POLICY ISSUE

NOTATION VOTE

April 29, 2004 SECY-04-0071

FOR: The Commissioners

FROM: William D. Travers

Executive Director for Operations

SUBJECT: PROPOSED PROGRAM TO IMPROVE THE EFFECTIVENESS OF THE

NUCLEAR REGULATORY COMMISSION INSPECTIONS OF DESIGN

ISSUES

PURPOSE:

The purpose of this paper is to obtain Commission approval of the staff’s methodology for

conducting a pilot program to assist in determining whether changes should be made to the

Reactor Oversight Process (ROP) to improve the effectiveness of Nuclear Regulatory

Commission (NRC) inspections in the design/engineering area. 

SUMMARY:

This paper describes a program to improve the ability to identify significant design issues at

commercial nuclear power facilities. This new inspection module responds to lessons learned

from past inspections and events, and is intended to provide a more indepth inspection of

engineering activities, thereby improving the effectiveness of the current engineering

inspection. The program has three phases: (1) data analysis of recent design/engineering

issues, (2) development and implementation of a pilot inspection program, and (3) analysis of

pilot program results and development of recommendations for future changes.

CONTACT: Jeffrey Jacobson, NRR/DIPM

 301-415-2977
The Commissioners - 2 -

During Phase 1, the staff reviewed the results of recent NRC design inspections, and evaluated

the contributing factors to design inspection findings that were NRC-identified, 

licensee-identified, or self-revealing. The staff also performed a review of recent NRC design

inspection results, including the inspection history at two facilities where the licensee had

identified significant design issues that had not been previously identified, namely Point Beach

and Davis-Besse. 

In conjunction with the data analysis, the staff conducted a review of its existing and previous

inspection guidance in the design area. Based on this review, the staff developed a draft

prototype inspection procedure which incorporates the best practices of the existing and past

programs, and which provides enhanced guidance that should improve the effectiveness of the

overall inspection effort. The draft prototype inspection procedure focuses on 

risk-significant components with a low safety margin (performance characteristics with relatively

small margin to design requirements), while making extensive use of industry operating

experience.

During Phase 2, the prototype inspection module would be conducted at four sites. During

Phase 3, which is planned to commence following the completion of the pilot inspections, the

staff will perform an assessment of the pilot results to determine the need for any overall

program changes. The staff’s goal is to provide a status of the assessment to the Commission

as part of the 2004 annual ROP self-assessment Commission Paper in April 2005. 

BACKGROUND:

As part of the licensing process for commercial nuclear power facilities, licensees must

demonstrate to the NRC that plant systems and components are designed with sufficient 

margins and redundancy to ensure they can perform their intended safety-related functions. 

After granting an operating license, the NRC relies on the licensee to maintain the facility’s

design in accordance with its licensing requirements. In addition, recent risk-informed initiatives

intended to reduce unnecessary regulatory burden are based on the assumption that the

changes being requested do not result in an unacceptable risk to public health and safety,

despite reductions in available margin or redundancy. To support this assumption, the NRC

staff and its licensees place significant emphasis on the results of probabilistic risk

assessments (PRAs) that model safety systems and components, and predict the likelihood of

various accident sequences. 

A fundamental and necessary aspect of such reliance on PRAs is that the design of the

modeled safety systems and components is correct, i.e., the PRA must accurately reflect the

current plant status. Any errors in the design, in the implementation of the design, or in the

modeling of plant changes could potentially invalidate the conclusions derived from the PRA. 

Therefore, verification that safety systems and components are correctly designed and can

perform their intended safety functions has become increasingly important as the industry and

NRC place increased reliance on and implement new risk-informed regulatory initiatives.
The Commissioners - 3 -

1

Fire protection is not typically reviewed as part of NRC design inspections since the

NRC has a specific fire protection inspection.

DISCUSSION:

Phase 1- Data Analysis of Recent Design/Engineering Issues 

In order to better understand the degree to which NRC inspections and licensee self

assessment efforts have been effective in identifying design issues, the staff reviewed the last 

3 years of data from the ROP. The details of this review are contained in the attachment. The

review covered greater-than-green issues in the initiating events, mitigating systems, or barrier

integrity cornerstones that involved safety systems or components that were nonfunctional due

to weaknesses in design or engineering.

Of the 17 greater than green design/engineering issues that fell within the scope of this review,

11 were NRC-identified, 2 were licensee-identified, and 4 were self-revealing. Of the 

11 NRC-identified issues, 7 involved issues that had been previously recognized by the

licensee, but whose significance the licensee had not recognized. Therefore, the licensees had

not taken adequate corrective actions. Three of the NRC-identified issues were associated with

fire protection, an area not typically covered in NRC design inspections.1

 Only one of the NRCidentified issues was identified as a result of an NRC design inspection. Of the two licenseeidentified issues, one was identified as a result of extensive system reviews conducted by the

licensee during an extended shutdown, and one was identified as a result of a pro-active selfassessment.

The staff also performed a review of the results of recent NRC design inspections conducted in

accordance with Inspection Procedure 71111.21, “Safety System Design and Performance

Capability,” including the inspection history at Point Beach and Davis-Besse, facilities where the

licensee had identified significant design issues that had not been previously identified by the

NRC. The staff noted that the design inspections at Point Beach and Davis-Besse, conducted

prior to the licensees’ identification of significant design issues, had identified a greater number

of lower level (green) design issues than were identified at other facilities during the same

period. Specifically, during the year 2000 design inspections at Point Beach and Davis-Besse,

there were five design related findings at each site, which was approximately twice the average

number of design inspection findings for all sites inspected during the same year. Furthermore,

the findings at Point Beach and Davis-Besse covered a wide range of design activities and

included multiple examples of calculational errors, errors in the translation of design

specifications, and test control weaknesses. Because these issues were not identified as being

risk-significant, the NRC did not perform detailed extent-of-condition reviews of the identified

issues, consistent with the ROP.

The results highlight the need for aggressive licensee self-assessments in the design area and

effective corrective action programs that can evaluate and resolve the identified issues in a

timely manner. Lastly, the results show that in some instances, the NRC had indications of

programmatic design/engineering weaknesses, but did not engage further, as the
The Commissioners - 4 -

2

 This increase in resources is partially attributed to the fact that the prototype inspection

combines the inspection requirements from several baseline inspection modules into one team

inspection. To normalize the inspection resources, credit could be given to completing

applicable portions of those baseline inspections. 

programmatic weaknesses had not yet resulted in issues that could be classified as risksignificant. In such instances, the issues were entered into the licensee’s corrective action

program.

Phase 2 - Development of Prototype Inspection Module and Pilot Inspection Program

Using the insights gained from its review of the above inspection data, and based on its review

of existing and past NRC inspection modules in the design area, the staff has developed a

prototype inspection module to more keenly focus inspection resources on areas of risk

significance. This new inspection module responds to lessons learned from past inspections

and events, and is intended to provide a more indepth inspection of engineering activities,

thereby improving the effectiveness of the current engineering inspection. A significant aspect

of the new inspection module is that it will focus on risk-significant/low margin components,

including components where margins have been reduced as a result of modifications to the

plant’s design or licensing bases. The newly developed prototype inspection module

incorporates the best features of the current and past NRC design/engineering inspections,

while differing from the current safety system design and performance capability inspection

module primarily in the following areas:

• Inspection samples will not be limited to one or two systems, but instead, will be focused

on risk-significant, low-margin components and operator actions. 

• Significant effort will be spent assessing relevant industry operating experience

associated with the samples selected for inspection.

• The inspection sample will not be limited to mitigating system components and may

include components that could be contributors to initiating events.

• If performance deficiencies are identified, extent-of-condition reviews will be performed,

as required. 

• A more detailed inspection report will be written that will include an integrated

assessment of design/engineering weaknesses.

• Overall, the prototype inspection module is more resource intensive and will require

about 700 hours of direct inspection versus the current allocation of approximately 500

hours2

 for the safety system design inspection. 

These changes are intended to focus inspection efforts on design and engineering areas which

have proven to be most susceptible and that have a high degree of safety significance. 
The Commissioners - 5 -

3

 This may cause some potential organizational conflict of interest (OCOI) concerns

because of the limited availability of skilled contractors with this expertise. The staff may seek

a waiver from the Commission’s policy on avoidance of contractor OCOI. 

As part of Phase 2, the staff intends to conduct a pilot program that would consist of four

inspections using the prototype inspection module. The pilot inspections will take the place of

the next regularly scheduled baseline safety system design inspection. The inspections will be

performed with a dedicated inspection team, and include three onsite inspection weeks and one

week of in-office preparation/inspection. The inspection team will consist of a team leader, two

or three contractor participants with expertise in power plant design, and a combination of two

or three regional and NRR inspectors. The design review portion of the inspection will be

performed by contractors/inspectors with extensive nuclear plant design experience, preferably

comparable to the experience gained through previous employment with an architect

engineering firm.3

 The field portion of the inspection will be performed by either resident

inspectors, regional inspectors, or NRR staff with past inspection experience. 

A key variable in the success of the proposed pilot inspections will be the qualifications and

experience of the inspection team members, particularly the inspection team leaders. The staff

is proposing the creation of four temporary inspection team leader positions to lead the pilot

inspections. The team leader positions will be for 3 months to allow sufficient time to prepare

for, conduct, and document the inspection. The need for specifically designated

design/engineering inspection team leaders on a ongoing basis will be assessed during Phase

3 of the overall program. The staff may also consider the use of additional regional inspectors

during the pilots in order to enhance the inspection knowledge base.

The sites for the pilot inspections will be selected based on consideration of the following

factors:

• Recent adverse performance as indicated by inspection findings, cross-cutting issues,

or performance indicators. The site should not have had significant engineering/design

inspection activity within the last year, such as IP 71111.21 SSDPC inspections, IP

95003 Supplemental inspections, and oversight under IMC 0350, “Oversight of

Operating Reactor Facilities in a Shutdown Condition with Performance Problems." 

• Site attributes such as design and licensing basis consistency with established NRC

regulatory positions, quality and scope of design basis information, unique plant safety

features, and recent licensing basis changes that could reduce safety analysis margins

(e.g., power uprates) should also be considered when selecting a site for this TI.

The plants selected may change based upon various scheduler considerations. Candidates

currently under consideration include Arkansas Nuclear One (ANO), Diablo Canyon,

Kewaunee, Monticello, Nine Mile Point Units 1 or 2, Summer, and Vermont Yankee.

The pilot program could be completed in approximately 6 to 9 months from the date of

Commission approval of the approach.
The Commissioners - 6 -

Phase 3 - Follow-on Assessment

As part of Phase 3, the staff plans to evaluate the results of the four pilot inspections. Included

within the scope of this evaluation will be the effectiveness of the pilot inspection procedure,

potential changes to ROP design/engineering-related procedures, the appropriateness of the

ROP guidance that governs NRC engagement on programmatic/cross-cutting issues, and the

adequacy of NRC staffing/training in the design/engineering area. In addition, prior to initiating

this review of the NRC’s design/engineering inspections, the staff had been working with the

industry on a proposal to allow NRC inspection credit for licensee self-assessments in the

design area. A brief synopsis of the staff’s work in this area was included in the 2002 and 2003

ROP self-assessments provided to the Commission. These efforts culminated last year with

the industry’s submittal of a draft self-assessment guidance document, NEI 04-03, “Safety

System Function Assessment (SSFA) Generic Assessment Plan Guideline.” This document

contains industry guidance for conducting self-assessments in the design area, including

guidance regarding staffing, self-assessment content, issue follow-up, baseline inspection

credit, and report documentation. The staff will consider additional interactions with the

industry, such as industry participation in a subsequent effort which would allow facilities to

conduct, and receive inspection credit for, design/engineering self-assessments. 

In addition to periodic status updates, the results of the staff’s evaluation and any

recommendations for continuing program changes will be included in the next ROP 

self-assessment. The staff estimates Phase 3 could be completed in 2 to 3 months after

completion of the last pilot inspection. 

RESOURCES:

To implement the pilot program, the staff estimates it would take about 1 FTE of NRR staff,

1 FTE of regional staff, and $350,000 of contract support ($210K in FY 2004 and $140K in 

FY 2005), beyond the resources which would have been spent performing the regularly

scheduled baseline design inspections. These resource estimates include both management of

the program and the actual pilot inspections. The staff estimates it would take about 1 NRR

FTE to complete the program evaluation specified in Phase 3. The FTE resources to conduct

the pilot inspections and subsequent program review would be accommodated with the

resources already budgeted in FY04 and FY05 for inspection program development,

management, and oversight. The additional $210K in FY 2004 would be reprogrammed from

existing NRR resources.

The Phase 1 work completed in FY 2004 was performed as an integral part of existing design

inspection resources. Pending Commission decision on the proposed program described in

this paper, any additional resources needed in the out years would be addressed as part of the

FY 2006 Budget Process through FY 2005 reprogramming and a FY 2006 budget request.
The Commissioners - 7 -

The additional inspection hours required to conduct the four pilot inspections would not be billed

to the individual licensees as Part 170 fees, but would be charged to all reactor licensees under

Part 171 annual fees since this work is program development. 

COORDINATION:

The Office of the General Counsel has reviewed this Commission paper and has no legal

objections to its contents. 

The Office of the Chief Financial Officer has reviewed this Commission paper for resource

implications.

RECOMMENDATION:

The NRC staff recommends the Commission approve the methodology for conducting a pilot

program in the design/engineering area. The staff plans to discuss this effort with external

stakeholders following Commission approval.

/RA/

William D. Travers

Executive Director

 for Operations

Attachment: Data Analysis of Recent Design/Engineering Issues
The Commissioners - 7 -

The additional inspection hours required to conduct the four pilot inspections would not be billed

to the individual licensees as Part 170 fees, but would be charged to all reactor licensees under

Part 171 annual fees since this work is program development. 

COORDINATION:

The Office of the General Counsel has reviewed this Commission paper and has no legal

objections to its contents. 

The Office of the Chief Financial Officer has reviewed this Commission paper for resource

implications.

RECOMMENDATION:

The NRC staff recommends the Commission approve the methodology for conducting a pilot

program in the design/engineering area. The staff plans to discuss this effort with external

stakeholders following Commission approval.

/RA/

William D. Travers

Executive Director

 for Operations

Attachment: Data Analysis of Recent Design/Engineering Issues

Accession Number:ML040970328

*see previous concurrence

OFFICE DIPM/IIPB DIPM/IIPB DIPM/IIPB Tech Editor PMAS OCFO

NAME JJacobson JAndersen SRichards PKleene CVelez JFunches

DATE 04/13/04 04/13/04 04/13/04 04/14/04 04/13/04 4/23/04

OFFICE OGC DIPM:D ADIP NRR EDO

NAME GMLongo BBoger

(C. Carpenter for)

JCraig JDyer WTravers

DATE 04/13/04 04/22/04 04/23/04 04/26/04 04/29/04 

OFFICIAL RECORD COPY
Attachment

DATA ANALYSIS OF RECENT DESIGN/ENGINEERING ISSUES

In an effort to improve the ability to identify significant design issues at commercial nuclear

power facilities, a data analysis of recent design/engineering issues was performed. As part of

this analysis, NRC staff reviewed the results of NRC inspections from the past 3 years and

evaluated the contributing factors to greater-than-green design inspection findings that were

NRC-identified, licensee-identified, or self-revealing. This appendix describes the 17

design/engineering issues that were identified during the review. The findings affected the

initiating events, mitigating systems, or the barrier integrity cornerstones and involved systems

or components that had been rendered inoperable due to weaknesses in design or engineering.

For the purposes of this paper, licensee-identified findings are those findings identified through

a licensee program or process that was specifically intended to identify the problem and for

which the licensee made effective evaluations and took appropriate corrective actions. 

NRC-identified findings are those findings that were solely identified by NRC inspectors or

those findings which the licensee had identified but had not effectively evaluated or had not

taken appropriate actions to correct. Self-revealing findings are those findings that reveal

themselves to either the NRC or the licensee through a change in process, capability or

functionality of equipment, operations, or programs during routine operation. Of the 17 

greater-than-green design/engineering issues that fell within the scope of the review, 11 were

NRC-identified, 2 were licensee-identified, and 4 were self-revealing. 

NRC-IDENTIFIED FINDINGS

Of the 11 NRC-identified issues, 7 involved issues that had been previously recognized by the

licensee but whose significance the licensee had failed to understand. As a result, the licensee 

had not taken adequate corrective actions. Three of the NRC-identified issues were associated

with fire protection, and one of the NRC-identified findings was a new issue identified as a result

of an NRC design inspection. These findings are described below.

HARRIS 1 - FIRE PROTECTION - WHITE

During a review of technical issues related to the fire-resistive performance of Thermo-Lag fire

area enclosures, NRC inspectors identified that the Thermo-Lag fire barrier material did not

perform to the manufacturer’s specifications. Fire endurance testing demonstrated that the

Thermo-Lag walls which served as part of the fire area separation barriers between cable

spreading rooms A and B and switchgear room B would have provided a 1 hour and 48 minutes

barrier for a 3-hour fire loading area with no automatic suppression and a fire brigade that had

not practiced in the area for over 7 years. This degraded condition increased plant risk

because if a severe fire occurred in the B train switchgear room and breached the Thermo-Lag

fire barrier, both trains of post-fire safe shutdown capability could have been damaged or lost

due to the same fire. (IR 2002010, 1999013, 2000009)
- 2 -

KEWAUNEE - FIRE PROTECTION - WHITE

As a follow-up to issues raised by the NRC during a triennial fire protection inspection (FPI), the

licensee determined that a fire area TU-95B (Safeguards Alley) was misclassified as having to

meet requirements of Section III.G.2 of 10 CFR Part 50, Appendix R. The fire area

should have been classified as having to meet requirements of Section III.G.3 and thus should

have had a fixed suppression system. As a result of failing to have a fixed fire suppression

system, there was a greater likelihood that a fire in fire area TU-95B would not be suppressed,

and redundant trains of cables and equipment required for safe shutdown could be damaged. 

The corresponding damage could require a shutdown of the plant from outside the control

room, significantly increasing the complexity of manual actions required to achieve safe

shutdown. (IR 2002006, 2003003, 2001002)

PALISADES - FIRE PROTECTION - WHITE

NRC inspectors identified that smoke detectors in the northwest portion of the cable spreading

room were not located and installed in accordance with the applicable National Fire Protection

Association (NFPA) code. The smoke detector located in that area was not adequately

evaluated to consider the effects of installed ventilation on the detector’s performance and

would not be able to quickly detect a fire. As a result of the inadequate detector placement,

detection of a fire in the northwest portion of the cable spreading room could be delayed and

sufficient cable damage could occur which would require a shutdown of the plant from outside

the control room, significantly increasing the complexity of manual actions required to achieve

safe shutdown. (IR 2002008, 2001008)

OCONEE - CORRECTIVE ACTIONS - WHITE

The NRC performed an in-office follow-up inspection on June 4, 2000, of Unresolved Item 

50-269,270,287/00-04-01, Lack of Reasonable Assurance That a High Pressure Injection (HPI)

Pump Could Operate for the Necessary Time Frame Using the Spent Fuel Pool (SFP) as the

Suction Source Following a Tornado. This follow-up inspection (documented in 

IR 50-269,270,287/00-11) resulted in the identification of a potential white finding. A violation of

10 CFR Part 50, Appendix B, Criterion III, “Design Control” (50-269,270,287/00-07-04), was

cited for Oconee’s failure to adequately consider design inputs to assure that the design bases

were translated into specifications, drawings, procedures, and instructions for the HPI system

using the SFP as a suction source following certain tornadoes. (IR 2001006)

TMI - CORRECTIVE ACTIONS - WHITE

The NRC inspectors identified that AmerGen had failed to consider all operability 

aspects of a significant oil leak on the A EFW pump (EF-P-2A) outboard pump bearing. 

Auxiliary operators and control room operators had noticed the increased oil condition

and had made a nonconservative operability determination that only considered standby pump

conditions. The NRC inspectors also identified an empty oil reservoir condition. (IR 2001014)
- 3 -

NINE MILE POINT - CORRECTIVE ACTIONS - WHITE

NRC inspectors identified a failure to evaluate significant conditions adverse to quality involving

degraded piping in the reactor building closed loop cooling (RBCLC) system. This failure

resulted in repetitive and continued degraded piping conditions in the RBCLC system. An

RBCLC system piping leak occurred due to significant pipe corrosion, primarily as a result of

inadequate piping design, application, and operation. Although numerous RBCLC system leaks

occurred during several preceding years, the cause for these leaks was not determined and

appropriate corrective actions were not implemented. This led to further degradation of the

RBCLC system piping such that additional significant leaks occurred. These leaks were

accompanied by a significant reduction in the pipe wall which degraded the structural integrity

of the affected piping sections. The degraded RBCLC piping increased the likelihood of the

loss of the RBCLC system which would result in the loss of cooling to several other 

risk-significant systems following a loss-of-coolant accident or a loss-of-all-AC-power event. 

(IR 2003003, 2003010)

OCONEE 1 - CORRECTIVE ACTIONS - WHITE

NRC inspectors identified that the licensee failed to promptly correct a condition adverse to

quality. The condition concerns an inability to align the station auxiliary service water (ASW)

pump to supply lake water to the steam generators within the 40 minutes required for mitigation

of a design basis tornado. During a simulator exercise, operators took over 60 minutes to align

the pump. The licensee then determined that procedures for aligning the station ASW pump to

mitigate a tornado were not adequate to ensure that the pump could be started and aligned

within sufficient time (40 minutes) to mitigate a design basis tornado event. NRC inspectors

identified that more than a year later, the licensee had not implemented corrective actions to

assure that operators could align the station ASW pump within 40 minutes. (IR 2001008,

2002007)

OCONEE 1 - CORRECTIVE ACTIONS - WHITE

NRC inspectors identified a potential flooding problem from non-safety-related fire

protection/HPSW lines in the auxiliary building (one system serves both high-pressure service

water and fire protection functions). The inspectors noted that the non-seismic 16-inch fire

system header that passed through the auxiliary building posed a potential problem to the

auxiliary building if the piping ruptured during a seismic event. Due to the design of the HPI

rooms, water from any flood in the auxiliary building would find its way into the HPI rooms via

the drain system. Penetrations between the HPI rooms and the LPI/RBS pump rooms

increased the likelihood that a flood in one room would affect more than one train of 

emergency core cooling system pumps and thus reduce the total amount of flooding 

necessary to affect the HPI and LPI/RBS pump rooms. (IR 2002013, 2000008)
- 4 -

OCONEE 3 - CORRECTIVE ACTIONS - WHITE

NRC inspectors identified a failure of the licensee to properly implement the vendor’s written

instructions for attaching electrical connectors on a pre-staged 4160 VAC emergency power

supply cable from the auxiliary service water switchgear to a high-pressure injection (HPI)

motor. The power supply cable would have been used to power the HPI pump motor following

the loss of the essential buses (normal AC electrical power supply) and the loss of the standby

shutdown facility function. Damaged electrical connectors were found while performing

maintenance activities. Had it been necessary to operate the pump during a high energy line

break or tornado event recovery, the cable connectors would have overheated and likely failed,

causing a loss in HPI pump function. Overheating would have been caused by the lack of

mating surfaces between the male and female ends of the connectors and the resulting higher

resistance for electrical current flow. Loose connectors would potentially impact the ability to

use the HPI pump during high energy line break and/or tornado event recovery. (IR 2003008,

2002015)

THREE MILE ISLAND - CORRECTIVE ACTIONS - WHITE

After noticing an empty oil reservoir condition, NRC inspectors identified that the licensee failed

to consider all operability aspects of a significant oil leak on a motor-driven emergency

feedwater pump outboard bearing. The oil leak was known by auxiliary operators to have

existed for more than 10 days before they initiated corrective actions to identify the cause. 

System engineers failed to investigate an unexplained step change in pump vibrations during

the most recent pump in-service test. The increased vibrations were later determined to be

directly related to the condition causing the oil loss. The oil loss and increased pump vibrations

resulted from loose cover bolts on the pump bearing housing. The bearing housing cover bolts

would have loosened sufficiently to cause increased pump vibrations and an oil leak of

sufficient magnitude to render the pump inoperable. This finding resulted in a single train of

emergency feedwater being inoperable for longer than the Technical Specification allowed

outage time. (IR 2001014, 2001002)

PRAIRIE ISLAND - NRC DESIGN INSPECTION - WHITE

During a Safety System Design and Performance Capability Inspection (SSDI), NRC

inspectors discovered that the original design and installation of the three safety-related deep

draft cooling water (service water) pumps failed to require safety-related electrical power for

the filter backwash system for the water source for bearing lubrication and cooling of the pump

drive shaft bearings. During a loss of offsite electrical power (LOOP), this could have resulted

in the clogging of the filters after a short time and inoperable cooling water pumps due to the

loss of shaft bearing lubrication water. In addition, a design change in 1977 inappropriately

reclassified the safety-related bearing lubricating water source for the pumps from safetyrelated to non-safety-related. This resulted in the installation of non-safety related bearing

lubrication water sources for the safety-related drive shaft bearings. The licensee declared all

three safety-related pumps inoperable since non-safety-related lubricating water systems

might not be available after a seismic event, a LOOP, and possibly other failures. (IR

2000013, 2001014, 2002003)
- 5 -

LICENSEE-IDENTIFIED FINDINGS

Of the two licensee-identified issues, one was identified as a result of extensive system

reviews conducted by the licensee during an extended shutdown, and one was identified as a

result of a proactive self-assessment. These findings are described below.

DAVIS-BESSE - YELLOW

During a 2002 refueling outage, the licensee determined that the existing amount of

unqualified containment coatings, uncontrolled fibrous material, and other debris inside

containment could have potentially blocked the emergency sump intake screen, rendering the

sump inoperable following a loss-of-coolant accident. With the emergency sump inoperable,

both independent emergency core cooling systems (ECCSs) and both containment spray (CS)

systems are inoperable, because both require suction from the emergency sump during the

recirculation phase of operation. This could prevent both trains of ECCS from removing

residual heat from the reactor and could prevent CS from removing heat and fission product

iodine from the containment atmosphere. Despite previous opportunities to identify and

correct this design control issue, the licensee failed to implement appropriate corrective

actions. This resulted in an actual loss of safety function of the ECCS system.

POINT BEACH - RED

The licensee probabilistic risk analysis (PRA) staff identified a vulnerability associated with the

auxiliary feedwater (AFW) recirculation valves. The recirculation valves were air-operated

valves which failed closed upon a loss of instrument air. Consequently, in certain transients,

such as a loss of instrument air, a loss of offsite power, a loss of service water, or a seismic

event, the flow path via the recirculation lines would be lost due to the recirculation valves

failing closed upon a loss of instrument air. Closure of the recirculation valves could result in

pump failure under low-flow conditions such as when AFW flow was throttled back to control

steam generator level or mitigate RCS overcooling. A common-mode failure of the AFW

pumps would result in substantially reduced mitigation capability for safely shutting down the

plant in response to certain transients; therefore, the issue was determined to have high safety

significance (red). (IR 2001017, 2003007)

SELF-REVEALING FINDINGS

Of the four self-revealing findings, three involved weaknesses in the licensee’s corrective

action program and one was a fire protection issue revealed during repair work. These

findings are described below.
- 6 -

D.C. COOK - CORRECTIVE ACTIONS - WHITE

The licensee failed to take prompt corrective actions to prevent a repetitive failure of a turbine

driven auxiliary feedwater pump (TDAFWP). On two occasions (about 5 months apart), the

pump failed due to the failure of the trip throttle valve latch mechanism to remain engaged

during pump start. The licensee concluded that the root cause of the repetitive failure was

incorrect machining of the trip throttle valve trip hook which resulted in inadequate alignment of

the trip hook and latching up lever faces. The pump failure resulted in the unavailability of a

train of auxiliary feedwater. (IR 2003004, 2002002, 2002005)

FERMI 2 - CORRECTIVE ACTIONS - WHITE

Approximately 12 hours into a routine 24-hour emergency diesel generator (EDG) surveillance

run, the EDG outboard bearing housing metal exhibited a high and rising temperature which

was sufficient to ignite the paint that covered the housing. An investigation into the EDG

outboard bearing failure revealed that the oil level in the bearing housing was below the

manufacturer-recommended minimum level. A previous modification (adding a stiffener plate

to the endbell of the generator housing of the EDG to reduce axial vibration) resulted in the oil

sight glass piping reference (tick) mark being lowered by 7/8 inch. As part of its root cause

analysis of this issue, the licensee identified several prior opportunities where this problem

could have been identified and corrected. (IR # 2001010)

POINT BEACH - CORRECTIVE ACTION - WHITE

A safety injection (SI) pump failed during monthly preventative maintenance bearing lubrication

activities. The failure was caused by gas binding from back-leakage of nitrogen-saturated

water from a reactor coolant system safety injection accumulator through two check valves. 

An auxiliary operator stationed locally in the vicinity of the SI pump noted a loud noise near the

end of the pump coastdown, observed excessive seal leakage, and perceived an acrid smell. 

Inspection of the pump revealed damage to the rotating element, the coupling and shaft keys

between the pump and the motor, the pump internal wearing rings, and other components. 

Despite multiple opportunities to have identified the effects of the leaking accumulator, the

licensee’s organization did not properly respond to adverse accumulator leakage trends or 

effectively use industry operating experience to prevent failure of the safety injection pump. 

The pump failure resulted in the inoperability of one train of the safety injection system. 

(IR 2002005, 2002012)

INDIAN POINT 2 - WHITE

Deficiencies were found in a concrete block wall located in the central control room (CCR) as

part of an initiative to reduce air in-leakage to the CCR and to improve HVAC system

performance. The wall was supposed to be constructed as a 3 hour rated fire barrier to

separate the control building from the turbine building. Passages through both the outer brick

and inner portions of the wall were identified when the licensee removed decorative interior

wall panels. If a significant amount of smoke and gas had penetrated the wall, the CCR could

have become inhabitable, causing the operators to resort to using the alternate safe shutdown

System. (IR # 2003010, 2002010)