IR 05000286/2007006

IR 05000286-07-006, on 10/01/2007 - 12/18/2007; Indian Point Nuclear Generating Unit 3; Component Design Bases Inspection

ML080320244
Person / Time
Site:	Indian Point
Issue date:	02/01/2008
From:	Doerflein L Engineering Region 1 Branch 2
To:	Joseph E Pollock Entergy Nuclear Operations
References
FOIA/PA-2011-0258 IR-07-006
Download: ML080320244 (58)

Text

ary 1, 2008

SUBJECT:

INDIAN POINT NUCLEAR GENERATING UNIT 3 - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000286/2007006

Dear Mr. Pollock:

On December 18, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection of Indian Point Nuclear Generating Unit 3. The preliminary inspection results were discussed with Messrs. P. Conroy and T. Orlando and other members of your staff at the completion of the on-site inspection activities on November 8, 2007. Following in-office reviews of additional information, the final results of the inspection were provided by telephone to Messrs. P. Conroy and T. Orlando on December 18, 2007, and to Mr. P. Conroy on January 29, 2008. The enclosed inspection report documents the inspection results.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

This particular inspection was performed by a team of NRC inspectors and contractors using NRC Inspection Procedure 71111.21, Component Design Bases Inspection. In conducting the inspection, the team examined the adequacy of selected components and operator actions to mitigate postulated transients, initiating events, and design basis accidents. The inspection also reviewed Entergys response to selected operating experience issues. The inspection involved field walkdowns, examination of selected procedures, calculations and records, and interviews with station personnel.

This report documents six NRC-identified findings that were of very low safety significance (Green). Five of these findings were determined to involve violations of NRC requirements.

However, because of the very low safety significance of the violations and because they were entered into your corrective action program, the NRC is treating the violations as non-cited violations (NCV) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspectors at Indian Point Unit 3. In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Lawrence T. Doerflein, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-286 License No. DPR-64

Enclosure:

Inspection Report 05000286/2007006 In a

REGION I==

Docket No. 50-286 License No. DPR-64 Report No. 05000286/2007006 Licensee: Entergy Nuclear Northeast Facility: Indian Point Nuclear Generating Unit 3 Location: 450 Broadway, GSB Buchanan, NY 10511-0308 Dates: October 1 to November 8, 2007 (on site)

November 13 to December 18, 2007 (in-office)

Inspectors: L. Scholl, Senior Reactor Inspector (Team Leader)

S. Pindale, Senior Reactor Inspector J. Richmond, Senior Reactor Inspector G. Ottenberg, Reactor Inspector T. Sicola, Reactor Inspector O. Mazzoni, NRC Instrumentation and Controls Contractor S. Kobylarz, NRC Electrical Contractor W. Sherbin, NRC Mechanical Contractor Approved by: Lawrence T. Doerflein, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY

During the period from October 1 through November 8, 2007, the U.S. Nuclear Regulatory

Commission (NRC) conducted a team inspection at the Indian Point Nuclear Generating Unit 3 (IP-3) in accordance Inspection Procedure 71111.21, Component Design Bases Inspection.

The inspection involved four weeks of on-site effort. Additional in-office reviews of information were also conducted through December 18, 2007. The inspection procedure is conducted as part of the NRCs Reactor Oversight Process (ROP).1 The objective of the inspection was to verify that the IP-3 design bases had been correctly implemented for selected risk-significant components, and that operating procedures and operator actions were consistent with the design and licensing bases. This was to ensure that the selected components were capable of performing their intended safety functions and could support the proper operation of the associated systems. The inspection team consisted of eight inspectors, including a team leader and four inspectors from the NRCs Region I Office, and three contractors.

The team selected twenty components for a detailed design review after completing a detailed, risk based selection process. In selecting samples for review, the team focused on those components and operator actions that have a high relative contribution to the risk of a postulated core damage accident if the component was to fail or if the operator did not successfully complete the action. The team also assessed available margin for the risk-significant components in selecting the samples. The selected samples included components in the safety injection (SI), residual heat removal (RHR), auxiliary feedwater (AFW), service water (SW), main steam (MS), onsite electrical power, and off-site electrical power systems. The team selected five risk-significant operator actions for review using the complexity of the action, time to complete the action, and extent of training on the action as inputs. The team also selected six operating experience issues related to the selected components or generic issues to verify they had been appropriately assessed and dispositioned. For each sample selected, the team reviewed design calculations, corrective action reports, maintenance and modification histories, and associated operating and testing procedures. The team also performed walkdowns of the accessible components to assess their material condition.

Overall, the inspection team determined that the components reviewed were capable of performing their intended safety functions. The team also found that the operating procedures, operator training and equipment staging adequately supported completion of the operator actions and were consistent with the design and licensing bases. The team did identify six findings of very low safety significance (Green) and one unresolved item. The six findings are listed in the Summary of Findings section of this report. The team assessed the safety significance of each of the findings using the NRCs Significance Determination Process (SDP).2 Also, for each of the findings where current operability was a relevant question, Entergy completed an operability evaluation. In each case, Entergy determined the equipment was operable. The inspection team independently confirmed Entergys conclusions. All of the findings were entered into Entergys corrective action program to ensure a more comprehensive assessment of the issue and to identify and implement appropriate corrective actions.

Described in NRCs Inspection Manual Chapter 0308, Reactor Oversight Process

Described in NRCs Inspection Manual Chapter 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations iv

Under the NRCs Reactor Oversight Process, findings of very low safety significance (Green)are addressed through the facilitys corrective action program. Future NRC inspections, most notably the biennial Problem Identification and Resolution (PI&R) team Inspection, review a substantial sample of Entergys response to the Green findings and assess the adequacy of the actions taken to correct the deficiencies.

The findings are also an input into the NRCs assessment process.3 The most recent assessment of IP-3 issued on August 31, 2007 (ADAMS Ref. ML072430942), concluded that the plants performance was in the Regulatory Response Column of the NRCs Action Matrix based on one White performance indicator in the Initiating Events cornerstone. Subsequently,

IP-3 performance transitioned back to the Licensee Response Column when the PI returned to the Green band at the end of the third quarter of 2007. Because the findings of this Component Design Bases Inspection were all Green, the NRCs overall assessment of IP-3 will not change from the Licensee Response Column as a result of this inspection. The recent assessment also discussed an existing substantive cross-cutting issue in the area of human performance regarding procedure adequacy. The Reactor Oversight Process considers that the areas of human performance, problem identification and resolution and safety conscious work environment, contain performance attributes that extend across (cross-cut) all areas of reactor plant operation. As noted in the inspection report, two of the findings had a cross-cutting aspect. As part of the assessment process, the NRC performs a collective review semi-annually of cross-cutting aspects of all inspection results from the previous twelve months, and monitors and evaluates a plant licensees actions to address a substantive cross-cutting issue.

This inspection is a key part of NRCs inspection effort to assure overall plant safety, protection of the public and the environment, and efficacy of key plant design features and procedures.

Many other NRC inspection and review activities are also important to NRCs role of ensuring safety. More detail is provided in the NRCs description of the Reactor Oversight Process at http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/index.html. A similar inspection was completed for the Indian Point Nuclear Generating Unit 2 on February 15, 2007 (ADAMS Ref.

ML070890270).

As described in Inspection Manual Chapter 0305, Operating Reactor Assessment Program v

SUMMARY OF FINDINGS IR 05000286/2007-006; 10/01/2007 - 12/18/2007; Indian Point Nuclear Generating Unit 3;

Component Design Bases Inspection.

This inspection covers the Component Design Bases Inspection, conducted by a team of five NRC inspectors and three NRC contractors. Six findings of very low safety significance (Green)were identified, five of which involved a violation of regulatory requirements and were considered to be non-cited violations. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609, Significance Determination Process (SDP).

Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very low significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, in that Entergy did not use an adequate methodology to determine if the residual heat removal pump discharge header isolation valve (AC-MOV-744) was susceptible to the pressure locking phenomenon. Additionally, the operation of the isolation valve seal water system (IVSWS) was not included in either the pressure locking analysis or actuator capability calculations. In response, Entergy performed a calculation using an appropriate methodology and as-found leak test results and determined that the valve would not pressure lock. Entergy also performed a calculation which verified that the valve actuator had sufficient margin to overcome the pressure applied by the IVSWS. Entergy entered these performance deficiencies into their corrective action program for longer term resolution.

The finding is more than minor because the methodology and calculation deficiencies represented reasonable doubt regarding the operability of the AC-MOV-744 valve, even though the valve was ultimately shown to be operable. The finding is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of valve operability. (Section 1R21.2.1.2)

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," in that Entergy had not verified the adequacy of design for the turbine driven auxiliary feedwater (TDAFW) pump. Specifically, the pump hydraulic analysis was non-conservative, but was used to verify adequacy of surveillance test acceptance criteria for pump minimum vi

discharge pressure. Entergy subsequently verified that the pump remained operable and entered the finding into their corrective action program to revise the system analysis.

The finding is more than minor because the design analysis deficiency resulted in a condition where there was reasonable doubt regarding TDAFW pump operability. The finding was associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609,

Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of pump operability. The finding had a cross-cutting aspect in the Problem Identification and Resolution area, because Entergy did not thoroughly evaluate a similar problem, such that the extent of condition adequately considered and resolved the cause. (IMC 0305, aspect P.1(c)) (Section 1R21.2.1.6)

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," in that Entergy did not ensure a change to the design basis was correctly translated into maintenance procedures. Specifically, a modification replaced the control element in the emergency diesel generator (EDG) jacket water temperature control valves, with a control element with a higher setpoint, to support EDG operation at a higher service water temperature.

Subsequently, using the uncorrected procedure, maintenance technicians re-installed elements with the lower setpoint. Entergy subsequently verified that the EDGs remained operable and entered the finding into their corrective action program to revise the maintenance procedure and replace the temperature control elements.

The finding is more than minor because the failure to update the maintenance procedure resulted in a diesel engine configuration different than that required to operate at maximum design cooling water specifications. The finding was associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of EDG operability. (Section 1R21.2.1.7)

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, in that measures had not been established to verify the proper component operating voltage requirements for battery sizing calculations. Specifically, the battery calculations did not properly verify that the minimum voltage needed to operate four-pole Agastat 7000 series timing relays would be available. Entergy reviewed the most recent battery discharge tests to ensure the error did not impact battery or relay operability and entered the issue into the corrective action program to resolve the calculation errors.

vii

The finding is more than minor because it is associated with the design control attribute of the Mitigating System cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of battery or relay operability. (Section 1R21.2.1.11)

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, in that Entergy did not ensure that design inputs in the EDG load analysis were conservative. As a result, capacity testing for EDG 32 was not sufficient to envelope the design basis load requirement at the maximum frequency limit allowed by Technical Specifications.

Entergy reviewed the calculation errors and determined EDG operability was not affected and entered the issues into the corrective action program to resolve the calculation errors.

The finding is more than minor because it is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of EDG operability. (Section 1R21.2.1.13)

Green.

The team identified a finding of very low safety significance involving the failure to perform a transformer bushing power factor (Doble) test within Entergy, vendor, or industry recommended frequencies. Entergy had not performed this test on the station auxiliary transformer (SAT) bushings since 1999, and had re-scheduled a 2007 test for 2009. Specifically, a ten year interval between tests significantly exceeds Entergys maintenance procedure specification to perform testing every 4 years as well as the bushing manufacturer and industry recommended test frequencies. Additionally,

Entergy did not provide an appropriate technical bases for deferring the test beyond the normal interval. Entergy evaluated the 1999 test results and the SAT's current operating history, concluded the SAT remained operable, and entered this condition into the corrective action program.

The finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 screening and determined the finding was of very low safety significance because it was not a design or qualification deficiency, did not result in an actual loss of safety function, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. The finding had a cross-cutting aspect in the Human Performance -

Work Control area, because Entergy had not adequately considered risk insights, job viii site conditions (i.e., outside work during winter) did not support the test activity, and there was no planned contingency if the work could not be accomplished within its scheduled work window. (IMC 0305, aspect H.3(a)) (Section 1R21.2.1.14)

Licensee-Identified Violations

None ix

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R21 Component Design Bases Inspection (IP 71111.21)

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the Indian Point 3 Probabilistic Risk Assessment (PRA) and the Nuclear Regulatory Commissions (NRC) Standardized Plant Analysis Risk (SPAR)model. Additionally, the Indian Point 3 Significance Determination Process (SDP)

Phase 2 Notebook, Revision 2, was referenced in the selection of potential components and actions for review. In general, the selection process focused on components and operator actions that had a risk achievement worth (RAW)1 factor greater than 2.0 or a Risk Reduction Worth (RRW)2 factor greater than 1.005. The components selected were located within both safety related and non-safety related systems, and included a variety of components such as pumps, valves, diesel generators, transformers, batteries and electrical buses.

The team initially compiled an extensive list of components based on the risk factors previously mentioned. The team performed a margin assessment to narrow the focus of the inspection to 20 components and five operator actions. The teams evaluation of possible low design margin considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition/equipment reliability issues. The margin assessment evaluated the impact of licensing basis changes that could reduce safety analysis margins. The assessment also included items such as failed performance test results, corrective action history, repeated maintenance, maintenance rule (a)(1) status, operability reviews for degraded conditions, NRC resident inspector input of equipment problems, plant personnel input of equipment issues, system health reports and industry operating experience.

Consideration was also given to the uniqueness and complexity of the design and the available defense-in-depth margins. The margin review of operator actions included complexity of the action, time to complete action, and extent of training on the action.

This inspection effort included walk-downs of selected components, a review of selected simulator scenarios, interviews with operators, system engineers and design engineers, and reviews of associated design documents and calculations to assess the adequacy of the components to meet both design basis and risk informed beyond design basis requirements. A summary of the reviews performed for each component, operator action, operating experience sample, and the specific inspection findings identified are RAW is the factor by which the plants core damage frequency increases if the component or operator action is assumed to fail.

RRW is the factor by which the plants core damage frequency decreases if the component or operator action is assumed to be successful.

discussed in the following sections of the report. Documents reviewed for this inspection are listed in the Attachment.

.2.1.1 No. 33 Safety Injection Pump

a. Inspection Scope

The team reviewed design basis documents, including hydraulic calculations, technical specifications, accident analyses and drawings to verify that the safety injection (SI)pump was capable of meeting system functional and design basis requirements. The refueling water storage tank (RWST) level setpoints and uncertainty calculations were also reviewed because the RWST is the water source for the SI pump during the injection phase of a postulated accident. The team also reviewed SI pump surveillance test results, system health reports, and corrective action documents to determine whether SI pump design margins were adequately maintained and to verify that Entergy entered problems that could affect system performance into their corrective action program. The team reviewed operating and emergency operating procedures to assess whether sufficient RWST inventory existed to inject water into the reactor vessel during a postulated accident, and to verify whether pump suction swap-over occurred before the onset of vortexing at the RWST outlet piping. To assess the general condition of the pump, the team performed walkdowns of the SI pump area. The team also reviewed SI pump and motor cooling systems and SI pump minimum flow requirements to assess the ability of the SI pump to operate under design basis conditions.

b. Findings

No findings of significance were identified.

.2.1.2 Residual Heat Removal Pump Discharge Header Isolation Valve (AC-MOV-744)

a. Inspection Scope

The team selected the residual heat removal (RHR) pump discharge header isolation motor operated valve (MOV), AC-MOV-744, as a representative high risk MOV sample.

The team reviewed calculations, procedures, leakage test results and technical reports to verify the valves capability to perform during postulated design basis accident conditions. The team also interviewed engineers and reviewed correspondence related to NRC Generic Letter 95-07, Pressure Locking and Thermal Binding of Safety-Related Power-Operated Gate Valves, to verify that Entergy was meeting its commitments to ensure the valve would not be susceptible to the pressure locking or thermal binding phenomena. Analysis methodology reports were reviewed to determine if appropriate inputs were being used to support the conclusion that the valve was not susceptible to pressure locking. Corrective action reports and preventive maintenance work orders were reviewed in order to assess the performance and operational history of the valve.

b. Findings

Introduction:

The team identified a finding of very low significance (Green) involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, in that Entergy did not use an adequate methodology to determine if AC-MOV-744 was susceptible to the pressure locking phenomenon. Additionally, the operation of the isolation valve seal water system (IVSWS) was not included in either the pressure locking analysis or actuator capability calculations.

Description:

The team found that Entergy used an inadequate methodology to determine if valve AC-MOV-744 was susceptible to pressure locking. Specifically, Entergy used an incorrect and non-conservative valve bonnet depressurization rate, which was based on a generic Westinghouse report (ESBU/WOG-96-022) that credited leakage from the valve bonnet past the valve seats and past the stem packing, to verify that the valve bonnet would not pressurize under postulated design basis conditions due to thermal inputs. This depressurization rate was inappropriately used in conjunction with a pressurization rate from another Westinghouse report (V-EC-1620) which also credited leakage from the bonnet. Additionally, the calculation used to determine the temperature change of the water in the bonnet post-accident did not include heat inputs due to conduction from the downstream piping and from the valve yoke and actuator.

The team also determined that the IVSWS could be actuated during a postulated design basis accident, after long term recirculation flow is established using the internal recirculation system. The IVSWS uses pressurized nitrogen applied to the bonnet of AC-MOV-744 in order to reduce leakage from containment following a loss-of-coolant accident (LOCA). Following establishment of internal recirculation flow and a postulated passive failure of the internal recirculation discharge header, AC-MOV-744 would have to reopen against the pressure applied by the IVSWS in order for long term recirculation flow to be established using the RHR system. Neither valve capability calculations nor the pressure locking analysis accounted for actuation of the IVSWS.

In response to this issue, Entergy performed a calculation using an appropriate methodology and used as-found leakage test results to determine that the valve would not become pressure locked. Entergy also performed a calculation to show that the valve actuator had sufficient margin to overcome the pressure applied by the IVSWS.

Entergys immediate corrective actions included performing the calculations discussed above and performing the associated operability determinations. The team reviewed the calculations and operability assessments for the pressure locking and IVSWS issues and found them to be acceptable. The team verified that the deficiencies did not impact the operability of the valve. Entergy entered these performance deficiencies into their corrective action program for longer term resolution.

Analysis:

The team determined that Entergys failure to use a correct methodology when evaluating AC-MOV-744 for pressure locking represented a performance deficiency that was reasonably within Entergys ability to foresee and prevent.

Specifically, Entergy did not use a correct methodology when evaluating the valve for thermally induced pressure locking, nor did Entergy include the potential actuation of the IVSWS in the evaluation or design inputs for the valve.

The finding was more than minor because it was similar to NRC Inspection Manual Chapter 0612, Appendix E, Examples of Minor Issues, Example 3.j, in that the methodology and calculation deficiencies represented reasonable doubt regarding the operability of AC-MOV-744. The finding was associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 SDP screening3 and determined the finding was of very low safety significance (Green) because it was a design deficiency that was confirmed not to result in a loss of AC-MOV-744 operability.

Enforcement:

10 CFR 50 Appendix B, Criterion III, Design Control, requires, in part, that measures shall provide for verifying or checking the adequacy of design. Contrary to the above, as of November 8, 2007, Entergys design control measures were not adequate to verify the adequacy of the design of the RHR pump discharge header isolation valve (AC-MOV-744). Specifically, Entergy did not use an appropriate methodology to evaluate the potential for pressure locking of valve AC-MOV-744.

Because this violation is of very low safety significance and has been entered into Entergys corrective action program (CR-IP3-2007-04204 and CR-IP3-2007-04217), this violation is being treated as a non-cited violation consistent with Section VI.A.1. of the NRC Enforcement Policy. (NCV 05000286/2007006-01, Inadequate Pressure Locking Methodology Used to Ensure Valve Operability)

.2.1.3 Service Water Pump 31

a. Inspection Scope

The team evaluated the service water (SW) pump and strainer to verify that the pump and strainer performance satisfied design basis flow rate requirements during postulated transient and accident conditions, and to assess the potential for common cause failure of the pumps or strainers. To determine design basis performance requirements and operational limitations, the team reviewed design basis documents including SW system hydraulic models and flow balance studies, calculations, operating instructions and procedures, system drawings, surveillance tests, and modifications. The team verified that design requirements and operational limits were properly translated into operating instructions, and procedures. Surveillance test results were reviewed to determine Subsequent to the inspection, the Phase 1 screening process remained unchanged but was moved from IMC0609, Appendix A, to IMC0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings.

whether established test acceptance criteria were satisfied. The acceptance criteria were compared to design basis assumptions and requirements to verify there were adequate margins for allowable pump degradation limits, strainer clogging affects, and available net positive suction head (NPSH) to ensure actual pump and strainer performance would be satisfactory during transient and accident conditions. In addition, the team walked down the SW pump house and strainer areas, interviewed system and design engineers, and reviewed system health reports and selected condition reports to assess the current material condition of the pumps and strainers.

b. Findings

No findings of significance were identified.

.2.1.4 Recirculation Pump 32

a. Inspection Scope

The team evaluated the recirculation pump to verify that pump performance, during postulated accident conditions, would satisfy design basis head and flow rate requirements, and to assess the potential for common cause failure of the recirculation pumps. To determine design basis performance requirements and operational limitations, the team reviewed design basis documents including NPSH analysis, certified pump curves, technical specifications, accident analysis, and system and vendor drawings. The team assessed whether the licensee adequately translated design requirements and operational limits into operating instructions, procedures, and emergency operating procedures. Post modification and surveillance test results were reviewed to determine whether established test acceptance criteria were satisfied. The acceptance criteria were compared to design basis assumptions and requirements to determine there were adequate margins for allowable pump degradation limits, minimum pump flow, and available NPSH, to ensure actual pump performance would be satisfactory during accident conditions. In addition, the team interviewed design engineers, system engineers and licensed operators, and reviewed selected condition reports to identify any potential adverse conditions or trends.

b. Findings

Inadequate Design Control of Recirculation Pumps The team identified an unresolved item concerning the adequacy of design control associated with a modification that replaced both internal recirculation pumps in March 2007. Specifically, Entergy did not evaluate or determine the minimum flow requirements for the new pumps and did not evaluate or determine whether the new pumps would be susceptible to strong-pump to weak-pump interactions, when operated in parallel.

Background The recirculation pump portion of the low-head safety injection system consists of two pumps, located in primary containment, that take suction from a containment sump and discharge into a common discharge header. Each recirculation pump has a 3/4 inch minimum flow line upstream of the pump discharge check valve and the two pumps share a 2 inch minimum flow line on the common discharge header. All three minimum flow lines return to the containment sump. Emergency operating procedure (EOP)

ES-1.3, Transfer to Cold Leg Recirculation, directed operators to sequentially start both recirculation pumps during the recirculation phase of a loss-of-coolant accident (LOCA).

Strong-pump to Weak-pump Interaction NRC Bulletin 88-04, "Safety-Related Pump Loss," documented industry operating experience regarding design deficiencies where the weaker centrifugal pump (i.e., lower discharge head at same flow rate) could be dead-headed under low flow conditions when operated in parallel with a stronger pump (i.e., higher discharge head at same flow rate), if both pumps shared a common minimum flow line.

Letter IP3-89-036, dated May 12, 1989, provided the licensees Bulletin 88-04 response to the NRC. The licensee stated that although the recirculation pumps shared a common minimum flow line, the potential for a stronger pump to dead-head a weaker pump did not exist. The basis, in part, was that having the individual pump minimum flow lines upstream of the pump discharge check valve would ensure flow through the pump even if the stronger pump would cause the discharge check valve on the weaker pump to close. The licensee also credited the EOPs with preventing the weak pump from becoming dead-headed because they assumed that by the time the EOPs directed starting of the second pump, flow to the reactor core would be sufficient to allow both pumps to operate at a point on their head verses flow curves where there was adequate flow for both pumps.

The team's review of the recirculation pump curves identified that the No. 32 recirculation pump had about 10 psi higher discharge head, under low flow conditions, than the No. 31 recirculation pump. The team determined that the No. 31 recirculation pump would likely be susceptible to dead-heading if both pumps were operated in parallel, as required by procedure ES-1.3, and at a low system flow rate, which might be encountered during certain small break LOCAs, such as high head recirculation. The team noted that the system valve line-up required the 3/4 inch minimum flow valve to be throttled to 1.5 turns open, resulting in very low flow through these lines. The most recent surveillance test results recorded the as-found flows as approximately zero (No. 31 pump was 0.1 gpm, No. 32 pump was 7 gpm). The team also identified that Entergy had not assessed the new recirculation pumps for strong-pump to weak-pump interactions.

The team concluded that Entergy had not verified the design adequacy for the new recirculation pumps for strong-pump to weak-pump interaction. In addition, the previous engineering evaluation for recirculation pump strong-pump to weak-pump interaction appeared to be inconsistent with a small break LOCA accident analysis and with the throttled configuration of the 3/4 inch minimum flow line. Entergy preliminarily determined the weaker pump was only susceptible to dead-heading during high head recirculation (e.g., other small break LOCA scenarios would not result in weak pump dead-heading). Entergy entered this issue into their corrective action program as CR-IP3-2007-04212. As an immediate corrective action, Entergy revised EOPs 3-ES-1.3, Transfer to Cold Leg Recirculation, and 3-ES-1.4, Transfer to Hot Leg Recirculation, to not start the second recirculation pump during high head recirculation.

Minimum Flow Requirements NRC Bulletin 88-04 also documented industry operating experience regarding design deficiencies with individual pump minimum flow rates that did not prevent pump damage while operating in the minimum flow mode. Based on Westinghouse analysis SECL-89-508, dated May 22, 1989, the licensee determined that the recirculation pump mechanical minimum flow rate (flow required to prevent pump mechanical damage at lower than design flow rates) and the thermal minimum flow rate (flow required to prevent fluid inside the pump from reaching saturation conditions) were adequate for all operational modes except surveillance testing. The lower flow rates during testing were evaluated as acceptable because of the short test duration and infrequent test times.

SECL-89-508 Table-1, "Required Minimum Flow vs. Actual Flow Rates," stated for the small break LOCA operating mode and a 24-hour duration, recirculation pump total flow was 1000 gpm, with a minimum required thermal and mechanical flow of 540 gpm.

The team identified that design drawing IP3V-2057-0010, "Flowserve Recirculation Pump Replacement," stated that sustained pump operation below 900 gpm should be avoided. In addition, the new recirculation pumps had a different suction stage design than the previous pumps. The team determined that EOP ES-1.3 would allow parallel pump operation if the total system flow was greater than approximately 1440 gpm, not including 130 gpm in the common minimum flow line. Since this would result in a total system flow of 1570 gpm, possibly with both pumps operating, the team questioned whether there were any LOCA scenarios where an individual pump flow might be less than 900 gpm. The team determined that Entergy had not evaluated the new recirculation pumps for thermal or mechanical minimum flow requirements, and had not verified whether the previous 18 year old minimum flow analysis was applicable to the new pumps. Entergy entered this issue into their corrective action program as CR-IP3-2007-04296.

Current Recirculation Pump Operability Entergy preliminarily determined that the recirculation pumps were potentially susceptible to adverse effects from strong-pump to weak-pump interactions and from inadequate minimum flow protection only during small break LOCA scenarios. Entergy is continuing to evaluate pump susceptibility to adverse affects during other (i.e., non-small break LOCA) scenarios.

Preliminary hydraulic analysis, performed by Entergy, indicated that the highest containment sump water temperature for a small break LOCA was about 195 degrees Fahrenheit (EF). Entergy received an initial evaluation for minimum flow from the pump vendor (Flowserve) in a letter dated November 9, 2007, which stated, in part, that while 900 gpm is recommended for continuous operation, 200 gpm is acceptable for up to a three hour duration in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. In addition, Flowserve stated that if the suction water temperature was less than or equal to 200EF, and the temperature rise in the pump did not result in flashing, then extended operation would only result in shortened pump life (i.e., not a short term pump failure). Based on the preliminary information, Entergy concluded that the pumps will operate satisfactorily under all design basis accident conditions. The team evaluated Entergys immediate corrective actions, including EOP changes, and Entergys operability assessment and found these actions and assessments to be reasonable.

Entergy is evaluating recirculation system hydraulic models and small break LOCA accident scenarios to determine expected minimum reactor core flows and individual pump flows. In addition, Entergy is evaluating recirculation pump design characteristics to determine pump minimum flow requirements. The acceptability of Entergy's final determination of pump minimum flow requirements will be an unresolved item (URI),pending further NRC review. (URI 05000286/2007006-02, Inadequate Design Control of Recirculation Pumps)

.2.1.5 Auxiliary Feedwater Pump 31 (Motor Driven)

a. Inspection Scope

The team reviewed the motor driven auxiliary feedwater (MDAFW) pump to verify that the pump was capable of achieving its design basis requirements. The review included an assessment of the design capacity of the condensate storage tank, ability to transfer the pump suction to an alternate water source, available net positive suction head, margin to prevent vortexing, pump minimum flow and run-out protection, and environmental and electrical qualification of equipment. The team reviewed drawings, calculations, hydraulic analyses, procedures, system health reports, and selected condition reports to evaluate whether maintenance, testing, and operation of the MDAFW pump were adequate to ensure the pump performance would satisfy design basis requirements under transient and accident conditions. Surveillance test results were reviewed to assess whether the pump was operated within acceptable limits, and to verify whether established test acceptance criteria were satisfied. The test acceptance criteria were compared to design basis assumptions and requirements to determine whether there were adequate margins to ensure actual pump performance would be satisfactory during transient and accident conditions. The team performed a walkdown of accessible areas of the auxiliary feedwater (AFW) system and supporting systems to determine whether the system alignment was in accordance with design basis and procedural requirements, and to assess the MDAFW pump and AFW system component material condition.

b. Findings

No findings of significance were identified.

.2.1.6 Auxiliary Feedwater Pump 32 (Turbine Driven)

a. Inspection Scope

The turbine driven auxiliary feedwater (TDAFW) pump was reviewed to assess its ability to meet its design basis head and flow rate requirements in response to transient and accident events. The team verified that the design inputs were properly translated into system procedures and tests, and reviewed completed surveillance tests associated with the demonstration of pump operability. Accident analysis evaluations for loss-of-normal feedwater were reviewed to determine whether appropriate design criteria for the TDAFW pump were used. The adequacy of the TDAFW pump for operation during a station blackout condition was reviewed. The team reviewed the design capacity of the condensate storage tank (CST), which is the preferred water source for the system, and the potential for vortexing at the pump suction line. The design and operating procedures for the service water system were reviewed with respect to supporting operability of the TDAFW pump when the normal pump suction source (CST) is depleted. The team also reviewed room temperature requirements and equipment thermal design requirements to assess whether the TDAFW pump would operate within design temperature limits. Lastly, the team performed walkdowns to assess the general condition of the TDAFW pump.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green)involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," in that Entergy had not verified the adequacy of design for the TDAFW pump. Specifically, the pump hydraulic analysis was non-conservative, but was used to verify the adequacy of surveillance test acceptance criteria for pump minimum discharge pressure.

Description:

The team reviewed calculation IP3-CALC-AFW-02581, "AFW Pump Discharge Pressure at Two Flow Rates 340 and 600 gpm." The purpose of the calculation was to verify the adequacy of the pump discharge pressure acceptance criteria for TDAFW pump surveillance testing. The test acceptance criteria had been established based on pump curves and allowances for pump degradation. The team identified that the analysis did not include the increased AFW flow requirements due to the IP-3 stretch power uprate (SPU), and did not include the increased pressure at the pump discharge due to the back-pressure between the main steam safety valves (MSSVs) and the steam generators (SGs). As a result, the calculation predicted too low of a value for pump discharge pressure, which resulted in a non-conservative value being used to assess the adequacy of the pump surveillance test acceptance criteria.

Entergy determined the AFW system remained operable because the most recent surveillance test results of the TDAFW pump documented an as-found pump discharge pressure greater than the value needed to account for the identified calculation deficiencies. In addition, Entergy determined that the approved surveillance test acceptance criteria was greater than the value needed to account for the identified calculation deficiencies. The team independently verified there was adequate margin between a higher required minimum pressure value and the current test acceptance criteria.

Analysis:

The team determined that the use of a non-conservative calculation to verify the adequacy of surveillance test acceptance criteria was a performance deficiency.

Entergy's design control measures were not adequate to ensure that a complete evaluation of TDAFW pump discharge pressure had been performed. Specifically, the TDAFW pump hydraulic analysis was used to verify adequate pump discharge pressure for surveillance test procedures, but did not include increased AFW flow requirements from the SPU, and did not include the back-pressure from the MSSVs to the SGs.

The finding was more than minor because it was similar to NRC Inspection Manual Chapter (IMC) 0612, Appendix E, Examples of Minor Issues, Example 3.j, in that the deficient hydraulic analysis resulted in a condition where there was a reasonable doubt with respect to operability of the TDAFW pump. The finding was associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations, the team conducted a Phase 1 SDP screening and determined the finding was of very low safety significance (Green) because it was a design deficiency that was confirmed not to result in a loss of TDAFW pump operability.

This finding had a cross-cutting performance aspect in the area of Problem Identification and Resolution. Specifically, this issue was the subject of CR-IP3-2007-03257, which identified the calculation for the MDAFW pumps required revision, in order to verify adequacy of surveillance test acceptance criteria for pump minimum discharge pressure.

Entergy did not thoroughly evaluate the similar problem that affected the TDAFW pump, such that the extent of condition adequately considered and resolved the cause. (IMC 0305, aspect P.1(c))

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that design control measures shall provide for verifying or checking the adequacy of design. Contrary to the above, as of November 8, 2007, Entergys design control measures were not adequate to verify the adequacy of design for the TDAFW pump minimum discharge pressure. Specifically, the TDAFW pump hydraulic analysis, in calculation IP3-CALC-AFW-02581, Rev. 0, did not include increased flow requirements from the SPU and did not include back-pressure from the MSSVs to the SGs. As a result, the hydraulic analysis was non-conservative, but had been used to verify the adequacy of surveillance test acceptance criteria. Because this violation was of very low safety significance and was entered into Entergy's corrective action program (CR-IP3-2007-04174), this violation is being treated as a non-cited violation (NCV), consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000286/2007006-03, Non-Conservative Calculation for TDAFW Pump Discharge Pressure Used for Surveillance Testing)

.2.1.7 No. 31 Emergency Diesel Generator (Mechanical)

a. Inspection Scope

The team reviewed emergency diesel generator (EDG) No. 31 to assess whether the EDG would function as required during postulated transient and accident conditions to meet design basis requirements. The review included the fuel oil storage and supply, starting air, combustion air, and jacket water and lube oil cooling systems. The team reviewed drawings, calculations, fuel oil transfer analyses, starting air capability analyses, heat exchanger performance analyses, system health reports, and selected condition reports to evaluate whether maintenance, testing, and operation of the EDG systems were adequate to ensure the EDG performance would satisfy design basis requirements under transient and accident conditions. Surveillance test results were reviewed to assess whether actual EDG performance, including starting air receiver pressures and service water flow rates, adequately demonstrated design basis assumptions would be met, that the EDG was operated within acceptable limits, and to verify whether established test acceptance criteria were satisfied. The test acceptance criteria were compared to design basis assumptions and requirements to determine whether there were adequate margins to ensure actual EDG performance would be satisfactory during transient and accident conditions. The team walked down selected accessible components and areas associated with the EDG to assess proper component alignment and verify whether any observed material conditions could adversely impact system operability.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green)involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," in that Entergy did not ensure a change to the design basis was correctly translated into maintenance procedures. Specifically, a modification replaced the control element in the EDG jacket water temperature control valves, with a control element with a higher setpoint to support EDG operation at a higher SW temperature.

Subsequently, the failure to properly update the affected maintenance procedure to specify the correct control element resulted in maintenance technicians re-installing elements with the old setpoint.

Description:

The team reviewed Modification 90-03-158, "EDG Jacket Water and Lube Oil Cooling," to assess the EDG's capability to operate at a higher SW temperature. The purpose of the 1990 modification was to support a design basis change that increased the maximum operating SW temperature from 85EF to 95EF. To allow the EDGs to operate at a 10EF higher SW temperature, the licensee determined, in part, that the jacket water outlet temperature needed to be increased from 180EF to 190EF, by changing the operating setpoint of the three-way temperature control valve (TCV). The TCV maintains the engine jacket water outlet temperature by controlling the quantity of water that bypasses the jacket water cooler. The modification installed a 180EF thermostatic element assembly in the EDG jacket water temperature control valves (TCV-31/32/33), in place of the original 170EF elements. A 180EF element, in the three-way TCV, is used to control temperature at 190EF, due to thermal hydraulic hysteresis.

The team identified that the licensee had not documented an evaluation of the impact of a jacket water temperature increase on the performance of the combustion air after cooler in either the modification package or in the supporting safety evaluation. Based on additional vendor information, Entergy subsequently determined the jacket water temperature increase did not adversely affect the after cooler performance or EDG operation.

While gathering data regarding EDG after cooler performance, Entergy determined that the 180EF thermostatic elements, installed in 1990 by Modification 90-03-158, had subsequently been replaced with 170EF elements, while performing routine preventive maintenance using maintenance procedure 3-GNR-022-ELC, EDG 6-Year Inspection.

The 180EF elements were sized to maintain jacket water temperature within design limits and prevent exceeding the maximum flow limits to the combustion air after cooler, for a SW temperature of 95EF. Entergy determined the EDGs were currently operable, based on river water (i.e., source of SW) temperature of approximately 50EF, because the 170EF elements were originally sized to support EDG operation for a maximum SW temperature of 85EF. Entergy entered this issue into their corrective action program as CR-IP3-2007-04411, and issued a corrective action to replace the elements prior to river temperature exceeding 85EF.

The team identified that jacket water cooling flow thorough the after cooler would have exceeded the after cooler design flow of 130 gpm, if the EDG were operated with the 170EF element and SW temperature at 95EF. Based on additional vendor information, Entergy subsequently determined that the after cooler design flow was 130 gpm, with a maximum allowable flow of 150 gpm. Entergy initiated a past operability assessment to determine whether SW temperature had exceeded 85EF while the 170EF thermostatic elements had been installed and, if so, to determine whether the after cooler flow would have exceeded the maximum allowable value of 150 gpm.

As an immediate corrective action, Entergy evaluated data during the previous two year period and determined that the SW maximum temperature had not exceeded 85EF, except for one day when the SW maximum temperature had been recorded as 85.8EF.

Entergy determined that a SW temperature of 85.8EF would result in an after cooler flow only slightly above the nominal design flow of 130 gpm. Therefore, Entergy concluded the EDGs had remained operable during the prior 2 year period. The team independently reviewed the Indian Point Monthly Environmental Reports for the previous 2 year period (October 1, 2005 to September 30, 2007), verified that the SW intake maximum temperatures did not exceed 85EF during that period (except for 1 day), and concluded that Entergy's past operability assessment for the prior 2 years was reasonable, based on the after cooler margin between the nominal design and maximum allowable flow rates.

Analysis:

The team determined that the failure to properly update the affected maintenance procedure was a performance deficiency. Entergy's design control measures did not ensure that a change to the design basis was correctly translated into maintenance procedures. Specifically, a modification replaced the 170EF control element in the EDG jacket water temperature control valves, with a 180EF element, to support EDG operation at a higher SW temperature of 95EF. Subsequently, using the uncorrected procedure, maintenance technicians re-installed 170EF elements.

The finding was more than minor because it was similar to NRC Inspection Manual Chapter (IMC) 0612, Appendix E, Examples of Minor Issues, Example 3.b, in that a valve design was changed, but a licensee oversight resulted in a failure to update a procedure, which could adversely affect an EDG. The finding was associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations, the team conducted a Phase 1 SDP screening and determined the finding was of very low safety significance (Green) because it was a design deficiency that was confirmed not to result in the loss of EDG operability.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures shall be established to ensure that the design basis are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, as of November 8, 2007, Entergy's design control measures were not adequate to ensure that a change to the design basis was correctly translated into maintenance procedure 3-GNR-022-ELC. Specifically, in 1990, Modification 90-03-158 installed a 180EF thermostatic element assembly in the EDG jacket water temperature control valves, in place of the original 170EF elements. The modification's purpose was to support a design basis change that increased the maximum operating SW temperature from 85EF to 95EF. As a result of not revising the procedure, during routine preventive maintenance, the correct 180EF element was subsequently removed and replaced with a 170EF element, which could have adversely affected EDG operation at SW temperatures greater than 85EF. Because this violation was of very low safety significance and was entered into Entergy's corrective action program (CR-IP3-2007-04411), this violation is being treated as a non-cited violation (NCV), consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000286/2007006-04, Maintenance Procedure Not Revised after Emergency Diesel Modification)

.2.1.8 Residual Heat Removal Supply from Reactor Coolant System Isolation Valves

(AC-MOV-730 and -731)

a. Inspection Scope

The team selected the residual heat removal supply from reactor coolant system isolation valves as a high risk sample and due to their unique operation in that they are routinely electrically backseated. The team reviewed calculations, MOV diagnostic tests, the valve vendor manual, and system and component level drawings to verify the valves capability to perform during design basis accident scenarios. The team interviewed engineers and reviewed the actuator torque switch settings to verify that structural limits of the valves were not being exceeded when the valves were backseated. NRC Information Notice (IN) 87-40, Backseating Valves Routinely to Prevent Packing Leakage, was reviewed to determine if the station took appropriate measures to prevent failure of the valves. Condition reports were reviewed to determine the historical performance of the valves and valve actuators.

b. Findings

No findings of significance were identified.

.2.1.9 Main Steamline Atmospheric Steam Dump Valves (MS-PCV-1134, 1135, 1136, & 1137)

a. Inspection Scope

The atmospheric steam dump valves were chosen as a representative high risk air operated valve (AOV) sample. The team conducted interviews with engineers and reviewed system and component level calculations, procedures, valve diagnostic test results, and trend data to verify the capabilities of MS-PCV-1134, 1135, 1136, and 1137 to perform their intended function during postulated design basis accident conditions.

The backup nitrogen supply system for the atmospheric steam dump valves was reviewed to determine if design assumptions were supported by procedural operation of the system. Preventive maintenance requirements and corrective action reports were also reviewed in order to determine the performance and operational history of the valves.

b. Findings

No findings of significance were identified.

.2.1.1 0 Motor Driven Auxiliary Feedwater Flow Control Valves (BFD-FCV-406A,B,C,D)

a. Inspection Scope

The MDAFW flow control valves were chosen as a representative high risk AOV sample.

The team conducted interviews with engineers and reviewed calculations, procedures, and periodic verification and inservice test results to verify the capability of the BFD-FCV-406A, B, C, and D valves to perform their intended function during design basis conditions. The backup nitrogen supply for the AFW system was reviewed to determine if there was sufficient capacity to support design assumptions for system operation following a loss-of-instrument air. Condition reports were reviewed to assess the condition of the system and to verify previously identified issues had been properly resolved.

b. Findings

No findings of significance were identified.

.2.1.1 1 Station Battery 31

a. Inspection Scope

The team reviewed the station battery, and associated 125 Vdc switchgear, buses, chargers and inverters. The team reviewed the battery calculations to verify that the battery sizing would satisfy the requirements of the risk significant loads and that the minimum possible voltage was taken into account. Specifically, the evaluation focused on verifying that the battery and battery chargers were adequately sized to supply the design duty cycle of the 125 Vdc system, and that adequate voltage would remain available for the individual load devices required to operate during a two-hour coping duration. The team reviewed battery surveillance test results to verify that applicable test acceptance criteria and test frequency requirements specified for the battery were met. The team also reviewed condition reports and maintenance work orders for the associated battery chargers and inverters as well as design change records for the 125 Vdc system. The team interviewed design and system engineers regarding design aspects and operating history for the battery. In addition, a walkdown was performed to visually inspect the physical condition of the station batteries, switchgear and battery chargers. During the walkdown, the team also visually inspected the battery for signs of degradation such as excessive terminal corrosion and electrolyte leaks.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green)involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, in that improper component voltage requirements were used when performing battery sizing calculations.

Description:

The team reviewed calculations IP3-CALC-EL-184 thru 186, 31, 32, 33 Battery, Charger, Associated Panels and Cables Component Sizing and Voltage Drop Calculations, and associated technical manuals for components powered from the batteries. The licensee utilized standardized calculation methods as described in IEEE-Standard-485-1983, Recommended Practice for Sizing Large Lead Storage Batteries for Generating Substations. The team found that the vendor manual for Agastat 7000 series timing relays included a footnote that stated that four-pole models of the timing relays have an operational voltage range of 85% -120% of the DC bus voltage of 125 Vdc. However, the team noted that the 85% (106.25 Vdc) requirement as stated in the vendor manual was not used as the minimum voltage for determining the battery size requirements. A review of all IP-3 battery calculations showed that a minimum component voltage of 100 Vdc was used for battery sizing and not the 106.25 Vdc required by the timing relays. Interviews conducted by the inspection team with system engineers confirmed that the four-pole models of the Agastat 7000 series timing relays were currently in use in IP-3 DC electrical systems powered from batteries 31, 32 and 33, and that the 85% voltage requirement was not considered in the sizing calculations.

Specifically, containment spray pump and high steam flow safety injection timing functions are controlled by these relays.

A review of the most recent discharge test results for all of the batteries indicated that current capacity margins are adequate for operation. The team noted that the Station Battery Load Profile Service Tests (3PT-R156C, Rev. 13) showed that the batteries are currently capable of providing adequate current for the design two hour discharge time before they reach the minimum individual cell voltages required to support operation of the Agastat 7000 relays. However, the acceptance criteria for these tests, specifically the minimum individual cell voltages (ICVs) may not be adequate to ensure the battery will provide for minimum component operating voltages when the batteries reach 80% of their maximum capacity, considered to be end of useful battery life. The licensee determined the batteries are operable based on the review of the most recent test results and initiated a condition report to track and document final resolution of the issue.

The team reviewed the results of the battery tests and determined the licensees operability assessment was appropriate.

Analysis:

The team determined that Entergys failure to use the minimum voltage associated with the limiting component for the battery sizing calculations represented a performance deficiency that was reasonably within the licensees ability to foresee and prevent. Specifically, proper sizing of station batteries is vital to ensuring the operation of safety-significant equipment upon a loss of AC power through the batterys end of useful life (80% capacity). The minimum component voltage for the Agastat 7000 relays, including a circuit voltage drop of five volts as assumed in the calculations, results in a required minimum battery terminal voltage requirement of 111.25 volts at the end of the discharge time. This battery voltage results in a minimum ICV of 1.854 volts versus the previously calculated 1.75 volts. The surveillance tests with the current ICV requirements could result in a battery remaining in service past its end of useful life. The team also noted that Agastat 7000 relay replacements in 2002 appears to have been a missed opportunity for prior identification.

This issue is more than minor because it was associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations, the team conducted a Phase 1 SDP screening and determined the finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in a loss of battery operability.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures shall provide for verifying or checking the adequacy of design.

Contrary to the above, as of October 19, 2007, Entergys design control measures were not adequate to verify the adequacy of the battery design. Specifically, Entergy used a non-conservative minimum operating voltage for the Agastat 7000 series timing relays as an input to the battery sizing calculations. Because this violation was of very low safety significance and was entered into Entergy's corrective action program (CR-IP3-2007-03957), this violation is being treated as a non-cited violation (NCV), consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000286/2007006-05, Inadequate Design Controls for Station Battery Sizing Calculations)

.2.1.1 2 480V Switchgear 32 Bus 6A

a. Inspection Scope

The team reviewed condition reports, corrective maintenance history, and preventive maintenance procedures for selected Bus 6A breakers, including the bus feeder breaker 6A, to evaluate the reliability of the equipment. The team reviewed the electrical distribution system load flow analysis and the manufacturers rating data for the Westinghouse type DS-416 and DS-532 circuit breakers and 480V switchgear to determine the operating margin for components that were identified by calculation as limiting components during design basis conditions. The team reviewed drawings, calculations, set point information network (SPIN) data sheets, and Amptector calibration tests to verify that breaker overcurrent trip settings were appropriately selected and calibration tested in accordance with the established acceptance criteria. The team reviewed the coordination calculation to verify that breaker 6A trip setting was determined in accordance with design basis conditions and the operating instructions for bus loading during a design basis accident. The team conducted walkdowns of the switchgear and the switchgear area ventilation equipment, to observe the material condition for indications of equipment degradation.

b. Findings

No findings of significance were identified.

.2.1.1 3 Emergency Diesel Generator 31 (Electrical)

a. Inspection Scope

The team reviewed the EDG 31 drawings and the schematics for the starting air circuit and the vendor nameplate data for the diesel starting air motor solenoid. The team reviewed the EDG loading study for the worse case design basis loading conditions to determine the margin available on the EDGs. The team also reviewed the results of capacity tests to verify that the diesel generator test conditions enveloped design basis and technical specification requirements. The team reviewed the coordination calculation, SPIN data sheet, and Amptector calibration tests to verify that EDG 31 generator breaker EG1 overcurrent trip settings were appropriately selected and calibration tested in accordance with the established acceptance criteria. The team conducted walkdowns of the EDGs to evaluate the material condition and the operating environment for the equipment and to determine if there were indications of degradation of any components.

The team also reviewed plant modification ER-05-3-017, Replacement of Unit Parallel Relay on the EDGs, to verify that the design bases, licensing bases, and performance capability of the component had not been degraded as a result of the modification.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green)involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control.

Specifically, Entergy did not use the most limiting design inputs in engineering analyses and surveillance test acceptance criteria for the EDG.

Description:

The team identified several examples in the engineering analyses for EDG loading in which the most limiting design input values were not used. As a result, the conclusions of the various analyses were non-conservative. For example, the team reviewed IP-CALC-04-00809, Brake Horsepower Values Related to Certain Pumps and Fans for EDG Electrical Loading, and found that the break horsepower (BHP) required for the primary auxiliary building (PAB) exhaust fans and the auxiliary feedwater pump motors were non-conservative in that worst case design conditions for maximum flow, in each case, were not considered. Also, the licensee assumed that the highest motor load for the containment fan coil units would occur when service water temperature to the units was at the maximum design temperature. During the inspection, the licensee, working with the nuclear steam supply system (NSSS) vendor, was not able to confirm that the assumption was correct or whether the lowest design service water temperature should have been considered. The team reviewed surveillance test 3PT-R160B, 32 EDG Capacity Test, performed on March 14, 2007, and found that the testing performed at 1900 kW load met Technical Specification surveillance requirement (SR)3.8.1.10.a. which requires the EDG be loaded between 1837 and 1925 kW. However, the actual tested load did not envelope the maximum possible load determined in the EDG load analyses using the most limiting design inputs. (1924.4 kW)

In addition, the team found that the maximum frequency limit 61.2 Hz allowed under Technical Specification SR 3.8.1.2.b was not used by the licensee to determine the maximum load requirement. All of the issues identified by the team were documented in condition reports for additional followup and resolution. As an immediate corrective action, Entergy performed additional analyses and determined that the effects of the issues identified did not impact EDG operability. Specifically, fuel rack position data was recorded during surveillance testing. Entergy evaluated the rack position recorded during the March 14, 2007, test and determined there was sufficient rack travel available to achieve maximum design load, including higher loading as a result of errors identified in the loading analyses. The team reviewed Entergys analyses and operability evaluation and found them to be reasonable.

Analysis:

The team determined that the failure to adequately evaluate the most limiting load conditions in the EDG loading analysis was a performance deficiency. Specifically, Entergys design control measures were not adequate to ensure design calculation inputs and assumptions were appropriate for the EDG loading calculation.

The finding is more than minor because it is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Significance Determination of Inspection Findings for At-Power Situations, the team conducted a Phase 1 screening and determined that this finding had very low safety significance (Green) because it was a design deficiency that was confirmed not to result in a loss of EDG operability.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of October 23, 2007, Entergys design control measures were not adequate to verify the adequacy of the EDG design. Specifically, Entergy did not verify that design inputs to the EDG load analysis enveloped the worse case load conditions. Because the finding is of very low safety significance and has been entered into Entergys corrective action program (CR-IP3-2007-04002, CR-IP3-2007-04024 and CR-IP3-2007-04098), this violation is being treated as a non-cited violation, consistent with Section VI.A.1 of the Enforcement Policy. (NCV 05000286/2007006-06, Inadequate Design Inputs and Testing Requirements for EDG Loading)

.2.1.1 4 Station Auxiliary Transformer (SAT)

a. Inspection Scope

The team reviewed the design, testing, and operation of the SAT to verify it was capable of performing its design function during normal, transient and accident conditions. The team conducted interviews with engineers, conducted walkdowns of equipment, and reviewed the SAT control logic and interlocks. The review included the adequacy of energy sources, control circuit supply, field installation conditions, tap changer operation, potential failure modes, and design, testing, and operating margins. The team also reviewed maintenance and inspection activities associated with the SAT.

The team also reviewed the electrical feed from the transformer secondary to the 6.9 kV Buses 5 and 6 to verify that the design, testing, and operation would result in a reliable source of offsite power to the safety buses under all conditions. This review included the electrical bus fast transfer scheme that transfers buses 1,2,3 and 4 from their normal feed, the unit auxiliary transformer (UAT), to the feed from the SAT, following a plant trip.

The team reviewed relevant sections of the study performed to analyze the transient conditions developed under an automatic fast bus transfer. The team reviewed the periodic test of the closing time for the tie breakers, including methodology and actual test results. The team also reviewed the settings, control and potential transformer connections, potential failure modes, and periodic surveillance test results for the synchro-check relay, which is connected to supervise the UAT and the SAT voltage phasing conditions.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green)involving the failure to perform a transformer bushing power factor (Doble) test within Entergy, vendor, or industry recommended frequencies. Additionally, Entergy did not provide an appropriate technical bases to defer the test beyond the normal interval.

Description:

The SAT is an essential component in the circuit that provides the preferred offsite electrical power source for the plant during both normal and post-accident conditions. A power factor test is an effective industry standard test used to assess the condition of transformers and bushings, and determine whether there is evidence of bushing contamination and/or deterioration. Industry operating experience shows that high voltage bushings, if allowed to deteriorate, have failed and caused the loss of the transformer, as well as damage to adjacent equipment.

During the last refuel outage, in March 2007, a SAT power factor test had been scheduled, but was not performed due to inclement weather. Entergy determined that the test could not be re-scheduled during the remaining outage time frame. Since it is necessary to remove the SAT from service to perform the test, Entergy determined the next opportunity for the test would be during the 2009 refuel outage. Entergy performed a deferral evaluation to re-schedule the test, which concluded that not performing the test for an additional 2 years was acceptable.

The team identified that the last power factor test on the bushings had been performed in 1999, and a deferral until 2009 would result in a 10 year interval between tests. The team noted that a 10 year interval between bushing tests was significantly longer than the 4 year test interval specified in Entergys maintenance procedure as well as the bushing vendor and industry recommendations for bushing test frequencies. The team determined this test interval was excessive because it did not facilitate identification of adverse trends, that if identified and corrected could prevent an in-service failure of the transformer. The team also determined that Entergy's deferral evaluation lacked a reasonable technical bases, because it contained errors (e.g. incorrectly assumed the last test was in 2001), and incorrectly assumed the SAT was a component not important to safety. The team noted that Indian Point's PRA identified the SAT as a risk significant component, with a RAW value of 6.8, because it is a key component in the offsite power circuit to the safety buses.

Entergy evaluated the SAT and concluded it was operable, in part, based on a comparison of the 1999 power factor test results to the transformer nameplate data, and because the transformer was currently energized and operating normally. Entergy entered this condition into the corrective action program. The team determined Entergys operability evaluation was reasonable.

Analysis:

The team determined that deferring an offsite power transformer test, to the extent that test results might not be adequate to predict degradation and allow subsequent corrective actions to prevent an in-service failure, was a performance deficiency. Specifically, Entergy did not perform a power factor test that was already past due, because of inadequacies in outage planning, scheduling, and work control, and re-scheduled the test for 2009, resulting in a 10 year test interval.

The finding was more than minor because it is associated with the equipment performance attribute of the Mitigating Systems and affected the cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC IMC 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the team conducted a Phase 1 SDP screening and determined the finding was of very low safety significance (Green) because it was not a design or qualification deficiency, did not result in an actual loss of safety function, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event.

This finding had a cross-cutting performance aspect in the Human Performance - Work Control area. A past due transformer bushing power factor test was not performed as scheduled, during the 2007 refuel outage and was deferred to the next outage, in 2009.

Specifically, risk insights had not been adequately considered (e.g., Entergy's deferral evaluation considered the SAT as a non-risk significant component), job site conditions (i.e., outside work during winter) did not support the test activity, and there was no planned contingency if the test activity could not be accomplished within its scheduled work window. (IMC 0305, aspect H.3(a))

Enforcement:

No violations of NRC requirements were identified. Entergy entered this issue into the corrective action program (CR IP3-2007-4266). (FIN 05000286/2007006-07, Inadequate Bushing Testing for the Station Auxiliary Transformer)

.2.1.1 5 Auxiliary Feedwater Pump and Valve Instrumentation and Controls

a. Inspection Scope

The team reviewed the design, testing and operation of the instrumentation and control circuitry associated with major components in the AFW system to ensure these circuits would support the system in performing its design functions during transient and accident conditions.

The team inspected the AFW system controls and instrumentation for MDAFW pump motor manual and automatic start, and the automatic and manual controls for flow control valves BFD-FCV-406A, B, C, and D. The team reviewed the capability of the valves to control the discharge pressure/flow of the MDAFW pumps in the automatic and manual modes. The team also reviewed the motor driven pump control circuit, which provides for a motor breaker trip for prevention of overload due to pump run-out.

Periodic surveillance tests, energy sources, potential failure modes, as well as the instrument setting calculations were also reviewed.

The team inspected the TDAFW pump controls and instrumentation for automatic start and manual operation. The team reviewed the controls and interlocks for steam turbine pressure reducing valve MS-PCV-1139. The team reviewed the capability of the flow control valves (BFD-FCV-405A-D) for automatic and manual control of the discharge pressure/flow of the TDAFW pump. The automatic controls for steam isolation valves MS-PCV-1310A and -1310B, and their automatic shut off operation in case of a steam line break in the AFW pump room were also reviewed. The team also reviewed the operation of the speed controller MS-HCV-1118, which included periodic surveillance tests, energy sources, potential failure modes, and the instrument setting calculations.

b. Findings

No findings of significance were identified.

.2.1.1 6 118 Vac Instrumentation Bus 31 and Inverter

a. Inspection Scope

The team reviewed the design and testing of the 118 Vac Bus 31 and its associated inverter to ensure it could perform its design function of providing a reliable source of 118 Vac power to its associated buses and components during normal, transient and accident conditions. The team reviewed the voltage drop calculations, control diagrams, schematics, block diagrams, past corrective actions, surveillance tests and component vendor manuals. The team verified proper load analyses, assumptions and calculation methodologies. In addition, a walkdown was performed to visually inspect the physical condition of the bus and inverter. Additionally, the team reviewed change records for the inverter as well as maintenance testing on associated system breakers.

b. Findings

No findings of significance were identified.

.2.1.1 7 Appendix R Standby Diesel Generator

a. Inspection Scope

The team reviewed the design, testing and operation of the Appendix R diesel generator to ensure it would provide a reliable source of AC power to equipment necessary to support plant safe shutdown during a fire that affects the availability of offsite and/or emergency diesel generator power and during a station blackout event (total loss of all AC power).

Specifically, the team reviewed the Appendix R DG drawings and operations procedures to verify breaker alignments required for generator operation. The team reviewed the DG loading study for the design basis loading conditions to determine the margin available on the DG. The team also reviewed the results of DG functional tests to verify that the test conditions enveloped design basis loading requirements. The team conducted walkdowns of the DG to evaluate the material condition and the operating environment for the equipment and to determine if there were indications of degradation of any components.

b. Findings

No findings of significance were identified.

.2.1.1 8 480 Vac Motor Control Center MCC-36B

a. Inspection Scope

The team reviewed the design of 480 Vac motor control center MCC-36B to verify that it could supply power to the necessary loads during normal, transient and accident conditions. The team reviewed corrective actions, surveillance tests and electrical schematics. A walkdown of the system was also performed to verify load configuration and physical conditions.

b. Findings

No findings of significance were identified.

.2.1.1 9 Steam Generator Atmospheric Dump Valve (MS-PCV-1134) Control Circuitry

a. Inspection Scope

The team reviewed the design, testing and operation of the valve to ensure it would perform its design function of removing heat from the reactor coolant system (RCS)during off-normal conditions when the main condenser is not available.

The review included the operation and settings of the proportional/integral/derivative controllers which control the atmospheric steam dump valves during automatic and manual operation. The review also included the instrumentation calibration, periodic testing, potential failure modes, availability of energy sources, adequacy of set points, logic and interlocks, and remote indication system. The team verified that the controller settings were such as not to unnecessarily challenge the operation of the safety valves.

The team also verified that backup nitrogen could be utilized to operate the system in the event the normal supply of instrument air was lost.

b. Findings

No findings of significance were identified.

.2.1.2 0 Switchgear Room Ventilation Fan 33

a. Inspection Scope

The team reviewed the design, operation and testing of the switchgear room ventilation fans to ensure the system would provide adequate cooling for all components within the room and prevent exceeding the maximum operating temperature of any components.

The review included system modifications, switchgear room heatup calculations, surveillance testing and preventive maintenance activities. The team reviewed the operating history of the fan to assess the adequacy of corrective actions taken to address failures. The team also interviewed design and system engineers and performed walkdowns of the ventilation system to assess the material condition of system components.

b. Findings

No findings of significance were identified.

.2.2 Detailed Operator Action Reviews (5 Samples)

The team assessed manual operator actions and selected a sample of five actions for detailed review based upon risk significance, time urgency, and factors affecting the likelihood of human error. The operator actions were selected from a PRA ranking of operator action importance based on RAW and RRW values. The non-PRA considerations in the selection process included the following factors:

• Margin between the time needed to complete the actions and the time available prior to adverse reactor consequences;

• Complexity of the actions;

• Reliability and/or redundancy of components associated with the actions;

• Extent of actions to be performed outside of the control room;

• Procedural guidance; and

• Training.

.2.2.1 AC Power Recovery

a. Inspection Scope

The team selected the operator action to recover AC power to at least one safeguards electrical bus via the alternate AC power source (Appendix R Diesel Generator). This action must be completed within one hour of losing all AC power, and the potential consequence of failure of this action is core damage. The team reviewed the incorporation of this action into site procedures, classroom training, and simulator training. The team also accompanied operators and walked through station procedures and plant equipment associated with the startup and alignment of the alternate AC power source to safety related 480 Vac buses to verify that Entergy could restore AC power within one hour of a station blackout event. Finally, the team observed a station blackout simulator scenario to further evaluate operator training and emergency operating and recovery procedures.

b. Findings

No findings of significance were identified.

.2.2.2 Initiate Low and High Head Recirculation Flow

a. Inspection Scope

The team selected the operator action to manually align and initiate low and high head recirculation flow. Specifically, the actions involve providing recirculation cooling flow from the recirculation or containment sumps to the reactor via the RHR system heat exchangers and low head or high head pumps. The IP-3 Human Reliability Analysis Notebook considered this action to be of a moderately high stress level and a moderate to high task complexity. The team observed simulator scenarios that required the initiation of low and high head recirculation, both by the use of the recirculation pumps and the RHR pumps. The incorporation of this action into site procedures, classroom training, and job performance measures were also reviewed. The team also interviewed operators and engineers to discuss the details associated with this action.

b. Findings

No findings of significance were identified.

.2.2.3 Manually Trip the Reactor Coolant Pumps Following Loss of Component Cooling Water

System

a. Inspection Scope

The team selected the operator action to manually trip the reactor coolant pumps (RCP)following the loss of the component cooling water (CCW) system in order to prevent an initiating event (RCP seal loss of coolant accident). The team verified that control room annunciator response and abnormal operating procedures provided adequate instructions to trip the RCPs following the loss of the CCW system. The team interviewed operators and observed a simulator scenario during which RCPs were required to be tripped following a significant CCW system malfunction.

b. Findings

No findings of significance were identified.

.2.2.4 Local/Manual Control of Turbine Driven Auxiliary Feedwater Pump Flow

a. Inspection Scope

The team selected the operator action to manually control the TDAFW pump following a loss of all AC power or loss of instrument air. This operator action involved locally and manually controlling the four flow control valves associated with the TDAFW pump. The team observed plant staff walk through the actions required to locally control steam generator levels, as well as resetting the TDAFW pump turbine overspeed trip device (in the event of an overspeed trip of the TDAFW pump turbine). The team verified that Entergy staged all necessary tools in an appropriate location to effectively and expeditiously operate the necessary equipment. The incorporation of this action into site procedures, classroom training, and job performance measures was also reviewed.

b. Findings

No findings of significance were identified.

.2.2.5 Local/Manual Operation of Atmospheric Dump Valves

a. Inspection Scope

The team selected the operator action to operate the steam generator atmospheric dump valves. This action included manual activities to locally align the two sources of backup nitrogen supply to operate the ADVs (instrument air is normal supply). The team reviewed the incorporation of this action into emergency and abnormal operating procedures, job performance measures, and classroom training. The team observed an operator locate the local nitrogen supply valves and controls, and walk through the proceduralized actions to locally operate the ADVs.

b. Findings

No findings of significance were identified.

.3 Review of Industry Operating Experience (OE) and Generic Issues (6 Samples)

a. Inspection Scope

The team reviewed selected OE issues for applicability at Indian Point Unit 3. The team performed a detailed review of the OE issues listed below to verify that Entergy had appropriately assessed potential applicability to site equipment and initiated corrective actions when necessary.

.3.1 NRC Information Notice (IN) 2005-023, Vibration-Induced Degradation of Butterfly

Valves The team reviewed Entergys evaluation of IN 2005-23 to assess the thoroughness and adequacy of the subject evaluation. IN 2005-23 focused on separation of butterfly valve internal components due to the vibration-induced loss of taper pins used to connect them. Entergys evaluation included conducting a search of the corrective action database to identify whether there were condition reports involving related valve failures, and reviewing valve preventive maintenance procedures to evaluate the measures employed at IP-3 to secure the valve disc-to-stem taper pins. The results of Entergys evaluation indicated that the subject butterfly valves were not susceptible to vibration induced failure as described in the Information Notice.

.3.2 NRC IN 2002-012, Submerged Safety-Related Electrical Cables

The team reviewed Entergys disposition of IN 2002-012 for applicability and the identification and effectiveness of corrective actions. This notice addressed submerged safety-related cables in duct banks. The team reviewed work orders to confirm that duct banks at IP-3 containing safety-related cables were periodically inspected under the preventive maintenance program, and were drained when cables were found to be submerged to minimize the time when cables are exposed to moisture. Entergy also determined that the underground power, control and instrumentation cable procurement specification for IP-3 required all cables to have a lead sheath under the jacket to prevent insulation damage due to long term moisture exposure.

.3.3 NRC IN 2006-26, Failure of Magnesium Rotors in Motor-Operated Valve Actuators

The team reviewed the applicability and disposition of IN 2006-26. The team reviewed Entergys response to the information notice, conducted interviews and reviewed industry response. The team evaluated Entergys evaluation of IN 2006-16, their response and subsequent actions to monitor MOVs which may be susceptible to the failures identified in IN 2006-26.

.3.4 NRC IN 2006-22, Ultra-Low-Sulfur Diesel Fuel Oil Adverse Impact on EDG Performance

The team reviewed Entergy's evaluation of IN 2006-22 to assess the potential impact on EDG operation from the use of ultra-low-sulfur fuel oil. The team reviewed Entergy's fuel oil monitoring program, including sample frequency, sample locations, acceptance criteria, and results from recent samples. The review included a walkdown of the No. 31 EDG and it's fuel oil system, and interviews with the system engineer.

.3.5 NRC IN 2005-30, Safe Shutdown Potentially Challenged by Unanalyzed Internal

Flooding Events and Inadequate Design The team reviewed Entergy's evaluation of IN 2005-30 to assess the potential impact of internal flooding events on electrical equipment. The team evaluated internal flood protection measures for the EDG rooms, the 4 kV switchgear rooms, the AFW pump room, and the relay room. The team walked down the areas to assess operational readiness of various features in place to protect redundant safety-related components and vital electrical components from internal flooding. These features included equipment floor drains, floor barrier curbs, and wall penetration seals. The team conducted several detailed walkdowns of the turbine building, EDG rooms, 4 kV switchgear rooms, relay room, the AFW pump room, and cable tunnels to assess potential internal flood vulnerabilities. The team also reviewed Entergys internal flood analysis, engineering evaluations, alarm response procedures, and CRs associated with flood protection equipment and measures.

.3.6 NRC IN 1992-16, Supplement 2, Loss of Flow From the Residual Heat Removal Pump

During Refueling Cavity Draindown The team inspected the IP-3 response to IN 92-16, Supplement 2 and found that the plant had installed an additional level indication system (Mansel system) to improve monitoring of RCS level. The team reviewed the operation of the system, the periodic surveillance tests, energy sources, potential failure modes, as well as the instrument settings. The team reviewed all of the condition reports written against the system and noticed that there were numerous issues at the beginning of operation in the year 2000.

However, corrective actions were implemented and the system has performed adequately for the last seven years.

b. Findings

No findings of significance were identified.

4OA2 Problem Identification and Resolution

a. Inspection Scope

The team reviewed a sample of problems that were identified by Entergy and entered into the corrective action program. The team reviewed these issues to verify an appropriate threshold for identifying issues, and to evaluate the effectiveness of corrective actions related to design or qualification issues. In addition, condition reports written on issues identified during the inspection, were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action program. The specific condition reports that were sampled and reviewed by the team are listed in the attachment to this report.

b. Findings

No findings of significance were identified.

4AO6 Meetings, Including Exit On November 8, 2007, the team presented the preliminary inspection results to Mr. P. Conroy, Director, Nuclear Safety Assurance and Mr. T. Orlando, Director, Engineering, and other members of Entergy staff. Based on subsequent in-office review of additional information provided by Entergy, a telephone conference call was conducted with Messrs. P. Conroy and T. Orlando and other members of their staff on December 18, 2007, and a followup telephone call was conducted with Mr. P. Conroy on January 29, 2008, to provide the final inspection results. The team verified that no proprietary information is documented in the report.

ATTACHMENT

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Altadonna, Program and Components Engineer

V. Andreozzi, System Engineering Supervisor

E. Bauer, System Engineer

J. Bencivenga, Design Engineer

J. Bubniak, Design Engineer

R. Carpino, Senior Reactor Operator

P. Conroy, Director, Nuclear Safety Assurance

G. Dahl, Licensing Engineer

J. Dinelli, Assistant Operations Manager

J. Etzweiler, Operations Coordinator

D. Gaynor, Senior Lead Engineer

M. Imai, System Engineer

C. Ingrassia, System Engineer

J. Kayani, Heat Exchanger Component Engineer

M. Kempski, System Engineer

T. King, Design Engineer

C. Kocsis, Senior Operations Instructor

C. Laverde, MOV Program Engineer

L. Liberatori, Design Engineer

T. McCaffrey, Manager, Design Engineering

I. McElroy, Reactor Operator

T. Moran, Check Valves Program Engineer

T. Orlando, Director, Engineering

R. Parks, Procedure Writer

M. Radvansky, Design Engineering

J. Raffaele, Design Engineering Supervisor

V. Rizzo, AOV Program Engineer

H. Robinson, Design Engineer

R. Ruzicka, Senior Operations Instructor

D. Shah, System Engineer

B. Shepard, Design Engineer

A. Singer, Superintendent, Training-Nuclear Operations

D. Vinchkoski, Senior Operations Instructor

J. Whitney, System Engineer

NRC Personnel

P. Cataldo, Senior Resident Inspector

C. Hott, Resident Inspector

W. Schmidt, Senior Risk Analyst

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000286/2007006-02 URI Inadequate Design Control of Recirculation Pumps (Section 1R21.2.1.4)

Closed

None

Opened and Closed

05000286/2007006-01 NCV Inadequate Pressure Locking Methodology Used to Ensure Valve Operability (Section 1R21.2.1.2)

05000286/2007006-03 NCV Non-Conservative Calculation for TDAFW Pump Discharge Pressure Used for Surveillance Testing (Section 1R21.2.1.6)

05000286/2007006-04 NCV Maintenance Procedure Not Revised after Emergency Diesel Modification (Section 1R21.2.1.7)

05000286/2007006-05 NCV Inadequate Design Controls for Station Battery Sizing Calculations (Section 1R21.2.1.11)

05000286/2007006-06 NCV Inadequate Design Inputs and Testing Requirements for EDG Loading (Section 1R21.2.1.13)

05000286/2007006-07 FIN Inadequate Bushing Testing for the Station Auxiliary Transformer (Section 1R21.2.1.14)