Report on Fact-finding Meeting by Diablo Canyon Independent Safety Committee (DCISC) at Diablo Canyon Power Plant (DCPP) on April 6 & 7, 2005 by Per F. Peterson, Member, and R. Ferman Wardell, Consultant [DCISC 15th Annual Report, Exhibit D.8]

1.0 Summary

The results of the April 6-7, 2005 Fact-finding Trip to the Diablo Canyon Power Plant in Avila Beach, CA are presented. The subjects addressed and summarized in Section 3 include:

  1. Spent Fuel Pool Thermal Management & Loss of Water Event
  2. Nuclear Fuel Overview
  3. Reactivity Management Program
  4. Update on Tsunamis
  5. Accident Radiation Exposure Projection Models
  6. December 8, 2004 Emergency Exercise Continuation
  7. Fire Protection Audit
  8. ECCS Voids Update
  9. Security Review and Tour
  10. Review PG&E Open Items
  11. DCISC Member Meeting with DCPP Management

2.0 Introduction

This Fact-finding Trip to the DCPP was made to evaluate specific safety matters for the DCISC. The objective of the evaluation was to determine if PG&E’s performance is appropriate and whether any areas revealed observations which are important enough to warrant further review, follow-up, or presentation at a public meeting. These safety matters include follow-up and/or continuing review efforts by the Committee, as well as those identified as a result of reviews of various safety-related documents.

Section 4 – Conclusions highlights the conclusions of the Fact-finding Team based on items reported in Section 3 – Discussion. These highlights also include the team’s suggested follow-up items for the DCISC, such as scheduling future Fact-finding meetings on the topic, presentations at future public meetings, and requests for future updates or information from DCPP on specific areas of interest, etc.

Section 5 – Recommendations lists specific recommendations to PG&E proposed by the Fact-finding Team. These recommendations will be considered by the DCISC. After review and approval by the DCISC, the Fact-finding Report, including its recommendations, is provided to PG&E. The Fact-finding Report will also appear in the DCISC Annual Report.

3.0 Discussion

3.1 Spent Fuel Pool Thermal Management & Partial Loss of Water Event

The DCISC Fact-finding Team reviewed spent fuel pool (SFP) thermal management, and a partial loss of water event in December 2004 where a valve misalignment resulted in a four-inch drop in the Unit Two pool level, with Dave Vosberg, Temporary Spent Fuel Pool Rack Project Manager, and Troy Finger, Spent Fuel Pool System Engineer. The DCISC last reviewed this topic in February 2005 at the DCISC Public Meeting (Reference 6.1).

DCPP has two spent fuel pools, one for each unit, which are currently used to store spent fuel discharged from the reactors, as well as to temporarily store fuel off-loaded during reactor refueling outages. PG&E plans to add an additional temporary fuel storage rack in each pool, located in the spent fuel transfer cask pit, each capable of holding 154 additional fuel assemblies. These temporary racks would bring the total capacity of the each of the pools to 1,478 assemblies.

The major safety functions of the SFPs include providing radiation shielding to protect plant personnel during fuel handling activities, prevention of nuclear criticality, and provision of reliable cooling and removal of decay heat to prevent overheating and thermal damage to spent fuel. The Fact-finding Team focused its review on thermal management for the SFPs, including potential effects on thermal management due to the addition of the temporary racks.

All flow inlets and outlets for cooling and makeup in the SFPs are located a minimum of 21 feet above the top of the stored fuel, making it impossible for leakage from the cooling system to reduce levels below this elevation. The SFP walls are reinforced concrete a minimum of six feet thick, with 0.25-inch thick stainless steel liners. The SFPs are located below the external grade elevation, so there are no directions from which external missiles could strike the SFP walls. The combination of the structural robustness of the SFP walls and their shielding from external missiles makes it highly unlikely that significant leaks could be generated by accident, natural, or terrorist-attack events.

In light-water reactor spent fuel pools, heat generation is dominated by the decay of short-lived fission products in freshly off-loaded fuel. After storage for 18 months, the typical refueling interval at DCPP, a fuel assembly’s heat generation drops by over a factor of 10. Thus, even in the current DCPP SFP condition where the spent fuel pools are loaded nearly to capacity, a partial-core offload of 96 assemblies increases total heat generation by a factor of 5, from 4.8 million Btu/hr to 23 million BTU/hr, and a full-core off-load of 193 assemblies results in a 7 times increase to 37 million Btu/hr.

The potential for thermal damage to spent fuel is therefore dominated by the potential for damage to freshly off-loaded fuel, and this potential is largest during refueling and steadily decreases thereafter. In general, it is impossible to overheat spent fuel that is covered with water, so overheating of fuel would require either an event that would drain the pool, or a loss of cooling and water makeup lasting for a few to many days, such that boiling of the water would cause sufficient water removal. DCPP maintains several sources of backup water, including independent, portable pumping equipment located away from the plant that can be used to provide makeup water to the SFPs in the event that plant makeup systems are disabled.

In the extremely unlikely event that water were to drain from the pool and makeup were not to occur, such that only air cooling of spent fuel were to occur, it has been recognized that the heat up of any freshly discharged fuel in the pool can be significantly mitigated by interspersing the spent fuel among the much larger quantities of old fuel in the pool (Reference 6.2).

The Fact-finding Team reviewed the current fuel off-loading practice. While the safety analysis for the pool thermal response assumes that freshly off-loaded fuel is placed in a single region of the pool, in practice DCPP has historically off-loaded fuel in a dispersed pattern, primarily because this practice mixes fuel of different effective enrichment and therefore further reduces the potential for inadvertent criticality.

The National Research Council of the National Academies recently completed a study on the security of commercial spent fuel storage, concluding (Reference 6.2):

“The committee believes that there are at least two [near-term] measures that should be implemented promptly:

  1. “Reconfiguring of fuel in the pools so that high decay-heat fuel assemblies are surrounded by low decay-heat assemblies. This will more evenly distribute decay-heat loads, thus enhancing radiative heat transfer in the event of a loss of pool coolant.
  2. “Provision for water spray systems that would be able to cool the fuel even if the pool or overlying building were severely damaged.

“Reconfiguration of fuel in the pool would be a prudent measure that could probably be implemented at all plants at little cost, time, or exposure of workers to radiation. The second measure would probably be more expensive to implement and may not be needed at all plants, particularly plants in which spent fuel pools are located below grade or are protected from external line-of-sight attacks by exterior walls and other exterior structures.”

Consistent with the report recommendation, DCPP has historically used the dispersed fresh fuel off-loading pattern that is currently judged to provide a prudent and cost-effective near-term method to reduce risk of fuel damage in the event of SFP drainage. DCPP also falls inside the category of plants where the SFPs are below grade and are also protected from external line-of-sight attacks by local geographical and plant features.

The FF Team reviewed the thermal analysis for the temporary fuel racks that will be added inside the spent-fuel transfer cask pits, if required, due to delays in implementing dry-cask storage. The temporary racks will be isolated from the existing racks by a gap of approximately two feet, and will be loaded only with fuel aged over 10 years. Because fuel in the temporary racks will be thermally isolated from the main racks by the large gap, and the fuel in these racks will provide a negligible contribution to the total SFP heating load, there exists no significant thermal difference between having fuel loaded in the temporary racks, and having fuel loaded in dry cask storage. That is, fuel placed in the temporary racks would be thermally isolated from the remainder of the pool under all conceivable conditions. Therefore the temporary racks provide an equivalently safe alternative to storing spent fuel, if required due to delays in implementing dry cask storage.

During any time period where the temporary racks are removed to allow fuel transfer into spent fuel transfer casks for dry storage, it would not be possible to use the temporary racks to permit an emergency full core offload. However, this would have little practical effect, because preparations to perform any full core offload would require a time period comparable to the few-day period required to prepare for fuel offloading during refueling outages. This time period would be available to remove the transfer cask and substitute the temporary fuel storage rack.

SFP thermal management will be affected by fuel removal once transfers to dry cask storage begin. The DCSIC should follow up to monitor plans and subsequent activities for spent fuel transfers to dry cask storage. The DCSIC should also follow up to assess any potential safety impacts if any modifications to the spent fuel pool systems or operations are implemented as a result of the recent National Research Council study on spent fuel pool security.

The Fact-finding Team also reviewed the December 23, 2004 Unit Two incident where a misalignment of valves for the SFP skimmer filter resulted in a four inch drop in the SFP level over a 3-hour period, which was detected due to a miscellaneous-equipment drain tank high-level alarm. The water level drop never came close to the technical specification limit or the low-level alarm limit. However, the incident revealed a deficiency in the SFP skimmer filter replacement procedure, due to ambiguity in the specification of the specific procedure section for removing the skimmer filter from service.

Contributing causes included:

Three corrective actions were implemented:

  1. Revise the relevant operating procedure to clearly differentiate removal of a pump and strainer from service, from the removal of a pump and filter.
  2. Distribute an incident summary to all operations crews, including details on the contributing causes,
  3. Apply the human error investigation tool to determine culpability of individuals involved.

The drop in SFP water level was detected and alarmed by instruments designed for this purpose in the Control Room, where operators took immediate corrective actions to stop the event. The 4-inch drop in water level was insignificant relative to the amount of water in the SFP. The drainage would have self-terminated with over 21 feet of water remaining above the top of the spent fuel, because of the physical arrangement of suction piping. The DCISC believes these corrective actions are adequate to prevent recurrence of this event. There were no significant challenges to the ability to maintain spent fuel temperature or sub-criticality. Radiation shielding was not compromised.

Conclusion:
DCPP’s spent fuel pools (SFPs) have robust, below-grade construction that makes significant leakage due to accidents or external events highly unlikely, and the plant provides multiple SFP cooling water makeup systems including independent, portable equipment stored away from the plant. DCPP has historically used a dispersed offloading pattern for recently discharged fuel, which significantly mitigates the potential for overheating and fuel damage in the event of pool drainage. New temporary racks to be used in the pools will be thermally isolated from existing racks, so their effect on pool thermal management is essentially equivalent to transferring a similar quantity of fuel to dry storage. The recent Unit 2 incident involving a four-inch SFP level drop, not coming close to the SFP low-level alarm, was caused by procedure deficiencies, for which corrective actions have been implemented. The DCISC should continue to monitor SFP thermal management, particularly for effects from upcoming fuel transfers to dry storage.

3.2 Nuclear Fuel Overview

The DCISC Fact-finding Team met with Bill Bojduj, Senior Advisory Engineer in the Reactor Engineering Group, and Jeff Gardner, Principal Engineer in Chemistry for an update and overview of DCPP nuclear Fuel. The DCISC last reviewed this topic in April and May 2003 (References 6.3 and 6.4).

In the current operating cycles (Cycle 13) both reactor cores are running defect-free. Unit 1 had been clean with no defects since Cycle 4, and Unit 2 since Cycle 11. Unit 2 has had a history of a small number of fuel rod leaks since initial operation. The leaks have been caused primarily by manufacturing defects, debris, and baffle-jetting impingement. PG&E has developed an aggressive program to address the Unit 2 leaks.

The program included the following:

Corrosion-resistant ZIRLO fuel cladding and reactor coolant maintained above 6.9 pH to avoid excessive cladding corrosion:

These measures have resulted in clean Unit 2 cores for the most recent and current cycles. Transuranics remaining in Unit 2 (about ten times the Unit 1 level) from past leakers are expected to be cleaned up over the next three to four cycles.

The 2R13 Unit 2 upflow conversion to eliminate baffle-jetting is expected to reduce the core flow by-pass one to two percent and consequently reduce the DNB (departure from nucleate boiling) margin. The DCISC should follow up on this margin reduction and review the associated safety analysis. The DCISC should also schedule a future Fact-finding meeting on current nuclear fuel issues, such as flaw-induced pellet-clad interaction.

The DCISC inquired about the use of Zinc in the RCS. The DCISC last reviewed zinc addition in April 2003 (Reference 6.5). Zinc acetate has been added gradually over several cycles to both units’ RCSs. The purpose of zinc is to reduce initiation of Primary Water Stress Corrosion Cracking (PWSCC) on the Steam Generator (SG) tubes; an added benefit was prevention of the plating-out of radioactive cobalt and nickel on metal surfaces and keep them in solution to facilitate cleanup and reduce contamination of the RCS. This has been successful as measured by lower Steam Generator bowl dose rates during refueling outages. There has been no adverse effect on fuel heat transfer characteristics or fuel integrity; a ten percent zinc fuel-oxide corrosion penalty has been removed. DCPP also uses lithium to maintain a pH of 7.2 to keep transport of crud to piping low.

The number of SG tubes experiencing PWSCC has been significantly reduced since Zinc injection began in Cycle 9; however, it is not clear that the improvement is fully attributable to zinc. The Electric Power Research Institute (EPRI) is studying the phenomenon.

Conclusion:
DCPP has had no Unit 2 fuel failure problems for almost two cycles due to an aggressive program of prevention and mitigation techniques. Continuation of this trend is an item the DCISC should follow. Use of Zinc has been helpful in reducing radioactive contamination of the Reactor Coolant System (RCS) without adverse effects on nuclear fuel. The DCISC should review current nuclear fuel issues, and specifically the Unit 2 core upflow conversion safety analysis, in a future Fact-finding meeting.

3.3 Reactivity Management

The Fact-finding Team met with John Griffin, Supervisor of Reactor Engineering, to review DCPP’s Reactivity Management Program. The DCISC last reviewed Reactivity Management (RM) in October 2004 (Reference 6.6)

The DCPP Reactivity Management Program was developed to assure conservative reactivity management by promoting a reactivity conscious culture for operating and maintaining the plant and to provide management expectations and standards for reactivity management. A previous department-level procedure has being replaced with an inter-departmental procedure effective December 6, 2004 applicable to all of DCPP to provide heightened awareness for plant staff whose work has a potential to affect reactivity. The procedure assigns expectations for RM to those whose work could affect RM, specifically stating that:

“The operations manager is responsible for reactivity management, including the direct control of reactivity, and for ensuring conservative actions with regard to nuclear fuel integrity during operations, fuel handling, and storage. The operations manager has the single-point accountability for operational decision-making associated with reactivity management.”

and that:

“The operator at the controls manages reactivity, but reactivity management is the responsibility of the entire licensed control room staff. Reactivity changes shall be conservative, deliberate and directly controlled.”

The procedure provides for and references other procedures controlling the operation of the following:

The procedure specifies use of pre-planned load reduction or increase ramps, reactivity briefs by control room operators, oversight by Operations management, operator distractions, turnovers, boration/dilution monitoring, peer checks, control rod movement stop & check points, etc. The DCISC Fact-finding Team believed the procedure was comprehensive and complete.

Operations and Reactor Engineering now work much closer together than in the past. A senior reactor operator has been assigned a rotational position with the Reactor Engineering organization since the end of 2003, and a new Reactor Engineering supervisor (John Griffin) was assigned in January 2004.

The most recent INPO evaluation concluded that there were areas for improvement in reactivity management, primarily in organization and engineering support, and the Reactivity Management Leadership Team started tracking program enhancements and deficiencies as inputs to the Reactivity Performance Indicators (RPIs).

The DCPP RPIs indicated mostly green (best) indicators from September 2003 through July 2004 with some white (good) indicators which were close to being green. The RPIs measure the number of reactivity events weighted by their significance. In August 2004 PG&E added RM Program deficiencies (as a result of the INPO evaluation) which brought the RPIs down into the yellow and red ranges. The DCISC should continue closely monitoring the RPIs and RM Program until the RPIs show consistently good results.

Oversight of the Reactivity Management Program is provided by a Reactivity Management Leadership Team (RMLT), formed in November 2002, with representatives from Operations, Reactor and System Engineering, Maintenance, Chemistry, Training, Human Performance and Corrective Action, and Operating Experience. The RMLT meets monthly to perform a low threshold review of all ARs with the potential to impact reactivity and to evaluate, classify and trend events. The RMLT also tracks recommendations from program evaluations, self-assessments and benchmarking trips. Items identified as program deficiencies or needed enhancements are tracked as part of a performance indicator.

The Fact-finding Team received and reviewed the minutes of the March 16, 2005 RMLT meeting. The attendees discussed the following items:

The RMLT appeared to be addressing the appropriate RM items and employed the right persons/positions to make decisions and plans and take actions.

DCPP utilizes the BEACON (Best Estimate Analysis of Core Operations - Nuclear) computer code as a RM predictor for ramp planning, RM tailboards, etc. The DCISC should review BEACON and ramp planning in a future Fact-finding meeting.

Conclusion:
PG&E has made significant improvements in its Reactivity Management Program and organization and appears to be on a trajectory for an effective program. The DCISC should continue to monitor RM closely until DCPP Reactivity Performance Indicators show a sustained good performance.

3.4 Tsunami Threats at DCPP

The Fact-finding Team met with Dr. Lloyd Cluff, Director of PG&E Geosciences Department Earthquake Risk Management, to review the threat of tsunamis on DCPP. Although aware of the tsunami design basis for DCPP, this is the first in-depth review the DCISC has made of tsunamis. The review was requested due to the December 26, 2004 Sumatra-Andaman Islands Earthquake and resulting tsunami.

The Sumatra Earthquake was magnitude 9.0, a very large earthquake. It prompted PG&E to review its tsunami design basis and take a new look at similar-sized earthquakes that have caused tsunamis, especially those that had the potential to affect DCPP. Dr. Cluff discussed the mechanics of tsunami generation from undersea earthquakes and described the Dec. 26, 2004 event from initiation of the earthquake to the conclusion of the resulting tsunami. Wave run-up heights in various locations were reviewed. In Banda Aceh waves were believed to be as high as about 35 meters (115 feet), and in Phuket, Thailand waves reached a maximum height of almost 11 meters (36 feet).

A review of other worldwide tsunamis resulting from earthquakes at or above magnitude 9.0 revealed five which initially had the potential to affect DCPP:

  1. 1700 Cascadia magnitude 9.0 earthquake off the coast of Oregon and Washington at Willapa Bay
  2. 1946 Aleutians magnitude 9.3 earthquake
  3. 1952 Kamchatka, Japan magnitude 9.0 earthquake
  4. 1960 Chilean magnitude 9.5 earthquake off the western coast of Chile near Valdive
  5. 1964 Alaska magnitude 9.2 earthquake

DCPP is designed for storm surge waves of 36 feet and tsunami waves of 20 feet. In 1981, DCPP experienced a 31-foot storm surge. Because of the location and relative geometry of DCPP and the Cascadia (Washington-Oregon) earthquake, there would be no significant tsunami wave action at DCPP, particularly compared to the storm surge that has already been experienced at the plant. Waves from Alaska and Chile could be expected to reach DCPP in five and 13 hours, respectively.

The range of wave heights from these earthquake-generated tsunamis recorded at Avila Beach tide gauges was 2.9 feet (Chile) to 5.3 feet (Alaska). PG&E concluded that none of these events would pose a threat to DCPP. PG&E is collecting additional tide-gauge data for storm surges and tsunamis at several Pacific coast sites for NRC; this is scheduled for completion in early 2006, and the DCISC should request a copy.

Conclusion:
PG&E’s analysis of significant earthquake-caused tsunamis, including the December 2004 Sumatra event super-imposed on Alaska, indicates that none represents a threat that would exceed the maximum tsunami design basis events at DCPP. The DCISC should request this tsunami presentation be made at its June 1-2, 2005 Public Meeting.

3.5 Computer Models for Radiation Exposure Projection

The DCISC Fact-finding Team met with Bob Hite, Radiation Protection Manager, to discuss the computer models PG&E uses to project accident radiation exposures. The DCISC last reviewed radiation exposure projections used in an emergency exercise in December 2004 (Reference 6.7).

PG&E uses three predominant models, R-2, MIDAS and EARS to make accident radiological projections. The models have been validated with tracer tests performed at the DCPP location. The DCISC requested reports documenting these models.

DCPP’s radiation protection strategy for the public is based on the premise that a fast wind would blow a radioactive plume to and over an area quickly thus making sheltering the most effective strategy. A slow wind-blown plume would reach an area slowly permitting time for evacuation and would pass over slowly, also rendering higher exposures due to the longer exposure time. Hite believed that field monitoring team (FMT) data is most useful in post-event analysis rather than in making dose projections or locating plumes for protective action recommendations (PARs). The PARs are based on projection models. A decision point occurs if FMT measurements are over 3 times larger, or under 3 times lower, than levels predicted by the projection models. However, it was not clear what actions would be taken if significant disagreement were observed between FMT measurements and model predictions; it appears that an ad hoc response would be applied. The DCISC should follow up to determine whether, and what, role FMT data might play in affecting or altering PARs.

Currently, protective action recommendations by PG&E are based on computer projection models, not FMT data, because of the difficulty in obtaining the latter information in a timely or accurate manner. It is noted that both PG&E and San Luis Obispo County personnel participate in analysis of the computer model projections and FMT data at the Unified Dose Assessment Center (UDAC), and make recommendations to the County for protective actions. The County officials then make the actual protective orders to the public.

Conclusion:
PG&E makes its radiological protective action recommendations to the County based on documented computer-modeled projections using information from the plant radiation monitors and radioactive material release rate data. The DCISC should inquire further into the workings, documentation and experimental validation of these models, and on the appropriate role, if any, for FMT data in affecting protective action recommendations.

3.6 December 8, 2004 Emergency Exercise Continuation

The DCISC Fact-finding Team met with Mark Lemke, head of Emergency Preparedness, to discuss the two-day continuation of the December 8, 2005 emergency exercise. The DCISC observed the December 8 first-day exercise (Reference 6.8) based on a ten-mile radius and was made aware that it was being continued for two additional days by the Federal Emergency Management Agency (FEMA) and other governmental agencies to assess off-site local and state agencies in dealing with the longer-term radioactive ingestion dose actions and impacts within a 50-mile radius.

The ingestion pathway exercise continuation is performed once per 12 years for DCPP (and once per six years for the State – the other plant involved is San Onofre Nuclear Generating Station). PG&E is not involved in this phase of the exercise, only in the initial first-day exercise.

The DCISC Fact-finding Team reviewed the FEMA Final Exercise Report dated March 14, 2005. All but four of the 182 objectives were met, and there were no Deficiencies. There were four Areas Requiring Corrective Action (ARCAs) as follows:

  1. The UDAC [County] Coordinator received the incorrect (most restrictive) Dose Conversion Factor [for converting self-reading dosimeters for field personnel to Total Effective Dose Equivalent (TEDE)] to modify the administrative dose limit. This caused the TEDE for County emergency workers to be much higher (more conservative) than it was in reality. FEMA believed the County should be trained on what proper factor to be requested and applied.
  2. The [County] Emergency Off-site Facility Radiological Monitoring Director (EOF-RMD) did not transmit the recommendation to two field monitoring teams to take Potassium Iodide (KI).
  3. Information concerning specific schools, State and County parks and beaches, and agricultural information was not provided to the public in a timely manner.
  4. A CALTRANS Hazardous Materials Manager was not aware of how to correctly read dosimeters issued to emergency workers.
Conclusion:
It appeared to the DCISC Fact-finding Team by reviewing the FEMA report that the two-day continuation of the December 8, 2004 emergency exercise to assess local and State agency response in the 50-mile radiological ingestion pathway was successfully completed with all but four of 182 objectives being met. The four exceptions were not deficiencies but areas for corrective action for the agencies.

3.7 Fire Protection Audit

The DCISC Fact-finding Team met with Kathleen Hubbard, Quality Verification Auditor, to discuss the most recent Fire Protection Audit. The DCISC last reviewed Fire Protection in March 2002 (Reference 6.8).

DCPP Technical Specifications require annual, biennial, and triennial audits on fire protection programs. The three audit types differ in audit scope and auditor qualifications and organizational independence (i.e., inside vs. outside consultant/personnel). The audit reviewed was a combination annual and biennial audit which required a review of both whether fire protection program, systems and personnel were adequate and met licensing basis requirements and whether programmatic documents adhered to NRC requirements.

The audit appeared thorough and comprehensive. Overall, the audit team considered the implementation of the Fire Protection Program satisfactory and effective. The audit scope included review of the following attributes (with audit results noted).

  1. Installed Fire Protection Systems and Barriers are Appropriate for the Objects Protected – Good
  2. Fire Loading in Each Fire Area Has Not Increased Above the Loading Specified in the UFSAR – Satisfactory
  3. Regularly Scheduled Maintenance is Performed in Plant Fire Protection Systems – Satisfactory
  4. Special Permit Procedures are Followed – Needs Improvement
  5. Identified Deficiencies are Promptly and Adequately Corrected – Unsatisfactory
  6. Plant Personnel Receive Appropriate Training – Satisfactory
  7. Plant Response to Fire Emergencies is Adequate (there were five incidents during the audit period) – Satisfactory
  8. Administrative Controls Limit Transient Combustibles in Safety-Related Areas – Satisfactory
  9. Review of Fire Protection Program and Implementing Procedures – Satisfactory
  10. Review of Operating Experience – Satisfactory
  11. Corrective Action Follow-up – Good

In Item 4 above field implementation of Hot Work Permits was found satisfactory; however, the permits were not being signed or dated by the hot work supervisor as required by procedure, and an Action Request (AR) was initiated. Reviews for proximity to safe shutdown equipment and the need for additional fire prevention and suppression equipment in areas of high nuclear safety significance were not being performed as required by procedure, and an AR was initiated.

Item 5 above was considered Unsatisfactory due to deficiencies identified since the 2003 audit and long-standing system problems. Specifically:

Fire Protection System conditions have been degraded for many years, in spite of persistent advocating by Fire Protection personnel for funds to solve the problems.

QV requested a schedule and actions from Engineering to address these and other issues needed to return the system health to Green status. Engineering’s long-term plans addressed the problems as follows:

Engineering stated that the Fire Protection System will be returned to Green status in 2009 with completion of the FWST project. Although some of these are long-term projects, the DCISC should be concerned about the timeliness of the project and should follow the progress of this work until completion. DCISC notes that, although not in Green status, the system is capable of performing its intended functions.

Item 7 for plant response to fire emergencies noted satisfactory performance during five incidents. These responses for two of these incidents (A0611584, Fire report for Unit 1 blowdown tank piping, and A0612992, Fire in administration building cafeteria) required bringing fire equipment through the plant security perimeter, which was performed smoothly. The Fact-finding Team noted that this provides preliminary evidence that the new security procedures have not degraded fire safety.

Conclusion:
DCPP’s 2004 annual fire protection audit found the Fire Protection Program and System to be satisfactory and effective but highlighted concerns regarding the Fire Protection System Health due to long-standing unresolved problems such as piping corrosion. Engineering responded with a long-term plan intended to return the system to Green status in 2009. Although the system remains fully operable, the DCISC is concerned about the timeliness and should closely follow the project implementation.

3.8 ECCS Voids Status

The DCISC Fact-finding Team met with Anderson Lin, Principal Engineer in the System Transient Analysis Group, for an update on Emergency Core Cooling System (ECCS) voids. The DCISC last reviewed this subject in the late 1990s.

Gas accumulation or voiding in high-points of ECCS piping is a concern due to the potential to render ECCS pumps inoperable during certain design basis accidents. Gases accumulate when introduced during maintenance, and by coming out of solution in a system. In 1997 NRC issued an information notice (and multiple supplements) regarding voids, and INPO issued Significant Operating Experience Report (SOER) 97-1 “Potential Loss of High Pressure Injection and Charging Capability from Gas Intrusion” on ECCS voiding; and a new SOER is expected.

When the DCISC reviewed DCPP voiding in the late 1990s, it believed PG&E had taken appropriate action to solve the problem caused by degassing occurring in the chemical and volume control system letdown orifice. Actions consisted primarily of careful filling and venting during restart from outages and the addition of specific high-point vents to eliminate accumulated voids. Periodically, systematic ultrasonic testing (UT) was used to detect and monitor high-point voids, and finally, continuous void monitoring was employed.

In 2004 Palo Verde experienced a large bubble in the Residual Heat Removal (RHR) System which was initially determined to render the system inoperable (but it was later determined through testing to have been operable). DCPP has performed scale-model testing and plans to run an actual charging pump test to determine the effects of voiding.

Gas voids in the suction piping of the ECCS have been a recurrent and elusive problem at DCPP and other nuclear plants. In the most recent events, during the second half of 2004, Units 1 and 2 experienced five unexpected voids at the crosstie between the Centrifugal Charging Pump (CCP) and the Safety Injection Pump (SIP) suction lines.

Investigation by a Root Cause Analysis (RCA) Team identified the phenomena that created the gas source, where during normal system operation, gases come out of solution in the RCP seals due to the large acceleration, pressure drop, and pressure recovery that occur in the RCP seal labyrinth and result in localized pressures below the gas saturation pressure. Additionally, H2 dissolved in the Volume Control Tank (VCT) may degas at process pressures lower or temperatures higher than that of the VCT, contributing to void formation. The Team investigated many potential mechanisms for the unexpected voids formation. They utilized both Fault Tree Analysis and Event and Causal Factors approaches to narrow down the causes. The DCISC considers their analysis to be noteworthy in identifying the root causes of the problem, and in particular in identifying the RCP seals as a source of gas. They also determined that the reason no sizeable voids formed from 1999 through mid-2004 was because of the way the PDPs and CCPs were operated for normal charging and swapping.

The DCPP Team determined that there were several earlier missed opportunities to identify the actual root causes of the void problems. Basically, two previous efforts identified some, but not all gas sources. They therefore stopped short of the actual root cause or didn’t go far enough in corrective actions, including failure to recognize and take advantage of an applicable industry event at Catawba Nuclear Station.

The root causes were determined to be inadequate piping configurations, due to design flaws, which caused the void accumulations. Specifically, the design flaws were as follows:

The root cause analysis was thorough and comprehensive. Two corrective actions recommended to prevent recurrence and address the root cause were:

  1. Revision of the Design Change Procedure to require the proper evaluation and correction of any void issue during the design change process
  2. Implementation of a piping design modification that would prevent accumulation of voids at the connection to the CCPs suction header.

It was also recommended that the PDP be replaced with a different type of pump with a continuous recirculation flow to minimize void collection. It was recognized that recirculation line check valves normally exhibit back leakage and that pump swaps are an operational/testing necessity, and no changes were recommended. Interim temporary modifications and operational procedure changes were put in place until the permanent corrective actions are complete.

DCPP developed an Effectiveness Evaluation Plan to test the effectiveness of the corrective actions. The Plan consists of performing Surveillance Procedure STM M-89 “ECCS System Venting” each month (and at prescribes modes of operation) for one year to verify whether the Units 1 and 2 ECCS are full of water.

DCPP and the industry have faced a difficult time identifying and resolving the problem of ECCS piping system voids which could potentially cause an ECCS pump to be inoperable. DCPP has performed a thorough root cause analysis which, with the identification of the RCP gas source and with corrective actions, appears to solve the ECCS void problem. A year’s monitoring should determine the effectiveness of the solutions.

Conclusion:
Following a thorough, comprehensive root cause analysis and implementation of resulting corrective actions, DCPP appears to have solved ECCS piping void problems which have plagued it since 1997. This involved noteworthy detective work to identify the root-cause source of degassing in the RCP seals. Its one-year evaluation and monitoring plan will determine the effectiveness of the solutions. The DCISC should closely follow this issue.

3.9 Review and Tour of DCPP Security

Prior to the Fact-finding meeting, the DCISC Fact-finding Team, consisting of Member Dr. Per Peterson and Consultant Ferman Wardell, had applied for and been granted access to DCPP security safeguards information. This was for the purpose of understanding NRC-required security upgrades since September 11, 2001 and how DCPP has balanced operations, maintenance and emergency preparedness requirements with the new security upgrades. Nuclear power plant security measures commonly involve measures to limit access to safety-related equipment, and thus have the potential to conflict with safety goals. Therefore a major focus of this Fact-finding meeting was to review recent activities to upgrade security, to assure that the implementation had properly considered, and mitigated, potential impacts of plant safety.

The last DCISC Fact-finding review of security was carried out by former Member Dr. E. Gail de Planque in October 2004 (Reference 6.9). The last presentation of security in a DCISC public meeting was in February 2005 (Reference 6.10). These references, like this Fact-finding Report, cannot contain any safeguards information due to its sensitive nature. The following is a non-safeguards level summary of the meeting.

Since September 11, 2001, the NRC expanded its Threat Advisory System by issuing Threat and Safeguards Advisories, Regulatory Issue Summaries for interim security enhancements, and has issued five Reactor Facility Orders as described below:

  1. February 2002 Power Reactor Security Order for Power Reactors and Spent Fuel Facilities with written response by May 31, 2005 and implementation of measures by August 31, 2005.
  1. Increased security patrols
  2. Augmented security forces
  3. Additional security posts
  4. Increased vehicle standoff distances
  5. Improved coordination with law enforcement and intelligence communities
  6. Strengthened safety-related mitigation procedures and strategies
  7. Specific guidance and strategies to maintain or restore spent fuel pool (SFP) cooling capabilities using existing or readily available resources
  8. In July 2004 additional spent fuel mitigation measures were issued, along with a related workshop in February 2005
  1. 2. January 2003 Access Authorization Order for Power Reactors and SFPs with implementation by January 2004.
  1. Enhanced background investigations for unescorted access
  2. Additional oversight of employees holding unescorted access or who have access to safeguards information
  3. Enhanced background investigation process for other Federal agencies supporting NRC and the nuclear industry
  1. April 2003 Order of Supplemental Requirements Related to the Design Basis Threat (DBT) – for Power Reactors & SFPs
  1. Supplemental requirements for specific adversary characteristics for terrorists and radiological sabotage
  2. Capability to defend against DBT adversaries will be tested in subsequent Force-on-Force exercises.
  1. April 2003 Fitness for Duty/Fatigue Order – due to initial longer work hours for security personnel
  1. Enforceable work-hour limits for security personnel
  2. Procedures to evaluate security force fatigue
  1. 5. April 2003 Training and Qualification of Security Force Personnel – implemented in October 2004
  1. Fitness requirements
  2. Drills and exercises to encompass defensive strategies and capabilities for the DBT

The DCISC understands there is an additional order for ISFSIs discussed with industry in a workshop in February 2005 and to be issued in May. The DCISC should review SFP security at DCPP along with the response to this order in a future Fact-finding meeting.

The DCISC Fact-finding Team viewed a DCPP-prepared video “Control of Safeguards Information” which explained what constitutes safeguards information and how it is controlled.

The Team then received a presentation on DCPP security consisting of the following topics:

The DCISC reviewed the provisions made for normal and emergency plant access in the new security design modifications. Prior to finalizing and implementing any security upgrade designs, Security involved affected stakeholders in a design review. (This is actually a standard practice in the DCPP Design Change Process). Likewise, Security reviews non-security draft plant design changes for security requirements and effects.

The DCISC reviewed an Action Request which documented these reviews by:

DCPP performed reviews of its hot shutdown analysis and SFP cooling water make-up resources and procedures with respect to the new DBT. The DCISC reviewed the procedure resulting from these reviews: CPM-15 Preparation and Response to Credible/Imminent Security Threats” and found it satisfactory in addressing operator and system responses to loss of various equipment and systems in a security event. The DCISC should review the hot shutdown and SFP capabilities in a future Fact-finding meeting.

In addition to these reviews, practical experience was also obtained during two fire incidents (Section 3.7 of this report) where fire equipment was required to pass through vehicle inspection to enter the Protected Area. In both incidents, good communication and coordination between fire, operations, safety, and security were observed and reported. The DCISC should continue to monitor plant operations and emergency response exercises for interactions with security systems.

The DCISC Fact-finding Team toured the following security areas of the plant:

Conclusion:
The DCISC is not charged to review DCPP security per se; however, it does feel obligated to be sufficiently familiar with DCPP security plans, practices, analyses, and features to assess the degree to which security requirements affect plant safety, and to assure that prudent measures have been taken to identify potential interactions between security and safety and to provide appropriate mitigation. Based on its one-day security review and tour, it appeared to the DCISC that DCPP is well equipped to defend itself and meets NRC security requirements. It also appears that DCPP has carefully reviewed recent security upgrades to assure acceptable impacts on operations, maintenance, and emergency response. However, because security-related changes to the plant, particularly in the area of access controls, have been substantial, continued monitoring is needed to assure that potential negative interactions with safety are identified and mitigated.
Recommendations:
Because necessary post-9/11 security upgrades at DCPP have been very substantial, over the next one to two years PG&E should actively monitor interactions of security with plant operations, maintenance, and emergency response to assure that potential negative security/safety interactions are identified and mitigated, as necessary to assure plant safety. Upcoming emergency exercises should be designed to test scenarios where plant operators and emergency response personnel would be expected to have significant interactions with plant security systems and forces, to confirm that effective communication and coordination are achieved.

3.10 Review PG&E Open Items

The DCISC Fact-finding Team met with Kent Oliver, DCISC liaison, to review PG&E open items identified at the February 16-17, 2005 Public Meeting. Pending review of the meeting minutes, it appears that PG&E has completed all open items.

3.11 DCISC Member Meeting with DCPP Management

Dr. Peterson met with Dave Oatley, Vice-President and General Manager, DCPP, to discuss items reviewed in the Fact-finding meeting and other items of interest.

4.0 Conclusions

4.1
DCPP’s spent fuel pools (SFPs) have robust, below-grade construction that makes significant leakage due to accidents or external events highly unlikely, and the plant provides multiple SFP cooling water makeup systems including independent, portable equipment stored away from the plant. DCPP has historically used a dispersed offloading pattern for recently discharged fuel, which significantly mitigates the potential for overheating and fuel damage in the event of pool drainage. New temporary racks to be used in the pools will be thermally isolated from existing racks, so their effect on pool thermal management is essentially equivalent to transferring a similar quantity of fuel to dry storage. The recent Unit 2 incident involving a four-inch SFP level drop, not coming close to the SFP low-level alarm, was caused by procedure deficiencies, for which corrective actions have been implemented. The DCISC should continue to monitor SFP thermal management, particularly for effects from upcoming fuel transfers to dry storage.
4.2
DCPP has had no Unit 2 fuel failure problems for almost two cycles due to an aggressive program of prevention and mitigation techniques. Continuation of this trend is an item the DCISC should follow. Use of Zinc has been helpful in reducing radioactive contamination of the Reactor Coolant System (RCS) without adverse effects on nuclear fuel. The DCISC should review current nuclear fuel issues, and specifically the Unit 2 core upflow conversion safety analysis, in a future Fact-finding meeting.
4.3
PG&E has made significant improvements in its Reactivity Management Program and organization and appears to be on a trajectory for an effective program. The DCISC should continue to monitor RM closely until DCPP Reactivity Performance Indicators show a sustained good performance.
4.4
PG&E’s analysis of significant earthquake-caused tsunamis, including the December 2004 Sumatra event super-imposed on Alaska, indicates that none represents a threat that would exceed the maximum tsunami design basis events at DCPP. The DCISC should request this tsunami presentation be made at its June 1-2, 2005 Public Meeting.
4.5
PG&E makes its radiological protective action recommendations to the County based on documented computer-modeled projections using information from the plant radiation monitors and radioactive material release rate data. The DCISC should inquire further into the workings and documentation of these models.
4.6
It appeared to the DCISC Fact-finding Team by reviewing the FEMA report that the two-day continuation of the December 8, 2004 emergency exercise to assess local and State agency response in the 50-mile radiological ingestion pathway was successfully completed with all but four of 182 objectives being met. The four exceptions were not deficiencies but areas for corrective action for the agencies.
4.7
DCPP’s 2004 annual fire protection audit found the Fire Protection Program and System to be satisfactory and effective but highlighted concerns regarding the Fire Protection System Health due to long-standing unresolved problems such as piping corrosion. Engineering responded with a long-term plan intended to return the system to Green status in 2009. Although the system remains fully operable, the DCISC is concerned about the timeliness and should closely follow the project implementation.
4.8
Following a thorough, comprehensive root cause analysis and implementation of resulting corrective actions, DCPP appears to have solved ECCS piping void problems which have plagued it since 1997. This involved noteworthy detective work to identify the root-cause source of degassing in the RCP seals. Its one-year evaluation and monitoring plan will determine the effectiveness of the solutions. The DCISC should closely follow this issue.
4.9
The DCISC is not charged to review DCPP security per se; however, it does feel obligated to be sufficiently familiar with DCPP security plans, practices, analyses, and features to assess the degree to which security requirements affect plant safety, and to assure that prudent measures have been taken to identify potential interactions between security and safety and to provide appropriate mitigation. Based on its one-day security review and tour, it appeared to the DCISC that DCPP is well equipped to defend itself and meets NRC security requirements. It also appears that DCPP has carefully reviewed recent security upgrades to assure acceptable impacts on operations, maintenance, and emergency response. However, because security-related changes to the plant, particularly in the area of access controls, have been substantial, continued monitoring is needed to assure that potential negative interactions with safety are identified and mitigated.

5.0 Recommendations

5.1
Because necessary post-9/11 security upgrades at DCPP have been very substantial, over the next one to two years PG&E should actively monitor interactions of security with plant operations, maintenance, and emergency response to assure that potential negative security/safety interactions are identified and mitigated, as necessary to assure plant safety. Upcoming emergency exercises should be designed to test scenarios where plant operators and emergency response personnel would be expected to have significant interactions with plant security systems and forces, to confirm that effective communication and coordination are achieved.

6.0 References

6.1
“Diablo Canyon Independent Safety Committee Fifteenth Annual Report on the Safety of Diablo Canyon Nuclear Power Plant Operations, July 1, 2004 – June 30, 2005”, Approved October 12, 2005, Exhibit B.3, Temporary Spent Fuel Pool Rack Status.
6.2
Committee on the Safety and Security of Commercial Spent Nuclear Fuel Storage, “Safety and Security of Commercial Spent Nuclear Fuel Storage, Public Report,” Pre-publication Draft, National Research Council, 2005, pg. 6.
6.3
“Diablo Canyon Independent Safety Committee Thirteenth Annual Report on the Safety of Diablo Canyon Nuclear Power Plant Operations, July 1, 2002 – June 30, 2003”, Approved October 2, 2003, Exhibit D.7, Section 3.8, Fuel Reliability.
6.4
Ibid., Exhibit D.8, Section 3.4, Nuclear Fuel System Review and Status of Issues.
6.5
Ibid., Exhibit D.7, Section 3.7, Effect of Zinc in the RCS.
6.6
“Diablo Canyon Independent Safety Committee Fifteenth Annual Report on the Safety of Diablo Canyon Nuclear Power Plant Operations, July 1, 2004 – June 30, 2005”, Approved October 12, 2005, Exhibit B.3, Operator Performance During 1R12 and Current Reactivity Performance
6.7
Ibid., Exhibit D.5, Section 3.1, Observe December 8, 2004 Emergency Exercise.
6.8
“Diablo Canyon Independent Safety Committee Twelfth Annual Report on the Safety of Diablo Canyon Nuclear Power Plant Operations, July 1, 2001 – June 30, 2002”, Approved October 5, 2002, Exhibit D.9, Section 3.9, Fire Protection Program and Systems Review and Tour.
6.9
“Diablo Canyon Independent Safety Committee Fifteenth Annual Report on the Safety of Diablo Canyon Nuclear Power Plant Operations, July 1, 2004 – June 30, 2005”, Approved October 12, 2005, Exhibit D.3, Section 3.12, Security Update.
6.10
Ibid., Exhibit B.6, Security Update

For more information about DCISC contact:

Diablo Canyon Independent Safety Committee
Office of the Legal Counsel
857 Cass Street, Suite D, Monterey, California 93940
Telephone: in Califonia call 800-439-4688; outside of California call 831-647-1044
Send E-mail to: dcsafety@dcisc.org