On August 12, 2020, Pacific Gas and Electric Company (PG&E) filed an Exigent License Amendment Request (LAR) asking the NRC for permission to assess and repair suspected degraded pipes on Unit 1 while the plant continues to operate at full power. This procedure is in conflict with Technical Specifications. Unit 2's deteriorated pipes were discovered by happenstance and recently repaired while the plant was shut down to address an unrelated safety problem - excess hydrogen. Mothers for Peace strongly objects both to PG&E's request for a LAR and to the way the NRC is processing that request. The public was given less than 24 hours to provide comments, and documents were difficult to access. A routine comment period is 30 days. MFP attorney Diane Curran and expert David Lochbaum filed oppositional comments.

August 21, 2020

Jennifer Dixon-Herrity
U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001


SUBJECT: Comments on Proposed Determination of No Significant Hazards
For Diablo Canyon Nuclear Power Plant License Amendment Request

Dear Ms. Dixon-Herrity:

On behalf of San Luis Obispo Mothers for Peace, I am submitting comments on the proposed determination by the U.S. Nuclear Regulatory Commission (“NRC”) Staff that an exigent license amendment request (“LAR”) by Pacific Gas & Electric Company (“PG&E”) meets the NRC’s standards for a No Significant Hazards Determination, thereby justifying postponing a public hearing until after issuance and implementation of the license amendment request. The LAR seeks permission to disable auxiliary feedwater system for a longer period of time than permitted by the technical specifications for Diablo Canyon, for purposes of inspecting degraded conditions.

As discussed in the attached Declaration of David A. Lochbaum, PG&E’s LAR falls far short of satisfying the NRC’s standard for a No Significant Hazards Determination. Contrary to PG&E’s assertion, the proposed LAR would elevate the risk of an accident.

We also protest the extremely unfair manner in which you have conducted your review of the LAR, providing almost no public notice of your proposed action and failing to disclose relevant documents until the last minute. Your actions are all the more unacceptable because, as Mr. Lochbaum points out, the purported need for this LAR stems from PG&E’s own negligence in monitoring the condition of its AFW pipes.



Diane Curran Enclosures: As stated


August 21, 2020


In the matter of
Pacific Gas and Electric Company Docket Nos. 50-275-LAR Diablo Canyon Nuclear Power Plant 50-323-LAR Units 1 and 2


Under penalty of perjury, I, David A. Lochbaum, declare:

  1. My name is David A. Lochbaum. I reside in the state of Tennessee. I am a nuclear engineer by training, experience, and education.

  2. I retired in October 2018 from the Union of Concerned Scientists (UCS) after working nearly four decades on nuclear power issues. My experience includes assignments at/for operating nuclear plants (Hatch, Browns Ferry, Grand Gulf, Hope Creek, Susquehanna, FitzPatrick, Wolf Creek, Salem, Peach Bottom, and Connecticut Yankee), working for the U.S. Nuclear Regulatory as a reactor technology instructor, and working for (UCS) on nuclear power safety issues. I have a Bachelor of Science degree in nuclear engineering from the University of Tennessee. My professional qualifications are detailed in my attached Curriculum Vitae (Exhibit A).

  3. I have been retained by San Luis Obispo Mothers for Peace to evaluate an exigent license amendment request (LAR) by Pacific Gas & Electric Co. (PG&E) to the Nuclear Regulatory Commission (NRC) on August 12, 2020 (ML20225A303). If approved, the LAR would allow PG&E to remove portions of the auxiliary feedwater system (AFW) on Diablo Canyon Units 1 for longer periods of time than allowed under the current operating license should planned inspections of the AFW pipes indicate, as expected by PG&E, that walls have thinned to unacceptable thicknesses. If so, the thinned pipe sections would be replaced as they were on Unit 2 to restore the necessary safety levels.

  4. I have examined PG&E’s exigent LAR in detail.

I have also reviewed the following related documents:

a. Diablo Canyon Updated Final Safety Analysis Report Rev. 23, May 3, 2017 (ML17157B366);

b. §50.59 Changes, tests and experiments of Title 10 of the Code of Federal Regulations;

c. Bley, Dennis C, Wheeler, David M., Cate, Carroll L., Stillwell, Daniel W., and Garrick, B. John, “Reliability Analysis of Diablo Canyon Auxiliary Feedwater System,” September 1980. (ML17095A390);

d. NRC Inspection Manual, Inspection Procedure 49001, “Inspection of Erosion- Corrosion/Flow-Accelerated-Corrosion Monitoring Programs,” December 11, 1998;

e. Pacific Gas and Electric Company, “Diablo Canyon Power Plant Units 1 and 2 Technical Specification Bases,” Revision 10, December 2016 (ML16356A266);

f. Pacific Gas and Electric Company, Diablo Canyon Unit 1 Technical Specifications, January 2008;

g. Email dated August 18, 2020, to me from Scott Morris, NRC Regional Administrator, Region IV;

h. Pacific Gas and Electric Company, “Diablo Canyon Unit 1 Licensee Event Report 1-92-022-00, Indications on the Main Feedwater Piping Near the Steam Generator Nozzles due to Thermal Fatigue,” October 30, 1992 (ML16341G734);

i. NRC Information Notice 92-07, “Rapid Flow-Inducted Erosion/Corrosion of Feedwater Piping,” January 9, 1992 (ML082380388);

j. NRC Information Notice No. 91-18, “High-Energy Piping Failures Caused by Wall Thinning,” March 12, 1991 (ML031190529);

k. Pacific Gas and Electric Company, “Response to Generic Letter 89-08, Erosion/Corrosion,” July, 19, 1989 (ML16342C228);

l. NRC Generic Letter 89-08, “Erosion/Corrosion-Induced Pipe Wall Thinning,” May 2, 1989 (ML031200731);

m. Pacific Gas and Electric Company, “Response to NRC Bulletin No. 87-01, Thinning of Pipe Walls,” September 8, 1987 (ML17083B938);

n. NRC Bulletin No. 87-01, “Thinning of Pipe Walls in Nuclear Power Plants.” July 9, 1987 (ML031210862);

o. Pacific Gas and Electric Company, “Diablo Canyon Power Plant Units 1 and 2 Individual Plant Examination Report,” April 1992 (https://adamswebsearch2.nrc.gov/webSearch2/main.jsp?AccessionNumber=9204 240016);

p. Nuclear Regulatory Commission, “Final Significance Determination of a Red Finding, Notice of Violation, and Assessment Follow-up Letter (NRC Inspection Report No. 05000259/2011008) Browns Ferry Nuclear Plant,” May 9, 2011 (ML111290482);

q. Pacific Gas and Electric Company, “Response to NRC Request for Additional Information Regarding “License Amendment Request 20-01, Exigent Request for Revision to Technical Specification 3.7.5, “Auxiliary Feedwater System”,” August 16, 2020; and

r. Pacific Gas and Electric Company, “Response to NRC Request for Additional Information Regarding “License Amendment Request 20-01, Exigent Request for Revision to Technical Specification 3.7.5, “Auxiliary Feedwater System”,” August 18, 2020.

6. Having examined these documents, it is my professional opinion that PG&E’s exigent LAR should not be approved by the NRC because it would likely expose the community around Diablo Canyon Unit 1 to an unduly elevated accident risk. Therefore, I strongly disagree with PG&E’s and the Staff’s determinations that the proposed license amendment poses “no significant hazards.”

7. My expert opinion is based on the following reasons:

a. The “how safe is safe enough” question for the Unit 1 AFW system is defined by the technical specifications, an integral part of the reactor operating license issued by the NRC.

b. The current technical specifications permit Unit 1 to continue operating for up to 72 hours when one of the three AFW pumps is inoperable (except in the case of a steam supply problem for the one turbine-driven AFW pump). If the full complement of AFW pumps cannot be restored within 72 hours, the reactor must be shut down within 6 hours. If two AFW pumps are unavailable, the technical specifications require the reactor to be shut down within 6 hours. If all three AFW pumps are unavailable, the technical specifications require the reactor to be shut down immediately.

c. The time-frames in the technical specifications were not pulled from a hat; they depend on the safety function performed by systems and components and the likelihood that plant conditions would require the systems and components to function to prevent or mitigate the consequences.

d.The reason for the relatively short time-frames governing AFW components in the technical specifications is evident from risk analyses performed by PG&E for Diablo Canyon. Many of these risk analyses are hidden from public view by the NRC as purportedly security-related information, but PG&E’s Individual Plant Examination (IPE) from April 1992 is reasonably believed to still accurately portray the relative risk of the AFW system and the safety rationale for the associated timeliness requirements for AFW components in the technical specifications.

e. Figure 1 on page 12 below is Table 3.4.2-2 from PG&E’s IPE. It lists 29 initiating events having the highest calculated risk of reactor core damage. A handful (e.g., Medium Loss of Coolant Accident, Large Loss of Coolant Accident, Excessive Loss of Coolant Accident, Core Power Excursion, and Interfacing System Loss of Coolant Accident) are not mitigated by the AFW system. However, the AFW system has a safety function to perform in mitigating the rest of the 29 initiating events.

f. As shown in Figure 1, Loss of Offsite Power, the initiating event with the highest risk in PG&E’s IPE, contributes nearly half (41%) of the risk of reactor core damage at Diablo Canyon. The AFW system has a vital safety function to perform to mitigate this initiating event. The loss of offsite power inherently results in the loss of the main feedwater system. The AFW system is designed to automatically start in event the main feedwater system is unavailable. The turbine-drive AFW pump and/or the two motor-driven AFW pumps (which can be powered from the onsite emergency diesel generators when offsite power is lost) can continue to remove decay heat produced by the reactor core.

g. Figure 2 on page 13 below is Table 3.4.2-4 from PG&E’s IPE. It ranks safety systems at Diablo Canyon by their importance in preventing reactor core damage. The AFW system placed 6th on this list, ahead of Residual Heat Removal (RHR) Trains A and B, Emergency Diesel General 2-2, 125 volt bus G and many other systems and components. And note that these results assumed the out-of-service times for AFW components from the current technical specifications, not the significantly relaxed times sought by PG&E in its exigent LAR. With the longer times, the AFW system could only move higher on the risk list, not lower.

h. Figure 3 on page 14 below is Table 3.4.2-6 from PG&E’s IPE. It ranks safety systems at Diablo Canyon by two related risk measures: Risk Achievement Worth (RAW) and Risk Reduction Worth (RRW). The RAW values are determined by two computer runs, one assuming the system or component reliability based on operating experience and the second assuming the system or component has zero reliability (i.e., 100% chance it fails when needed). The RRW valves are also determined by two computer runs, but this time the second run assumes that the system or component has perfect reliability (i.e., 0% chance of failing when needed). The AFW system’s systems motor-driven and turbine-driven pumps occupy two of the top ten risk-rankings, 4th and 8th.

i. PG&E’s IPE considered common-cause failures that would prevent the AFW system from fulfilling its necessary safety function. But those common-cause failures were limited to failures of active components (e.g., check valves, dump valves, etc.).

j. The only common-cause failure of passive components (e.g., pipes, tanks, heat exchangers, etc.) in PG&E’s IPE affecting the AFW system was the rupture of a main feedwater or AFW pipe that flooded the AFW pump rooms and disabled both of the motor-driven AFW pumps. This potential flooding scenario was one of the three postulated internal flooding events having risk significance. PG&E’s no significant hazards analysis for the exigent LAR stated: “The AFW System is not an initiator of any design basis accident or event” – a statement apparently contrary to their own IPE’s analysis. See Initiating Event 21 on Figure 1 which is Table 3.4.2-2. PG&E’s description of this initiating event explained that rupture of either a main feedwater or an AFW pump could flood the AFW pump rooms and disable BOTH of the motor-driven AFW pumps. Yet PG&E’s no significant hazards analysis fails to explain how the technical specification changes it seeks will not adversely affect this initiating event.

k. Similarly, a third-party evaluation reported in September 1980 of the reliability of the AFW system at Diablo Canyon considered common-cause failures as factors in lessening the reliability of the system. As in PG&E’s IPE, this evaluation was limited to failures of active components to common-causes (e.g., inadequate maintenance, design errors, installation miscues, etc.). Thus, the increased likelihood of AFW system piping ruptures until its pipes thinned to unacceptable thicknesses are not modeled in the risk analyses. In other words, risk analyses that exclude consideration of pipe ruptures due to common-causes (i.e., thinning) cannot be used to justify continued reactor operation. The risk tool does not apply to the question being asked and therefore cannot provide a righteous answer.

l. Appendix 9.5A to the Updated Final Safety Analysis Report (UFSAR) for Diablo Canyon describes how the AFW system provides removal of reactor core decay heat in event of postulated fires in various Fire Areas throughout the plant. The fire hazards analyses that are summarized in the UFSAR were performed to fulfill Appendix R to 10 CFR 50 adopted in the early 1980s following the Browns Ferry fire. Unlike the response to other design bases events, the response to a postulated fire need not assume the worst-case single failure. Thus, while the AFW system has redundancy in terms of three pumps and four flow pathways to steam generators for decay heat removal, UFSAR Appendix 9.5A describes cases where the fire takes away all but a single AFW flow pathway. If NRC approves PG&E’s exigent LAR, that sole safety net could be removed for 7 days at a time as PG&E fixes up to four unsafe AFW flow pathways. PG&E’s no significant hazards analysis for the exigent LAR does not mention the potential impact on the fire hazards and safe shutdown analyses, which rely considerably if not entirely on AFW.

m. PG&E seeks the NRC’s approval to revise the answer to the “how safe is safe enough” question for the Unit 1 AFW system to allow portions of the system to unavailable for longer periods than currently permitted by the technical specifications, extending the current 72-hour time limit for one AFW pump to be unavailable to 7 days.

n. PG&E stated in their exigent LAR that they will inspect the Unit 1 AFW system piping and expect to find pipe walls thinned to less than allowed by the ASME code. If so, they propose to replace the unacceptably thinned pipe sections to restore the required safety levels. PG&E stated that, based on their experience replacing unacceptably thinned pipe sections on Unit 2, the safety restoration could take up to 7 days.

o. PG&E stated in their exigent LAR that they discovered a 3.9 gallon per minute leak from an AFW pipe on Unit 2 last month and discovered six other AFW pipe sections thinned to less than thicknesses allowed under the ASME code.

p. Following the rupture of a corroded or otherwise thinned pipe in December 1986 at the Surry nuclear power plant that killed four of the eight workers in the vicinity, the NRC required all nuclear plant owners to develop and implement monitoring programs to detect pipe wall thinning and replace sections before they thinned to unacceptable thicknesses. Not every inch of every pipe is monitored. Based on factors such as fluid flow rate, fluid temperature, fluid pressure, and pipe configuration (e.g., straight run versus pipe bend), vulnerable sections are monitored

q. The seven AFW pipe sections replaced on Unit 2 (i.e., the leaking section and the six other thinned locations) may or may not have been monitored under PG&E’s pipe monitoring program mandated by the NRC. If so, PG&E’s failure to adequately implement a monitoring program mandated many years ago by the NRC is insufficient justification for them to now be given longer time to remedy their self-inflicted cause.

r. NRC Region IV Administrator Scott Morris emailed me that the leakage on the Unit 2 AFW pipe was caused by external corrosion. By letter dated August 16, 2020, in response to NRC’s Request for Additional Information, PG&E identified the cause of the pipe degradation as being external corrosion from the highly corrosive coastal marine environment. PG&E stated that Unit 2 was subjected to higher corrosion due to localized weather patterns and noted that “Unit 2 has historically experienced more forced outages and consequently operated its 10 percent atmospheric steam dumps more frequently. The steam dump exhaust, being located above the AFW piping, results in a wet environment due to falling condensation. The other two trains (supplying SGs 3 and 4 for each unit) are located indoors.”

s. PG&E’s implication that the Unit 1 AFW piping will likely have less degradation due to milder marine coastal environmental conditions seems contrary to its exigent LAR. If PG&E’s implication was accurate, whenever they get around to conducing inspections on Unit 1 would confirm that notion. In that case, neither the pipe replacements nor the longer out-of-service times requested via the exigent LAR would be necessary. If, on the other hand, the Unit 1 AFW piping has degraded as much or more than that on Unit 2, the reactor’s operation with multiple AFW trains impaired is not justified. The Unit 1 piping should be replaced with the unit offline as was properly done on Unit 2.

t. By letter dated August 18, 2020, in response to NRC’s Request for Additional Information, PG&E explained its position that Unit 2 was subjected to a harsher marine coastal environment than Unit 1. PG&E stated that its “review of the Corrective Action Program identified on the order of twice as many condition reports documenting corrosion and coating on the Unit 2 pipe rack versus Unit 1.” In other words, PG&E had ample warnings that exposed piping on both units was degrading due to exposure to the corrosion marine coastal environment but took zero steps to prevent that identified degradation mechanism from compromising necessary safety margins until workers discovered the 3.9 gallon per minute leakage on Unit 2 in July 2020. As noted below where NRC sanctioned another plant owner for documenting but not resolving signs of problems, the NRC should neither tolerate nor facilitate such abysmal licensee performance.

u. PG&E identified seven sections of Unit 2 AFW piping with thicknesses less than allowed by the ASME code. The identifications led PG&E to replace the thinned sections before restarting Unit 2.

v. PG&E strongly suspects that sections of the Unit 1 AFW piping will also be thinner than allowed by the ASME safety code, requiring replacement to restore the necessary safety levels. PG&E seeks the NRC’s permission to fix this safety problem on Unit 1 while Unit 1 continues to operate — something they recently opted NOT to do when the problem was found on Unit 2.

w. Whether caused internally (i.e., thinning due to erosion/corrosion) or externally (i.e., exposure to corrosive agents), PG&E’s current aging monitoring program for AFW system piping is demonstrably inadequate. If thinned internally to less than thicknesses allowed by the ASME code, the NRC-mandated monitoring program failed to detect and correct this slowly developing condition until thicknesses dropped below acceptable levels. If thinned due to external corrosion, a failure mode not anticipated by and therefore not adequately managed by the AFW system aging management program is involved.

x. In its exigent LAR and in other publicly available records, PG&E has not explained how the degradation resulting in AFW system being thinned to unsafe thicknesses will be prevented in the future by either a revision to its pipe wall thickness monitoring program and/or the development of a new program to monitor for external corrosion degradation. Absent such discussion, the efficacy of merely replacing the pipes cannot be judged. The erosion/corrosion monitoring programs mandated by the NRC protect against internal degradation, but PG&E contends that the current degradation mechanism is external corrosion from the marine coastal environment. Just as PG&E has a formal monitoring program for internal pipe degradation, a comprehensive corrective action for external pipe degradation necessitates a comparable monitoring program. PG&E has failed to describe such a program as part of its corrective actions for this safety impairment.

y. The situation on Diablo Canyon Unit 1 mirrors the situation NRC uncovered at the Tennessee Valley Authority’s Browns Ferry Nuclear Plant (see May 9, 2011, NRC Red Finding letter). The disc of a valve in the Residual Heat Removal (RHR) system separated from its stem. The reactor operated for several years with this degraded condition. TVA periodically tested the valve by stroking it opened and closed. But whilst the stem moved here and there, the disc did not. TVA contended that the valve’s failure was unforeseen and the NRC could not blame them for not having found and fixed it sooner. The NRC disagreed. TVA contended that had an emergency happened, workers would have quickly noticed that the valve was not positioned properly and found means to force the valve to its proper position. The NRC disagreed. TVA contended that even if the valve remained in the wrong position, there were redundant trains available to perform the necessary safety function. The NRC disagreed, pointing out that TVA took credit for this valve and associated RHR train in mitigating fires in certain Fire Areas. While there were indeed redundant trains for non-fire events, this valve and its train were the only safety net protecting against fires in certain Fire Areas. This reality led NRC to push the overall risk of this deficiency into the Red zone – a space occupied by a handful of reactors over the 20 years of the NRC’s Reactor Oversight Process’s color-coding.

z. Appendix 9.5A to the UFSAR for Diablo Canyon describes how the AFW system performs roles during postulated fires in many Fire Areas, without backup. PG&E’s exigent LAR was silent with regard to how the fire hazard would be properly managed during the proposed extended AFW system impairments.

aa. The current technical specifications for AFW system component unavailability were developed based on the safety function to be performed during design bases events and the likelihood that such events occur. PG&E repaired multiple sections of AFW piping on Unit 2 and anticipates needing to do so on Unit 1, hence the submittal of the exigent LAR seeking longer time to implement the overdue replacements.

bb. If the Unit 1 AFW system currently has pipe sections thinned to unacceptable thicknesses in multiple pathways, they could be in condition that warrants immediate shutdown of the reactor for safety reasons — Technical Specification LCO 3.7.5 Condition C. NRC must not allow PG&E to pretend that only one AFW train at a time is impaired when it has such ample grounds to suspect a larger problem.

cc. Had PG&E shut down Unit 1 on August 12, 2020, instead of asking NRC’s approval for an online repair effort, workers could have inspected and repaired AFW trains in parallel rather than in series as proposed. IF PG&E is correct in estimating that repairs take up to seven days, they’d have fixed all AFW system piping by now and could safety restart the Unit.

I declare under penalty of perjury that the foregoing facts are true and correct to the best of my knowledge, and the foregoing opinions are based on my best professional judgement.

Executed August 21, 2020

David A. Lochbaum

AFW background information (also below)

During normal reactor operation, three loops transfer the heat generated by the reactor core to the Pacific Ocean, producing electricity along the way. The primary loop, shown in red in the center of the graphic, consists of the reactor vessel, the four steam generators, the reactor coolant pumps, and connecting piping. Water heated flowing through the reactor core flows to the steam generators. As this water flows inside thousands of metal tubes inside the steam generators, heat conducts through the metal walls to boil water in the secondary loop. The cooled water leaves the steam generators and gets pumped back to the reactor vessel.

The secondary loop consists of the four steam generators, the main turbine/generator, the condenser, and the feedwater pumps. Steam produced in the steam generators flows into the turbine to spin the generator and make electricity. Steam exhausts from the turbine into the condenser. Thousands of metal tubes pass ocean water through the condenser to cool the steam down and convert it back into water. The feedwater pumps draw water from the condenser and recycles it to the steam generators.

The tertiary loop features pumps (not shown in the graphic) that draw water from the Pacific Ocean and send it through metal tubes within the condenser. The water, warmed up to 30°F flowing through the condenser, is discharged back into the ocean.

The feedwater system is not designed to withstand an earthquake or to operate if the plant’s connection to the offsite power grid is lost. The Auxiliary Feedwater (AFW) system is its emergency backup. Three AFW pumps can transfer water from either of two large storage tanks to the steam generators so heat from the reactor can continue to be removed.

The AFW system also performs this vital role in case of an accident. Should a primary loop pipe break and drain reactor coolant water into the containment building, the emergency systems shown on the left side of the graphic will automatically start and provide makeup water to the reactor vessel. The AFW system supplements this makeup cooling water function by continuing to remove heat from the primary loop via the steam generators.

The AFW system serves a safety function during many transient and accident scenarios. About the only emergency conditions in which the AFW system has little to no role to play involve medium or large sized loss of coolant accidents. If a medium or large pipe in the primary loop were to break, water would flow from its broken ends at such a high rate that while the emergency systems on the left can provide adequate makeup flow to the vessel to keep the reactor core covered and cooled, they may be unable to keep the entire primary loop filled with water. If primary loop water does not flow through the steam generators, the AFW system cannot remove its heat.

In medium and large sized loss of coolant accidents, the emergency systems will provide makeup water to the reactor vessel. The containment spray system, with nozzles mounted to the roof of the containment building car-wash style, will spray water into the containment to cool the primary loop water now pooling on the containment floor.

Because it plays a vital role in all but a few potential emergencies, the AFW system is one of the most important safety systems in the plant. The operating license issued by the NRC for Diablo Canyon allows the reactor to continue operating for up to 72 hours if one of its three AFW pumps is unavailable. If two of the three AFW pumps are unavailable, the reactor can continue operating for up to 6 hours. If all three AFW pumps are unavailable, the reactor must be shut down immediately.                     

Dave Lochbaum, August 2020