IR 05000293/2011007

From kanterella
Jump to navigation Jump to search
IR 05000293/2011007; 9/12/2011 - 10/6/2011; Pilgrim Nuclear Power Station; Component Design Bases Inspection
ML113220117
Person / Time
Site: Pilgrim
Issue date: 11/18/2011
From: Doerflein L
Engineering Region 1 Branch 2
To: Rich Smith
Entergy Nuclear Operations
References
IR-11-007
Download: ML113220117 (41)


Text

SUBJECT:

PILGRIM NUCLEAR POWER STATION - NRC COMPONENT DESIGN BASES I NSPECTION REPORT 05000293/201 1 007

Dear Mr. Smith:

On October 6,2011, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Pilgrim Nuclear Power Station (PNPS). The enclosed inspection report documents the inspection results, which were discussed on October 6,2011, with you and other members of your staff, and during a subsequent telephone call with Mr. J. Lynch on November 16, 2011.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

In conducting the inspection, the team examined the adequacy of selected components to mitigate postulated transients, initiating events, and design basis accidents. The inspection involved field walkdowns, examination of selected procedures, calculations and records, and interviews with station personnel.

This report documents three NRC-identified findings of very low safety significance (Green).

These findings were determined to be violations of NRC requirements. However, because of the very low safety significance and because they have been entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with Section 2.3.2.a of the NRC's Enforcement Policy. lf you contest any NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region l; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Senior Resident Inspector at PNPS. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region l, and the NRC Senior Resident lnspector at PNPS. The information you provide will be considered in accordance with lnspection Manual Chapter 0305. ln accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for the public inspection in the NRC Public Docket Room or from the Publicly Available Records component of NRC's document system, Agencywide Documents Access and Management System (ADAMS).

ADAMS is accessible from the NRC Web site at http://www.nrc.gov/readinq-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

  • 4 ll Yq^^r**- / t tl"p^f<P-,-

Lawrence T. Doerflein, Chief (

Engineering Branch 2 Division of Reactor Safety Docket No.: 50-293 License No.: DPR-35 Enclosure:

I nspection Report 05000293/201 1 007 w/Attachment: Supplemental lnformation cc w/encl.: Distribution via ListServ

SUMMARY OF FINDINGS

lR 0500029312011007; 09/1212011 - 101612011; Pilgrim Nuclear Power Station; Component

Design Bases Inspection.

The report covers the Component Design Bases Inspection conducted by a team of four NRC inspectors and two NRC contractors. Three findings of very low safety significance (Green)were identified, all of which were considered to be non-cited violations (NCVs). The significance of most findings is indicated by their color (Green, White, Yellow, Red) using lnspection Manual Chapter (lMC) 0609, "Significance Determination Process." Cross-cutting aspects associated with findings are determined using IMC 0310, "Components Within the Cross-Cutting Areas." The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

NRC-ldentified Findinqs

Cornerstone: Mitigating Systems

. Green: The team identified a finding of very low safety significance involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion lll, Design Control, because Entergy had not verified the adequacy of the 4160 volt emergency bus 95% voltage alarm/load shed relay design regarding the potential for multiple starts of the salt service water (SSW) and reactor building closed cooling water (RBCCW) pump motors.

Additionally, Entergy had not verified the adequacy of design with respect to the ability of the SSW pump motors to restart following a load shed of the motors without tripping the motor control center (MCC) thermal overload (TOL) relays at design basis degraded voltage conditions. Entergy entered the issue into their corrective action program and implemented measures to bypass the SSW pump motor TOL relay motor trips based on their initial review of TOL margin. The team determined this to be a conservative action which ensured under all conditions including degraded voltage, that the SSW pump motors would not be inadvertently tripped due to TOL margin concerns.

The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding in accordance with IMC 0609,

Significance Determination Process, Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of findings." The finding was determined to be of very low safety significance because it was a design deficiency confirmed not to result in a loss of operability. This finding was not assigned a cross-cutting aspect because it was a historical design issue not indicative of current performance. (Section 1R21.2.1.1)

Green: The team identified a finding of very low safety significance involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion Xl, Test Control, because Entergy did not adequately perform battery discharge testing and assure that the battery discharge test procedures incorporated requirements contained in applicable design documents for multiple cycles of Technical Specification (TS) required surveillance testing of the station batteries. Specifically, test results have been negatively impacted because of improper use of battery test equipment and tests had errors with load profiles. Entergy entered these issues into the corrective action program to evaluate and correct the deficiencies in the battery testing program and ensure any future testing requirements are met.

The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding in accordance with IMC 0609,

Significance Determination Process, Attachment 0609.04, " Phase 1 - Initial Screening and Characterization of Findings." The team determined the finding was of very low safety significance because it was not a design or qualification deficiency, did not represent a loss of system safety function, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. This finding had a cross-cutting aspect in the area of Human Performance, Resources Component, because Entergy did not ensure that complete, accurate, and upto-date procedures were available and adequate to assure nuclear safety. Specifically, the battery discharge test procedures did not ensure that capacities were correctly measured and service test profiles were correctly translated from the battery design calculations.

(lMC 0310, Aspect H.2(c)) (Section 1R21.2.1.2)

Green: The team identified a finding of very low safety significance involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion lll, Design Control, because Entergy did not verify the adequacy of the design with respect to ensuring that safety-related equipment would be adequately protected from a postulated flood originating in the turbine building. Specifically, Entergy did not correctly evaluate a failure of seawater system piping or equipment that could challenge the doors separating the turbine building from the reactor building auxiliary bay, which would require timely operator identification and action to secure the seawater pumps to prevent the common mode failure of redundant safety-related components. Entergy entered the issue into their corrective action program, evaluated the immediate operability of systems potentially affected by the postulated flooding scenario, and provided interim guidance to operators.

The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding in accordance with IMC 0609, Appendix A, " significance Determination of Reactor Inspection Findings for At-Power Situations," ill and completed a Phase 3 risk evaluation using the Pilgrim Standardized Plant Analysis Risk (SPAR) model, Revision 8.15 and SAPHIRE 8. Based upon the Phase 3 evaluation, the finding was determined to be of very low safety significance. The finding was not assigned a cross-cutting aspect because it was a historical design issue not indicative of current performance. (Section 1R21.2.2.3)iv

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

==1R21 Component Desiqn Bases Inspection (lP 71111.21)

==

.1 lnspection Sample Selection Process

The team selected risk significant components for rdview using information contained in the Pilgrim Probabilistic Risk Assessment (PRA) and the U.S. Nuclear Regulatory Commission's (NRC) Standardized Plant Analysis Risk (SPAR) model for the Pilgrim Nuclear Power Station. Additionally, the team referenced the Risk-lnformed Inspection Notebook for the Pilgrim Nuclear Power Station (Revision 2.1a)in the selection of potential components for review. ln general, the selection process focused on components that had a Risk Achievement Worth (RAW) factor greater than 1.3 or a Risk Reduction Worth (RRW) factor greater than 1.005. The components selected were associated with both safety-related and non-safety related systems, and included a variety of components such as pumps, transformers, diesel engines, batteries, and valves.

The team initially compiled a list of components based on the risk factors previously mentioned. Additionally, the team reviewed the previous component design bases inspection (CDBI) reports (0500029312008007 and 0500029312006006) and excluded the majority of those components previously inspected. The team then performed a margin assessment to narrow the focus of the inspection to 18 components and four operating experience (OE) items. The team selected a main steam isolation valve (MSIV) and a containment vent valve to review for large early release frequency (LERF) implications.

The team's evaluation of possible low design margin included consideration of original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition/equipment reliability issues. The assessment also included items such as failed performance test results, corrective action history, repeated maintenance, Maintenance Rule (aX1) status, operability reviews for degraded conditions, NRC resident inspector insights, system health reports, and industry OE.

Finally, consideration was also given to the uniqueness and complexity of the design and the available defense-in-depth margins.

The inspection performed by the team was conducted as outlined in NRC lnspection Procedure (lP) 71111.21. This inspection effort included walkdowns of selected components; interviews with operators, system engineers, and design engineers; and reviews of associated design documents and calculations to assess the adequacy of the components to meet design basis, licensing basis, and risk-informed beyond design basis requirements. Summaries of the reviews performed for each component and OE sample are discussed in the subsequent sections of this report. Documents reviewed for this inspection are listed in the Attachment.

.2.2.1

Results of Detailed Reviews

Results of Detailed Component Reviews (18 samples)

4160 Volt Bus A5 Svstem Voltaqe Alarm/Load Shed Looic Relavs

.2.1.1 a.

Insoection Scope The team inspected the 4160 volt Bus A5 95% voltage level alarm and load shed relay protection scheme to verify it was capable of meeting its design basis requirements. The voltage relays (127A-A511&2)were designed to monitor 4160 volt emergency Buses A5 and A6, and to initiate a load shed of non-essential loads and essential loads such as the salt service water (SSW) and reactor building closed cooling water (RBCCW) pump motors. The relays were designed to function at the 95% voltage level when the emergency buses were supplied from the startup transformer coincident with a loss-of-coolant-accident (LOCA) signal. The design intent of the load shedding was to improve the voltage at safety-related motor control centers (MCCs) to a level where the degraded voltage relays could be set to protect safety-related equipment at a reasonable switchyard voltage. The team reviewed the adequacy of the pickup and reset setpoints for the 95% voltage and the second level undervoltage relays with respect to meeting their design functions. The team also reviewed the Independent Systems Operator (lSO)-New England (NE) system response studies for offsite power conditions and contingencies for Pilgrim Station reactive power voltage support conditions.

b.

Findinqs

Introduction:

The team identified a finding of very low safety significance (Green)involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion lll, Design Control, because Entergy had not verified the adequacy of the 4160 volt emergency bus 95% voltage alarm/load shed relay design regarding the potential for multiple starts of the SSW and RBCCW pump motors. Additionally, Entergy had not verified the adequacy of design with respect to the ability of the SSW pump motors to restart following a load shed of the motors without tripping the MCC thermal overload relays (TOLs) at design basis degraded voltage conditions.

Description:

The design of the 95% voltage relays was to provide an alarm when the safety bus voltage dropped to this value. The alarm at this voltage level is provided when the safety buses are powered via the unit auxiliary transformer (UAT), startup transformer (SUT), emergency diesel generators (EDGs), or the shutdown transformer (SDT). These relays provide a load shed function after a nominal 10 second time delay only when the safety buses are powered from the SUT, which is the preferred power source, and when a LOCA signal is present. The load shed logic was intended to reduce the load and increase the voltage available at the safety-related buses. ln addition to the 95% voltage relay, the adequacy of offsite voltage is monitored by the second level undervoltage relays which are set to operate at a nominal92o/o of 4160 bus voltage after 10 seconds. lf voltage remained below this level, then the buses would transfer to the emergency diesel generators.

The team noted that the undervoltage design results in load shedding of non-essential loads as well as the safety-related SSW and RBCCW pumps. The team determined that this design had the potential to result in several hot restarts of the SSW and RBCCW pump motors, depending on offsite power voltage conditions during a LOCA. A hot motor start is restarting of a motor which was previously in operation prior to the motor temperature returning to ambient temperature conditions. The team noted that the load shed would take place if the voltage levels on the safety buses would not recover above 95o/o for 10 seconds during a postulated LOCA. The team determined that the SSW pump motor capability was specified in accordance with industry motor design standard National Electrical Manufacturers Association (NEMA) MG-1, Motors and Generators, which allows for one hot start when a motor is initially at a temperature that does not exceed its rated load operating temperature. During the inspection, the team found that the in-service SSW pump motors were operating at greater than rated full load while the RBCCW pump motor was found to be operating at less than rated full load.

The team reviewed Entergy's analysis for SSW pump motor load during a postulated LOCA and noted that the SSW pump load was analyzed at 113 brake horsepower (HP),which was within the service factor rating of the motor (1 15 HP). This indicated that the SSW pump motors would potentially be operating at or above the rated full load (100 HP)operating temperature and considered to be a hot running condition. lf offsite power voltage levels during a LOCA resulted in the 95% bus voltage relay actuation, the SSW pumps would trip and automatically restart in approximately 22 seconds based on load sequencing and SSW pump header pressure. This would result in the first hot start of the motors. The team noted that a postulated continued degradation of offsite voltage would eventually result in the second level undervoltage (92%) relays operating at the design basis degraded voltage level. The A5 and 46 4160V safety buses would be automatically isolated from the SUT source and would transfer to the EDGs resulting in another hot restart of the SSW and RBCCW pump motors which would be outside of NEMA guidelines. In response to the team's concern, Entergy evaluated the postulated condition of two hot motor starts for the SSW and RBCCW motors and determined the issue to be an insulation degradation issue that would result in a reduction of motor operating life, but not result in motor damage.

During the investigation of the motor start issue, Entergy took current measurements for the SSW and RBCCW pump motors and determined that the SSW motors were operating above their full load ampacity of a nominal 1 13 amperes and into or over their service factor at a nominal 136 amperes. The team and Entergy personnel determined that the above higher than expected current required a review with respect to TOL margin. Specifically, the team questioned the impact of the 95% undervoltage load shed design given the existing field current measurements for the motors and the potential for inadvertently tripping the TOL relays during a postulated LOCA and a hot SSW pump motor restart condition. Entergy performed a preliminary analysis during the inspection and determined that very little margin existed in the overload relay heater setting with respect to not inadvertently tripping the MCC TOL relays at design bases degraded bus voltage conditions. The RBCCW pump motor TOLs were not considered to be a concern based on the motor load factor, which was determined to be less than 100 percent rated full load under all conditions.

During the inspection, Entergy developed and implemented a plan to bypass the SSW pump motor TOL relay motor trips based on the limited preliminary margin determination.

The team determined this to be a conservative action which ensured under all conditions the SSW pump motors would not be inadvertently tripped due to TOL margins. Entergy subsequently performed a test of a SSW motor TOL relay which was designed to simulate two hot motor starts after maximum motor load for degraded bus voltage conditions. The results of the testing demonstrated that the TOL relays did not actuate for the postulated two hot motor starts, providing reasonable assurance of past operability of the SSW pump motors. Additionally, Entergy performed a historical review of expected plant post-trip voltage response of the offsite power network to anticipated worst case conditions and postulated contingencies. The results provided assurance that offsite power voltage levels would not have resulted in multiple hot motor restarts given a postufated LOCA condition. Entergy initiated condition reports CR-PNP-2011-04182 and CR-PNP-2011-04285 on the multiple motor restart and TOL relay issues, respectively.

Analysis:

The team determined that the failure to evaluate the 4160 volt emergency bus 95% voltage alarm and load shed relay design for impact on SSW and RBCCW motors during a design basis LOCA was a performance deficiency. The performance deficiency was determined to be more than minor because it was similar to example 3.j of NRC IMC 0612, Appendix E, Examples of Minor lssues, in that, based on design degraded voltage conditions, there was a reasonable doubt of operability with respect to SSW pump motor TOL settings. ln addition, the performance deficiency was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, Entergy had not previously evaluated the impact of possible multiple motor starts on the capability of the SSW and RBCCW pump motors and on the adequacy of the motor thermal overload settings for design basis LOCA conditions.

The team evaluated the finding in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of findings," Table 4afor the Mitigating Systems Cornerstone. The finding screened as very low safety significance (Green) because it was a design deficiency confirmed not to result in a loss of operability. This finding was not assigned a cross-cutting aspect because it was a historical design issue not indicative of current performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion lll, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of September 16, 2011, the 4160 volt emergency bus 95%

voltage alarm and load shed relay design had not been adequately verified for the impact on SSW and RBCCW pump motors and TOLs during design basis LOCA and degraded voltage conditions. However, because this violation was of very low safety significance, and since it was entered in the licensee's corrective action program (CAP) as CR-PNP-2011-04182 and CR-PNP-2011-04285, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000293/2011007-01, Inadequate Evaluation of the Adequacy of the 4160 Volt Emergency Bus 95%

Voltage Alarm and Load Shed Relay Design)

.2.1.2 D1 and D3 Station Batteries (2 samples)

a. Inspection Scope

The team reviewed the design, testing, and operation of the 125 VDC D1 and 250 VDC D3 station batteries to verify that they could perform their design function of providing reliable sources of direct current (DC) power to connected loads under operating, transient, and accident conditions. The team reviewed design calculations to assess the adequacy of the batteries' sizing to ensure they could power the required equipment for a sufficient duration, and at a voltage above the minimum required for equipment operation. The team reviewed battery test results to ensure that the testing was in accordance with design calculations, the plant Technical Specifications (TSs), vendor recommendations, and industry standards; and that the results confirmed acceptable performance of the battery. Design and system engineers were interviewed regarding the design, operation, testing, and maintenance of the DC system. The team performed a walkdown of the batteries, DC buses, battery chargers, and associated distribution panels to assess the material condition of the equipment. Finally, a sample of condition reports (CRs) was reviewed to ensure Entergy was identifying and properly correcting issues associated with the D1 and D3 batteries.

b.

Findinos lntroduction: The team identified a finding of very low safety significance (Green)involving a non-cited violation of 10 CFR Part 50, Appendix B, Criterion Xl, Test Control, because Entergy did not adequately perform battery discharge testing and assure that the battery discharge test procedures incorporated requirements contained in applicable design documents for multiple cycles of TS required surveillance testing of the station batteries. Specifically, test results have been negatively impacted because of improper use of battery test equipment and tests had errors with load profiles.

Description:

The team reviewed the results of station battery TS surveillance discharge testing conducted from 2001 through 2011. The discharge tests included performance tests and service tests. Performance tests are used to determine the capacity of a battery, which, when trended and properly evaluated, will accurately determine when a battery is reaching the end of its service life. Initially, performance tests are performed every five years, but the test frequency increases as the battery approaches the end of its service life. Service tests are tests, in the as-found condition, of the battery's capability to satisfy the battery duty cycle. The battery duty cycle is the calculated worst case loading required for the battery.

During performance tests, an individual cell voltage shutdown value is used to stop the test if a cell voltage is too low. The team reviewed the most recent performance discharge tests for the D1 and D3 batteries in 2009. For the D1 battery the individual cell voltage shutdown value was set to 1.5 volts, and for the D3 battery the shutdown was set to 1

.6 volts. Institute of Electrical and Electronics Engineers (IEEE) Standard 450-1995

states that the tests should only be paused if a cell reaches one volt or less. The team reviewed the test procedures and noted that the procedures did not specify the individual cell voltage shutdown value. The team also noted that the procedure allowed the test to be stopped and considered complete. The IEEE 450-1995 provides direction to jumper low voltage cells or to continue the test with a low cell, but does not allow for stopping the test early. Battery capacity is the ratio of test time to rated time, so stopping the test early would result in an incorrectly measured capacity. The team determined that for the 2009 D1 and D3 battery performance discharge tests, the tests were stopped early and the battery capacities were not accurately measured. The battery capacities were required to be measured accurately because the change of capacity from one test to the next provides an indication of the end of service life for a battery. The team reviewed CRs from 2005 that described procedural and equipment issues that Entergy identified during the 2005 performance tests. In response to the issues, Entergy reviewed the 2005 and 2009 test results and by calculating estimated corrected capacities, demonstrated adequate capacity trends.

The team reviewed the 2011 service test for the D1 battery. The team compared the service test load profile to the design load profile and noted that the test profile was different and non-conservative. Entergy, as an extent-of-condition review, identified that the D2 battery also had a non-conservative load profile. Based on other conservatisms in the design calculations and the voltage margin recorded during the tests, Entergy determined that there was reasonable assurance that the batteries were operable.

The team reviewed the temperatures of the D1 and D3 battery cells as recorded in routine surveillances and observed that the summer time temperatures of the battery cells exceed the manufacturer's ideal temperature of 77"F. Elevated temperatures are known to accelerate the degradation of battery cells. As cell degradation reduces the expected service life performance testing frequency is increased. The team determined that the battery testing procedures did not require increased performance testing based on temperature derating. Based on the observed deficiencies with the battery testing, the team concluded there was reasonable doubt whether the battery test control program would accurately record or recognize indications of a degraded battery in a timely fashion. In response to the issue, Entergy reviewed historical temperatures and test results to confirm and conclude the batteries remained operable. Entergy initiated actions to share test results with the battery vendor for additional followup and assurance of continued operability. Entergy also initiated actions to fully evaluate any future testing requirements.

Entergy entered the issues into the CAP (CR PNP-2011-4495) and implemented actions to evaluate and correct the deficiencies in the battery testing program. Entergy determined that there were no operability issues for the batteries, and the surveillance test results did not exceed TS acceptable values. Based on the repetitive nature of the issues, Entergy initiated a higher tier apparent cause evaluation to fully address the battery testing deficiencies. The team reviewed Entergy's basis for operability and independently evaluated battery operability. The team determined that Entergy's conclusion that the issues identified did not render any of the batteries inoperable, based on the magnitude of the errors and current battery capacity margin, was reasonable.

Analvsis: The team determined that the failure to adequately perform battery discharge testing and assure that the battery discharge test procedures incorporated requirements contained in applicable design documents was a performance deficiency that was reasonably within Entergy's ability to foresee and prevent. The performance deficiency was determined to be more than minor because it was similar to Example 2c of NRC IMC 0612, Appendix E, "Examples of Minor lssues," in that the test control inadequacies affected multiple batteries and the issue was repetitive. In addition, the performance deficiency was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potentialfor impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements.

The team evaluated the finding in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Table 4a. The team determined the finding screened as very low safety significance (Green) because it was not a design or qualification deficiency, did not represent a loss of system safety function, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event.

This finding had a cross-cutting aspect in the area of Human Performance, Resources Component, because Entergy did not ensure that complete, accurate, and up-to-date procedures were available and adequate to assure nuclear safety. Specifically, the battery discharge test procedures did not ensure that capacities were correctly measured and service test profiles were correctly translated from the battery design calculations.

(lMC 0310, Aspect H.2(c))

Enforcement:

10 CFR Part 50, Appendix B, Criterion Xl, Test Control, requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to the above, between May 1, 2005, and May 5,2Q11, Entergy did not adequately perform battery discharge testing and assure that the battery discharge test procedures incorporated requirements contained in applicable design documents for the D1, D2, and D3 batteries.

Specifically, there were instances where Entergy did not correctly measure battery capacity and incorporate the design load profiles for station battery discharge tests.

Because this violation was of very low safety significance (Green) and has been entered into Entergy's CAP (CR-PNP-2011-4495), this violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000293/2011007-02, Inadequate Test Gontrol of Safety Related Bafteries)

.2.1.3 Residual Heat Removal Iniection Valve. MOV-1001-298

a.

lnspection Scope The team inspected the residual heat removal (RHR) injection motor-operated valve (MOV), MOV-1001-298, to verify the valve was capable of performing its design basis function. The valve is a normally closed gate valve with a safety function to open on a low pressure coolant injection (LPCI) initiation signal and to automatically close on a LPCI loop select logic isolation signal to isolate a downstream broken loop. The team reviewed the Updated Final Safety Analysis Report (UFSAR), the TSs, design basis documents, drawings, and procedures to identify the design basis requirements of the valve. The team reviewed the valve inspection and periodic MOV diagnostic test results and stroketiming test data to verify acceptance criteria were met. The team verified the MOV safety functions, performance capability, torque switch configuration, and design margins were adequately monitored and maintained in accordance with NRC Generic Letter 89-10 guidance. The team reviewed MOV weak link calculations to ensure the ability of the MOV to remain structurally functional while stroking under design basis conditions. The team verified that the MOV valve analysis used the maximum differential pressure expected across the valve during worst case operating conditions.

Additionally, motor data and voltage drop calculation results were reviewed to confirm that the MOV would have sufficient voltage and power available at the motor starter and motor terminals to perform its safety function at degraded voltage conditions. The team conducted walkdowns of the valve and associated injection piping to assess the material condition and to verify the installed configuration was consistent with the plant drawings, and the design and licensing bases. Finally, the team reviewed corrective action documents to determine if there were any adverse trends associated with the MOV and to asses Entergy's capability to evaluate and correct deficiencies with the valve.

b.

Findinqs No findings were identified.

.2.1.4 Standbv Liquid Control Pump. P2078

a. Inspection Scope

The team inspected the'B'standby liquid control (SLC) pump (P2078) to verify that it was capable of meeting its design basis requirements. The SLC system is designed to deliver a neutron-absorber solution, at a specified boron concentration and injection rate, to the reactor pressure vessel (RPV) during an Anticipated Transient Without Scram (ATWS) event to safely shutdown the reactor. The team reviewed calculations and surveillance test procedures to verify that the pump was capable of achieving design basis flow requirements during limiting design basis conditions and that the test acceptance criteria were consistent with these requirements. The team reviewed the I

hydraulic calculations associated with system flowrate and pressure as well as net-positive-suction-head (NPSH) margin for the pump to ensure that the required performance could be achieved.

The team reviewed selected industry operating experience and Entergy's associated actions to verify that Entergy incorporated applicable insights from the OE. The team interviewed system engineers and maintenance personnel in order to review the design and system functional requirements, as well as obtain historical performance and trend data. The team performed a review of the emergency operating procedures (EOPs)associated with post-accident pump operation to ensure the capability of the component to perform as required under accident conditions. The team conducted walkdowns and visual inspections of the SLC pumps and associated support systems, including control room instrumentation, to assess Entergy's configuration control, the material condition, operating environment, and potential vulnerability of the SLC pumps to external hazards.

Finally, the team reviewed system health reports, component maintenance history, and CRs to verify that Entergy monitored or prevented potentialdegradation.

b.

Findinos No findings were identified.

.2.1.5 Emeroency Diesel Generator Fuel OilTransfer Pump. P-1418

a. Inspection Scope

The team inspected the'B' EDG motor-driven fuel oil transfer pump (FOTP) (P-141B) to verify that it was capable of meeting its design basis requirements. The EDG FOTP is designed to automatically transfer fuel oil from the respective EDG fuel oil storage tank (FOST) to the associated fuel oil day tank (FODT) to support prolonged EDG operation.

The team reviewed applicable portions of the UFSAR, associated DBD, and drawings to identify the design basis requirements for the pump. The team reviewed calculations and surveillance test procedures to verify that the pump was capable of achieving design basis head/flow requirements during limiting design basis conditions and that test acceptance criteria were consistent with these requirements. The team reviewed FOTP hydraulic design requirements related to FOST vortexing and NPSH margin to verify the design capability of the pump during normal and accident conditions. The team also independently verified FOST and FODT levels during walkdowns and reviewed Entergy's monitoring of fuel oil tank levels to ensure compliance with TS requirements for onsite fueloil inventory.

The team interviewed non-licensed operators (NLOs), reviewed associated response procedures and operator training, and observed an NLO respond to a simulated demand to align and transfer fuel oil from the station blackout diesel generator (SBODG) fuel oil tanks to the EDG FOSTs. This observation was performed to independently assess the likelihood of cognitive or execution errors, to identify unforeseen operator challenges, and to ensure the availability of this credited standby equipment. The team conducted walkdowns and visual inspections of the FOTP and associated support systems to assess Entergy's configuration control, the material condition, operating environment, and potential vulnerability of the FOTP to external hazards. The team reviewed system health reports, work orders, surveillance test results, and corrective action documents to identify failures or nonconforming issues, and to determine if Entergy appropriately identified, evaluated, and corrected deficiencies.

b.

Findinos No findings were identified.

.2.1.6 Station Blackout Diesel Generator (SBODG)

a.

Insoection Scope The team inspected the SBODG to verify that it was capable of meeting its design basis requirements. The SBODG is designed to supply one of the two 4KV safety-related buses, A5 or 46, through bus A8 breaker 4801 concurrent with a failure of either one or both EDGs following a loss-of-offsite power (LOOP) event. The SBODG is Pilgrim Station's credited alternate AC (AAC) power source for mitigating a station blackout (SBO) event onsite. The team reviewed applicable portions of the UFSAR, associated DBD, and docketed correspondence to identify the design and licensing basis requirements for the SBODG. The team reviewed surveillance test procedures to verify that the SBODG was capable of achieving design basis requirements during limiting design basis conditions and that test acceptance criteria were consistent with these requirements. The team reviewed the loading calculation to verify that it is sufficiently sized to supply all the anticipated electrical loads during an SBO. The team also reviewed the sizing of the A8 switchgear battery to obtain reasonable assurance that the battery was adequately sized to perform the required breaker operations and energize the SBODG control panel during an SBO.

tn addition, the team interviewed NLOs and reactor operators, reviewed associated response procedures and operator training, and observed an NLO respond to a simulated demand to align and start the SBODG from its local control panel. This was performed to independently assess the likelihood of cognitive or execution errors, to identify unforeseen operator challenges, and to verify remote start capability. The team reviewed selected industry and internal OE, and Entergy's associated actions to verify that Entergy incorporated applicable insights and lessons-learned from the OE. Finally, the team conducted walkdowns and visual inspections of the SBODG and associated support systems to assess Entergy's configuration control, the material condition, operating environment, and potential vulnerability of the SBODG and associated bus A8 to external hazards. The team reviewed system health and walkdown reports, preventive and corrective maintenance work orders, surveillance test results, and corrective action documents to identify failures or nonconforming issues, and to determine if Entergy appropriately identified, evaluated, and corrected deficiencies.

b.

Findinqs No findings were identified.

.2.1.7 Diesel Driven Fire Pump. P-140

a. Inspection Scope

The team inspected the diesel-driven fire pump (DDFP) (P-140) to verify that it was capable of meeting its design basis requirements. The primary purpose of the fire water system is to provide a sufficient and reliable water source for fire fighting. lts secondary function is to provide an alternate source of water for RPV injection, upper containment spray, and torus spray during an SBO or a severe accident. The team reviewed applicable portions of the UFSAR, associated DBD, and drawings to identify the design basis requirements for the DDFP. The team reviewed fire pump test procedures to verify that the pump was capable of achieving design basis head/flow requirements during limiting design basis conditions and that test acceptance criteria were consistent with these requirements.

The team interviewed NLOs, reviewed associated response procedures and operator training, and observed several NLOs respond to a simulated demand to align and transfer fuel oil from the'A' EDG FOST to the DDFP day tank using the'A' EDG FOTP.

In addition, the team observed a NLO respond to a simulated demand to align and transfer fuel oil from the 'A' EDG FOST to the DDFP day tank using the hydroturbine pump (P-181) and to align the firewater cross-tie to the RHR system. The team observed these activities and walked down the associated structures, systems, and components (SSC) to independently assess the likelihood of cognitive or execution errors, to identify unforeseen operator challenges or procedure issues, and to verify that operators could perform the credited function. The team reviewed selected industry OE and Entergy's associated actions to verify that Entergy incorporated insights from the OE. The team conducted walkdowns and visual inspections of the DDFP and associated support systems, including the fire water storage tanks and fuel oil day tank, to assess Entergy's configuration control, the material condition, operating environment, and potential vulnerability of the DDFP to external hazards. Finally, the team reviewed system health reports, preventive and corrective maintenance work orders, test results, and corrective action documents to identify failures or nonconforming issues, and to determine if Entergy appropriately identified, evaluated, and corrected deficiencies.

b.

Findinqs No findings were identified,

.2.1.8 'B' Residual Heat Removal Pump. P-203B

a. Inspection Scope

The team inspected the'B' RHR pump (P-203B) to verify that the pump was capable of performing its design basis function. The pump has a safety function of taking suction from the torus (suppression pool) and delivering low pressure-high volume cooling water flow through the associated heat exchangers to the reactor vessel. The team reviewed the pump NPSH requirements and available NPSH to ensure the pump was capable of fulfilling its safety function at the maximum flowrates assumed. The team evaluated pump performance to ensure there was no degradation by reviewing inservice testing (lST) results.

The team reviewed UFSAR and TS design requirements to ensure consistency between pump parameters, and the test requirements. The team walked down the pump and motor, and accessible portions of the RHR system, to independently assess Entergy's configuration control, the pump's operating environment, and the RHR system material condition. The team reviewed system health reports, preventive and corrective maintenance work orders, and corrective action documents to identify failures or nonconforming issues, and to determine if Entergy appropriately identified, evaluated, and corrected deficiencies.

b.

Findinos No findings were identified.

.2.1.9 Hiqh Pressure Coolant Iniection Temperature lsolation Instrumentation. TS-2371C and

TS-2373C a.

lnspection Scope The high pressure coolant injection (HPCI) system temperature isolation instrumentation, TS-2371C and TS-2373C, were inspected to verify they were capable of performing their design function. The team interviewed design engineers regarding the function, testing, and performance of the instrumentation to ensure that appropriate assumptions had been used in the setpoint calculations. The team reviewed the setpoint calculations to verify that they were consistent with expected normal and accident plant conditions. The team reviewed the calibration test results for the instrumentation to verify that the acceptance criteria were in accordance with the setpoint calculations and that the results were within the calculated expected drift. The team reviewed the calibration procedures and test frequencies to verify that the calibration testing was being done in a manner sufficient to detect any degradation. Finally, a sample of CRs was reviewed to ensure Entergy was identifying and properly correcting issues associated with the instrumentation.

b.

Findinqs No findings were identified.

.2.1.1 0 HPCI Stop Valve. HO-1

a. Inspection Scope

The team inspected the HPCI stop valve (HO-1) to verify that it was capable of meeting its design basis requirements. This valve was provided as part of the HPCI pump driver assembly and was designed to isolate steam from the turbine and trip the pump. The team reviewed applicable portions of the UFSAR and drawings to identify the design basis requirements for the valve. The team reviewed surveillance procedures to verify that the valve was capable of performing its design basis function and that test acceptance criteria were consistent with these requirements.

The team interviewed design and system engineers to review the design and system functional requirements as well as historical test performance results. The team also performed walkdowns of the valve and associated equipment to assess the material condition of the equipment. ln addition, the team reviewed work orders and corrective action documents to identify failures or nonconforming issues, and to determine if Entergy appropriately identified, evaluated, and corrected these deficiencies.

b.

Findinqs No findings were identified.

.2.1.1 1Main Steam lsolation Valve. AO-203-2B

a. Inspection Scope

The team inspected a main steam isolation valve (MSIV), AO-203-28, to verify that the valve was capable of meeting its design basis requirements. The MSIVs are designed to isolate the main steam lines under transient and accident conditions. The team reviewed the UFSAR, drawings, and procedures to identify the design basis requirements. The team reviewed a sample of surveillance test results to verify that valve performance met the acceptance criteria with respect to design basis stroke times. The acceptance criterion for stroke time was reviewed to ensure consistency with engineering analysis assumptions. The team interviewed the system engineer and reviewed corrective action documents to determine whether issues were appropriately evaluated and corrected.

b.

Findinos No findings were identified.

.2.1.1 2 HPCI Turbine Exhaust Vacuum Relief Line. MOV 2301-33 and 34

a.

lnspection Scope The team inspected the HPCI turbine exhaust vacuum relief line, including the motor operated isolation valves MOV 2301-33 and 34 and the HPCI turbine exhaust check valve, to verify the valves were capable of performing their design function. The team reviewed the UFSAR, calculations, and procedures to identify the design basis requirements of the valves. The team reviewed periodic motor operated valve verification diagnostic test results and stroke test documentation to verify acceptance criteria were met. Additionally, the team verified the valves' safety function was maintained in accordance with Generic Letter (GL) 89-10 guidance by reviewing torque switch settings, performance capability, and design margins. The team reviewed degraded voltage conditions and voltage drop calculations to confirm that the valves would have sufficient voltage and power available to perform their safety function under worst case degraded voltage conditions. The team also reviewed the test and maintenance history of the HPCI turbine exhaust check valve to ensure it would be capable of performing its required isolation function under design basis conditions.

The team interviewed the motor operated valve and check valve program engineers to gain an understanding of the maintenance issues and overall reliability of these valves.

The team conducted walkdowns to assess the material condition of the valves and associated equipment. Finally, corrective action documents were reviewed to verify that

.

Entergy was appropriately identifying and resolving deficiencies and that the valves were properly maintained.

b.

Findinqs No findings were identified.

.2.1.1 3 'B' Reactor Buildinq Component Coolinq Water Heat Exchanqer (RBCCW)

a. Inspection Scope

The team inspected the'B' RBCCW heat exchanger to verify that it was capable of performing its design function. The heat exchanger is designed to transfer heat from the RBCCW system to the salt service water system and the ultimate heat sink. The team reviewed the UFSAR, calculations, and procedures to identify the RBCCW heat exchanger design basis requirements. The team reviewed heat exchanger testing procedures and results to ensure consistency with design basis requirements. The team reviewed calculations to verify the basis of test acceptance criteria. The team reviewed the actions taken in response to a previous heat exchanger tube leak to ensure that the condition was corrected.

The team interviewed the system engineer to gain an understanding of maintenance issues and overall reliability of the heat exchanger. The team conducted a walkdown to assess the material condition of the heat exchanger and associated equipment. Finally, corrective action documents were reviewed to verify that Entergy was appropriately identifying and resolving deficiencies and that the heat exchanger was properly maintained.

b.

Findinqs No findings were identified.

.2.1.1 4'B' Emerqencv Diesel Generator Mechanical Review. X-107B

a. Inspection Scope

The team inspected the 'B' EDG and its associated fuel oil, lube oil, starting air, intake and exhaust, and jacket water cooling systems to ensure they could perform their respective design basis function in response to transient and accident events. The team reviewed the UFSAR, the TSs, design basis calculations, vendor documents, and procedures to identify the design basis, maintenance, and operational requirements for the engine and its support systems. The team reviewed the design specification for the starting air system, as well as air start test results, the normal operating pressure band, air compressor actuation setpoint, and the TS limit for operability to verify that the starting air system was properly sized and could meet its design function for successive starts.

The team reviewed EDG surveillance test results, operating procedures, and maintenance work packages to determine the overall health of the EDG engine and its mechanical support systems.

The team performed several field walkdowns of the EDG and observed a monthly surveillance test to independently assess the material condition and the operating environment of the EDGs and associated electrical equipment. During the walkdowns, the team compared local and remote EDG control switch positions, breaker position indicating lights, and system alignments to design and licensing bases assumptions to verify the adequacy of the equipment configuration control. The team interviewed slstem engineers and operators to evaluate past performance and operation of the EDGs. The team reviewed system health reports and corrective action documents to determine if there was any adverse equipment operating trends and to ensure problems were properly identified and corrected. Additionally, the team conducted pre and post-surveillance test operation walkdowns to assess the equipment material condition.

b.

Findinos No findings were identified.

.2.1.1 5 'B'EDG Electrical Review. X-107B

a.

lnspection Scope The team inspected the'B' EDG to verify that it was capable of meeting its design basis requirements for starting components such ds starting air solenoids, generator field flash, and the generator breaker close coil. The team reviewed electrical one-line diagrams for the EDG, the vendor nameplate rating data, and the EDG load study to ensure that the EDG was operated consistent with its rating and capable of operating under the worst case design basis loading conditions. The team reviewed the adequacy of voltage available for the starting components and ensured that surveillance testing adequately verified that components would be functional. The team reviewed the brake horsepower basis for selected pump motors to ensure loads were adequately considered in the loading study at the most conservative motor load conditions. Finally, CRs relative to electrical issues were reviewed to verify deficiencies were appropriately identified and resolved, and the generator was properly maintained.

b.

Findinqs No findings were identified.

.2.1.1 6 480V Bus 81 Transformer. X21

a. Inspection Scope

The team inspected the 4.16kV 480V transformer X21 to verify that it was capable of meeting its design basis requirements. Transformer X21 is designed to provide power to the safety-related 480V bus 81. The team reviewed loading calculations to determine the design basis maximum load and reviewed the bus load center equipment vendor ratings to ensure they were in conformance with the design basis. The team also reviewed the coordination/protection calculation for the transformer incoming line and load side breakers for design basis load flow conditions, and transformer protection and coordination. The team performed walkdowns of the transformer to assess the observable material condition. The team reviewed transformer cooling fan schematics and surveillance tests to ensure acceptance criteria would support the design basis load requirements. Finally, the team reviewed CRs and system health reports to verify that deficiencies were appropriately identified and resolved.

b.

Findinqs No findings were identified.

.2.1.1 7 Torus Puroe Exhaust lsolation Valve AO-5042B and Torus Vent Valve AO-5025

a. Inspection Scope

The containment torus purge exhaust isolation valve (AO-50428) and the associated direct torus vent valve (AO-5025) were reviewed to verify their ability to operate in the event of an emergency. These vent valves are manually opened to allow operators to vent primary containment during severe accidents which involve the loss of decay heat removal. The team reviewed the design bases document, maintenance history, design changes, CRs, drawings, and associated surveillance testing to ensure the valves were capable of performing their intended safety function. The team also interviewed operators and the system engineer, and performed a walkdown to assess the current material condition of the valves, related piping, associated pipe support structures, and air supply and backup nitrogen supply lines.

ln addition, the team reviewed the associated EOP and assessed the manual operator actions required to operate the valves to ensure the operators were provided with clear guidance to perform the actions as credited in the Pilgrim design and licensing bases.

The following were also assessed:

r The time needed to complete the actions; r

The complexity of the actions;

.

The reliability and/or redundancy of components associated with the actions; o

The extent-of-actions to be performed outside of the control room; and o

The amount of relevant operator training conducted.

b.

Findinqs No findings were identified.

.2.2 Review of Industrv Operatino Experience and Generic lssues (4 samples)

The team reviewed selected OE issues for applicability at the Pilgrim Nuclear Power Station. The team performed a detailed review of the OE issues listed below to verify that Entergy had appropriately assessed potential applicability to site equipment and initiated corrective actions when necessary.

.2.2.1 NRC Information Notice 2006-01: Torus Crackino in a Boilino Water Reactor Mark I

Containment

a. Inspection Scope

The team evaluated Entergy's applicability review and disposition of NRC Information Notice (lN) 2006-01. The NRC issued the lN to inform the owners of Boiling Water Reactor (BWR) Mark I containments about the occurrence and potential causes of the through-wall cracking of a torus in a BWR Mark I containment. The team independently walked down accessible exterior surfaces of the torus and support systems on several occasions to inspect for indications of leakage, support system degradation, and adverse system interactions. The team also reviewed corrective action documents and torus inspection reports, and interviewed design engineers to determine whether there were any adverse operating trends or degraded conditions.

b.

Findinqs No findings were identified.

.2.2.2 NRC Information Notice 2007-09: Equipment Operabilitv Under Deqraded Voltaoe

Conditions

a. Inspection Scope

The team evaluated Entergy's applicability review and disposition of NRC lN 2007-09.

The team reviewed Entergy's evaluation of the adequacy of Class 1E control power transformers located in 480V MCCs. This review was documented within CR-HQN-2007-00863 and evaluated worst case inrush current of contactors. The team also reviewed associated engineering analyses for the adequacy and margin of voltage available to pickup the contactors at degraded voltage conditions.

b.

Findinqs No findings were identified.

.2.2.3 NRC lnformation Notice 2005-30: Safe Shutdown Potentiallv Challenoed Bv Unanalvzed

Internal Floodino Events and Inadequate Desiqn

a. Inspection Scope

The team evaluated Entergy's applicability review and disposition of NRC lN 2005-30.

The NRC issued the lN to alert licensees to the importance of establishing and maintaining the plant flooding analysis and design, consistent with NRC requirements and principles of effective risk management, to ensure that internal flooding risk was effectively managed.

The team reviewed Entergy's evaluation of their internal flooding analysis and design to ensure that safe shutdown would not be challenged by unanalyzed flooding events. The team reviewed maintenance procedures, operational procedures, and alarm response procedures to verify measures were adequate to protect safety-related components. The team conducted a walkdown of components analyzed and protective measures taken to ensure they would not be challenged by an internal flooding event from a non-safety system.

b.

Findinos lntroduction: The team identified a finding of very low safety significance (Green)involving an NCV of 10 CFR Part 50, Appendix B, Criterion lll, Design Control, because Entergy did not verify the adequacy of the design with respect to ensuring that safety-related equipment would be adequately protected from a postulated flood originating in the turbine building. Specifically, Entergy did not correctly evaluate a failure of seawater system piping or equipment that could challenge the doors separating the turbine building from the reactor building auxiliary bay, which would require timely operator identification and action to secure the seawater pumps to prevent the common mode failure of redundant safety-related com pone nts.

Description:

The team reviewed the relevant portion of Entergy's internal flooding licensing basis contained in a letter to the Atomic Energy Commission (AEC) dated September 1, 1972. This letter was in response to two questions from the AEC;

(1) whether the failure of any non-Class I equipment, particularly in the circulating water (seawater) system and fire protection system, could result in flooding which would adversely affect Class I equipment; and
(2) whether the failure of any equipment could cause flooding such that common mode failure of redundant equipment would result.

This licensee letter outlined an evaluation of a major failure in the seawater system in the turbine building basement resulting in the discharge of the full runout flow of one seawater pump, or 200,000 gallons per minute (gpm). lt assumed drainage from the turbine building to the 'B' reactor building auxiliary bay to be 10,000 gpm. The letter stated that drainage to the torus compartment via dewatering lines could continue for up to 50 minutes before overflow to the reactor building (RB) corner compartments could lead to loss of redundant safety-related equipment. lt also stated that operator action would terminate the event and prevent common mode failure of equipment. The letter concluded that in no case could such flooding result in common mode failure of redundant safety-related equipment.

Based on review of a 1988 engineering study, performed in response to NRC Information Notice 87-49, "Deficiencies in Outside Containment Flooding Protection," the team questioned the bases of the values used in the letter to the AEC. In response, Entergy determined that the time values included in the 1972letter were not bounding based on an informal analysis performed during the inspection. Specifically, the conclusion that operators would have 50 minutes to terminate the event with a 200,000 gpm leak was incorrect. Entergy's best estimate review showed that operator actions would be required within approximately 50 minutes to mitigate an assumed 10,000 gpm leak.

In addition, assuming a seawater pump runout flowrate of 200,000 gpm, Entergy's informal analysis determined that only 3 to 5 minutes would be available for operators to recognize the flood event and take action to secure the seawater pumps to preclude impact to redundant safety-related equipment. The team determined that 1972 evaluation did not account for the fact that once a volume of water has entered the turbine building and the 'B' reactor auxiliary bay it would continue to flow and eventually enter the torus room area, even after the seawater pumps have been stopped, due to the elevation differences between the areas. The team also noted that Entergy had a reasonable opportunity to previously identify this historical licensing bases evaluation error during a 2005 operating experience review performed for similar postulated internal flooding events.

Entergy initiated CR-PNP-2011-04503 in response to this issue, evaluated the immediate operability of systems potentially affected by the postulated flooding scenario, and provided interim guidance regarding turbine building flooding to the operators. Entergy performed additional evaluations and determined that the operators would have approximately 30 minutes to respond to a calculated credible seawater system break flow of 16,000 gpm, based on an assumed 12 inch diameter hole in an expansion joint. The assumed break size was based on the size and construction of the seawater expansion joints. Based on this evaluation and the interim guidance provided to the operators, Entergy determined that the safety-related systems potentially affected by this flooding scenario remained operable. The team reviewed Entergy's operability evaluation and determined the conclusion was reasonable.

Analysis:

The team determined that Entergy's failure to verify the adequacy of the design with respect to ensuring that safety-related equipment would be adequately protected from a postulated flood originating in the turbine building was a performance deficiency that was reasonably within Entergy's ability to foresee and prevent. This conclusion was based on the available opportunity in 2005 to review the licensing bases in response to a review of similar operating experience. The performance deficiency was determined to be more than minor because it was similar to example 3.j of NRC IMC 0612, Appendix E, Examples of Minor lssues, in that it resulted in a reasonable doubt of operability with respect to protecting redundant safety-related equipment. In addition, the performance deficiency was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, Entergy's design evaluation had not ensured that the failure of non-safety related equipment would not result in the common mode failure of redundant safety related equipment. Additional evaluations and compensatory measures were required to verify operability of safety-related equipment.

The team evaluated the finding in accordance with IMC 0609, Appendix A, "Significance Determination of Reactor lnspection Findings for At-Power Situations." Based upon the Significance Determination Process (SDP) Phase 1 screening criteria of IMC 0609, 04, the finding screened as potentially risk significant due to internalflooding that involves the postulated loss of multiple safety functions. This finding required a Phase 3 risk evaluation.

A Region I Senior Reactor Analyst (SRA) conducted a Phase 3 risk evaluation using the Pilgrim SPAR model, Revision 8.15 and SAPHIRE 8. The SRA made the following assumptions and modeling changes to represent a bounding analysis of the design vulnerability associated with the identified performance deficiency:

. The risk model initiating event impacted by the condition is a transient (TRAN)based upon the postulated operator actions in the event of a condenser expansion boot rupture o The failure probability for operator action to align alternate low pressure injection (OPR-XHE-XM-ALPl, "Operator fails to starUcontrol firewater injection") was changed to reflect the Pilgrim Probabilistic Risk Assessment model value of 2.21E-2. The Pilgrim value more accurately models the human performance shaping factors and associated time available for operator mitigation of this condition. The SRA noted that due to the installed flood door protecting the HPCI system from cross-flooding from the adjacent Emergency Core Cooling System (ECCS) corner room, the HPCI system would be available for a few hours, if not longer, immediately following the postulated flood event. As a result, this revised operator action failure probability could reasonably be reduced by an order of magnitude per SPAR-H Human Reliability Analysis methodology (i.e., time available >5 times the time required for this operator action).

. The following basic events were set to TRUE to represent the consequences of the postulated boot rupture and internalflooding:

o CD-XHE-XO-ERROR <Operator fails to starUcontrol condensate injection>

o LCS-MDP-CF-START <CS pumps common cause fail to start>

o MFW-MDP-CF-RUN <Feed water pumps failfrom common cause to run>

o PCS-CND-FC-UNAVL <Condenser and circ water system are unavailable>

o RCI-TDP-FS-P206 <RCIC pump P-206 fails to start>

o RHR-MDP-CF-START <RHR pumps common cause fail to start>

. Cutset truncation was set at 1.0E-13

. The expansion boot failure probability of 4.5E-5 per year (reference Surry Units 1 and 2,lnternal Flooding Analysis for the Individual Plant Examination (lPE)

Supplemental Report, dated November 1991) was revised to reflect the additional years of condenser boot service with no known additional catastrophic failures, and to reflect credit for Pilgrim's periodic replacement and preventive maintenance program for condenser expansion boots. The revised boot failure probability was calculated to be 3.3E-6 per year Based upon the above assumptions, an initiating event assessment was run for a transient (reactor trip). The resultant conditional core damage probability (CCDP) was then multiplied by the estimated expansion boot rupture frequency (times four, reflecting the number of condenser inlet boots), consistent with the established methodology of the Risk Assessment of Operational Events (RASP) Handbook, Volume 2 - External Events, Section 3.0. The calculated conditional core damage frequency represents the estimated annualized increase in core damage frequency (ACDF) associated with the finding. The calculated ACDF for this finding is 3.9E-7 and considered of very low safety significance (Green). The dominant core damage sequences involve a reactor trip followed by the successful depressurization of the reactor vessel then subsequent failure of operators to inject firewater. Based upon the nature of the design vulnerability, there was no external events ACDF contribution to this finding.

Due to the calculated ACDF being greater than 1E-7, the SRA evaluated this finding for potential large early release frequency (LERF). Review of the dominant cut sets identified that approximately 10 percent of the dominant cut sets consist of core damage sequences that involve the failure to depressurize the reactor to facilitate low pressure water injection. The failure to depressurize the reactor vessel leads to high pressure core damage sequences that would challenge containment integrity and potentially result in a large early release. The unavailability of ECCS to put water on the drywellfloor contributes to the risk potential of these postulated LERF sequences. However, based upon the LERF contribution being an order of magnitude less than the calculated ACDF, the risk significance of this finding is based upon the ACDF value (Green).

This finding was not assigned a cross-cutting aspect because it was a historical design issue not indicative of current performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion lll, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of October 4,2011, Entergy had not verified the adequacy of their design with respect to ensuring that safety-related equipment would be adequately protected from a postulated flood originating in the turbine building. Specifically, Entergy had not verified the accuracy of the required operator response times addressed in the 1972 licensing basis letter, and had not verified adequacy of existing procedures to ensure actions would be taken in the required time to protect redundant safety-related equipment. Because this finding was of very low safety significance, and it was entered into Entergy's CAP as Condition Report CR-PNP-201 1-04503, this violation is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy.

(NCV 05000293/2011007-003, Inadequate Evaluaton of the Affect of Non Glass I Equipment Internal Flooding on Redundant Safety Related Equipment)

.2.2.4 NRC lnformation Notice 2006-22: New Ultra-Low-Sulfur Diesel Fuel Oil Could Adverselv

lmpact Diesel Enqine Performance a.

lnspection Scope

. The team performed a detailed review of Entergy's evaluation of NRC lN 2006-22. This lN discussed events involving Ultra-Low-Sulfur Diesel (ULSD) Fuel Oil which has the potential to degrade the associated diesel engine or may create a condition that is inconsistent with the plant design and licensing bases. The team reviewed the UFSAR, the TSs, design basis documents, and Entergy evaluation ER06118057, "ULSD Fuel Storage Volume lqtpact," to assess the completed evaluation and applicable corrective actions to ensure the operability of the EDGs was not affected by use of ULSD fuel. The team verified that Entergy had appropriately evaluated the operational experience and had made engineering evaluations and procedural changes needed for identified deficiencies to minimize and limit the impact of ULSD fuel.

b.

Findinqs No findings were identified.

OTHER ACTIVITIES

4OA2 ldentification and Resolution of Problems (lP 71152)

a. Inspection Scope

The team reviewed a sample of problems that Entergy had previously identified and entered into the CAP. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions. In addition, corrective action CRs written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action system. The specific corrective action documents that were sampled and reviewed by the team are listed in the Attachment.

b.

Findinqs No findings were identified.

4OAO Meetinos. includinq Exit On October 6, 2011, the team presented the preliminary inspection results to Mr. Robert Smith, and other members of the Pilgrim Nuclear Power Station management. The final inspection results were discussed with Mr. J. Lynch in a telephone call on November 16, 2011. The team verified that no proprietary information was documented in the report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

PNPS Personnel

J. Bonner, Supervisor, Electrical Design
J. Bracken, Operations Field Supervisor
W. Lobo, Licensing Engineer
A. Madeiras, System Engineer
J. McDonald, Assistant Operations Manager
R. Pace, Supervisor, Mechanical Engineering
B. Mello, System Engineer
D. Rydman, System Engineer

NRC Personnel

W. Cook, Senior Risk Analyst
M. Schneider, DRP, Senior Resident Inspector
B. Smith, DRP, Resident Inspector

LIST OF ITEMS

OPENED, CLOSED AND DISCUSSED

Open and

Closed

NCV

0500029312011007-01 Inadequate Evaluation of the Adequacy of the 4160 Volt Emergency Bus 95% Voltage Alarm and Load Shed Relay Design (Section 1R21.2.1.1)

NCV

0500029312011007-02 Inadequate Test Control of Safety Related Batteries (Section 1R21.2.1.2)

NCV

0500029312011007-03 lnadequate Evaluation of the Affect of Non Class I Equipment Internal Flooding on Redundant Safety Related Equipment (Section 1R21.2.2.3)

LIST OF DOCUMENTS REVIEWED