdown. Regulatory Guide 1.155, Section 3.5, Quality Assurance and Specification Guidance for Station Blackout Equipment That Is Not Safety-Related, states that the subject guidance is provided in Appendices A, Quality Assurance Guidance for Non-Safety Systems and Equipment; and B, Guidance Regarding System and Station Equipment Specifications, of the Regulatory Guide. In response to 10 CFR 50.63, Loss of All Alternating Current Power, as stated in Arizona Public Services letter to USNRC, No. 102-05370-CDM/TNW/RAB, dated October 28, 2005, Revised Station Blackout (Station blackout) Evaluation, the licensee adopted Regulatory Guide 1.155, Sections 3.3.5 and 3.5, and Appendix A, as the manner by which they would meet the requirements of 10 CFR 50.63. This includes Appendix A, Criterion 5, Testing and Test Control, which contains requirements for a test program to ensure that testing is performed to demonstrate conformance with design and system requirements.

On October 31, 2006, the NRC approved Amendment 157 to the Palo Verde Nuclear Generating Station operating license. This amendment changed the coping requirement for a station blackout event from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, and allowed 6 months for the required modifications to be completed before compliance was required. This change affected the design and system readiness requirements of the station blackout system and components.

When the Station blackout generators were initially installed, the required coping capability was 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Pre-operational testing demonstrated the capability of the station blackout generators to supply the design loads for the 4-hour duration.

Subsequent periodic testing has consisted of operating the generators for approximately

1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> per month and up to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during each refueling outage (approximately 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> per year).

The team found that the maintenance program established by licensee personnel did not consistently meet the vendors requirements/recommendations. For example, many maintenance activities specified in the Palo Verde Nuclear Generating Station PM

[preventive maintenance] Program Basis were on a biannual frequency. An exception were the lubricating oil filters which were scheduled for replacement on an 18-month frequency. Licensee personnel established this frequency on the basis of the infrequent operation of the station blackout generators. The vendor, however, identified the filter replacement as a mandatory requirement at a frequency of 6 months, regardless of operating hours.

The air filters for the starting air diesel were scheduled for cleaning/replacement on a 6-month frequency. However, as observed by the team, the 6-month frequency for the cleaning/replacement of air filters was inadequate. The filters for Train A were replaced on March 7, 2007, after the team noted that they were clogged with dirt and debris. The Train B filters were scheduled for replacement on, or about, April 24, 2007; however, the team also noted that these air filters were partially clogged.

Another deficiency the team identified that could affect the capability of the station blackout generators to run for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> (a design requirement) was the existence of delamination of the internal coating in the fuel oil storage tank. While licensee personnel had noted this condition, there was no established preventive maintenance task. The licensee had elected to perform maintenance on the fuel oil filters on an as required basis. Similar concerns were noted for preventive maintenance tasks associated with the testing and inspecting the fuel oil storage tank emergency vent valves, the combination pressure relief/vacuum breaker valves, and fuel oil.

Analysis.

The team determined that the ineffective demonstration of conformance with design and system readiness requirements through effective preventive maintenance was a performance deficiency.

While the testing and maintenance program established to demonstrate the conformance with design and system readiness requirements to meet the 4-hour coping requirement was minimal, the ability of the station blackout system to perform its design functions was demonstrated. However, the established testing and maintenance program had not been identified as requiring modification to demonstrate conformance with the design and system readiness requirements to cope for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. As a result, the team found that the existing program would not effectively demonstrate conformance to design and system readiness requirements.

The finding is greater than minor because it affects the mitigating systems cornerstone attributes of design control, equipment performance, procedure quality, and human performance, which affect the cornerstone objective to ensure the availability of systems that respond to initiating events necessary to prevent undesirable consequences. Using the NRC Inspection Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheet, the team determined that this finding had very low safety significance

(Green) because there was no loss of system function and it did not involve an external event. The licensee has entered this into the corrective action program as Palo Verde Action Request PVAR 2982699.

The cause of the finding was related to the crosscutting element of decision making associated with human performance for the failure to adequately evaluate the design and system readiness requirements for the station blackout generators for the approved license amendment that increased the coping period to 16-hours.

Enforcement.

No violation of regulatory requirements was identified. This issue is identified as FIN 05000528, -529, -530/2007011-001, Ineffective Demonstration of Conformance to Design for the Alternate ac Power Sources.

b.2. Inadequate Control of Design Information for the Station Blackout System

Introduction.

A noncited violation of very low safety significance (Green) was identified for the failure to include design-related guidelines used in complying with 10CFR50.63 in design documents.

Description.

The current station blackout coping requirement of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> was increased to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> after License Amendment 157 was approved (October 31, 2006). In order to implement the amendment, the Design Change DMWO 2827452 must be implemented.

During the review of Design Change DMWO 2827452, the team found that licensee engineers did not account for key performance parameters. The performance section of the vendor technical manual addresses fuel and lubricating oil consumption as key parameters to be monitored to demonstrate the capability of the station blackout generators to perform their design requirements (i.e., provide an alternate ac power source for the required coping time).

The team also found that licensee engineers had not performed battery sizing calculations to determine the required battery capacity for the station blackout batteries.

To complicate matters, the team found that the battery testing procedures were inadequate to provide an accurate indication of the health of the batteries. In addition, the licensee engineers review of key structures and components was not adequate to identify or properly classify components (e.g., fuel oil storage tank vent and relief valves)which impact station blackout system operation.

Although the station blackout system was identified as requiring an augmented quality program, the team found that licensee personnel did not implement such a program with respect to design control. The licensee has entered these issues into their corrective action program as Palo Verde Action Requests PVARs 2980758, 2982699, and 2985197.

Analysis.

The NRC issued Regulatory Guide 1.155, Station Blackout, as an acceptable method for meeting the requirements of 10 CFR 50.63. The Licensee adopted the methodology described in the regulatory guide to comply with 10 CFR 50.63. The team

determined that the failure to control the design information for the station blackout system is a performance deficiency; is more than minor because it is associated with the mitigating system cornerstone attributes of design control, procedure quality, human performance, and equipment performance; and it affected the cornerstone objective to ensure the availability of systems that respond to initiating events necessary to prevent undesirable consequences.

Quality assurance, as defined in Regulatory Guide 1.155, Appendix A, requires a quality program for equipment which is used to meet the requirements of 10 CFR 50.63 and not explicitly covered by existing quality assurance requirements. Criterion 1, Design Control and Procurement Document Control, of Appendix A to Regulatory Guide 1.155 states that [m]easures should be established to ensure that all design related guidelines used in complying with §50.63 are included in design and procurement documents, and that deviation therefrom are controlled.

The cause of the finding was related to the crosscutting element of decision making associated with human performance for the failure to evaluate the key performance parameters for the station blackout generators for the approved license amendment that increased the coping period to 16-hours. Since no actual loss-of-safety function of the station blackout system has occurred as a result of the inadequate design control, the team determined that this finding was of very low safety significance (Green) in Phase 1 of the significance determination process.

Enforcement.

Criterion 1, Design Control and Procurement Document Control, of Appendix A to Regulatory Guide 1.155 states that [m]easures should be established to ensure that all design related guidelines used in complying with §50.63 are included in design and procurement documents, and that deviation therefrom are controlled.

Contrary to the above, as of March 15, 2007, the measures established to ensure that all the design-related guidelines for the station blackout system were not adequate in that key design parameters were not included in the design documentation used to demonstrate compliance with 10 CFR 50.63 and Regulatory Guide 1.155. Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation, consistent with Section VI.A.1 of the Enforcement Policy: NCV 05000528, -

529, -530/2007011-002, Inadequate Control of Design Information for the SBO System.

b.3. Non-conservative Containment Sump Level Analysis

Introduction.

The team identified a noncited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, of very low safety significance for containment flood level during certain loss-of-coolant accidents. Specifically, the design calculation that determined the minimum containment flood level following a loss-of-coolant accident was not based on the most limiting reactor coolant system break location. The calculated containment flood level was used to verify the adequacy of the available net positive suction head for the emergency core cooling pumps that would take suction from the containment sump during the recirculation phase of a postulated loss-of-coolant accident.

Description.

The team reviewed design Calculation 13-MC-SI-017, Safety Injection System Interface Requirements, Revision 6. In part, this calculation determined the minimum water level that would be available in the containment during the recirculation phase of a postulated loss-of-coolant accident. This calculated water level was used to verify that the emergency core cooling pumps taking suction from the containment sump would have adequate net positive suction head under the most limiting conditions. The team noted that this calculation included a portion of the reactor coolant system inventory in the volume of water that would be available in the containment. The available volume of reactor coolant was based on an assumed break location at, or below, the centerline of the cold leg injection nozzles. The team questioned if this assumed break location was bounding, and if a reactor coolant system break at a higher elevation would result in a lower containment water level during the recirculation phase of a postulated loss-of-coolant accident.

In response to this concern, licensee engineers initiated Palo Verde Action Request PVAR 2981257 on March 12, 2007. The engineers also issued a prompt operability determination on March 15, 2007. The engineers concluded that there was a reasonable expectation of operability for all the emergency core cooling pumps. They evaluated the potential reduction in emergency core cooling pump net positive suction head margin that would result from this non-conservative analysis input. The design calculations indicated that the limiting emergency core cooling pump net positive suction head margin was 3.8 feet. If the water volume associated with all reactor coolant system spillage was eliminated from Calculation 13-MC-SI-017, the calculated net positive suction head margin would be reduced by less than 1.4 feet. In addition, the engineers evaluated the containment sump screen performance based on a lower water level and concluded that the emergency core cooling system performance would not be adversely affected. The team reviewed the prompt operability determination during the inspection.

Analysis.

The failure to properly implement design controls was a performance deficiency. Specifically, design Calculation 13-MC-SI-017 included a non-conservative input value, which affected the available emergency core cooling pump net positive suction head margin under postulated accident conditions. The team determined this finding to be greater than minor because accident analysis calculations were required to be re-performed to assure the accident analysis requirements were met. The finding affected the mitigating systems cornerstone as related to the availability, reliability, and capability of the emergency core cooling system.

In accordance with Inspection Manual Chapter 0609, Significance Determination Process, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations, the team conducted a Phase 1 screening and determined the finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in loss-of-operability in accordance with Part 9900, Technical Guidance, Operability Determination Process for Operability and Functional Assessment. Based on the licensees evaluation, this deficiency would not have resulted in the emergency core cooling pumps becoming inoperable under the most limiting postulated accident conditions. Licensee personnel entered this into the corrective action program as Palo Verde Action Request PVAR 2981257.

This finding has crosscutting aspects associated with corrective action of the problem identification and resolution area to ensure that issues potentially impacting nuclear safety are promptly identified, fully evaluated and that actions are taken to address safety issues in a timely manner.

Enforcement:

Criterion III, Design Control, of Appendix B to 10 CFR Part 50 requires, in part, that measures shall be established for the identification and control of design interfaces and for coordination among participating design organizations. These measures shall include the establishment of procedures among participating design organizations for the review, approval, release, distribution, and revision of documents involving design interfaces. The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of March 15, 2007, the design control measures taken were not adequate to verify that Calculation 13-MC-SI-017, Revision 6, did not include a non-conservative input value which affected the available emergency core cooling pump net positive suction head margin under postulated accident conditions. Because this violation is of very low safety significance and has been entered into the licensee's corrective action program as Palo Verde Action Request PVAR 2981257, this violation is being treated as a noncited violation consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000528, -529, -530/2007011-003, Non-conservative Containment Sump Level

Analysis.

b.4. Inadequate Corrective Actions for Target Rock Solenoid-Operated Valves

Introduction.

The team identified a 10 CFR 50, Appendix B, Criterion XVI, noncited violation of very low safety significance (Green) for the failure to promptly identify and correct significant conditions adverse to quality for failures of Target Rock solenoid-operated valves.

Description.

During the review of the auxiliary feedwater pumps, the team noted repetitive failures of Target Rock solenoid-valves for the steam admission valves to the turbine-driven pumps. The team also noted Target Rock solenoid-operated valve failures associated with the safety injection tanks and the turbine-driven auxiliary feedwater pump high pressure drain traps.

Repetitive failures of the turbine-driven auxiliary feedwater pump steam admission bypass valves have been a long-standing equipment reliability issue and valve failures have resulted in increased unavailability of the turbine-driven pumps. Corrective actions taken have addressed the symptoms of the failures but have not been effective in addressing the underlying cause. For example, licensee engineers determined, in 2002, that the Target Rock solenoid-valves coils should be replaced every other refueling outage because of accelerated aging from being in a hot environment. Another cause was associated with the tolerances of the solenoid piston ring. A potential contributor was evaluated as the manufacturing tolerance for the piston ring may be too large for the valve applications. Licensee engineers had determined, through maintenance

activities, that by reducing the ring thickness, that the piston ring did not stick and cause blow-by. The blow-by has been postulated as the cause of the heat-related accelerated aging.

The valves in question are bolted bonnet, dual pilot assisted, 125Vdc, stainless steel solenoid-operated valves manufactured by Curtis-Wright Flow Control©. In the applications associated with the turbine-driven auxiliary feedwater pump steam admission bypass line and the safety injection tank system, the valves are normally closed and fail closed on loss-of-power. In the turbine-driven auxiliary feedwater pump high pressure drain system, the valves are normally open and fail closed.

The steam admission bypass valves have two safety functions. One is to provide containment isolation; the other to provide initial steam flow to the auxiliary feedwater turbine-driven pump to warm the steam lines and bring the skid mounted hydraulic control valves and lubrication subsystem to normal operating conditions prior to the larger steam admission valve opening. There are two valves in parallel, each with a steam supply from a different steam generator, in each pumps steam admission line.

Over a period dating as far back as 15 years and continuing in current performance, there have been multiple examples of failures and off-normal operation of these steam admission valves for each turbine-driven auxiliary feedwater pump, as well as of similar or identical Target Rock valves in other systems. In most cases, the failures were attributed to one of a small set of known apparent failure causes. A review over the last 2 years of the six steam admission valves onsite, 10 occurrences of valve problems were identified. There were 7 instances of the valves stroking within surveillance acceptance criteria but outside reference values. In a separate occurrence, 1 valve failure resulted in a turbine-driven auxiliary feedwater pump overspeed; and 2 valve failures caused failed surveillance tests, one of which led to a unit shutdown when the valve could not be repaired within its 7-day technical specification allowed action time.

Many of the failures involved sticking piston rings with associated blow-by.

Failure of the Target Rock solenoid-operated valves have resulted in significant conditions adverse to quality. However, the licensee has not conducted root cause evaluations for the failures and initiated corrective actions to prevent recurrence. The team noted that a root cause Charter investigation, dated April 26, 2006, was to investigate the cause(s) for unacceptable delays experienced relative to the maintenance and retest of the failed valve, resulting in a unit shutdown. The charter did direct the root cause investigation team to determine the cause(s) associated with the failure of Valve 2JSGAUV138A, as well as the delays that were experienced in resolving the condition in a controlled and timely manner. However, the root cause investigation team focused on the reasons why maintenance personnel were unable to repair the valve within 7 days, not on the cause of the valve failure or possible corrective actions to prevent recurrence. The root cause investigation did note the historical problems with these valves as the second contributing cause and the failure to replace the coil in accordance with the recommended preventive maintenance frequency as the third contributing cause. Similarly, each time a turbine-driven auxiliary feedwater pump steam admission bypass valve would fail during a surveillance, an apparent cause evaluation would attribute the failure to defects in the Target Rock design.

Analysis.

The team found that the failure to identify and correct significant condition(s)adverse to quality, involving the Target Rock solenoid-operated valves was a performance deficiency. The finding was more than minor because it is associated with the mitigating systems cornerstone attribute of equipment performance and it affected the cornerstone objective to ensure the availability of systems that respond to initiating events to prevent undesirable consequences. In one instance, the turbine-driven auxiliary feedwater pump Target Rock solenoid-valve failure affected the containment barrier cornerstone. This finding has cross-cutting aspects associated with corrective action of the problem identification and resolution area to ensure that issues potentially impacting nuclear safety are promptly identified, fully evaluated and that actions are taken to address safety issues in a timely manner. Since there was no actual loss of safety function of the pump, the team determined that this finding was of very low safety significance (Green) in Phase 1 of the significance determination process. For the one instance that involved the containment barrier cornerstone, none of the attributes identified in the Manual Chapter 0609, Significance Determination Process, Appendix A, for the containment barrier were affected, and the issue screened as very low safety significance.

Enforcement.

Criterion XVI, Corrective Actions, of Appendix B to 10 CFR Part 50 state, in part, that [m]easures shall be established to assure that conditions adverse to quality

. . . are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.

Contrary to the above, the the licensee did not promptly identify and correct significant conditions adverse to quality for failures of Target Rock solenoid-operated valves to assure that the cause of the failures were determined and corrective action taken to prevent recurrence. For example, the cause analyses performed for the auxiliary feedwater pump Target Rock solenoid-valve failures, that resulted in a turbine overspeed on one occurrence and a plant shutdown as required by the Technical Specifications, on a separate occurrence, did not promptly identify and provide actions to prevent recurrence. Because the finding is of very low safety significance (Green)and has been entered into the licensees corrective action program as Palo Verde Action Requests PVARs 2984832 and 2985372, this violation is being treated as a noncited violation, consistent with Section VI.A.1 of the Enforcement Policy: NCV 05000528,

-529, -530/2007011-004, Inadequate Corrective Actions for Target Rock Solenoid-Operated Valves.

b.5. Problem Identification and Resolution Assessment of Corrective Action Program Inspection Scope The team reviewed calculations, drawings, procedures, and other design information for the components, operator actions, and operating experience items identified above.

Many of those items had also been reviewed by licensee personnel during the

performance of a component design basis review undertaken by the licensee in response to previously identified issues associated with engineering performance at the site.

The team performed these reviews as part of the inspection procedure, as well as to gain an insight into the effectiveness of the licensees review program and ability to identify conditions adverse to quality. In addition to reviewing the documents, the team performed walkdowns of the selected items and interviewed cognizant plant personnel.

Assessment The team found that the licensees component design basis review activities were not completely effective in identifying conditions adverse to quality. The team identified several examples of conditions adverse to quality associated with the same components that had also been reviewed by the licensee. (Of these examples, 4 were more than minor and resulted in the noncited violations and findings discussed above.)

Based on the teams interviews with licensee personnel and a review of the component design basis review reports, the team was concerned with the thoroughness of the reviews and their understanding of which conditions should be addressed as conditions adverse to quality. Many of the minor violation examples identified by the team had aspects of problem identification deficiencies that were associated with design control and procedural adequacy/implementation.

The team was also concerned with an apparent lack of understanding by license personnel of the marginal review program. Following identification of the issues by the team, licensee personnel promptly initiated appropriate corrective action documents.

Also, as stated above, those examples that were determined to be more than minor were entered into the corrective action programs as Palo Verde Action Requests in accordance with station procedures.

4OA5 Other Activities

(Closed) URI 05000528, -529, -530/2005002-04: Potentially Nonconservative Setpoints NRC Inspection Report 05000528, -529, 530/2005002 documented an unresolved item regarding potentially nonconservative setpoints for safety-related instruments. This item was left unresolved pending review of the licensees evaluation of these setpoints to determine if there was sufficient margin when all uncertainties were accounted for. The licensee was able to demonstrate that there was sufficient margin in the calculations to demonstrate that the setpoints were conservative. Based on these results, the team identified no performance deficiencies or violations of NRC requirements. This unresolved item is closed.

4OA6 Meetings, Including Exit

On March 23, 2007, the team leader presented the inspection results to Mr. R. Bement, Vice President, Nuclear Operations, and other members of the staff who acknowledged the findings. The team leader confirmed that, while proprietary information was provided and examined during this inspection, no proprietary information is included in this report.

On May 3, 2007, the team leader presented information related to the classification of findings to Mr. R. Bement, Vice President, Nuclear Operations, and other members of the staff who acknowledged the findings.

On May 25, 2007, the team leader presented additional information related to the classification of findings to an exit teleconference was held with Mr. R. Randels, Director, Design Engineering, and other members of the staff who acknowledged the findings.

4OA7 Licensee-Identified Violations

The following violations of very low safety significance (Green) were identified by licensee personnel and are violations of NRC requirements which meet the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600, for being dispositioned as noncited violations.

• 10 CFR Part 50.55(a)(g)(4), Codes and Standards, states, in part, that . . .

components which are classified as American Society of Mechanical Engineers (ASME) Code Class 1, 2, and 3 must meet the requirements . . . set forth in Section XI of editions of the ASME Boiler and Pressure Vessel Code. Contrary to this, the licensee identified on January 25, 2007, that required ASME Section XI Inservice Inspections on non-corrosion resistant bolting that was covered by insulation had never been performed. Technical Specifications Surveillance Requirement 3.4.103.1 also requires that these inspections be performed in every 10-year inspection interval per the Code. The affected bolting occurs on valve body-to-bonnet connections and bolted flanges in approximately 50 locations per unit in the safety injection and shutdown cooling systems. This finding is greater than minor because, if left uncorrected, it would lead to a more serious safety concern. Using the Manual Chapter 0609, Phase 1 worksheet, the finding is determined to have very low safety significance (Green)because there was no actual loss of safety function to any component, train, or system. The licensee is currently inspecting the bolted connections and replacing the bolts with corrosion-resistant material. This violation was documented in Palo Verde Action Request PVAR 296298.

• 10 CFR 50.63(a)(1) requires that a licensed nuclear power plant must be able to withstand and recover from an station blackout event. To meet this requirement, Section 8.3.1.1.10 of the Palo Verde Nuclear Generating Station Updated Final Safety Analysis Report (UFSAR) states that the alternate ac power system is capable of energizing the required loads within one hour of the onset of an

station blackout. The UFSAR also states that a study was performed to demonstrate that Palo Verde Nuclear Generating Station is capable of coping with a station blackout for that initial one-hour period. Contrary to this requirement, the licensee determined, as the result of five tests, that it took from 61 minutes 30 seconds to 67 minutes 30 seconds to energize the required loads.

This issue is documented in the licensees corrective action program as Palo Verde Action Request PVAR 2970059. This finding is of very low safety significance because testing has demonstrated that, even at the most limiting time of 67 minutes, 30 seconds, Palo Verde Nuclear Generating Station could withstand an station blackout.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

G. Andrews, Director, Performance Improvement

R. Bement, Vice President, Nuclear Operations

B. Bolf, Senior Engineer, NSSS System Engineer

M. Brutcher, Section Leader, Design Engineering

R. Buzard, Senior Consultant, Regulatory Affairs

D. Carnes, Director, Nuclear Assurance

C. Churchman, Director, Plant Engineering

G. D'Aunoy, Senior Engineer, PRA Engineering

D. Fan, Department Leader, Special Projects

D. Hautala, Senior Engineer, Regulatory Affairs

J. Hesser, Vice President, Engineering

M. Karbassian, Department Leader, Design Engineering

M. Perito, Plant Manager, Nuclear Operations

R. Randels, Director, Design Engineering

M. Salazar, Section Leader, Maintenance

G. Sowers, Section Leader, PRA Engineering

B. Thiele, Site Manager, Component Design Basis Review

A. Turner, Administrative Assistant, Component Design Basis Review

T. Weber, Section Leader, Regulatory Affairs

J. Wood, Department Leader, Nuclear Training

NRC personnel

T. Brown, Resident Inspector, Diablo Canyon Nuclear Power Plant

J. Melfi, Resident Inspector, Palo Verde Nuclear Generating Station Nuclear

G. Warnick, Senior Resident Inspector, Palo Verde Nuclear Generating Station

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000528, -529, -530/2007011-01 FIN Ineffective Demonstration of Conformance to Design for the Alternate ac Power Sources (Section 1R21b.1.).

05000528, -529, -530/2007011-02 NCV Inadequate Control of Design Information for the Station Blackout System (Section 1R21b.2.).

Attachment

Opened and Closed

05000528, -529, -530/2007011-03 NCV Non-conservative Containment Sump Level Analysis (Section 1R21b.3.).

05000528, -529, -530/2007011-04 NCV Ineffective Maintenance on Target Rock Solenoid-Operated Valves (Section 1R21b.4.).

Closed

05000528, -529, -530/2005002-04 URI Potentially Nonconservative Setpoints (Section 4OA5).