ML12089A664

Entergy Pre-Filed Evidentiary Hearing Exhibit ENT000364 - Indian Point Independent Safety Evaluation Report (July 31, 2008)

ML12089A664
Person / Time
Site:	Indian Point
Issue date:	07/31/2008
From:	Entergy Nuclear Operations
To:	Atomic Safety and Licensing Board Panel
SECY RAS
Shared Package
ML12089A633	List: ML12089A637 ML12089A638 ML12089A639 ML12089A640 ML12089A641 ML12089A642 ML12089A645 ML12089A647 ML12089A648 ML12089A649 ML12089A650 ML12089A651 ML12089A652 ML12089A655 ML12089A657 ML12089A658 ML12089A659 ML12089A661 ML12089A663 ML12089A664 ML12089A665 ML12089A666
References
RAS 22135, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01
Download: ML12089A664 (232)

Text

ENT000364 Submitted: March 29, 2012 July 31 08 Indian Point Independent Safety Evaluation (ISE)

Indian Point Independent Safety Evaluation (ISE)

We, the undersigned members of the Indian Point Independent Safety Evaluation Panel, affirm that this report faithfully documents our observations and conclusions regarding operations at the Indian Point Energy Center.

James T. Rhodes Neil E. Todreas William Kane T. Gary Broughton Elmer J. Buzz Galbraith Clayton S. Hinnant Cristine McCombs Martin Vonk Harvey Stevens Kenneth E. Brockman John S. Dyson Maureen O. Helmer ISE 2

Indian Point Independent Safety Evaluation (ISE)

Table of Contents Executive Summary 5 Section 1: The ISE, In Overview 19 1.1 A Short History 19 1.2 The ISE Panel 20 1.3 ISE Objectives, Scope and Criteria 22 1.4 The ISE Process 25 Section 2: Supporting the Public Interest 27 2.1 Public Policy Team 27 2.2 Information Gathering 29 2.3 Issues of Expressed Public Concern 30 Section 3: Nuclear Safety 31 3.1 The ISE Nuclear Safety Team 31 3.2 The Workforce and its Performance 34 3.3 Indian Point Systems and Equipment 39 3.4 Processes for Managing Nuclear Safety 52 3.5 Indian Point Unit 1 60 3.6 Indian Point Nuclear Safety, In Summary 62 Section 4: Security 64 4.1 Evaluating IPEC Security 64 4.2 Indian Point Security Force 67 4.3 Protection from External Threats 72 4.4 Security Systems, Equipment and Processes 81 4.5 The Insider Threat 85 4.6 Security Strategies and Their Effectiveness 89 4.7 Protection from Terrorist Attack 92 4.8 Indian Point Security, In Summary 94 Section 5: Emergency Preparedness 95 5.1 The ISE Emergency Preparedness Team 95 5.2 Entergy Interaction with Offsite EP Organizations 97 5.3 Emergency Preparedness People and Plans 99 5.4 EP Equipment and Facilities 104 5.5 The Siren Upgrade Project - A Case Study 109 5.6 LongerTerm Considerations for Indian Point EP 113 5.7 Indian Point Emergency Preparedness, In Summary 117 Section 6: Crosscutting Technical Issues 118 July 31, 2008 ISE 3

Indian Point Independent Safety Evaluation (ISE) 6.1 Fire Protection 118 6.2 Managing Radioactive Materials 121 6.3 Indian Point Vulnerability to Terrorist Attack from the Air 127 Section 7: Management, Ownership and Financial Issues 134 7.1 Relations with Public/Stakeholders 134 7.2 Entergy Ownership and Management 137 7.3 Workforce Issues 141 7.4 Employee Concerns 143 7.5 License Renewal 145 Section 8: Principal Conclusions and Recommendations 146 Acknowledgements 155 Appendices Appendix 1: ISE Panelist Biographies Appendix 2: ISE Charter Appendix 3: Issues of Expressed Public Concern Appendix 4: List of Acronyms July 31, 2008 ISE 4

Indian Point Independent Safety Evaluation (ISE)

Executive Summary On March 20, 2008, Entergy Corporation announced the formation of a special panel to conduct an Independent Safety Evaluation (ISE) of the Indian Point Energy Center (IPEC).

The ISE Panel conducted extensive reviews at Indian Point during the spring of 2008 and completed its work in July. This Executive Summary is a synopsis of the ISE objectives, scope, approach and conclusions; the main report covers the entire ISE effort in more detail.

Genesis The two IPEC operating nuclear reactor units1 in Buchanan, N.Y., together produce more than 2 million kilowatts of electric power and have supplied a substantial amount of the electricity consumed in the greater New York City area since the mid1970s. As such, the station plays an important role in the electric reliability and economic health of New York City and surrounding areas.

Indian Point has been the subject of continuing controversy since its early years of operation. The plant itself is located in a highly populated area - nearly 300,000 people live in the 10mile radius emergency planning zone2 (EPZ) around the plant, making it the most densely populated EPZ of any U.S. nuclear plant. And it is about 40 miles from the heart of Manhattan, one of the financial, political and cultural centers of the nation and the world. Not surprisingly, Indian Point has been a visible focal point for antinuclear activism.

Contributing to the unease of some in the public regarding the plants operation has been a history of very visible problems. Leaks from plant systems raise concern about environmental contamination, fines from the U.S. Nuclear Regulatory Commission (NRC) raise obvious questions about plant safety, and the evident difficulty of demonstrating the effectiveness of emergency plans causes many to wonder whether their safety could be protected if there were a major problem at the station. Collectively, these operational upsets, equipment failures and other issues serve to keep Indian Point in the public eye, usually in a negative context.

1 The currently operating plants are Indian Point Units 2 and 3, which entered commercial service in 1974 and 1976 respectively. The older and smaller Unit 1 was placed in service in 1962 and taken out of service in 1974.

2 The emergency planning zone (EPZ) is the area surrounding each licensed commercial nuclear plant in the United States, within which federal regulations prescribe thorough planning, warning and protective actions to safeguard the populace in the event of a significant radiological accident.

July 31, 2008 ISE 5

Indian Point Independent Safety Evaluation (ISE)

The terrorist attack on the World Trade Center on September 11, 2001, elevated to an entirely new level the fundamental issue of acceptability of a nuclear power plant so close to New York City. While these heightened fears have diminished somewhat due to the passing of time and much work to protect the plant from external threats, public acceptance of Indian Point among many is tenuous at best.

Culminating years of public and political debate, U.S. Senator Hillary Clinton and U.S.

Congressman John Hall, both of New York, introduced in Congress proposed legislation calling for an independent assessment of the safety of Indian Point. Although Congress took no action on these legislative proposals, Entergy - Indian Points owner - chose in early 2008 to commission its own independent evaluation of Indian Point safety, security and emergency preparedness.

The ISE Panel The Panel of experts engaged to perform the ISE brought extraordinary knowledge, experience and integrity to this task. The Panel cochairs, selected by Entergy to lead the ISE, are Dr. James Rhodes, former President and Chief Executive Officer (CEO) of the Virginia Electric & Power Company and later Chairman, President and CEO of the Institute of Nuclear Power Operations (INPO), and Dr. Neil Todreas, former Head of the Nuclear Engineering Department at the Massachusetts Institute of Technology (MIT). Both Dr.

Rhodes and Dr. Todreas are retired from fulltime employment and neither has had any professional ties to Entergy or Indian Point. Together they provided strong leadership and an exceptionally deep and diverse experience base to the ISE.

The other 10 members of the ISE Panel were selected personally by the cochairs, without constraint from Entergy. Panelists were compensated by Entergy for their participation in the evaluation. In composite, the Panel represented virtually every facet of nuclear plant safety, security and emergency preparedness, from a variety of vantage points, and with full independence. Among the cochairs and Panelists, five have direct nuclear plant operations experience, seven do not. Further, three have been senior officers in U.S.

nuclear utilities; two have held executive positions with the U.S. Nuclear Regulatory Commission (NRC); two have served with INPO and another with the International Atomic Energy Agency (IAEA); three have held senior executive positions in state (New York or Massachusetts) agencies; four were nucleartrained officers in the U.S. Navy, one a nuclear submarine commanding officer; and one is an internationally known expert in security.

July 31, 2008 ISE 6

Indian Point Independent Safety Evaluation (ISE)

An Independent Panel Entergy required a technically sound, credible evaluation of the health of the Indian Point plants. To get that, they consciously chose to secure the services of a team with an essential balance - the capability, experience and objectivity to provide a solid assessment and the ethical strength to do so honestly.

The Indian Point ISE Panel is a diverse group, in terms of background, experience and corporate and government relationships. Panel members were selected by the cochairs, not Entergy. They have impeccable professional credentials for this work. And they have no financial ties3 to Entergy, beyond this ISE.

The ISE Panel members are placing their considerable reputations on the line. Each has signed and stands behind this report - an undeniable measure of independence.

The ISE Panel is structured into four teams, each with an area of primary focus - nuclear safety, security, emergency preparedness and public policy - and all members collaborated in examining the plant as a whole.

ISE Objectives, Scope and Criteria As summarized in the ISE Charter, approved by the ISE Cochairs on March 27, 2008:

The Indian Point independent safety evaluation will be a thorough and objective assessment of the IPEC. The independent panel will examine a range of nuclear safety and plant performance factors, with particular attention to matters of importance to those who live and work near the station, including plant security and emergency management.

The charter further states:

The objectives of the independent safety evaluation are:

1. To provide internal and external decisionmakers with a body of technically sound and reliable information about the safety of the Indian Point Energy Center.

2. To address issues of particular interest to IPEC stakeholders including the public.

Based on that directive, the ISE Panel developed a detailed scope of review that included examination of specific aspects of Indian Point nuclear safety, security and emergency preparedness, along with a broader look at the overall plant health in areas germane to the ISE objective, but not limited to one of these three areas of particular attention.

3 Two panelists previously provided limited professional services (approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />) at other Entergy plants.

July 31, 2008 ISE 7

Indian Point Independent Safety Evaluation (ISE)

The Panel also placed very high emphasis on examination of matters that have been particularly prominent in the public eye. These public interest issues were identified through review of media reports, transcripts of public meetings, discussions with stakeholders and public officials, and letters or emails to the Panel. Many were implicitly included in the Panels review of nuclear safety, security and emergency preparedness while others required separate investigation. In light of the broad ISE objective above, the Panel considered review of these issues to be a necessary part of its review.

Several issues of high public interest are not within the ISE scope. Among these are:

License Renewal: The ISE Panel was charged with examining the current state of Indian Point, whereas license renewal is a regulatory process that addresses its suitability for extended future operation. Although some information in this report may be pertinent to license renewal, the ISE effort did not explicitly examine Indian Point operations beyond the plants current operating licenses.

Offsite Aspects of Emergency Preparedness (EP): Offsite evacuation planning and implementation are the responsibility of governmental (primarily county) organizations, with support from the station. On that basis, the ISE did not attempt to assess the details or projected effectiveness of evacuation planning. The ISE did, however, examine the stations effectiveness in discharging its EP responsibilities and its interface with local, county, state and federal emergency management organizations.

Offsite Environmental Issues: The ISE addressed IPEC radioactive materials management, including implications of onsite radiological releases. It did not assess offsite radiological consequences of normal plant operation or other environmental issues (such as thermal effects on Hudson River aquatic life).

Macroeconomics: The ISE addressed IPEC economics/investment, but not regional electricity supply cost/demand issues or impacts.

Evaluation Criteria The Panelists evaluated Indian Point performance in comparison with their own experience and expectations for high performing nuclear plants and other facilities, such as chemical and manufacturing plants. This criterion was applied to the evaluation of IPEC nuclear safety, security and emergency preparedness, based on the collective professional judgment of the Panel members and taking into account a range of qualitative and quantitative factors. Given the diversity and depth of Panelist experience, this approach made possible an unusually broad composite perspective on the station.

July 31, 2008 ISE 8

Indian Point Independent Safety Evaluation (ISE)

As a separate evaluation factor, the Panel consciously assessed the level of difficulty facing Entergy in correcting the problems identified by the ISE. It was the Panels view that judgments by others about the viability of the station should take into account not only the current health of the plant but also Entergys capability, resources and will to correct any serious safety, security or emergency preparedness problems that currently exist.

Process Four ISE Teams - Nuclear Safety, Security, Emergency Preparedness and Public Policy -

conducted preplanned, structured assessments of the station, including observations of work in progress, meetings, interviews with individuals, discussion sessions with groups of employees, and reviews of plant records, work products and other documents. Each of the teams examined plant aspects germane to its areas of responsibility, and all Panelits collaborated in a review of crosscutting topics indicative of overall station health.

July 31, 2008 ISE 9

Indian Point Independent Safety Evaluation (ISE)

In parallel with the inplant reviews, members of the Public Policy and Emergency Preparedness Teams interviewed numerous municipal, county and state officials regarding issues of public interest. The Panel hosted two public meetings on April 28, 2008 as opportunities for direct communication with members of the public on matters of importance to them, and established a dedicated email address as an additional avenue for public comments and questions. From those sources, and from news reports and other communications, the Panel developed a comprehensive list of public issues for consideration as appropriate by individual teams or the Panel as a whole.

In all of their individual and collective assessments, the Panelists formulated judgments about Indian Point performance relative to their experience and expectations of high performing nuclear plants and other facilities, both in the United States and internationally.

July 31, 2008 ISE 10

Indian Point Independent Safety Evaluation (ISE)

Principal Conclusions From the entirety of its work - the evaluations by the Nuclear Safety, Security, Emergency Preparedness and Public Policy Teams, and its composite plant assessment - the ISE Panel has reached several principal conclusions. These are summarized here and discussed in much more detail in the main report.

There are two overarching principal conclusions:

1. Indian Point is a safe plant.

The Panel found that Indian Point nuclear safety meets the U.S. nuclear industry highest standards in most respects. Indian Point nuclear operations are conducted July 31, 2008 ISE 11

Indian Point Independent Safety Evaluation (ISE) competently and professionally, plant safety systems are wellmaintained, reliable, and are backed with full resource commitment by the plant owner. Control Room operations - a key indicator of plant nuclear safety culture - were observed frequently by the Nuclear Safety Team and other ISE Panelists and found to be consistently professional and effective. Indian Point management, at all levels, is clearly attentive to nuclear safety.

2. The Indian Point relationship with public and stakeholders on matters of emergency preparedness is not healthy.

Public protection from a sizable radiological release from a nuclear reactor - whether caused by natural disaster, accident or terrorism - is by law a shared responsibility among federal, state and local authorities, with defined support by plant personnel.

Effective public protection therefore demands close cooperation and communications, and in turn joint planning, preparation and practice. Most importantly, it must be founded on mutual respect and trust among all participants.

The Panel found numerous indicators that a sufficiently respectful and trusting relationship between Entergy/Indian Point and the public/stakeholders is not in place today.

And the Panel has drawn additional principal conclusions:

3. The Indian Point emergency response facilities and equipment do not meet high industry standards.

Both the Indian Point Emergency Operations Facility (EOF) and the backup EOF, although compliant with regulatory requirements, are undersized and would be sub optimal for extended use in a major emergency. Other Indian Point emergencyuse facilities and equipment, on and offsite, are inadequate in some respects.

Communications and other equipment used by these facilities is dated and in many cases difficult to use or unreliable.

In an actual emergency, public safety would depend on effective use of these facilities, by Entergy personnel and public officials, under very trying conditions. The ISE Panels view is that these facilities and equipment should be upgraded to meet top standards.

4. Security at Indian Point is strong in many respects, but has some shortcomings.

The ISE Security Team found the Indian Point security force to be welltrained, proficient and professional. The IPEC Security organization has developed sound strategies for dealing with a range of possible security threats including some scenarios well beyond those that the plant is required to prepare for by regulation.

July 31, 2008 ISE 12

Indian Point Independent Safety Evaluation (ISE)

However, there is inadequate staffing (and resultant excessive overtime work) in some security functions and some security systems and equipment are old and difficult to maintain.

5. The physical condition of the plant in nonsafety areas is visibly deficient.

While station personnel pay close attention to the care, maintenance and operation of plant safety systems, the care and maintenance of some other plant systems and structures do not meet the standards of highperforming plants. Also, the external visible condition of the plant is poor in many respects. While these have no direct bearing on safe operation of the plant, it is the Panels view that the maintenance and preservation of noncritical plant systems, equipment and structures is important, because it communicates to employees and the public alike the owners and operators commitment and professionalism.

6. The new leadership team at the station is strong, and morale and attitudes among workers are distinctly positive.

Nuclear power plants are operated by people. The capability, dedication and attitudes of the staff affect every aspect of plant safety and performance. And while these are intangibles and difficult to assess, the ISE Panel was favorably impressed in its extensive interviews and observations of plant personnel.

The station senior management team is experienced, capable, energetic and well respected. This is a relatively new team, and its longterm effectiveness remains to be seen, but it exhibits the strengths central to successful and safe operation. Similarly, the ISE Panelists found Indian Point workers to be welltrained, professional and positive about their jobs. Also noteworthy is the mutually respectful and constructive relationship between union and station management.

It is the Panels judgment that the caliber of Indian Point staff is very good, consistent with highperforming plants.

7. The station is facing potentially critical staffing shortages.

The Panel found staffing issues, of different kinds, in several areas. The combined effects of several factors - an aging IPEC workforce, high cost of living in the U.S.

Northeast, internal corporate changes at Entergy and a very competitive hiring climate in nuclear specialty areas around the country - is already affecting Indian Point hiring and retention and portends even more serious future challenges. Particularly critical needs are foreseen in licensed nuclear operators, technicians and EP personnel.

Entergy and IPEC have formulated ambitious plans to deal with this situation, but it is not yet clear that they will be adequately implemented and ultimately successful.

July 31, 2008 ISE 13

Indian Point Independent Safety Evaluation (ISE)

8. Station effectiveness in work management and project management needs improvement.

The processes of work management and project management - the planning, preparation and execution of the myriad of daytoday tasks and longer term projects necessary to keep the plants running smoothly and safely - is not as effective as at most highperforming plants. Inadequacies in these areas are considered by the Panel to be a contributing factor to many of the observed problem areas at Indian Point -

poor execution of the siren system replacement project and the backlog of maintenance work are two key examples - and are an impediment to lasting station improvement. The pace of improvement has been unnecessarily slow.

9. Change management at Indian Point is important and should be improved.

In recent years, the Indian Point workforce has been deluged with change - new ownership of both plants, integration of previously separated Unit 2 and Unit 3 functions, adoption of new Entergy standards and procedures, and significant plant software modifications, as examples. The steps taken to plan for and accommodate these changes, and particularly to prepare and train the workforce, have been inadequate in some respects, with ripple consequences in station performance. Better implementation of change management processes is needed.

10. Acquisition by Entergy has affected Indian Point in many ways - most of them good.

Fleet ownership of nuclear plants has proven to be beneficial to both owners and plants. Successful nuclear operating companies like Entergy offer proven practices and processes, extensive operating experience and timely technical support, a supply stream of seasoned managers, layers of oversight and other sources of strength to their operating plants. At Indian Point, there has been dramatic improvement in the performance of both units since the acquisitions early in this decade. As examples, plant capacity factors and forced outage rates have both improved to levels comparable to highperforming U.S. plants, and in the experience of the Panel, there is strong correlation between a plants operational stability and its safety. It is very reasonable to conclude that Indian Point is a safer plant now than when initially acquired by Entergy.

On the other hand, there are aspects of Entergy ownership that merit close scrutiny.

The recent announcement of the Entergy corporate restructuring, now under review by two state public utility commissions, is a good example. This is a complex change, and while it may prove financially beneficial to the corporation, its effect on Indian Point (if any) is not yet known.

July 31, 2008 ISE 14

Indian Point Independent Safety Evaluation (ISE)

Applying these 10 principal findings to the central ISE evaluation criterion of judging Indian Point relative to highperforming nuclear plants and other facilities, the Panel concludes that the comparison must be drawn separately in each of its primary areas of evaluation, as follows:

In nuclear safety, Indian Point performance is good, and compares favorably to highperforming plants in most aspects of nuclear safety.

Indian Point security compares favorably to highperforming U.S. nuclear plants in a number of areas, but needs upgrading in others. The ISE Panel judges Indian Point security to meet the highest standards of international nuclear facilities and to be superior to most complex nonnuclear U.S.

industrial facilities.

Emergency preparedness at Indian Point requires improvement. The relationship and interaction between EP station personnel and local, county and state officials is not healthy, and the emergency response facilities and equipment provided by Entergy, while compliant with regulatory requirements, are inadequate in some respects. Indian Point emergency preparedness clearly does not meet the standards of highperforming U.S.

nuclear plants.

With respect to its public and stakeholder interactions, Indian Point is uniquely challenged - compared to all other U.S. nuclear stations - because of its location and political visibility. Entergy/Indian Point management has not been sufficiently proactive in dealing with this unique challenge.

Principal Recommendations In the course of its examinations, the Panel identified numerous recommendations and areas for improvements. These are presented throughout the report, in each applicable section. From these, the Panel has derived eight principal recommendations, including two overarching recommendations that relate to the plant as a whole, and six additional major recommended actions, as follows.

Overarching principal recommendations that affect the viability of the entire station:

1. Investment commitment as needed to achieve and maintain top levels of safety, security and emergency preparedness at Indian Point July 31, 2008 ISE 15

Indian Point Independent Safety Evaluation (ISE)

Entergy must continue its financial commitment to accelerate visible, meaningful and convincing improvement to the station. The Panel acknowledges the progress already made, but given the history of the station, its national visibility, its precarious position in terms of public and political acceptance, its importance to New Yorks supply of electrical power and its financial value to its owner, Entergy must commit to achieving unequivocal excellence.

2. Aggressive, proactive communication and outreach Maintaining a strong, mutually respectful and trusting relationship between the company and the community is central to longterm viability of the station. This relationship is not healthy today - it must be rebuilt, and Entergy must take the lead in making that happen. The Panel recommends that Entergy and IPEC executives commit to a structured process of continuing proactive and frequent interactions with the surrounding communities, including both private citizens and local officials. While resourceintensive, such an initiative could be very effective in replacing the distant, faceless owner with a personal and (over time) familiar contact.

Other principal ISE recommended actions include:

3. Comprehensive upgrade of emergency response facilities and equipment As detailed in Sections 5 and 7, the Panel strongly recommends nearterm, significant upgrades to the Entergyprovided emergency response facilities and equipment, including:

- Emergency Operations Facility (both main and backup) replacement

- Technical Support Center and Operations Support Center upgrades

- Joint Information Center upgrade

- Substantial equipment upgrades, including the Offsite Notification System (RECS), Low Band Radio, satellite phones and the Plant data system.

Additionally, the Panel recommends that Entergy consider and act upon, as appropriate, reasonable requests from the counties for EP financial support. And as part of this action the company should establish a clear and consistent process for dealing with requests for EP resources and support.

4. Aggressive staffing actions The Panel notes the encouraging plan of action to address immediate and potential longerterm critical staffing shortages at IPEC. However, Entergys corporate commitment to effective implementation of this comprehensive staffing plan remains to be seen. The Panel urges close management attention to this action plan.

July 31, 2008 ISE 16

Indian Point Independent Safety Evaluation (ISE)

As a related matter, the Panel recommends immediate action to restore the EP staff positions that were eliminated as part of aligning Indian Point with Entergys corporate structure. These positions support daytoday offsite interface with county EP organizations and are important to both EP effectiveness and the Entergy relationship with the offsite EP personnel. The reductions in these positions had the unintended consequence of undermining stakeholder trust and confidence in Entergy, just at the time it was most important to strengthen their relationship.

5. Security improvements The Panel recommends a number of improvements and enhancements in Security equipment, in order to improve reliability, maintainability and effectiveness of these systems. Items needing upgrading include the plant entrance, Central Alarm Station (CAS) and Secondary Alarm Station (SAS), the Access Authorization system and the fence line/barrier.

6. Station cleaning and preservation A major sitewide campaign is recommended to accelerate cleaning, painting or removal (as appropriate) of deteriorating nonsafety exterior features such as the containment ventilation ductwork and plant stack. This work is needed to properly reflect overall station quality and to convey to workers and the public Entergys commitment to care and protection of their workplace.

Relationship with the Public On a plane above the specific conclusions and recommendations previously summarized, the ISE Panel is compelled to call attention to the unusually polarized relationship between the Indian Point owner/operator and the larger public. Indian Point seems to inspire strong advocacy among both its ardent supporters and its strident critics. In the Panels view, such polarization is a major obstacle to achieving progress on the issues that matter to both sides.

Two Sides of the Same Coin In their multiple interactions with both Indian Point personnel and offsite stakeholders and public, the ISE Panelists observed sharply different points of view on many of the same issues.

By and large, the people who run Indian Point take their jobs very seriously. They know their plant provides a vital service to the New York area, they are acutely aware of the importance of safe operation, and they see themselves as hardworking, dedicated and very July 31, 2008 ISE 17

Indian Point Independent Safety Evaluation (ISE) capable professionals. They are proud of what they do. And they are consequently often dismissive of criticism from media and the public.

On the other hand, some in the public who live near Indian Point fear nuclear power and are suspicious of its owner. They frequently hear rumors (some true) about problems in the plant, and they have no way to separate fact from fiction or to view the facts in perspective. They see the plant as a large, potentially dangerous industrial facility, owned and managed by a huge corporation a thousand miles away. And while they recognize the value of the plant as an electricity provider for the greater New York City area, they believe themselves to be saddled with the lions share of the risk for a disproportionately small share of the benefit.

Neither point of view is wrong, neither side has a corner on the truth. It is the Panels view that on most of the lightningrod issues, there is a factbased common ground, a place for mutually satisfactory resolution - if both sides are willing to go there.

Several of the findings and recommendations of the ISE Panel address this polarization.

The Panel considers it essential that Entergy take an active role in addressing this issue, and the Panel is hopeful that public officials and citizens will be willing to do so as well.

This Executive Summary and the lengthy main report that follows present the results of an extensive and rather unusual evaluation of Indian Point. It was performed by a highly qualified Panel and reflects the Panelists objective and independent perspectives about the station. It considers the gamut of technical, institutional and public policy issues germane to Indian Point safety, security and emergency preparedness.

The ISE Panel presents this report with the hope that it will guide future actions by Entergy and that it will contribute in a meaningful way to decisions by company and public officials regarding the future of the station.

July 31, 2008 ISE 18

Indian Point Independent Safety Evaluation (ISE)

Section 1: The ISE, In Overview This is a report of the Independent Safety Evaluation (ISE) of the Indian Point Energy Center (IPEC) conducted in the spring and summer of 2008.

1.1 A Short History Indian Point Units 2 and 3 commenced commercial operation in 1974 and 1976 respectively. Both are pressurized water reactors manufactured by the Westinghouse Electric Corporation. An older unit on the site, Indian Point Unit 1, began operation in 1962 and was retired in 1974. The station is owned and operated by Entergy Corporation, which purchased Unit 3 from the New York Power Authority (NYPA) in November 2000, and Units 1 and 2 from the Consolidated Edison Company (ConEd) in September 2001.

Together, these plants produce over 2 million kilowatts of electric power, supplying a significant fraction of the electricity consumed in the greater New York City area. As such, they play an important role in the electric reliability and economic health of New York City and the surrounding areas.

IPEC has been a relatively controversial facility, the focus of strong antinuclear activism and significant public opposition, for many years. A central point of concern among public and stakeholders has been the plants proximity to New York City and its attendant high population density, which raises the obvious question of the viability of evacuation in the event of a nuclear accident. The terrorist attack on September 11, 2001 significantly elevated public concerns, and numerous visible equipment and plant performance issues -

both before and after 9/11 - have kept the station in the public eye, usually in an unfavorable light.

The purchase of the station by Entergy, while not overtly problematic (and arguably beneficial in terms of plant support and resource availability), introduced the perception of absentee ownership (Entergy is a national firm, headquartered in New Orleans) compared to the prior ownership by NYPA and ConEd, two established New York entities.

Since then, the level of concern about Indian Point operation among some in the public -

along with vigorous, organized opposition in some quarters - has continued to grow. The July 31, 2008 ISE 19

Indian Point Independent Safety Evaluation (ISE)

James Lee Witt Associates report, released in 2003, asserted significant inadequacies in the Indian Point emergency response process (at all levels - federal, state, county, municipality and company), reinforcing concerns about vulnerability to terrorism. There have been further plant upsets, equipment failures and leakage events. Then in April 2007, Entergy announced its intent to seek extension of the Indian Point plant operating licenses for an additional 20 years, under U.S. Nuclear Regulatory Commission (NRC) regulations.

In January 2003, the Attorney General of the state of New York publically advocated shutdown of the Indian Point plants.

In July 2005, Hillary Rodham Clinton, U.S. Senator from New York and a resident of nearby Chappaqua, N.Y., introduced legislation (in the form of a rider to the 2005 Energy Policy Act) that required Indian Point to provide emergency backup power to its existing emergency siren system - a modification that made it necessary for Indian Point, uniquely among U.S. nuclear plants4, to modify or replace its siren system. The resultant Entergy project to replace the sirens has been fraught with delays, regulatory disagreements regarding requirements, operational problems and ultimately major fines from the NRC -

none of which provided any confidence to the public that Indian Point emergency preparedness is in good hands.

During the course of these episodes, Senator Clinton and U.S. Congressman John Hall also introduced legislation to the Congress calling for the conduct of an independent safety assessment of the Indian Point station, to be funded by the federal government and managed by the NRC. While that legislation was not enacted, Entergy on its own chose to commission this Independent Safety Evaluation (ISE).

The ISE hosted two public meetings on April 28, 2008, and began its onsite evaluation shortly thereafter. This is the report of its work.

1.2 The ISE Panel The Panel cochairs, selected by Entergy to lead the ISE, are Dr. James Rhodes and Professor Neil Todreas. Dr. Rhodes is the former President of the Virginia Electric & Power Company and later Chairman of the Institute of Nuclear Power Operations. Professor Todreas is the former Head of the Nuclear Engineering Department at the Massachusetts Institute of Technology (MIT). Together they provide strong leadership and an exceptionally deep and diverse experience base to the ISE.

4 Legislation dictated the change for all plants with a specified high emergency planning zone (EPZ) population density, a criterion applicable only to Indian Point.

July 31, 2008 ISE 20

Indian Point Independent Safety Evaluation (ISE)

The other 10 members of the ISE Panel were selected personally by the cochairs, with no influence or constraint from Entergy. ISE Panelists, their principal credentials and their primary ISE area of interest are summarized on the following table:

ISE Panelist Primary Credentials Cochairs James T. Rhodes, Ph.D. Former President and Chief Executive Officer (CEO) of Virginia Electric & Power Company; former Chairman, President and CEO of the Institute of Nuclear Power Operations (INPO); retired Neil E. Todreas, Sc.D. Former Nuclear Engineering Department Head at MIT; currently Korea Electric Power Corporation Professor of Nuclear Science and Engineering and Professor of Mechanical Engineering (emeritus) at MIT Public Policy Maureen Helmer, Esq. Former Chair of the New York State Public Service Commission (PSC); practicing attorney John S. Dyson New York City businessman; former Chairman of NYPA; former New York State Commissioner of Commerce; former New York City Deputy Mayor for Economic Development and Finance Nuclear Safety William F. Kane Thirtyfour years with the NRC, including service for six years as NRC Deputy Executive Director of Operations; retired from NRC; nuclear consultant Clayton S. (Scotty) Hinnant Former Senior Vice President and Chief Nuclear Officer for four nuclear power plants, Progress Energy Corporation; retired T. Gary Broughton Former President and CEO, GPU Nuclear Corporation; retired Elmer J. (Buzz) Galbraith Former commanding officer of a U.S. Navy nuclear submarine and a former INPO professional; retired Security Harvey M. Stevens, Ph.D. Internationally known expert in public and private sector security; consultant Kenneth E. Brockman Expert in nuclear safety and security, in senior professional roles with both the NRC and the International Atomic Energy Agency (IAEA) in Vienna, Austria; consultant Emergency Preparedness Cristine McCombs Former Director of the Massachusetts Emergency Management Agency (MEMA); consultant in public and private sector emergency preparedness Martin Vonk Experienced nuclear professional in emergency preparedness and health physics; held senior positions in Commonwealth Edison Company and Nuclear Management Company; consultant Additional information on the ISE Panelists credentials is provided in Appendix 1.

In composite, the ISE Panel represents virtually every facet of nuclear plant safety, security and emergency preparedness, from a variety of vantage points. It includes senior executives, an academic, experienced nuclear engineers, public officials and military officers. It offers extraordinary stature, knowledge and experience in nuclear safety, July 31, 2008 ISE 21

Indian Point Independent Safety Evaluation (ISE) security and emergency preparedness, along with broad recognition and understanding of public concerns regarding Indian Point.

Moreover, it is a clearly independent Panel. It is a diverse team in terms of background, experience, and corporate and government relationships. ISE Panel members were selected by the cochairs, not Entergy. They have no financial ties5 to Entergy beyond this ISE. It is a balanced team, with the capability, experience and objectivity to provide a solid assessment and the ethical strength to do so honestly.

The ISE Panel structure included four teams, each with an area of primary focus - Nuclear Safety, Security, Emergency Preparedness and Public Policy - and all Panelists also collaborated in examining the plant as a whole.

1.3 ISE Objectives, Scope and Criteria Consistent with the ISE Charter, reproduced in Appendix 2, the ISE Panel developed a detailed scope of review that included examination of specific aspects of Indian Point nuclear safety, security and emergency preparedness, along with a broader look at the overall plant health in areas germane to the ISE objective, but not limited to one of these three areas of particular attention.

The Panel chose as well to identify and examine - in some cases in substantial detail -

matters that have been particularly prominent in the public eye. Some of these public interest issues were identified through review of media reports, transcripts of public meetings, discussions with stakeholders and public officials, and letters or emails to the Panel. Many of these issues are implicitly included in the Panels review of nuclear safety, security and emergency preparedness, but others are not. Nevertheless, in light of the broad ISE objective above, the Panel considered review of these issues to be a necessary part of its review.

5 Two panelists previously provided limited professional services (approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />) at other Entergy plants.

July 31, 2008 ISE 22

Indian Point Independent Safety Evaluation (ISE)

Public Interest Issue #1: ISE Scope, in comparison with the Maine Yankee ISA In 1996, the NRC conducted an Independent Safety Assessment (ISA) of the Maine Yankee nuclear station. The Maine Yankee work has been looked on by some as a model for independent assessment, and the adequacy of this Indian Point ISE has been questioned on the basis of its departure from the Maine Yankee model.

Key points of comparison are:

The Maine Yankee ISA was prompted primarily by a single technical issue.

The ISA team therefore was comprised primarily of experts in that specific area and their review was technically very deep.

The Indian Point ISE was broader in scope, covering nuclear safety, security, emergency preparedness and other public interest issues. The ISE Panel was accordingly diverse and its examinations were broader, but not as deep in some areas, as the Maine Yankee ISA.

The level of effort of the two examinations was comparable.

In summary, both were major efforts - but they were different in objectives and scope.

These differences in turn drove the differences in team member credentials and breadth and depth of review. A more detailed comparison of the ISE scope with respect to the Maine Yankee ISA is contained in Appendix 3.

It is important as well to note what issues are not within the ISE scope. Among these are:

License Renewal: While the ISE report may prove to be pertinent in some respects to the license renewal deliberations, license renewal is a specialized regulatory topic governed by regulation. The ISEs primary focus was the current health of the Indian Point station, not its suitability for operation beyond its current license.

Offsite Aspects of Emergency Preparedness: Despite its obvious importance, offsite evacuation planning and implementation are not within the scope or control of Entergy, the plant owner. The Panel did, however, examine the plants effectiveness in discharging its EP responsibilities and its interface with local, county, state and federal emergency management organizations.

Offsite Environmental Issues: The ISE addressed radioactive materials management, which includes consideration of onsite radiological releases.

July 31, 2008 ISE 23

Indian Point Independent Safety Evaluation (ISE)

It did not assess offsite radiological consequences of normal plant operation or other environmental issues (such as thermal effects on Hudson River aquatic life).

Macroeconomics: The ISE addressed IPEC economics/investment, but not regional electricity supply cost/demand issues or impacts.

July 31, 2008 ISE 24

Indian Point Independent Safety Evaluation (ISE) 1.4 The ISE Process The Panelists evaluated IPEC performance relative to their experience and expectations for high performing nuclear plants and other facilities - so, in that sense, the ISE evaluation criteria were the collective professional judgments of the Panel members concerning IPEC performance, taking into account a range of qualitative and quantitative factors. Given the diversity and depth of Panelist experience, this approach made possible an unusually broad composite perspective on the station.

Three of the four ISE Teams conducted structured evaluations in key performance areas, and from these assessments drew conclusions regarding the adequacy of nuclear safety, security and emergency preparedness at IPEC. The assessments involved extensive observations, interviews and document reviews, and the Panelists conclusions reflect their experiencebased judgments about IPEC performance in these areas relative to that of highperforming nuclear plants and other facilities, both in the United States and internationally.

The Panels onsite evaluations followed a methodical structure, developed to yield both an indepth assessment of station performance in nuclear safety, security and emergency preparedness, along with a meaningful measure of overall plant health. Panel reviews examined the station from several perspectives:

1. People. Interactions with and observations of individuals and groups at all levels, along with assessment of the organizational structure, size and capabilities.

2. Plant. Examination of the physical plant via walkdowns, personal observations, and reviews of equipment operating and maintenance records.

3. Process. Observation of plant operations, maintenance and other work in progress, and reviews of work processes and work products.

Protocols and guidelines for these review activities were prepared by the Panel in advance of its onsite reviews.

Within this framework, the Panel identified and specifically examined areas of key importance to nuclear safety, security and emergency preparedness, including such matters as radiological protection, radioactive materials management, training and industrial safety. The stations internal and external interactions were assessed. The Panel assessed the degree to which Indian Point applies lessons learned (from Indian Point and other plants) to steadily improve its own operation.

As a companion effort to the reviews by the Nuclear Safety, Security and Emergency Preparedness Teams, the ISE Public Policy Team examined Indian Point health from the July 31, 2008 ISE 25

Indian Point Independent Safety Evaluation (ISE) public point of view. This Team met with municipal, county, state and federal officials, and gathered information regarding issues of public interest from a variety of sources.

Together, the four teams evaluated a wide range of these public interest issues, all matters of evident importance to stakeholders and the general public.

The Panel reviewed thirdparty evaluations (from NRC, INPO and others), primarily to ensure its awareness of and attention to matters considered by others to be important; but at the same time, the Panel worked to conduct an unbiased review, basing its conclusions on its own observation and assessment, rather than on the work of others.

Conclusions and suggestions for improvement were drawn by each team in its area of review, and are presented in those respective areas of the report. Principal conclusions and recommendations are presented in Section 8 of this report and in the Executive Summary.

The Panels onsite deliberations were conducted in private. During the course of its on site review, the Panel received technical support from the Indian Point staff, in the form of arranging meeting rooms, coordinating schedules and providing resource materials and other documents as requested. At the Panels requests, the site provided factchecking and accuracy verification, but neither draft nor final versions of this report were shared with any Entergy personnel prior to report signout by the Panel.

July 31, 2008 ISE 26

Indian Point Independent Safety Evaluation (ISE)

Section 2: Supporting the Public Interest Acceptance of Indian Point by the larger public in the surrounding areas involves issues beyond technical and operational ones. For that reason, the ISE included a substantial public interest component, with evaluation of issues of expressed concern to the public conducted handinhand with the technical and operational parts of the assessment. This public policy engagement is a fundamental distinction between this ISE and the more conventional nuclear plant evaluations, such as plant inspections by the NRC and evaluations by INPO.

Evaluation of areas of public interest was incorporated into the ISE in two major ways:

1. The Public Policy Team brought to the ISE Panel a publically oriented perspective to its evaluation, as a companion to the more technical, inplant perspectives of the Nuclear Safety, Security and Emergency Preparedness Teams.

2. A comprehensive list of Issues of Expressed Public Concern was compiled from numerous sources. These issues were catalogued, classified and evaluated by technical and public policy Panelists as appropriate, and their conclusions are included in this report.

2.1 Public Policy Team The ISE Public Policy Team comprised two individuals with long term, broad and deep experience with government affairs in New York State and City, in energy and other areas.

The Public Policy members are John Dyson and Maureen Helmer. Mr. Dyson is a former Chairman of the New York Power Authority (NYPA) and a former New York City Deputy Mayor for Finance and Economic Development (during September 11, 2001). In addition, he has held other senior positions in the public sector and continues to have a successful business career. Ms. Helmer is an attorney whose 25year public sector and energy related career experience included service as General Counsel, Commissioner and Chair of the New York State Public Service Commission (also during September 11, 2001).

Both Mr. Dyson and Ms. Helmer have been dedicated public servants, known and respected for their capabilities and their integrity. Both have worked effectively at different levels of government, with members of both major political parties. Both are now working in the private sector. Their inclusion is particularly important, because it adds an entirely different dimension to the Panel and enhances its independence.

The Public Policy team served several key functions:

- To raise awareness and understanding in the Panel to the points of view held by many in the public regarding Indian Point July 31, 2008 ISE 27

Indian Point Independent Safety Evaluation (ISE)

- To provide insight to the Panel into the economic and political implications of the plant's location, near New York City, a major population and finance center

- To provide understanding of the heightened sensitivities in the city and state that were directly impacted by the September 11, 2001 attacks on the World Trade Center

- To inform the Panel regarding key stakeholders in the region in both the public and private sectors and assist the Panel in soliciting and assessing stakeholder inputs Through the course of the ISE, the Public Policy Team worked both independently from, and interactively with, the other teams. Public Policy Panelists were trained and cleared for unescorted access and visited many parts of the station. They conducted numerous meetings with stakeholders and state, county and municipal officials, and they also participated in Nuclear Safety, Security and Emergency Preparedness (EP) Team interviews, meetings and observations. These activities provided the Team with both the outside and inside perspectives. They engaged with the Panel as a whole in review sessions and deliberations regarding conclusions and recommendations, particularly on crosscutting issues and assessments of public interest topics.

July 31, 2008 ISE 28

Indian Point Independent Safety Evaluation (ISE) 2.2 Information Gathering With the help of the Public Policy Panelists, the ISE went to great lengths to secure public input as to the scope of its inquiry and specific matters of concern to the public and various stakeholders. The means of obtaining this information included:

1. Public Meetings. In April, the full Panel held two public meetings (afternoon and evening to maximize participation by all interested parties) in Cortlandt Manor, N.Y. The meetings were attended by approximately 150 individuals, many of whom provided written and/or oral (and in one case musical) presentations.

2. Email. The Panel established an email address, safety@nyindianpoint.org, to facilitate further suggestions from the public and to offer an avenue for anonymous input where desired. There were over 70 public contacts received at this address, prompting consideration from the cochairs or staff.

3. Direct Outreach

- County and Municipalities: ISE Panelists, including EP and Public Policy Team members, met extensively with representatives of each of the four counties and the local municipalities that include or have direct involvement with Indian Point. Typically, these were several hour meetings and involved a thorough exchange of ideas and concerns.

- State: Multiple meetings, phone conversations and exchanges of information took place between Panel members and various state agencies having direct responsibilities related to Indian Point safety, regulation and emergency preparedness. These conversations produced valuable input and advice for the Panel.

- Federal: Representatives of several federal elected officials from the area participated in the public meetings and provided input into the scope of the ISE Panel's inquiry. Panelists also met with representatives of federal officeholders during the evaluation process.

July 31, 2008 ISE 29

Indian Point Independent Safety Evaluation (ISE) 2.3 Issues of Expressed Public Concern As an activity very closely coupled to the Public Policy Teams work, the ISE Panel applied particular attention to issues of expressed public concern, compiling and categorizing a list of such items for consideration by the Panel as part of its overall evaluation. Panel cochair Dr. Todreas took on personal accountability for this activity, working with members of the Public Policy Team and other Team and staff members to enable the ISE to produce an evaluation that considers and is responsive to public input.

Sources of public concern issues include the Public Policy Teams information gathering steps outlined above, screening of media reports over several years, and input via direct communications from stakeholders. Some of the items gleaned from these sources are technical in nature, some are not. Some refer to isolated incidents while others are potential indicators of underlying problems. The range of perceived or actual risks to the public varies widely. Their only common denominator is that all, to some degree, have captured the public interest, and for that reason the ISE Panel determined that their careful consideration was warranted.

In total, several hundred public interest items were identified and ultimately reduced (primarily by aggregation of similar items) to a working list of 39 issues.

In that most of these involve matters that are being or have been dealt with by the plant, many fell logically within the planned evaluation scope of one of the ISE Teams. In those cases, the evaluation was performed by the appropriate Team and reported in its section of this report. In other cases, special handling was assigned. A few cases - review of the potential vulnerability of Indian Point to aircraft impact, as an example - received a great deal of Panel attention, involving extensive document review and multiple meetings with plant specialists.

Appendix 3 is a complete listing of the ISE compilation of Issues of Expressed Public Concern and a discussion of the ISE Panels treatment of each. Conclusions pertinent to these issues are captured in appropriate sections throughout this report.

July 31, 2008 ISE 30

Indian Point Independent Safety Evaluation (ISE)

Section 3: Nuclear Safety At a nuclear plant, safety must be the first order of business, every minute of every day.

When the plant is operating to generate electricity its continuing function it must be done so safely. If not, public health and safety could be in jeopardy.

3.1 The ISE Nuclear Safety Team In his 34year career with the U.S. Nuclear Regulatory Commission, the team leader, William Kane, was involved at every level of developing, implementing and monitoring U.S. safety regulations for licensed U.S. nuclear plants. As the NRC Deputy Executive Director for Operations, he was accountable at a senior executive level for regulatory oversight of the entire fleet of over 100 licensed commercial nuclear operating units in the United States.

Team members Scotty Hinnant and Gary Broughton retired from long and successful careers in engineering, operations and management of nuclear plants. Mr. Hinnant retired recently as Chief Nuclear Officer for Progress Energy, and in that capacity was the senior accountable executive for the operation of Progress Energys four nuclear plants. Mr.

Broughton was President and CEO of the GPU Nuclear Corporation6 (GPUN) and in his career at GPUN held a succession of key nuclear engineering and plant operational positions. Team member Buzz Galbraith is a retired U.S. Navy Commander and former nuclear submarine commanding officer, and in his subsequent career held management positions at U.S. nuclear plants and with Institute of Nuclear Power Operations (INPO), an industry organization responsible for inspecting nuclear plants around the country safe operation.

In composite, the Independent Safety Evaluation Panel (ISE) Nuclear Safety Team has nearly 150 years of directly applicable experience in engineering and safe operation of nuclear stations like Indian Point. Collectively, they have operated, managed, inspected or visited many nuclear plants in the United States and overseas.

6 GPU Nuclear was a subsidiary of the General Public Utilities Corporation, an electric utility company that served large portions of New Jersey and Pennsylvania. GPU Nuclear operated two nuclear plants, Three Mile Island Unit 1 and Oyster Creek.

July 31, 2008 ISE 31

Indian Point Independent Safety Evaluation (ISE)

The Teams Evaluation Approach To reach a conclusion regarding the overall safety of the Indian Point Energy Center (IPEC), the ISE Nuclear Safety Team examined three fundamental areas of plant operations:

People Safe plant operation is fundamentally a matter of prudent, careful and fully professional behavior of those entrusted with responsibility for plant operation and support. Plant personnel at every level must be qualified, well trained and held accountable to clear, high standards. On that basis, the Nuclear Safety Team examined in depth the caliber, capabilities and performance of Indian Point leadership, organization and staff.

To do so, the Team interviewed plant personnel at every level, and met with groups of employees. They observed personnel at work in the plant in routine and nonroutine tasks and in drills. They reviewed the training program and observed actual training activities. They examined work products and plant records, and they reviewed various internal and external evaluations of IPEC performance.

Systems and Equipment Nuclear power plants are large industrial facilities, with thousands of pipes, valves, tanks, pumps, motors and instruments. And like all currently operating U.S. nuclear plants, Indian Point is not a new station - Units 2 and 3 were placed in operation over 30 years ago.

It is imperative, therefore, that the plant be well maintained and updated where needed, and that the plant condition be monitored continually. In particular, systems and equipment that are important to nuclear safety must be surveilled and maintained to ensure their availability to perform when called upon.

The ISE Nuclear Safety Team spent many hours in the plant, assessing interior spaces and compartments, including areas with controlled access because of presence of radioactivity7, and the outlying structures and 7 There are areas within all nuclear plants for which personnel access is restricted for radiological protection purposes. Such areas are specifically designated and marked (based on levels of radiation and airborne or surface contamination), and controlled as appropriate. Their interior conditions are routinely surveyed and radiological exposure to personnel accessing them is controlled via shielding and specially designed ventilation systems as needed. Personnel entry requires special training and protective clothing and July 31, 2008 ISE 32

Indian Point Independent Safety Evaluation (ISE) exterior parts of the plant as well. They reviewed plant maintenance records and system and equipment reliability data.

Processes and Programs It is conventional practice among U.S. nuclear plants to utilize formalized processes and programs as a means to achieve high levels of performance in important functions. As an example, programs for worker safety provide uniform training, prescribed safety practices and requirements, performance goals, and performance measures.

The Team performed thorough reviews of the Indian Point processes and programs it considered to be particularly important to nuclear safety, as described in the following sections, in each case examining the process and its demonstrated effectiveness.

In each of these three focus areas, the ISE Nuclear Safety Team members applied their knowledge, extensive experience and personal high standards, comparing what they found at IPEC to nuclear plants that are recognized as highperforming plants.

Like all of the Panel members, the Nuclear Safety Team had unescorted access to the plant.

They were free to interface and communicate with all levels of staff and management. In the plant, they attended meetings and training sessions and they observed work in progress, worker behaviors, procedure compliance and interpersonal interactions. They reviewed plant equipment and work process data as input to their assessment of organization and staff performance and effectiveness, particularly in areas related to nuclear safety.

The Team reviewed nuclear industry reports and evaluations, primarily from INPO and the NRC, to verify that its areas of inquiry covered any areas of nuclear safety concern identified by these outside organizations.

As a related aspect of its work, the Team looked into public interest issues related to nuclear safety, as outlined in Section 2 and Appendix 3.

equipment. Members of the Nuclear Safety Team were trained and qualified for entry to such areas in accordance with Entergy requirements.

July 31, 2008 ISE 33

Indian Point Independent Safety Evaluation (ISE) 3.2 The Workforce and its Performance The workforce and its performance is a key layer of nuclear safety defense in depth.

Significant Team attention was applied to this area.

Both the IPEC organization and the Entergy Corporate organization that interfaces with IPEC were examined to assess if they demonstrate the standards and effectiveness necessary to run a top quality nuclear operation. The review and assessment included a full range of organizational elements, including:

- Organizational structure

- Site and corporate organization interfaces

- Leadership experiences and skills

- Professional staff numbers and quality

- Management/union interfaces and relations

- Employee skills and motivation

- Training program effectiveness

- Staff size and financial resources Nuclear Safety Team members interviewed numerous site personnel to gain multidimensional views of the organization and its effectiveness. Station managers, professional employees and union leaders were interviewed in scheduled meetings and during contact discussions in plant and office spaces. Meetings with groups of craft employees and separate groups of first line supervisors were also conducted to seek their perspectives on various issues, to gauge safety culture and as one window into interpersonal and intergroup communications.

Nuclear Safety Team members reviewed organizational charts, staffing numbers, vacancies, and hiring and turnover data. They evaluated Entergys process and effectiveness in integrating, subsequent to its acquisition of the two separate Indian Point operating units, site management and site processes, procedures and training, and they compared the resultant composite organization to other nuclear power station structures.

Indian Point Organization The current IPEC organizational structure compares favorably with similar size nuclear plants.

In 2007 Entergy restructured its nuclear organization, combining its Northern (unregulated) and Southern (regulated) nuclear plant organizations into a single integrated organization. This new structure has changed certain responsibilities and interfaces between the IPEC organization and corporate organizations located in White Plains, N.Y. and Jackson, Miss. Simultaneously, Entergy conducted a process termed Corporate Alignment (Alignment Process) to achieve consistency between the Indian July 31, 2008 ISE 34

Indian Point Independent Safety Evaluation (ISE)

Point management organization and those of other Entergy stations and also to resolve residual organizational issues from the integration of Units 2 and 3. The ISE Panel does not consider these organizational changes to pose safety concerns. However, the changes have been substantial and disruptive, and the new organization has not been in place long enough to provide a high confidence level that gaps at the interfaces do not exist.

The IPEC leadership team appears to be well qualified and appropriately focused on safety as the overriding priority in their decision making process. A majority of the members of the management team have extensive IPEC knowledge and experience, although many are in new positions as a result of the Alignment Process. The individual managers qualifications and backgrounds meet industry standards. The numbers of staff and managers onsite is smaller than before the Entergy purchase due to staffing reductions that occurred during the integration of the two unit organizations and the Alignment Process.

The IPEC workforce (craft, professional, supervisors and managers) is qualified and skilled to perform the necessary operation, maintenance and engineering needed to safely run the station. Union leadership and site management appear to work together well and both understand that the safety of the station must be maintained to allow operations to continue. Entergy and IPEC consider training to be a core value, and the quality of training programs reviewed and the actual training observed by the Team support that contention. Control Room operator professionalism, clear communications protocols, and command and control are considered strengths by the ISE Panel.

Recently, Entergy announced its intent to implement a second major structural change.

Under the proposed structure, ownership of Entergys unregulated nuclear plant assets (including Indian Point) would be shifted to a newly formed company named Enexus, and the plants will be operated by a second new company named EquaGen. The process and procedures used for fleet operations would not be affected, but as part of this proposed change current Indian Point personnel would shift employment from Entergy to the new companies. This change has created some anxiety among site employees, anxiety that can be expected to continue until all details are known. The ISE Panel cannot assess the future July 31, 2008 ISE 35

Indian Point Independent Safety Evaluation (ISE) impact of the corporate restructuring, if implemented, although its potential ramifications on employee retention and plant funding are discussed in Section 7 of this report.

In summary, the ISE Panel believes that the workforce and management at IPEC work effectively together to safely operate and maintain the nuclear units. Management and worker interactions, as well as worker trust for site managers, appear to be good.

However, there has been some stress within the workforce stemming from the organization Alignment Process carried out in 2007 and by the recent announcement of the proposed formation of Enexus and EquaGen.

Human Performance To understand the effectiveness of the workforce, which includes craft and supervision, to be able to safely operate and maintain the power plant, it is important to understand how they approach work and their ability to focus on performing tasks correctly the first time.

To this end the Panel examined human performance error reduction programs, procedure usage, and how important work is planned and executed within the IPEC organization.

IPEC has an ongoing program to reduce human errors that includes training on error reduction techniques and coaching by supervisors in the field. The expectations that workers focus on reducing human errors are defined and reinforced by management. The use of proven tools such as formal communications practices, procedure place keeping, correct component identification, self/peer checking and coaching is encouraged to develop and reward desired behaviors. Human error rate and supervisor coaching time are monitored monthly.

Both the quality and proper use of procedures are important components of an effective human performance program. The IPEC procedures have been consolidated between Units 2 and 3. In addition some Entergy fleet program procedures have been adopted on site. Procedure adequacy and human performance have been areas receiving extra scrutiny by oversight groups. For three years NRC has identified human performance related to procedural use as a substantive crosscutting issue8 at Indian Point Unit 2.

Recently NRC identified the same crosscutting issue for Unit 3. The reasons for the issue still being open were described in the NRC annual assessment report for 2007 as insufficient progress in resolving the procedure adequacy issue. Because this issue remained open for three consecutive NRC assessment periods, the station was requested by NRC to conduct an independent safety culture assessment. That assessment was initiated in June 2008.

8 As part of its ongoing oversight of licensed nuclear plants, NRC regularly identifies substantive cross cutting issues. These are licensee areas of weakness that in NRCs view can adversely affect plant performance in multiple areas.

July 31, 2008 ISE 36

Indian Point Independent Safety Evaluation (ISE)

Specific actions by IPEC to improve procedure quality were defined in 2006 and revised in May 2008 to include procedure related human performance elements and to focus on improvements to specific procedures in the Operations Area.

There have been two recent Indian Point events that stemmed from failure to use error reduction tools and to notify supervisors of unexpected field conditions. These illustrate opportunities for human performance improvement:

Power was interrupted to a vital electrical circuit during checks of relay settings. Technicians performed procedure steps out of sequence; did not use error prevention tools for communications, component identification, checking and place keeping; and failed to involve supervisors when unexpected conditions occurred.

The reactor was manually tripped after a turbine runback. The runback circuit was prematurely enabled by the control room crew after being unable to find the procedure step requiring the feature to be placed in service later in the plant startup sequence. Operations management was not consulted.

It is the Nuclear Safety Teams view that the underlying human performance problems which prompted these events are well understood and that Entergy is taking the proper steps to address them. However, the pace of improvement is disappointing. Continuing management attention is warranted.

Staffing From its review of site personnel resources compared to similar nuclear organizations, the Team concluded that the overall number of people authorized in the organizational structure is adequate. However, there are selected areas where additional staffing is needed. At Entergy, managers and supervisors request approval of additional staffing through an established business process. This appears to be more structured and controlled, particularly for adding budget dollars and contractor resources, than the previous plant owners required. Additional training is being conducted on development of budgets and how to identify and justify changes to meet the sites needs.

The nuclear industry is currently experiencing a high turnover rate due to the combined effects of retirements (the aging workforce effect) and job creation by nuclear vendors, engineering organizations and utilities to staff existing nuclear plants and new nuclear plant design and licensing projects. The NRC has also been hiring at a high rate to accommodate the increasing workload related to new plant license application reviews.

July 31, 2008 ISE 37

Indian Point Independent Safety Evaluation (ISE)

IPEC has been experiencing a relatively high rate of attrition, for reasons discussed in Section 7. Indian Point Operations Department has lost 10 licensed personnel over the last year. There is also a number of Reactor Operator (RO) and Senior Reactor Operator (SRO) licensed personnel who will reach early retirement age during the next few years. There are adequate licensed operators to staff the shifts, but fewer SRO licensed personnel are available than is desired to fill rotation positions to Training (5), Work Management (2),

and Quality Assurance (1). The need for more licensed personnel has been recognized by Entergy and IPEC. A fiveyear plan has been developed and approved to hire extra people to fill an operator training pipeline. The issue of staffing and actions taken by Entergy to address it are discussed in greater detail in Section 7.

The Team does not consider this to be a current safety concern, but it could be in the future and, as such, it is an area that requires close management attention.

Safety Culture An NRC inspection conducted in 2006 identified pockets of safety culture issues in Plant Instrumentation and Controls (I&C) and Chemistry. Previously, a survey had been conducted for Entergy that identified potential issues in the same areas and in three additional areas.

Entergy conducted a followon assessment in 2007. As a result, an Executive Review Board, chaired by the Site Vice President, was convened to address identified issues, including achieving consistency in disciplinary actions. An Executive Protocol Group, chaired by the Entergy Nuclear Safety Assurance Director, was also formed to examine safety culture trends from all sources.

In June 2008, Entergy initiated another independent assessment in response to the latest NRC findings. The ISE Nuclear Safety Team chose not to conduct its own focused assessment of Indian Point safety culture, in view of the separate, methodical and simultaneous safety culture evaluation by others. Nevertheless, in the course of its work, the team drew many insights into Indian Point safety culture, as reflected in this report.

Numerous interviews with station personnel indicate that they feel free to raise any issues that concern them.

The team did not detect in the course of its evaluation any Indian Point safety culture issue that, in its judgment, would adversely affect station nuclear safety performance.

July 31, 2008 ISE 38

Indian Point Independent Safety Evaluation (ISE) 3.3 Indian Point Systems and Equipment At every nuclear plant, there are specially designed systems whose sole purpose is to mitigate the effects of accidents. These include water sources to flood the reactor core and remove heat from the plant, and the electrical, control and monitoring systems needed by the staff to place and maintain the plant in a safe condition following a wide range of postulated accidents. Furthermore, the reliable and steady performance of normal plant systems serves to avoid operational disruptions that can trigger system instability and potentially lead to unsafe conditions.

Nuclear Safety What Can Go Wrong?

Nuclear power plants rely on numerous mechanical (pipes, valves and pumps),

instrumentation and control, electrical, and software systems to maintain smooth, reliable operations. Nuclear plants have numerous safety systems - backup cooling water and power supplies, as examples - designed to prevent core damage in the event of serious problems. They also include containment systems to prevent spread of radioactivity even if main and backup systems fail. Together, these layers of protection are termed defense in depth.

Plant damage could stem from any of a number of causes - equipment failure, operator error, natural disaster or intentional sabotage. Regardless of cause, multiple simultaneous failures in large, robust systems and structures would have to occur before there would be any danger to the public.

In the wake of the terrorist attacks of September 11, 2001, there has been a great deal of justifiable concern about the possibility of a terrorist attack at a nuclear station like Indian Point. But from a nuclear safety perspective, the cause of damage is largely irrelevant. To cause sufficient damage to harm the public, terrorists - or nature - would have to disable or breech multiple, rugged protective features.

The ISE Nuclear Safety Team found that performance of Indian Point safety systems -

principally high pressure safety injection, emergency AC power and auxiliary feed water -

has generally exceeded industry goals. The reactor fuel has performed at a high level of reliability with no deficiencies. On the other hand, there have been a number of reactor trips9 and power reductions over the past several years - and while these were not caused by safety system malfunction, each challenged safety system operation.

9 The design of a commercial nuclear reactor includes numerous safety features to automatically shut down (scram or trip) the reactor upon detection of any condition that could threaten plant safety. Such shutdown is precautionary, but both its cause and effect - the many system and operator actions that attend July 31, 2008 ISE 39

Indian Point Independent Safety Evaluation (ISE)

The ISE Nuclear Safety Team has examined these overall plant reliability issues in detail and its evaluation is summarized here.

IPEC Switchyard Nuclear power plant safety systems depend on electrical power for motor driven pumps, motor operated valves, and control systems to direct and deliver cooling water to cool the reactor core. Plants are designed with redundant onsite emergency power sources, diesel generators, to provide their own necessary electric power if normal sources are lost.

However, offsite power sources from the electric grid surrounding the plant are the primary sources of electric power used for normal and emergency plant equipment when the plant is not in service and producing its own electric supplies. This designed defense in depth helps to ensure reactor safety.

The Indian Point units connect to the New York power grid through a large Consolidated Edison Company switchyard that is located directly adjacent to the power plant site. This switchyard serves as an important transmission node for supplying power to the city of New York. Due to the switchyards importance to grid reliability in the area and its important support function to IPEC, Consolidated Edison maintains personnel at the switchyard around the clock (24/7).

There are multiple supply cables between the switchyard and the three units on the IPEC site. This supply redundancy, plus onsite power crosstie capability, provides a reliable source of offsite power to the station. As an example of the reliability, IPEC was one of the first facilities in the region to receive electric power after the 2003 Northeast blackout.

Power was restored in approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Unplanned Shutdowns Baseloaded nuclear power plants such as IPEC are designed to safely operate at 100 percent power between planned outages (except for occasional power reductions for required testing). Forced outage rate is a measure of the reliability of the plant for this continuous operation objective. The ISE Nuclear Safety Team reviewed recent generation outages and forced outage rates for both Indian Point Units 2 and 3.

to reactor shutdown - are undesirable, and frequent occurrence of such events is a matter of potential concern.

July 31, 2008 ISE 40

Indian Point Independent Safety Evaluation (ISE)

Public Interest Issue #34: Fire in Unit 3 Main Power Transformer An example of the kind of plant upset that can cause an unplanned reactor shutdown is the Unit 3 electrical fault and fire of April 6, 2007. The fault and resultant fire occurred in one of the two main power transformers, called the 31 main power transformer. This resulted in a plant trip. The adjacent 32 main power transformer sustained minor damage due to the fire in 31.

The cause of the fire was a failure of the Bphase, highvoltage insulating bushing. Entergy replaced the 31 main power transformer and repaired the 32 transformer.

The Nuclear Safety Team reviewed reports of the fire as well as Event Notifications provided to the NRC. Main power transformer faults, as well as high voltage bushing failures have become more common industry occurrences in recent years due in part to the age of the transformers. Transformers of this type are cooled by circulating oil which acts as an insulating medium as well as a conductor of heat from the windings to oiltoair radiators. The transformers are located external to the turbine building and have fire detectors and sprinkler systems installed to suppress any fires.

The transformers are important for delivering electrical power to the grid when the plant is operating but they serve no direct nuclear safety function. Their physical location and designed protective systems prevent transformer fires and other failures from causing nuclear safety concerns. Entergys replacement plans for other similar transformers are included in the Indian Point capital budget plans and appear appropriate to the Panel.

This event raised questions from the NRC concerning management effectiveness in the communications about this event and its causes. Entergy has made changes to improve decision making in such situations.

The combined forced outage rate per year for both Indian Point units improved significantly after Entergy took over station management in 2001. For the 10year period 1991 through 2000, the average forced outage rate per year was 37.5 percent under the previous owners. For the period 2001 through 2007, the forced outage rate improved with a per year average of 1.86 percent being achieved for the 7year period.

However, in 2006 and 2007, the number of plant trips and shutdowns increased and exceeded the rate experienced in recent years. The table below lists those generation outages by unit for this period, including the first four months of 2008. The primary causes of the outages were equipment related, although human errors caused a few. The two most common categories of equipment failure are electronic power supplies and the main generator exciter/voltage regulator.

July 31, 2008 ISE 41

Indian Point Independent Safety Evaluation (ISE) 20062008 Lost Generation - IPEC Units 2 and 3 Date Shutdown Type Cause Indian Point Unit 2 September 2006 Manual reactor trip Loss of heater drain pumps November 2006 Automatic reactor trip Main generator exciter December 2006 Turbine/generator shutdown Steam generator leak March 2007 Manual reactor trip Main feedwater pump trip May 2007 Turbine/generator shutdown Feedwater regulator valve repair March 2008 Manual reactor trip Main feedwater pump trip April 2008 Turbine/generator shutdown Negative sequencing relay April 2008 Manual reactor trip Runback relay failure and operator error Indian Point Unit 3 July 2006 Automatic reactor trip Main generator relay July 2006 Manual reactor trip Observed electrical arcing March 2007 Manual reactor trip Main feedwater pump April 2007 Automatic reactor trip Main power transformer May 2007 Turbine/generator shutdown Main generator exciter Actions to Reduce the Frequency of Equipment Failures Numerous investigations have been conducted to determine the root and common causes of the kinds of equipment failures that have resulted in unplanned shutdowns, and plant management has taken several actions to prevent these and similar future equipment failures. These have included:

- Identification of components critical to safe and sustained operation.

- A Single Point Vulnerability Study to identify components that, if they were to fail, could cause a plant trip.

As part of the latter, a cross system component review identified electronic power supplies as a single point vulnerability item. As a result, 29 electronic power supplies were replaced in the Unit 2 spring 2008 refueling outage. The remainder of the identified power supplies in Units 2 and 3 will be replaced by the end of 2009.

Engineering design change processes have also been improved to reduce design vulnerabilities. All plant components have been reviewed to identify the preventive maintenance activities necessary for their optimum operation and to implement a July 31, 2008 ISE 42

Indian Point Independent Safety Evaluation (ISE) schedule to accomplish these activities on a recurring basis. The revised preventive maintenance schedule is being implemented, with actions to modify, repair or replace identified equipment on a schedule based on need and plant status.

Entergy has also taken action to improve the administrative and procedural guidance to minimize plant transients. The procedure upgrade project is intended to improve procedural clarity and incorporate industry best practices so that workers and operators can more effectively perform their duties and reduce errors.

The root cause evaluations show that maintenance practices have been factors in some of the transients and reactor trips. Corrective actions taken at the station include additional training and qualification oral boards and focused crew assessments by management. The Entergy fleet maintenance peer group initiatives are also in the process of being implemented.

Finally, the station has established a Unit Reliability Team to apply sharply focused attention to equipment reliability. This team is chaired by the Operations Manager and includes representatives from Engineering, Maintenance and Work Management. The team meets weekly and is accountable to identify, prioritize and drive resolution of issues challenging plant reliability.

It appears that these steps and others are having a positive effect on plant performance. At the time of this report completion IPEC Unit 3 had operated over 450 days of continuous operation. Unit 2 achieved a 298 day run prior to its refueling outage earlier in 2008.

Preventive Maintenance About 95 percent of the maintenance work is preventive, work done to check equipment operation and replace lubricants, seals and parts which wear out with use or age.

Per license requirements, preventive maintenance of safetyimportant equipment must be performed within prescribed intervals. The window of regulatory compliance is the prescribed interval plus a period (generally 25 percent of the interval) usually referred to as the grace period. Typically, nuclear power plants perform as much preventive maintenance as possible on schedule or early in the grace period in order to minimize excessive maintenance while retaining adequate margin to avoid noncompliance with regulatory requirements.

At the time of the ISE review, the number of Indian Point critical preventive maintenance actions (PMs) in the grace period was 795, of which 658 - a very high proportion - were late in grace, that is, in the second half of the prescribed grace period. In addition, there were 47 deferred PMs and 23 overdue. An overdue PM is defined as a PM that has not been performed by the end of its grace period; a deferred PM is one consciously delayed beyond July 31, 2008 ISE 43

Indian Point Independent Safety Evaluation (ISE) the grace period, justified by an approved engineering evaluation, usually on the basis of conflict with emerging work and conscious balancing of risk. In cases when the required PM is not performed in time, and the deferral cannot be justified by engineering evaluation, the PM is classified as overdue. All deferred and overdue PMs are captured in the corrective action program and addressed accordingly.

In summary, the number of PMs late in grace is excessive, and the number of deferred and overdue PMs is about average for U.S. nuclear plants. Until recently, the number of deferred and overdue PMs had been minimal. Station personnel advised that preparations for the recently completed Unit 2 outage and lack of resources impacted the ability to get PMs done on time. The initial problems with implementation of the Passport work management system10 (instituted by Entergy for purposes of fleet standardization) were also cited as a factor, as was an organizational change that resulted from the Alignment Process involving the reassignment of PM responsibility to an initially unfilled position in the Plant Scheduling and Outage (PS&O) Organization. A recovery plan is in place.

Maintenance personnel estimate that it may take the rest of the year to get back to acceptable PM backlog levels.

In the Nuclear Safety Teams view, the large number of PM actions in the latter half of their grace period raises the potential for late preventive maintenance work and possible adverse effect on safe operation.

Corrective Maintenance By definition (consistent with industry practice) corrective maintenance is any work required to correct the failure or significant degradation of a power block structure, system or component (SSC).

At the time of the ISE Team site reviews, the stations corrective maintenance backlog -

that is, identified corrective action work waiting to be accomplished - comprised 10 work orders, much better than the stations goal of 20. However, in addition to this required corrective action workload, there was a backlog in elective maintenance11 of 1,313 non outage and 553 outage work orders, along with an additional 6,775 other12 maintenance backlog items.

10 One of the shortfalls in the initial Passport implementation was that the mapping from Maximo, the previous system, was incorrect. This resulted in approximately 37,000 tasks not being scheduled.

11 Elective maintenance is any work on power block equipment for which identified potential or actual degradation is minor and does not threaten the components design function or performance criteria. This category is intended for future maintenance for which there can be scheduling flexibility.

12 Other maintenance is work that does not reflect a material condition deficiency on station power block equipment.

July 31, 2008 ISE 44

Indian Point Independent Safety Evaluation (ISE)

Operations pays close attention to this work, reprioritizing maintenance actions and/or putting stopgap workarounds to prevent adverse impact on the plant. But collectively this maintenance backlog exceeds those of highperforming plants and in time could adversely affect overall plant reliability.

In the Teams judgment the backlog does not constitute a current safety concern, but it does introduce an additional operational burden, with attendant opportunity for error or unintended consequences.

Temporary Plant Modifications The station exercises effective control over temporary plant modifications (a process many plants have difficulty managing well), but the number of such modifications is higher than desired.

These are typically minor design changes to plant systems needed to place those systems in a safe and reliable status until a final modification or repair is approved and completed.

Proposed temporary modifications are thoroughly reviewed for safety, reviewed and approved at the Unit Reliability Team meeting, and are also reviewed by senior Entergy management at the monthly management review meeting. The stations objective is to have as few temporary modifications in effect as possible. Currently IPEC has 19 modifications that will require an outage to remove and 17 that will be removed at the earliest opportunity while on line. This exceeds the station goal of eight.

LongTerm Plant Health An aging plant (of any kind) with thousands of active components requires a program of methodical, proactive monitoring, assessment and upgrading to preempt degrading performance.

Indian Point maintains a fiveyear asset management plan to identify and prioritize equipment replacements over the relatively near term, based primarily on reducing risks to generation. Some of the equipment currently in the plan includes traveling screen replacement, trash rack replacement, Unit 2 battery replacement, transformer replacements and reactor core split pin replacement. This fiveyear plan is a subset of a longerterm (15year) plan that identifies and sets tentative timing for all planned capital improvements such as replacement of obsolete equipment and mandated regulatory changes.

The Nuclear Safety Team reviewed both of these plans and found them to constitute a technically sound basis for maintaining a high level of plant reliability and safety, over the long term, provided that sufficient resources are made available.

July 31, 2008 ISE 45

Indian Point Independent Safety Evaluation (ISE)

The station also maintains a Top 10 equipment list which highlights the major equipment issues/problems that most warrant repair or upgrade in the near term. This list is reviewed at the weekly Unit Reliability Team Meeting and at the Monthly Management Review Meeting with Entergy senior management.

As has become common practice at U.S.

nuclear plants, IPEC utilizes formalized health plans for each plant system. Each health plan is developed and maintained by a system engineer who is knowledgeable and experienced in that system. These plans catalog system status, operating experience, maintenance work, and modifications or other improvements currently anticipated for that system, and present detailed actionable schedules for the accomplishment of these items.

A colorcoded classification system is utilized to reflect the relative urgency of actions necessary to bring or maintain the system to the highest operating level. At the time of the Teams review, a total of 10 systems were classified in the worst two categories, four were classified in the highest (red) level of focus: Unit 2 Gas Turbines, Unit 2 Service Water, Unit 3 Emergency Diesel Generators, Unit 3 Control Room Air Conditioning; and six systems that are in the second level (yellow): Unit 2 138 KV, Unit 3 Service Water, Unit 2 Radiation Monitoring, Unit 2 Rod Position Indication, and Units 2 and 3 Circulating Water.

It is noted that the threshold for designation of systems as red is intentionally very low, to give them high visibility and focus for repair or modification. If a redclassified system can be operated safely until permanent repair or modification using compensatory measures, such as a temporary modification or special procedure that satisfies license conditions, it is considered operable. In the case of each of the above reddesignated systems, there has been considerable evaluation performed. Corrective actions are in progress, and the systems are expected to exit the red designation before the end of 2008. The Nuclear Safety Team considers both the designation and disposition of these systems to be appropriate.

July 31, 2008 ISE 46

Indian Point Independent Safety Evaluation (ISE)

As another measure of longterm health, the station has 12 systems in Maintenance Rule (a) (1) system status13. Seven of these are Unit 2 systems and five are Unit 3 systems. This number of systems is slightly higher than that at the best performing plants, but there are some systems that should return to normal status in 2008.

The station has implemented an Entergy fleetwide metric for equipment reliability. The Equipment Reliability Indicator reflects performance against a number of criteria such as corrective maintenance backlog (nonoutage), system health windows, work management metrics and capability factor. These are combined by a weighted average to give a measure of the equipment reliability status of the plant. IPEC Unit 2 score is currently 1.38 and Unit 3 is 1.26, in comparison with the station and fleet goal of 1.2 and Entergy fleet average of 1.195 (with lower numbers indicating better performance). This indicator is meaningful insofar as it provides comparison with other Entergy stations, a fleet of 10 generally wellperforming stations in different geographic areas. IPEC expects to achieve the fleet average or better once the PM backlogs are reduced.

Plant Material Condition The team spent many hours in the plant and observed the plants material condition. By visual inspection, most areas appear to be in satisfactory condition and many are maintained to good industry standards. Entergy has invested heavily in improving the overall material condition of the plant. Two recent examples are:

A new diesel generator, rated at 2 MW, was installed inside of the turbine hall to support station blackout and 10 CFR 50 Appendix R (fire protection) emergency power supply requirements. Additional switchgear and ventilation equipment were installed to support the new diesel. This new diesel generator installation will allow the Unit 2 gas turbines to be retired and is expected to improve emergency power reliability.

The reliability of the service water systems have been improved through increased preventive maintenance and use of new technology. All river silt was removed from service water bays and the frequency of heat exchanger 7 NRC Regulation 10 CFR 50.65, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (the Maintenance Rule), requires monitoring the performance of certain structures, systems and components (SSCs) against licensee established goals (or performance criteria) to provide reasonable assurance that they are capable of performing their intended functions. Required activities include: determining the SSCs within the scope of the Maintenance Rule (scoping); risk determination for those SSCs; and the determination of performance criteria for the SSCs. Maintenance Rule (a) (1) systems are those that dont meet the established performance criteria.

July 31, 2008 ISE 47

Indian Point Independent Safety Evaluation (ISE) cleaning was increased. Also, service water piping is being upgraded from cementlined piping to a highly corrosionresistant alloy.

There are some outofthe way areas, however, where conditions are below industry standards. Degraded conditions observed in some areas could pose an industrial safety challenge (although not a nuclear safety problem), and do not reflect expectations for a highperforming plant.

The most degraded areas in the plant are the equipment tunnel and the Unit 1 Screen Well House, an area that houses Unit 1 equipment that supports Unit 2. Another plant area observed to be degraded was a portion of the ground level of the Unit 2 Turbine Building where there are two discharge canal flow gates that are no longer in use. The severity of corrosion is such that continued structural deterioration could at some point adversely affect the overall flow stream.

The site appearance also suffers from legacy equipment abandonment and inadequate attention to infrastructure appearance and vegetation control. The plant and its equipment, particularly safety related structures, systems and equipment receive adequate attention and resources, as summarized previously in this report. However, the areas of the site visible to the general public present a picture of rusting buildings, cluttered equipment storage and external fences overgrown with vegetation. This does not build public confidence that the unseen parts of the station are well maintained, and it does not communicate to either public or workforce the sense of professionalism and pride in the workplace that is characteristic of high performing plants.

Modifications to Enhance Nuclear Safety The NRC has over the past two decades performed a number of analyses and tests to determine if U.S. nuclear plant containment sump screens could potentially become blocked by debris following a design basis loss of coolant accident. In 2004 Generic Letter (GL) 200402, Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized Water Reactors, requested that all pressurized water reactor licenses evaluate the adequacy of their recirculation sump and screen designs and implement any plant modifications determined to be necessary. This has resulted in modifications that have significantly increased screen sizes at U.S. plants.

Entergy has completed significant modifications including installation of new internal recirculation sump strainers and vapor containment sump strainers at both Units 2 and 3.

July 31, 2008 ISE 48

Indian Point Independent Safety Evaluation (ISE)

Panel members entered the Unit 2 containment building during the spring 2008 refueling outage, talked with engineers, and observed additional modifications that were completed in this outage. Indian Point plans to complete all modifications required by GL 200402 by October 2008.

A related and complicated issue that Indian Point and the U.S. industry is continuing to address is the postaccident chemical effects that could cause small fibers and debris to form sludge that could cause partial screen blockage or downstream impacts on equipment. Entergy engineering as well as the NRC are actively monitoring testing methodologies and results to resolve this issue for Indian Point.

The Panel has no safety concerns with the modifications installed to date or the planned activities to resolve this long standing industry sump screen issue.

Buried Piping Virtually all industrial facilities utilize underground or buried piping to transport fluids (such as cooling water) between sources and served facilities. As plants age and materials deteriorate, monitoring and maintaining the integrity of buried piping systems demands significant effort. At Indian Point, leakage of condensed tritiated steam14 from buried piping has been a matter of considerable public attention. This leak in buried, small diameter, carbonsteel piping necessitated the replacement of 225 linear feet of Units 1 and 3 auxiliary steam piping in the spring of 2007.

Public Interest Issue #8: Buried Piping at Nuclear Plants Buried piping is commonly used in industrial facilities of all kinds to transport fluids between structures and systems onsite. Built of materials appropriate for its service and properly fabricated and installed, such piping can be dependable and long lasting.

Nevertheless, corrosion and other failure mechanisms can prove problematic, particularly as the facility ages, and leaks can be difficult to find and repair.

A number of U.S. nuclear plants have experienced problems with buried piping systems, and a great deal of industry and regulator attention has been paid to this generic issue.

Potential for radioactive contamination of soils and groundwater and reliability of safety systems supported by buried piping are both important concerns. Programmatic actions 14 Tritium is a radioactive isotope of hydrogen. Tritiated water is therefore water in which some of the molecules (H2O) comprise atoms of tritium rather than the normal hydrogen - and its radioactivity is therefore part of the water itself, rather than a separately entrained contaminant. Tritiated steam is similarly the steam or vapor form of water comprising some tritium. Tritium is a relatively lowenergy radioactive material and, except in very high concentrations, is not harmful.

July 31, 2008 ISE 49

Indian Point Independent Safety Evaluation (ISE) to address real and potential buried piping problems include: (1) identification and location of buried piping (sometimes difficult in older plants); (2) evaluation of the consequences of failure of the plants specific piping systems; (3) evaluation of the specific corrosion risk for the important systems, taking into account pipe material, soil condition, pipe coatings and cathodic protection; and (4) development of a methodical course of inspection or replacement.

Depending on the specific factors such as system design, age, construction history and soils, buried piping management can be a major or a minor issue. It is a significant matter at Indian Point - although not extraordinary - and was a point of thorough examination by the ISE Panel.

The following table summarizes the buried piping at IPEC:

Category IPEC Application Status 1 Service and circulating water systems (large Inspected robotically - no leakage diameter pipe) - nonradioactive water - experienced cement lined, carbon steel material 2 Safety injection (3 and 6inch diameter) and Buried portions of these systems are containment spray piping (12inch diameter) pressure tested once each 31/3 year supply (portions underground) from the period to confirm leak tightness - no refueling water storage tank - radioactive leakage detected.

water - stainless steel material 3 Auxiliary feedwater and steam systems (8 and Leakage has been found, and some repairs 12inch diameter/6inch diameter piping) - made. Piping in this category has been the very low tritium levels - carbon steel material main focus of public concern at IPEC.

The failures in the auxiliary steam (Category 3) piping that led to the 2007 repairs have been the subject of extensive analysis. In summary, inspections performed during the repair indicated that the protective wrapping/insulation most likely was not installed as required by design specification, causing the corrosion of the piping. However, a comprehensive investigation of the nature and rate of wall corrosion had not been done in 1998 when wall thinning of the auxiliary steam piping was first detected, and by 2007 the piping condition was sufficiently degraded as to preclude effective investigation of the leak source.

In summary, based both on the inspections of the observed failures and analysis of the many factors involved, the vulnerability remains for future tritiated steam leaks in the remaining 725 linear feet (excluding 350 linear feet which are normally dry) of Unit 2 auxiliary feedwater piping. More detail on this evaluation is provided in Appendix 3.

July 31, 2008 ISE 50

Indian Point Independent Safety Evaluation (ISE)

The Panel notes that the application of qualified inspection techniques to the feedwater piping vulnerable to tritium leakage could well exceed two years. And given the level of tritium involved, the risk to public health from such a leak would be insignificant compared to allowable standards. But in the Panels view, this vulnerability is an undesirable impediment to public confidence in IPEC operations. Consequently, the Panel recommends more aggressive corrective actions to address this issue.

ISE Panel Recommendation, re buried piping:

IPEC should explore options for reducing the vulnerability of this piping to the occurrence of any future unanticipated leak. Such options include excavating a few selected locations to confirm the presence of protective coating on the piping, as well as to measure and confirm the existence of sufficient wall thickness of the thus exposed piping using existing inspection techniques, and/or performing a pressure test to confirm the existence of wall thickness sufficient to obviate vulnerability to tritiated water leakage prior to the next scheduled test in April 2010. The Panel recommends that at least one of these options be completed no later than calendar year 2008.

July 31, 2008 ISE 51

Indian Point Independent Safety Evaluation (ISE) 3.4 Processes for Managing Nuclear Safety During the course of this review the ISE Nuclear Safety Team had the opportunity to observe and assess many IPEC processes, to varying degrees. Detailed reviews of some processes were performed and comments are provided below. Processes important to safe or reliable operation are reviewed and audited internally (by IPEC and Entergy) and externally (by NRC, INPO and insurers). The team found that IPEC has a comprehensive array of programs for identifying and evaluating abnormal conditions and potential problems, for maintaining design control, and for learning from IPEC and industry experience. Although the Team did not attempt to determine the effectiveness of each program, it found that to the extent observed, programs at IPEC are robust and consistent with others in the industry.

Although the Team did not look in detail at Quality Assurance (QA), the Environmental Qualification (EQ) or the Engineering Design Control programs, these programs were seen as part of the Teams overall review of Indian Point nuclear safety and nothing was found in the course of the evaluation to suggest inadequacies in these specific programs.

Fire Risk Analysis The ISE Nuclear Safety Team evaluated the IPEC approach to fire protection. The Team found that several design modifications had been made, some of which involved obtaining fire protection exemptions from the NRC. The team also notes that about half of the 104 operating nuclear units in the U.S. are moving to the riskinformed approach of National Fire Protection Association (NFPA) - and in fact, four plants within the Entergy system (Arkansas Nuclear One, Cooper, Palisades and Waterford) are planning to do so - and it therefore inquired as to the rationale at IPEC for not pursuing a similar course.

The Team learned that in 2006, the IPEC fire protection program was evaluated for potential transition from the deterministic approach under 10 CFR 50, Appendix R to NFPA805 under the provisions of 10 CFR 50.48 c. Based on that review Entergy concluded that there was no clear preference from either a regulatory compliance or cost effectiveness standpoint to make that change. Either the Appendix R deterministic criteria or the NFPA805 probabilistic assessment can provide an adequate basis for assuring fire protection safety.

However, Entergy advised that more recent assessments in response to NRC generic communications regarding specific technical fire protection issues may provide a basis to revisit this conclusion. Entergy currently anticipates that resolution of these issues can be accomplished through reanalysis combined with the exemption process. Should the exemption process be unsuccessful or should the plant modifications required by the exemption process be substantial, NFPA805 may be a better course.

July 31, 2008 ISE 52

Indian Point Independent Safety Evaluation (ISE)

The Nuclear Safety Team notes that fire remains a significant safety concern for operating nuclear power plants. The team also believes that the deterministic criteria of Appendix R has significant conservative margin and therefore exemptions may be granted without adversely affecting safety. In addition, a fire probabilistic risk assessment (PRA) may be useful given the different approaches to fire protection at Units 2 and 3, auxiliary feedwater and diesel generators being the most obvious examples.

ISE Panel Recommendation, re fire risk analysis:

Entergy should closely monitor its own and other industry experience in NFPA805 implementation and remain flexible regarding IPEC adoption of NFPA805 and development of a fire probabilistic assessment.

Cable Separation and the Use of Hemyc Appendix R of 10 CFR Part 50 addresses fire protection requirements for safe shutdown capability for nuclear power plants. It requires that fire protection features be provided such that at least one of the redundant trains of any safety system necessary to achieve safe plant shutdown remain operable even in the event of a severe fire. One acceptable means to achieve that is to physically separate one train of equipment, power cables and control cables. However, if cables of redundant trains need to be routed through a physical area of the plant that is within a single fire boundary, the cables of one train can be enclosed or wrapped in fireresistant material. As an example, the regulatory requirement could be met by enclosing the raceway and cables of one train of a safety system in a fire barrier having a onehour fire rating with appropriate fire detectors and sprinklers.

Hemyc is a material that was qualified in the 1970s and 1980s to meet this onehour requirement and was utilized for raceway wrap in a number of U.S. and international nuclear power plants. Subsequent Hemyc testing in various configurations by the NRC Office of Research in the early 2000s showed that the material, installed as initially prescribed, did not pass a rigorous onehour test. Furnace tests by NRC and the nuclear industry showed the material would generally pass for durations of 30 minutes, but less than one hour.

Although Indian Point Units 1 and 2 have different licensed design safety bases (the plants were separately constructed and licensed), both used Hemyc as fire barriers for safety circuits.

The Unit 2 design basis requires Hemyc to protect circuits for 30 minutes, and testing and analysis has shown that with some additional Hemyc wrapping on the external structural steel that passes through wrapped raceways, the internal temperatures of Unit 2 circuits July 31, 2008 ISE 53

Indian Point Independent Safety Evaluation (ISE) would be sufficiently low to prevent cable damage for 30 minutes or longer. These modifications have been completed on Unit 2.

The Unit 3 license design basis called for onehour safety circuit fire protection. Hemyc fire wrap was used, but additional fire detection and fire suppression systems had also been incorporated into the design. IPEC engineers reviewed the design, taking into consideration fire loads, fire detection systems, fire sprinklers, cable jacket materials, etc.

and determined that by adding additional Hemyc to cover the external steel structures, a 30minute rating would meet the cable protection requirements. This approach, however, required a revision to the January 7, 1987 safety evaluation by the NRC and an exemption issued for IPEC Unit 3. The exemption was granted by the NRC, and IPEC plans to complete the modifications by the end of 2008.

It is the ISE Panels view that there is significant conservative margin in the Appendix R regulations and that the plans to accommodate the reduced Hemyc rating as being implemented by Entergy and approved by the NRC provides adequate fire protection for the plant and public.

Corrective Action In its annual assessment letter in March 2008, the NRC identified a crosscutting issue for Unit 2 in the area of problem identification and resolution (PI&R). This was related to inspection findings attributable to implementation of corrective action. A recently completed PI&R inspection found no findings of significance and concluded that IPEC has a generally effective corrective action program to identify, evaluate and correct problems.

IPEC has not, however, made significant progress in implementing action plans to resolve either of the NRC substantive crosscutting issues (as described in Section 3.2).

Upon review, the Nuclear Safety Team concludes that the IPEC corrective action program meets industry standards, but agrees with the NRC that shortfalls exist in its implementation.

Plan of the Day Each workday at Indian Point begins with a plan of the day (POD) meeting which sets the course for nearterm station actions, primarily those related to equipment safety and reliability. Topics covered in this daily meeting include:

- Plant chemistry, because of its importance to the integrity and performance of the reactor coolant system, main condensate systems and other plant systems.

- Major station concerns and actions to address them are discussed and, where appropriate, assigned to the stations FIN (fixitnow) teams for prompt and efficient corrective actions.

July 31, 2008 ISE 54

Indian Point Independent Safety Evaluation (ISE)

- The status of operations issues, including work orders of concern.

- Operational decisionmaking issue (ODMI) discussion. These are documented courses of action to deal with some higher level, but typically shortterm issues, developed through a rigid process that engages all responsible individuals and organizations.

- A review of the stations risk status and protected equipment (equipment that must receive special attention, because its backup is out of service for maintenance or testing), along with any technical specification (station license) pending activities.

Some categories such as operations workarounds (OWAs) are reviewed once a week at this meeting. Currently there are two OWAs at Unit 2 and none at Unit 3. These numbers are consistent with industry norms.

The Team attended POD meetings and found them to be thorough and effective.

Outage Management Outages provide the opportunity to conduct refueling, inspections, repairs, modifications and maintenance that cannot be accomplished when the plant is operating. They also present challenges since the plant will be in unusual conditions and systems and components normally available will be out of service to enable work. Successful outages accomplish the proper work scope while minimizing risk.

A stations outage performance is an indicator of its overall health, in at least two ways: (1) refueling outages are usually the largest component of offline time over a stations entire fuel cycle (Entergy plants operate on an 24month fuel cycle) and therefore the outage length is directly linked to the plants overall capacity factor, in turn a strong measure of its economic performance for the cycle, and (2) outages require the coordination of many people and tasks, placing a premium on strong planning, preparation, management and team performance; therefore an efficient, timely and technically successful outage is usually indicative of a wellrun plant.

IPEC outage management processes are effective. There are good systems in place to track work orders, tests, preventative maintenance and surveillances required to change plant modes. Representatives from organizations with outage responsibilities are on shift to provide continuous support. Outage risk assessments are made at least twice a day and work is planned to minimize risk. There is a formal process to document and approve scope changes.

Indian Point outage performance has improved markedly over the last four fuel cycles in both plants. Members of the ISE Nuclear Safety Team visited Unit 2 during its spring 2008 outage and considered it to be well managed and generally successful. One component July 31, 2008 ISE 55

Indian Point Independent Safety Evaluation (ISE) that was not satisfactorily repaired, however, was the turbine generator exciter system, known as Generrex. As a result the main generator for Unit 2 was being controlled in its manual operating mode for several weeks until repaired in a later outage.

Outages are also used as an opportunity to make improvements in overall plant equipment reliability.

Work Management Planning and executing the large number of tests and work activities necessary to operate and maintain a nuclear plant is an important organizational core skill. Essentially all work done at IPEC is planned and scheduled by the work control process. The process is intended to develop work packages for individual jobs and produce an integrated schedule of activities that avoids conflicts and considers resources available. IPEC has solid processes and computer programs necessary to plan and track these activities. Their systems are comparable to those used at most U.S. nuclear plants. However, the organization is not efficiently using these planning tools to smoothly execute work and control work backlogs.

Symptoms of an ineffective work control process at IPEC include a large number of preventive maintenance items in the latter half of their grace period (as discussed in Section 3.2), high elective maintenance backlog, late preparation of work packages, a large number of late additions to the work week schedule and a high rate of work items not worked when scheduled. Supervisors are spending additional time coordinating and facilitating work at the expense of overseeing and coaching at the work sites. Many in the organization seem to value their ability to handle work on a crisis basis more than the skills to plan and execute it. Workweek managers make last minute adjustments to schedules to accommodate nonemergent work that has not met the planning milestones.

Employee interviews indicated that supervisors work well with their peers to get the job done regardless of the shortcomings of the work control system.

Senior IPEC management clearly and repeatedly has conveyed its expectation that work be planned and performed in accordance with the work control process. However, accomplishing work that was incompletely or delinquently planned is applauded and celebrated as a success by supervisors and managers, rewarding behaviors that reinforce the ingrained culture.

ISE Panel Recommendation, re work management culture:

The ISE Nuclear Safety Team believes that positive progress depends on changing the work management culture from crisis management to prevention. Entergy management should assign high importance to this effort.

July 31, 2008 ISE 56

Indian Point Independent Safety Evaluation (ISE)

Team Training Training programs and the quality of the training observed supports the Teams confidence that training is a core value of Entergy and IPEC. Line organizations take responsibility for training and are involved in defining training needs and evaluating program effectiveness. Training staff and facilities for licensed operator training are of high quality.

Nuclear Oversight An organization must be able to critically examine what it is doing, how it is doing it and to identify shortcomings to improve performance. At a minimum the oversight process will conduct QA audits to evaluate the degree of compliance with requirements. Entergy is adopting a performancebased approach to audits which should broaden the look at activities to include events and practices which affect performance. The organization and leadership are in place to make this change, but the staff requires training and coaching for the revised mission. Rotation of staff through the QA organization is also a stated desire of management.

The Nuclear Safety Team supports this initiative, but notes that the lack of a clear plan and schedule makes achievement uncertain.

Change Management Although the Entergy Change Management Process is thorough, there are a significant number of changes in progress at IPEC. Interviews indicate that the changes for the Entergy proposed reorganization (creation of Enexus and EquaGen) caused some anxiety for the employees for several months until personnel details were made public. In one case the change management effort for Passport implementation was not effective. For example, supervisors rely on Maximo, the predecessor of the current work control database Passport, to provide information needed to accomplish scheduled tasks. A recovery effort is underway; however, no formal evaluation (e.g., use of the root cause evaluation process) has been conducted to determine shortfalls and lessons learned for future changes.

Project Management Successful projects deliver a quality product on time and within budget. Skills required for successful management of projects include budgeting, scheduling and coordination of resources within and outside the company. Recent examples of poorly managed projects July 31, 2008 ISE 57

Indian Point Independent Safety Evaluation (ISE) at IPEC include emergency sirens15 and dry cask storage. Since initiation of those projects, Entergy has put in place a project management organization at IPEC with the responsibility for major and minor projects. Although the organization is new and the members require training in project management techniques and experience working within the IPEC organization, the Unit 2 Blackout (Appendix R) Diesel Generator project was successfully managed by this group. The Panel expects the current project management process and organization to be able to properly manage future projects at IPEC.

Human Factors Engineering The interface between the machinery and the people who operate it determines the ease of operation and the likelihood of error. Systems with well designed human interfaces are less subject to improper operation during normal operation, startup, shutdown, testing and abnormal or emergency conditions. Although this concept applies to every component and system at the station, the control room is the location where most human actions are concentrated. Control room design reviews were completed at Units 2 and 3 as required by the NRC in the early 1980s.

The Units 2 and 3 control rooms have few illuminated alarms while operating at power, which is positive. Alarms considered normal for full power have green windows. Red (Units 2 and 3) and orange (Unit 3) windows assist operators when responding to multiple alarms. In cases where an alarm monitors several items, if an abnormal condition or sensor failure for one item will exist for a prolonged period, a temporary modification may be installed to restore the alarm capability for the other items. Control panels use some demarcation and different background colors to group controls and indications. Best in industry practices for control rooms include demarcation and labeling to identify individual components and systems on control panels and alarm panels. Hierarchical labeling can reduce the amount of information on labels and allow use of larger and bolder fonts which improves readability for operators and supervisors. Units 2 and 3 control room human factors are similar to others in the industry.

The modification process includes reviews by affected groups and may also receive reviews by engineers with experience in control and indication arrangement. A Unit 2 reactor trip on April 21, 2008 resulted from a relay failure combined with incorrect positioning of a main control panel switch. A turbine runback feature was installed in 1989 and modified in 1995 after completion of the control room design reviews and using a modification process less detailed and complete than is in place today. The modification includes a main control panel switch to enable or disable the runback. The plant startup 15 See Section 5.5 for the ISE Panels assessment of the siren upgrade project.

July 31, 2008 ISE 58

Indian Point Independent Safety Evaluation (ISE) procedure required enabling the runback, but there were no plant procedures that disabled it when plant conditions allow.

Opportunity for Improvement, re human factors engineering:

To identify other latent problems before they become self revealing, IPEC should consider conducting a limited scope control room design review to determine if the operations of controls are correctly included in appropriate plant procedures.

Industrial Safety The IPEC rate of personnel injuries has been higher than the companys goal for several years.

Late last year, the station began a campaign of presenting an education and behavioral observation program to all site employees. Managers and supervisors perform daily observations and interactions with employees to reinforce proper behavior and coach to correct errors and improve performance. An active program to reward positive behaviors of individuals and the workforce as a whole is in place. Injuries resulting from unsafe work practices continue to occur and are given high visibility by management. The actions being taken to reduce injuries have proven effective at other facilities when they result in individual employees taking accountability for their safety and the safety of their co workers.

Root Cause Evaluation A root cause evaluation is a structured process conducted by a team lead by a qualified evaluator. The need for a root cause evaluation is determined during the Condition Report review process. Four root cause evaluations were performed for three Unit 2 and one Unit 3 events which occurred in 2008. The events included trips of the reactor, turbine, feedwater pump and an electrical bus. The root cause evaluation process appears to be sound.

July 31, 2008 ISE 59

Indian Point Independent Safety Evaluation (ISE) 3.5 Indian Point Unit 1 Indian Point Unit 1 was placed in service in 1962 and retired in 1974. Although no longer in operation, Unit 1 shares the same site, is physically connected to Units 2 and 3, and parts of it are still in use.

Unit 1 Condition and License Status Unit 1 has an NRC license for fuel storage and is in a condition called Safstor. Unit 1 facilities are used to maintain the plant in a safe condition until decommissioning, support the operation of Units 2 and 3, or have been retired. Routine operation, maintenance and support activities at Unit 1 are performed by IPEC staff.

Some Unit 1 systems and facilities are used to support normal operation of Units 2 and 3.

For example, Unit 1 is the site distribution point for city water, fuel oil and fire water. Unit 2 liquid radioactive waste is processed in the Unit 1 Chemical Systems Building. The Unit 1 Turbine Building houses the Unit 2 diesel generator used for station blackout. Unit 2 has responsibility for operation and maintenance of the portions of the facility that support Units 2 and 3.

Items not required at Unit 1 have been retired by isolating and deenergizing to eliminate interference with Units 2 and 3 and to minimize fire and industrial safety risks at IPEC.

The original retirement conditions established by Consolidated Edison were verified and, in some cases, enhanced in 2005. Unit 1 Safstor and fuel transfer activities are being conducted without adversely affecting Units 2 or 3.

Adequate resources are being applied to maintain the Safstor condition. Continuous radiation monitoring of ventilation exhaust and periodic monitoring of radiological conditions inside the containment sphere provide indications of changes in conditions.

Inspections conducted every two years monitor for degradation of structures and systems.

IPEC has corrected deficiencies from the initial inspection (conducted in December 2005) and is responding to items from the last inspection (November 2007).

Nuclear Fuel Storage At the time of the ISE Panel onsite review, spent nuclear fuel from Unit 1 was still in storage in the Unit 1 spent fuel pool. There has been leakage from that pool over the years, a source of soil and groundwater contamination and one of the public interest issues addressed in this report. Preparations are in progress to move spent fuel from the Unit 1 spent fuel pools to the IPEC onsite dry fuel storage facility. The fuel transfer is scheduled for completion by the end of 2008.

July 31, 2008 ISE 60

Indian Point Independent Safety Evaluation (ISE)

When all fuel has been removed, the pools will be drained. Pool drainage is a twostep process. First the water level will be lowered to 23 feet. The residual water layer will provide radiological protection while the debris and sludge in the bottom of the spent fuel pool is removed, after which the remaining water will be drained by April 2009. The removed debris will be collected and, based on activity level, either shipped offsite for disposal or stored onsite in the interim radioactive waste disposal facility. The process will be closely controlled and monitored to prevent environmental contamination.

The broader issues and plans related to extended term storage of spent nuclear fuel on the Indian Point site are described in Section 6.2 and Appendix 3.

July 31, 2008 ISE 61

Indian Point Independent Safety Evaluation (ISE) 3.6 Indian Point Nuclear Safety, In Summary The ISE Nuclear Safety Team concludes that the plant is physically sound and is being operated safely. From a nuclear safety standpoint, Indian Point is generally comparable to that of highperforming U.S. nuclear power plants. As with all nuclear plants, there are areas where improvements can be made, as noted in this report. And while this review was not focused on regulatory compliance, the team found no instance of noncompliance with regulations.

Unit 1 is no longer operating and its spent fuel is scheduled to be removed to dry storage by the end of 2008. Remaining radiologically contaminated material will be disposed of during decommissioning. Conditions and activities at Unit 1 do not adversely affect Units 2 or 3 or present undue hazards to the IPEC staff.

The team noted several strengths germane to nuclear safety, particularly the positive attitude and professionalism of station personnel. Observed crew performance in control rooms and simulator was excellent. Nuclear safety systems and equipment were found to be reliable and in good material condition.

The Nuclear Safety Team identified one potential safety concern that it considers important for the station to resolve in the near term. Specifically, prompt action needs to be taken to complete the number of overdue PM actions and to reduce to a much lower number the PM actions that are late in the grace period.

The Team identified three other issues with possible safety implications that should be resolved in a timely manner:

Staffing shortfalls are projected in several critical positions. An effective and wellintegrated program of hiring, developing and retaining the staff is needed to enable continued safe plant operation.

An effective performancebased audit program is needed. The Team recommends that a plan be developed for performancebased auditing, including guidelines for conducting reviews and the development of skills required to carry out such a program.

Inefficiencies in the implementation of the work management process are reducing the effectiveness of supervisors in monitoring work and coaching the staff. The Team urges management to take steps to achieve a culture which values orderly conduct of work, as opposed to crisis management.

Three areas where standards are not up to high nuclear industry standards are personal injury rate, housekeeping and general site appearance. The personal injury rate is low by July 31, 2008 ISE 62

Indian Point Independent Safety Evaluation (ISE) general industry standards, but not as good as highperforming nuclear plants.

Housekeeping is quite good in heavily traveled areas, but not up to the same standard in less traveled and out of the way areas. Increased management attention to these areas is needed.

While station personnel pay close attention to the care, maintenance and operation of plant safety systems, the care and maintenance of many other plant systems and structures is not up to the standards of highperforming plants. Also, the external visible condition of the plant is poor in many respects. While these have no direct bearing on safe operation of the plant, it is the Panels view that the maintenance and preservation of non critical plant systems, equipment and structures is important, because it communicates to employees and the public alike the owners and operators commitment and professionalism. Improvement is warranted.

July 31, 2008 ISE 63

Indian Point Independent Safety Evaluation (ISE)

Section 4: Security Nuclear plant security encompasses a technologically sophisticated and robust series of barriers, processes and response capabilities. Over the years, as with other industrial applications, nuclear plant security has been the subject of increasing regulatory and operational attention - and since September 11, 2001 it has become a matter of utmost concern to the public as well. For that reason, security was chosen as one of the central focus areas of the IPEC Independent Safety Evaluation (ISE).

4.1 Evaluating Indian Point Security The ISE Security Team leader is Dr. Harvey Stevens, an internationally recognized expert in industrial security, knowledgeable in security systems, processes and implementation.

He has been a security consultant on projects worldwide, including public, commercial and industrial facilities, many in New York City. As one who has a broad and deep security background, but relatively little experience in nuclear power applications, he brings a fresh and unique perspective to the ISE Panel.

Kenneth Brockman has an extensive analytical and regulatory background in multiple facets of nuclear power security and safety, as an officer in the U.S. Army, as a member of the U.S. Nuclear Regulatory Commission (NRC) executive senior service, and four years as a senior diplomat with the International Atomic Energy Agency (IAEA) in Vienna, Austria.

Just as Dr. Stevens nonnuclear industrial security experience gives him a unique perspective on Energy Center (IPEC) security, Mr. Brockmans NRC and IAEA background offers insights into security practices at domestic and international nuclear facilities -

including some that are very challenging from a security standpoint. Together, Dr. Stevens and Mr. Brockman are ideally equipped to judge IPEC security in comparison with high performing nuclear and other facilities, in the United States and around the world.

The Team approached the challenge of assessing IPEC security by conducting a targeted and indepth review of the security aspects that, in the Team members judgment, are of greatest importance to public protection. Their selection was based on their personal experience, as well as insights gained from reviewing previous assessments of IPEC security by various federal and state authorities. And as they proceeded with their review process, the team refined its focus on emerging topics of interest and potential importance.

A principal line of investigation was the identification of ways by which outsiders might gain detected or undetected access into critical areas and cause a radiological release, along with assessment of the stations capability to respond to such hostile intrusion. In doing so, they considered numerous factors, such as the processes for summoning internal and external assistance, assistanceresponse time, responseforce capabilities, response July 31, 2008 ISE 64

Indian Point Independent Safety Evaluation (ISE) force management, response and securityforce training. They provided technical recommendations to help the station achieve maximum security benefit from security equipment and strategies in place.

The Team also considered challenges associated with insider threats and sabotage. This report addresses physical security, in detail, for those areas now under the direct supervision and control of IPEC management and it also addresses offsite areas and organizations as they relate to supporting the security at IPEC.

The ISE Security Team assessed all of these vulnerabilities in a risk/threat assessment context, weighing (qualitatively in most cases) both the probabilities and consequences of postulated events. The Team considered challenges postulated by the NRCs defined design basis threat (DBT) and, in selected cases, challenges beyond those described in the DBT.

Design Basis Threat - What Is It?

The term design basis commonly refers to the underlying premises, assumptions, conditions and requirements which a system or facility is designed to accommodate. This is an important element in nuclear plant design, with rigorous controls to ensure that the plant configuration and operation continues to conform to the approved design basis.

Consistent with that practice, the NRC has established a DBT for security challenges to licensed nuclear plants. The specifics of the DBT are classified, but they include among other elements, detailed criteria relative to the size and capabilities of an intruding force against which the station must be successfully defended. As a licensee, Entergy is required to demonstrate that the IPEC security facilities, systems and procedures are adequate to meet the DBT.

Sources of information in preparing and executing this review included input from the public at the meetings hosted by the ISE Panel on April 28, 2008 and other public communications; previous security reports and studies issued by the NRC, the Department of Homeland Security, former federal officials and others; and interviews of command personnel from the local police departments, the New York National Guard and Naval Militia, the Federal Bureau of Investigation (FBI), the Federal Aviation Agency, the United States Military Academy Provost (West Point, N.Y.), the New York State Police, and chemical and structural engineers.

The Security Team also consulted with a representative of the IAEA and with experts responsible for implementing IAEA guidelines regarding security. IPEC strategies and practices were reviewed relative to what is expected and in place at nuclear plants around July 31, 2008 ISE 65

Indian Point Independent Safety Evaluation (ISE) the world. While not directly relevant to IPEC, this nevertheless provided a perspective of what this standardsetting international agency expects of nuclear plants worldwide.

Protecting Sensitive Information In view of the obvious importance of restricting the public disclosure of security information that would be helpful to terrorists or others who wish to harm a facility and threaten public health and safety, there are strong classification measures required by regulation and stringently enforced at IPEC. For that reason, securityrelated information in this ISE main report is necessarily limited to that otherwise available in the public domain.

The ISE Security Team, and all other ISE Panel members, applied for and received authorization to view classified security information - termed Safeguards under NRC requirements - and their judgments, conclusions and recommendations took this protected information into account. The ISE Panel has produced a classified appendix to this report containing significantly more detail in descriptions of security issues and strategies and related recommendations. Access to this Safeguards Appendix is restricted to those with proper authorization and needtoknow status, per Entergy procedures and NRC requirements.

July 31, 2008 ISE 66

Indian Point Independent Safety Evaluation (ISE) 4.2 Indian Point Security Force At the heart of every security system are human beings - managers, planners, security officers and support personnel whose 24/7 job is keeping IPEC secure. At the first line are Entergy personnel since the security force at the site is a totally proprietary organization.

In immediate support are the Entergy and contractor technicians and specialists who help provide and maintain the services and equipment used at the site. Behind them are the public sector organizations including local, state and federal authorities, whose responsibility it is to affirm and confirm that public safety is assured.

IPEC Security Personnel The IPEC Security organization consists of a security manager, security supervisors, alarm station operators, security officers and administrative personnel. Management is competent and highly motivated. The Security Department utilizes a military command structure to achieve the level of command and control needed for an operation of this kind.

The IPEC Security Force consists of a welltrained contingent of proprietary security officers, both male and female. These officers work two shifts of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> per day, staffing fixed and mobile defensive positions around the clock, seven days per week. Many are former members of law enforcement agencies and others are military veterans, some with combat experience. Based on numerous private interviews, the ISE Security Team found this to be a dedicated and highly motivated group.

In most respects the security force staffing is adequate. The exception is the lieutenant positions, which are adequate in number to cover shift requirements, but with the added burden of training, vacation and sick time, they routinely must put in significant overtime.

Pending changes to federal requirements regarding fitnessforduty will set limits on overtime, which will in turn dictate staffing increases at IPEC among the lieutenant ranks.

The officers who staff security positions at IPEC receive eight weeks of training including 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> dedicated to individual weapons qualifications; this is supplemented by over four weeks of annual continuing training. This exceeds the training given to security officers at most industrial facilities; it is comparable to that received at nuclear power plants throughout the United States and exceeds that proposed in IAEA guidelines.

The training is sitespecific. It covers both conventional law enforcement topics (laws of arrest, search and seizure, and the use of force, as examples), as well as topics related to nuclear safety, applicable NRC and other federal and state requirements, and sabotage and contraband detection. Extensive training in the use of weapons (including individual qualification requirements) and in the implementation of individual and task force tactics is conducted on an ongoing basis.

July 31, 2008 ISE 67

Indian Point Independent Safety Evaluation (ISE)

A new training class observed by the Team consisted of both men and women, of whom more than 30 percent were former members of the military or police agencies. The integration of these new officers will bring the security officer force up to its full authorized strength.

ISE Panel Recommendation, re authorized staffing levels:

Increase the authorized lieutenant positions to accommodate training, vacation and sick time without excessive overtime Entergy Interaction with State and Local Law Enforcement The IPEC security force is supported by federal, state and local authorities, in accordance with established procedures and protocols. In summary, these are:

New York State Police Following 9/11, the New York State Police (NYSP) was assigned the role of primary law enforcement agency during emergencies16. The senior NYSP official arriving onsite becomes the Incident Commander, and during an emergency this individual would communicate with IPEC security supervision and exercise the external command and control function from the Integrated Command Center. The team notes that current emergency strategies call for the NYSP personnel to be stationed primarily outside of the fence line or on the Owner Controlled Area (OCA) perimeter, thereby allowing them to focus on: ingress control; interdiction of intruders attempting rapid egress; and coordination and control of local traffic to quick and effective access by emergency responders.

Buchanan Police Department The Buchanan Police Department has limited resources - six officers and three squad cars - and therefore its emergency role must be similarly limited. On the other hand, its resources are nearby and several of its members have excellent personal knowledge of the station. Currently they 16 When IPEC Unit 2 was owned by Consolidated Edison, the Buchanan Police Department was the primary law enforcement agency responsible for security response at that unit, while at Unit 3, at that time owned by the New York Power Authority, the primary responder was the NYSP. Coincident with Entergys consolidation initiatives upon purchase of both units, the lessons from 9/11 pointed clearly to the need for strong and deep law enforcement presence.

July 31, 2008 ISE 68

Indian Point Independent Safety Evaluation (ISE) have no assigned role in the security plan; the ISE Security team believes that inclusion of the Buchanan Police Department, and other local law enforcement organizations, could add significant value and should be considered.

The New York National Guard (NYNG) and New York Naval Militia (NYNM)

As directed by the governor of the state of New York after 9/11, the NYNG provides constant presence at IPEC and represents a substantial protective capability. It is not known how long the NYNG presence onsite will continue, and for that reason the IPEC defense strategy has been constructed so as not to be dependent upon the NYNG for assistance in defending against the DBT. However, the very significant defensive resources afforded by NYNGs current presence not only adds backup strength to the IPEC security forces, but make it possible for them to defend the site against a force with capabilities beyond those prescribed in the DBT.

The NYNG has clear and open communications channels with the IPEC security management team and the NYSP. The NYNG Detachment Commander has a seat at the Integrated Command Center, should a security related emergency be declared. Per current plans, the NYNG emergency mission is to provide monitoring and detection capabilities in the OCA.

Through cooperation with the NYNM, that role includes the oversight of and interdiction within the restricted area in the Hudson River designated by the Coast Guard Commandant of the Port of New York.

Whether by land or water, any intruders would have to pass through terrain monitored by the NYNG or NYNM to reach the IPEC Protected Area; thus, the additional warning time that these assets could provide could only enhance the response capabilities of the IPEC security force. However, while NYNGs response role is significant, it remains somewhat detached from the integrated IPEC emergency planning, training and execution activities. The NYNG has conducted its own independent tabletopping of response strategies, but no such exercises have been held with IPEC and local law enforcement agencies. In addition, the NYNG response plan has not been fully coordinated with the IPEC Security Plan or integrated into the response strategies that would be implemented by the Response Team Leaders (RTL).

During an actual security event, this lack of preplanning could undermine effectiveness in the implementation of tactical initiatives by the NYNG forces.

This lack of full integration is driven by IPEC managements recognition of the inherently tenuous nature of NYNG presence at IPEC and the attendant July 31, 2008 ISE 69

Indian Point Independent Safety Evaluation (ISE) risk of implicit dependence on resources that may not be available in the future. The Team recognizes the IPEC Security Forces inherent regulatory obligation to protect the site and the uncertainties attendant to dependence on external resources to meet that obligation. However, the Team believes that IPEC could take substantially better advantage of the NYNG presence and that the primary consideration in doing so should be making the best use of all resources available to protect the station, thereby achieving the highest level of protection possible. Further, if the station were to increase the role of NYNG in IPEC security, it could adapt quickly should the governor choose to withdraw the NYNG at some point in the future.

Federal Aviation Administration (FAA)

Among the many steps taken since 9/11 by the federal government to reduce the threat of airborne attacks (antihijack measures, as an example),

the FAA takes an active role in monitoring and interdicting air traffic that could pose a threat to IPEC. In conjunction with other federal and state agencies and with industrial security organizations, the FAA has regularly exercised their response processes, including the notification and preparation activities related to possible attacks against nuclear plants.

Federal Bureau of Investigation The FBI is designated within the Federal Response Plan (FRP) as the Lead Federal Agency (LFA) for any securityrelated event at a nuclear facility. The New York office of the FBI maintains an excellent working relationship with IPECs security management. The FBI and the Joint Terrorist Task Force are aware of the potential target attractiveness of all nuclear plants, and they are sensitive to intelligence related to such plants. Any information developed relative to IPEC is shared with other interested agencies, as well as with security and appropriate management representatives at IPEC to facilitate the safe and secure utilization of the site relevant to the overall safety of the public.

ISE Panel Recommendations, re federal, state and local law enforcement:

Better utilize and integrate all available resources, as follows:

- The IPEC Security Force and the NYSP should conduct onsite tactical familiarization sessions with the NYNG and local response agencies, such as the Westchester County or New York City SWAT teams.

- IPEC should establish an ongoing program of drills and/or tabletops with the NYNG force.

July 31, 2008 ISE 70

Indian Point Independent Safety Evaluation (ISE)

Opportunities for Improvement, re engagement of federal, state and local law enforcement:

- The NYSP should expand its coordination efforts and strategies with the Buchanan (and all other local) police departments. Also, the Buchanan Police Department should be more fully integrated into the local law enforcement agencies police department response strategy. Buchanan and other local police departments should participate in tabletop drills or other familiarization activities with the IPEC, the NYNG and, particularly, with the NYSP.

- In the Teams view, the most effective use of the local law enforcement agencies would be in the area of local traffic control, thereby making possible rapid and efficient response of the other supporting forces passing through their jurisdictions; coincidentally, making sure that local security measures are attended to (e.g.,

prevention of pilfering) would allow the NYSP resources to remain focused on the situation at the IPEC site.

July 31, 2008 ISE 71

Indian Point Independent Safety Evaluation (ISE) 4.3 Protection from External Threats As part of its risk vs. threat assessment process, the ISE Security Team examined the IPEC site and facility configuration in terms of its inherent and engineered resistance to outside threats, as described in the following sections.

Overview of IPEC Physical Security The IPEC site is located on 239 acres in Buchanan, Westchester County, N.Y. On a normal business day, approximately 1,000 persons require access to the facility. While most of these persons are employees, there are numerous contractors, delivery personnel and guests.

As with all U.S. commercial nuclear power plants, physical site security and protection against external threats are afforded via multiple barriers, with progressively increasing levels of protection consistent with the safety significance of the various portions of the plant they enclose. These security areas are:

Owner Controlled Area. The OCA is essentially the entire site, that is, the property owned by Entergy. Its boundary is delineated by an eightfoot high chainlink fence, topped with razor wire around most of the site. Routine access July 31, 2008 ISE 72

Indian Point Independent Safety Evaluation (ISE) to the site is via a single main entrance on the south side of the plant. All access requires authorization and is controlled by the IPEC security force (with NYNG support) at this entrance.

Protected Area. An area of approximately 50 acres of the site within the OCA has been defined as PA, both because of potentially important equipment in that area and because it surrounds and serves as a buffer to the more important equipment in the Vital Areas within it. It is at the PA boundary that the interdiction capabilities of the station come into play, with detailed personnel and vehicle access procedures, strict monitoring and total accountability required. By federal law, the IPEC security force must be capable of defending its PA against the defined DBT.

Vital Area . The VA, completely within the PA, encloses all plant structures, systems and components considered essential to maintaining operational nuclear safety and preventing radiological releases. At IPEC, the VA actually comprises several separate areas. VA entry is totally controlled and the concepts of redundancy and diversity have been integrated into VA design and layout.

Importantly, the overall concept of nuclear safety defenseindepth dictates that the compromise of any individual structure, system or component cannot result in a condition that endangers public health and safety. Multiple structures, systems or components, in specific combinations, would have to be compromised to produce an accident sequence with offsite consequences.

The Site Itself - Inherent Resistance to Outside Threats The IPEC topography is naturally advantageous from the standpoint of defensible terrain -

a particularly important factor in developing tactics for armed interdiction, vehicle control practices and external interventions, such as airborne or waterborne assault. The hilly terrain, large number of trees and dense foliage, and site positioning adjacent to the Hudson River all constitute significant elements of protection against ingress. However, these natural assets could also be used as staging areas for terrorist activity - for that reason, sweeps or inspection of these areas are conducted periodically and during periods of high threat.

Owner Controlled Area Exterior Perimeter Fencing July 31, 2008 ISE 73

Indian Point Independent Safety Evaluation (ISE)

Although not required by regulation, chainlink fences enclose most of the IPEC facility complex. These fences act as a barrier to ready access onto the property (the OCA) and prevent persons at ground level from entering the facility uninhibited.

In and of itself, fencing does not prevent wellequipped determined individuals, working either alone or in groups, from accessing a fenced enclosure. Most fences can be compromised within a few seconds. Nevertheless, fences perform several important functions in access control:

- Delineating the boundary between public and private property, providing a basis for taking action (including prosecution) against those who violate that boundary

- Preventing intrusion by opportunists and providing visual vantage point to identify unauthorized persons seeking access

- Delaying intruders attempts to gain unauthorized access.

The design and construction of the fences at IPEC meet or exceed the industry standards for a perimeter fence.

The IPEC OCA fencing is visibly vulnerable to compromise, in that there is vegetation growing over the fence in several areas and the areas on either side are not kept clear of brush and debris. The ISE Security Team considers this visibly poor condition of the OCA fence inconsistent with its expectations for a highperforming facility. Although the fence is not required to provide any critical security function or to meet any regulatory requirement, it does serve a purpose and it is visible to the public. For both reasons, this situation should be corrected.

ISE Panel Recommendation, re OCA fencing:

The OCA perimeter fence be cleared of vegetation and a clear zone should be established on both sides. Brush, vines and other debris should not be allowed to accumulate on the perimeter fences. This should be affirmed under the controls of the stations recurring maintenance program.

Waterside Security The Hudson River is a needed cooling water source for the station. At the same time, it is a valued and wellused recreational venue - and it is a possible access point for intrusion.

These competing factors complicate the strategies for providing adequate waterside security.

The team reviewed the stations interdiction methodologies, as well as the viability of its proposed response strategies. Through interviews and direct observation, the team also July 31, 2008 ISE 74

Indian Point Independent Safety Evaluation (ISE) verified the effectiveness of the external support capabilities to the stations waterside security assets.

The IPEC security force is responsible for the defense of the facility beginning at its PA boundary. Under the direction of the governor of New York, the NYNG and NYNM are supplementing the IPEC security force by serving as an outer buffer for identifying and interdicting potential waterborne adversaries. In this regard, the IPEC security force has developed effective strategies and is capable of dealing with a DBT attack on the facility from the waterside.

The commandant of the Port of New York has declared the water immediately adjacent to the IPEC site as offlimits to unauthorized boating traffic. The restrictions associated with this declaration are posted on signage in the area, are noted at local marinas and are specified in relevant navigation charts. The NYNM/NYNG team is responsible for enforcing these restrictions.

Exercises and evaluations by the Team affirmed that the IPEC capabilities were sufficient to effectively protect against interventions with weaponry and size of force beyond that defined in the DBT.

The Team nevertheless felt that enhancements were justified to improve the effectiveness and advance warning that could be achieved from a more proactive posture.

ISE Panel Recommendation, re waterside security:

Improve the lighting at the pier to provide for effective identification throughout the Coast Guard commandants restricted area.

Opportunities for Improvement, re waterside security:

Erect large signage in the pier area to ensure that small and pleasure boat traffic is aware of the restricted area.

Owner Controlled Area Access Control There is only one gateway in normal use to access the IPEC station. This gateway, located on Broadway on the south side of the station, leads to a checkpoint that is manned by an IPEC armed security officer and an armed member of the NYNG. Adjacent concrete barriers guide vehicles directly through this checkpoint.

July 31, 2008 ISE 75

Indian Point Independent Safety Evaluation (ISE)

Persons entering the IPEC station by vehicle drive up to the guard station. The security officer examines the identification card presented to verify the person has been authorized for entry to the site. This is verified by the entrant having either an OCA or a PA access card or, by being on an Access Authorization List, preapproved by plant management. The officer then checks the interior and exterior of the vehicle and based on those observations determines whether more targeted inspection is called for. With the officers permission, the entrant may then proceed into the OCA. If the entrant does not have an identification card, he or she is instructed to drive to the Training Center where an OCA or PA access card can be properly issued. Additionally, as part of the overall security verification procedures in place, all vehicles are subject to being selected for a random search. In such cases, when identified, the driver is instructed to move the vehicle to an adjacent lane where it is subjected to a more intensive search.

There are several other gateways that can be used to access the facility during abnormal, emergency or special conditions. When not in use, these gateways are closed and locked and secured by aircraft cable and/or concrete barriers to prevent unauthorized entry.

Two of these gateways are located on Broadway and served, in the past, as the normal access points to Units 2 and 3, when ownership of the facilities was segregated between Consolidated Edison Company and the New York Power Authority. An additional entryway to the OCA could be via the pier that abuts the Hudson River. Other access points are available to assist in the delivery of heavy and/or large pieces of equipment that may require special (e.g., rail) delivery options. All these gateways, whether used or unused, only provide access into the OCA. None provide access into the PA.

ISE Panel Recommendations, re OCA Access Control Procedures:

The present method for verification should be brought up to standards of high performing plants. While not an essential element of the IPEC security strategy, such improvements would provide additional warning and response times for the security force.

- Electronic (pictorial) verification should be implemented for all persons entering the site, or full search procedures should be implemented.

- Processes and procedures should be upgraded to incorporate modern vehicle search technologies.

- Improved communications and observation practices between the entry check point, the overwatch position and the alarm station could be implemented.

- Special consideration should be given to the need for a dedicated vehicle search facility.

July 31, 2008 ISE 76

Indian Point Independent Safety Evaluation (ISE)

The Protected Area The PA Boundary As called for by NRC regulations, protective strategies and capabilities at IPEC come into effect at the boundary to the PA. Federal standards specify the capabilities and processes required for identifying, assessing, deterring and responding to entrance into the PA by an armed intruder.

The IPEC PA is approximately 50 acres in size. Should the need arise, all of the critical structures, systems and components needed to bring the reactors to a safe shutdown condition, and to ensure containment of radiological material are inside the PA. These include the backup electrical capabilities, normal and emergency cooling water for reactor fuel and key equipment, and all of the facilities associated with the storage of spent fuel.

The IPEC PA is clearly identified, and all personnel with normal access to the site are trained on its importance and the need to assure its ability to function. Unauthorized entry into the PA is provided by several barriers and identification processes. Different technologies are implemented to preclude single point vulnerabilities. Monitoring systems are tested and verified to be functional under all, not just some, of the environmental conditions expected at the site. If any individual sensor is compromised or broken, it is compensated for by the immediate dispatch of an armed security officer. The systems associated with the PA have their own backup power supplies and these are held to high maintenance standards, fully at the levels established for nuclear safety equipment.

Extensive controls have been established concerning individual and vehicular access to the PA. To be granted unescorted access, a person is subjected to a background investigation, a psychological evaluation and fitnessforduty testing, and they must be approved for access (i.e., a need to enter) by plant management. To assure that these precautions are reflective of current conditions, the site implements a detailed behavior observation program. Before any person is granted access to the PA, they and their belongings are searched for contraband and prohibited materials. Any person who needs access but has not been subject to the background reviews will be escorted at all times while inside the PA. There are no exceptions to these search and verification processes.

PA Perimeter Fence Detection System and Its Computer Control Equipment The current perimeter fence enclosing the PA uses a technology that was developed several decades ago. Detectors provide the security force with knowledge of any instances of attempted human or vehicular access. When properly installed and maintained, and used in a stable environment, these systems work well. The problem, however, is that fence sensors of this type have a lesser degree of detection in realworld applications, as July 31, 2008 ISE 77

Indian Point Independent Safety Evaluation (ISE) compared to more modern applications; concurrently, they have a high level of false/nuisance alarms during periods of rain, snow, lightning or thunderstorms, thereby requiring human compensatory measures.

The Team also inspected the processing equipment controlling the fence detection system, and estimates that the equipment is several decades old. There are no replacement circuit boards available onsite, and Entergys instrument repair group is not able to perform complex repairs to this equipment, if needed. This places Entergy in a condition where it is dependent upon one service provider to maintain the equipment. Thus, while still serving its purpose, this equipment is subject to significant singlepoint vulnerability, and its expected remaining lifetime is relatively short. The team did confirm that the current cameras are compatible with modern computerized analytics and that these capabilities are in place in some limited applications.

To determine the relevance of these concerns, the Team reviewed the previous years condition reports (CRs) and determined that this equipment routinely malfunctions, requiring the security force to take compensatory measures. The number of invalid alarms exceeds the threshold specified by the NRCs Performance Indicator guidelines. Continuing to operate with this vulnerability is unnecessary, expensive and runs counter to good security practices.

ISE Panel Recommendations, re PA fencing and equipment:

Install a more modern but proven fence alarm technology. Excellent alternatives that offer stability, maintainability, high probability of detection and low probability of defeat are commercially available. The new system could be fully integrated with a dual redundant Command, Control and Communication console. The use of video analytics should also be considered, especially for those areas where wildlife can frequently alarm the system.

PA Access Control All PA access control activities are conducted through the Access Control Facility. This is a concrete structure that provides protection for the security force staff and effective controls to prevent unauthorized entry. It is considered to be part of the PA boundary and is monitored at all times.

The access control system used to authorize entrance into the PA utilizes a combination of identification key card bearing a photograph and biometric verification. Each individual entering the facility is monitored for explosive residues and metal. All personal items are July 31, 2008 ISE 78

Indian Point Independent Safety Evaluation (ISE) scanned by an Xray machine that is supplemented by computerized analytics. Any suspicious articles are opened and inspected by a security force member. Once through the search train, anyone seeking entry to the PA must be verified by a card reading device with biometric confirmation.

In the event of an emergency or to process visitors, the security officer can bypass the card reader and biometric system; however, this requires a written approval from management and the active assistance of a second guard. If an intrusion were being dealt with, turnstiles could be locked by the alarm station guard, thus setting up an additional barrier to unauthorized access. All activities within the Access Control Facility are continuously monitored by the alarm station personnel. During periods of high volume (shift changes), the oversight duties are supplemented by additional security force members.

Due to the physical layout of the search train, if an item is determined to need full search due to an Xray alert or due to a question on the part of the search train guard, the train must be shut down and ingress stopped unless a second search train guard is present. The Xray and metallic monitoring is done in front of the search train guard while the access card reader and biometrics verification device are behind the guard. When access is proceeding without incident, this is an inconvenience, but not an impediment. When special oversight is needed, special action (stopping ingress) is required.

Exiting from the PA requires a less intensive verification process. All personnel leaving the PA must card out for accountability purposes. Biometric verification is not needed.

Additionally, each person is monitored for radioactive contamination, this system serving as the final barrier for radiological safety.

Public Interest Issue #23: Worker Reliability In recent years, several instances have been reported of IPEC security officers being inattentive to their duties, and on one occasion, apparently sleeping on duty. These reports were investigated by Entergy and by NRC.

July 31, 2008 ISE 79

Indian Point Independent Safety Evaluation (ISE)

The ISE Security Team observed activities associated with access control during high volume and normal periods of activity, to include nighttime and weekends. Particular attention was paid to the methods in place to ensure the attentiveness of officers engaged in search activities. No instances of inattentiveness have been reported in recent months or were observed by the Team during its time on site.

Corrective actions have been implemented as a result of previous occasions of guard inattentiveness including installation of audible alarms on entry doors to the access facility, providing opportunities for officers to stay engaged in other approved activities when assigned to response activities (i.e., activities not requiring their constant attention),

and limiting the time an officer remains on station or in any one activity. These actions seem to have been effective in improving both morale and attentiveness.

While fully effective in meeting its design purpose, screening out any persons who were not authorized entry to the facility (i.e., no false positives), the system was found by the Team to be inefficient in that it produced numerous false negatives (failures to allow authorized persons access). During the course of the ISE investigation several members of the Panel were unable to gain access into the PA even though they had met all requirements and had been processed to allow entry. Other members of the Team had difficulty exiting the PA without repeated attempts to scan their key cards. This situation persisted during the entire course of the ISE evaluation.

Evidently, at least part of the access control problem is that the system connects with two separate databases (one for each unit), a holdover from the time when the IPEC units were separately owned and operated. For an individual to be permitted entry into the PA, independent authorization from both systems is required. While inefficient and sometimes leading to false negatives it does provide an additional barrier to unauthorized access and, as such, cannot be considered a failure in the security controls in place.

While the access difficulties experienced by ISE Panelists do not suggest any security compromise - since no unauthorized person was granted access into the protected area -

it is another example of an IPEC process or equipment that does not meet the standard of high performing facilities. The infrastructure incompatibilities that cause this problem have been recognized by Entergy and a new system is being designed; however, the priority for installing this new system is unclear.

ISE Panel Recommendation, re PA access control:

Modernization of the access control system should be pursued on an expedited basis.

Ensure that the physical modifications being made to the access control facility are human factored to provide efficient and practical configuration.

July 31, 2008 ISE 80

Indian Point Independent Safety Evaluation (ISE) 4.4 Security Systems, Equipment and Processes The IPEC facility is protected by a variety of systems and equipment to provide detection, assessment and identification, access control, property delineation, physical protection, lighting and transportation. In the case of IPEC, this equipment must be qualified and capable of fulfilling these functions on land and water. The Team evaluated the effectiveness of these systems and their associated equipment against the standard criteria of reliability, supportability, maintainability and user friendliness.

Systems and Equipment Central Alarm Stations and Secondary Alarm Stations Among the most important components of the security infrastructure at IPEC are the Central Alarm (CAS) and Secondary Alarm Stations (SAS).

The IPEC CAS/SAS facilities and the equipment within them clearly have been in place for decades. While still able to meet their design intent, they are neither efficient nor reflective of currently available technology. Some improvements and technological advances have been implemented in a piecemeal manner, but there is a need for the development, construction and implementation of a more cohesive and synergistic system.

There are dual CAS/SAS systems at IPEC, another holdover from the days of separately owned and operated plants. While this redundancy increases security robustness, the problems inherent to fractured command and control have caused Entergy management to conclude that a single CAS/SAS pair is best suited for the site. The ISE Security Team agrees with this conclusion. A detailed modification plan has been formulated - one that will require extensive licensing actions, detailed engineering activities and a significant construction effort. The modernization and consolidation benefits that can be expected from this effort are well worth the costs.

ISE Panel Recommendation, re CAS/SAS:

The unitized CAS/SAS facilities should be consolidated and modernized on a highpriority basis.

CCTV Cameras and Monitors Many of the IPEC closed circuit television (CCTV) cameras and display monitors in use are old, black and white units, and some are in poor condition. Years ago, there was justification for using black and white cameras, because color cameras (which provide July 31, 2008 ISE 81

Indian Point Independent Safety Evaluation (ISE) better assessment) had poor lowlight capabilities. In recent years, this deficiency has been corrected.

In one CAS inspected by the Team, there were problems with numerous camera displays.

While these were not so significant as to compromise the ability of the operators to identify interventions or effectively control response activities due to redundancies, they were significant enough to make these critical tasks unnecessarily challenging. Again, the IPEC equipment used in this area does not convey a commitment to achieving high performing facility status.

ISE Panel Recommendation, re CCTV cameras and monitors:

Replace all monochrome cameras and monitors with new highresolution color units. In the short term, repair or replace all cameras that are not providing the resolution and definition desired, and take action as needed to ensure that station maintenance expertise is adequate Heating, to support Ventilation and the Air new equipment.

Conditioning System (HVAC)

Protecting building ventilation systems from terrorist attack is a new consideration for owners of existing buildings. The expense involved in protecting building ventilation systems can only be justified when the threat analysis indicates that there is a high threat condition. Providing protection from such threats is a major concern of federal, state and city officials. In the case of IPEC, the design requirements associated with assuring the robustness of safetyrelated structures, systems and components required that all such intakes be protected from external and internal missiles. Additionally, due to the safety significance of such intakes, they were designed to be able to detect and respond to industrial safety vulnerabilities (e.g., chlorine and ammonia intrusion).

The air intake ducts and air conditioning system servicing the safety related areas of IPEC are centralized, allowing for easy detection of adverse environmental conditions, as well as facilitating rapid and effective corrective actions (e.g., initiating filtered recirculation) to be implemented.

Opportunity for Improvement, re HVAC:

Incorporate security considerations and vulnerabilities relevant to todays security environment into the HVAC system. Include capabilities to institute HVAC recirculation mode, as is currently in place for adverse industrial conditions.

Duress Communications Devices Effective communications under stressful or dangerous circumstances can be difficult to July 31, 2008 ISE 82

Indian Point Independent Safety Evaluation (ISE) achieve, and inadequate communications can increase police and/or security officer response time to intrusions or other emergencies, with potentially severe consequences.

IPEC has addressed this challenge by providing panic buttons in locations where initial access by intruders is considered most possible. Although this is a very proactive measure, the Team determined that improvements should be considered. In particular, the portable duress devices supplied to personnel would be difficult to use if personnel working there were truly under duress.

Opportunities for Improvement, re duress communication:

Duress buttons should be improved to standards, such as those used by banks, and/or programmed duress codes be incorporated into the computerizedaccess authorization system.

Processes Shipping and Receiving The ISE Security Team examined, in detail, the shipping and receiving procedures used at IPEC. Shipping and receiving locations are possible conduits for delivery of explosives or toxic chemicals to the facility. They could also, if compromised, provide a vehicle for theft of lowlevel radioactive materials. The Team concluded that even with the assistance of an insider, compromising the systems currently in place would be virtually impossible.

However, improvements in the attention given to the receipt practices associated with radioactive materials (e.g., radioactive sources) are advisable.

In all industrial facilities there are areas that should be controlled in a manner that precludes inappropriate access. In many instances, such controls are so important as to require significant and detailed measures, such as those used for entry to the PA or VA. In other instances, more traditional measures are appropriate. Examples at IPEC include important, but not safetyrelated rooms (security concern), radiological controlled areas (radiationprotection concern) or valves whose positions need to be guaranteed (operations concern).

Opportunity for Improvement, re shipping and receiving:

The warehouse facility should be provided with an Xray machine to check all (including radioactive material) shipments, or the radioactive material receipt inspection practices should be changed.

July 31, 2008 ISE 83

Indian Point Independent Safety Evaluation (ISE)

Key Control The ISE Security Team assessed the Key Control practices in place at IPEC. Procedures were reviewed, inventories were checked and responsible individuals were interviewed.

The Team found that the Key Control program at IPEC is comprehensive and well implemented. Keys are issued only to those individuals who have need of them; controls are in place for checking out and returning keys that are used; and periodic inventories are conducted, in accordance with the vulnerability associated with the key. No recommendations for improvement were identified.

Mail Package Delivery There are historical precedents demonstrating the relative ease with which explosives can be delivered by mail. For example, in several recent Christmas holiday seasons, postal authorities were confronted with explosive devices that were attached to holiday cards.

Other, less deadly threats included the receipt of letters containing a harmless powder that spilled out when opened by company personnel. Given that America has been challenged with actual occurrences of letter bombs and contamination by mail, it is essential that strategies for responses to such threats be determined.

A range of options is available for dealing with the vulnerabilities in mail delivery processes and facilities. These include training, equipment and facility structure and layout. For additional guidance, see Letter and Package Bomb Protection Techniques, a document published by the U.S. Bureau of Alcohol, Tobacco and Firearms.

ISE Panel Recommendations, re mail delivery:

IPEC procedures should stipulate that unchecked mail is not to be opened in the control room, the CAS or SAS stations or any other critical location.

Modernday techniques related to explosives scanning should be integrated into the receipt and screening practices at the site.

July 31, 2008 ISE 84

Indian Point Independent Safety Evaluation (ISE) 4.5 The Insider Threat Much of conventional security practice, at nuclear and other facilities, addresses external threats - that is, attacks by intruders. A more insidious and challenging threat, however, can be that posed by a knowledgeable insider - one or more individuals who have access to the facility, have detailed knowledge about how to harm it, and are unlikely to be suspected or challenged by other workers. The ability to deal with disgruntled employees and other insiders who might attempt by themselves or in concert with outsiders to sabotage a facility is a potentially significant danger.

The NRC has recognized this challenge for many years, and long ago promulgated regulations related to the insider threat. Since the events of September 11, 2001, however, the expectations and requirements relative to insider vulnerability have increased dramatically.

Insider Threat Mitigation In keeping with NRC regulations, IPEC has implemented an extensive Insider Mitigation Program (IMP) that includes personal background screening, fitnessforduty testing, continual behavioral observation practices and strict access control procedures. Personnel monitoring has always included the concepts of access authorization, access control and fitnessforduty testing; over the past several years this has been enhanced and integrated into an Insider Mitigation Program (IMP).

Although details of these programs are designated as safeguards information and cannot be divulged in this report, ISE Security Team members were authorized for access and were able to review their adequacy and personally verify their completeness. The randomness of the fitnessforduty program was demonstrated in the sense that several members of the Panel were reverified (via random testing) during the course of the ISE onsite review. In addition to reviewing the program, the Team made several attempts to test its adequacy by simulating actions by which an insider could damage the facility.

Team members looked for ways of circumventing security procedures - to gain unauthorized access to the site and to bring weapons and other prohibited items into the PA, via hand, package or truck delivery. They were unsuccessful.

Also of note, during the Teams review an actual situation occurred in which a contractor was discovered to be carrying contraband. It was properly identified by the IPEC security force outside of the PA; proper law enforcement actions were undertaken; and an appropriate and highly conservative response posture was implemented until the potential implications of the event were understood and addressed.

The Team also tested the stations vulnerability to the insider threat as part of the table top scenarios process described in the following section - in each scenario proposed by July 31, 2008 ISE 85

Indian Point Independent Safety Evaluation (ISE) the ISE Team, an insider was utilized. While some limited, marginal success on individual pieces of equipment was realized, the processes and procedures in place to verify the operability of standby equipment, to control the access to VAs of the plant, and to respond aggressively to any security event provided confidence such an attack could not achieve substantial plant damage.

Protection Against Sabotage Over the past several decades, there has been an increasing number of incidents in which individuals with no (or not noticed) indications of being a risk have violated the safety of individuals (e.g., Columbine, Virginia Tech, post office shootings) or challenged the security of private or governmental facilities (e.g., Senate office buildings, airports, local food marts). Many of these attacks were due to persons having been under stress; some were attacks by persons who should have been identified beforehand; and some were due to covert and planned acts of terrorism. The ISE Security Team assessed the ability of IPEC to preclude acts that can jeopardize the health and safety of the workers and the local populace.

Since the inception of commercial nuclear power, provisions for protecting the plant from sabotage have been required - this has included design considerations, physical protection provisions and personnel monitoring practices. Design has always included the concepts of diversity and redundancy, meaning that no individual action or loss of equipment can jeopardize the nuclear safety of the plant - these concepts continue to be formidable barriers to the release of radiation. Physical protection has always included the concepts of identification, assessment and response - these capabilities have been bolstered significantly in the aftermath of the 9/11 attacks. Personnel monitoring has always included the concepts of access authorization, access control and fitnessforduty testing - over the past several years this has been enhanced and integrated into an IMP.

The IMP at IPEC was assessed by the Team, both hypothetically and practically.

Background checks are required for any persons requesting unescorted access to the facility; a psychological check (Minnesota Multiphasic Personality Inventory - MMPI) with professional review and monitoring is likewise required for any persons with unescorted access; then, each person with unescorted access is subjected to an initial and subsequent random drug and alcohol testing program; finally, all persons are part of a Continuing Behavioral Observation Program (CBOP). Only if a person successfully passes the initial testing (and significant training) can they be authorized for unescorted access; and then, only if they remain (no more than a 30day break) in a program where their behavior is observed and they are subject to random drug testing can they retain that authorization.

Any break of greater than 30 days and you go back to square one - background update, behavior verification and fitnessforduty testing.

July 31, 2008 ISE 86

Indian Point Independent Safety Evaluation (ISE)

While no program can guarantee how individuals will respond at any time, the combination of barriers to assure public health and safety are robust and comprehensive and provide a level of assurance and confidence comparable to that associated with the highest of military classifications/access.

This has been an essential point of consideration during the past several months, when three members of the security force were identified as having used prohibited substances.

In each of the instances, the program identified the problem before an individual was performing duties on site. This is a positive point to note - the program was proactive and identified individuals with potential abuse problems. From a different perspective, however, it highlights how important the ongoing, random testing component of the program is. The Team found that the actions taken after such an identification -

immediate loss of unescorted access; immediate referral to medical assistance and counseling; and development of an individualized returntoduty program that included extensive random testing - are appropriate.

ISE Panel Recommendation, re fitnessforduty testing of security:

The Panel recommends that IPEC conduct an appropriate assessment, under its Corrective Action Program, of the reasons for and basis behind the increased number of positive tests in the security force. Such assessment should consider the appropriateness of the random testing component of the current IMP.

Outside Contractor Service Personnel All industrial facilities require regular access by persons who provide services in support of the operation - delivery personnel, contractors and repair personnel, as examples. In some cases, these personnel must have access to critical plant areas and thus may be in a position to significantly damage a facilitys infrastructure. Disgruntled service employees, former plant personnel, those who are suffering from mental problems and crazed individuals may constitute a threat. As has the entire nuclear industry, Entergy has done a great deal of work to address this issue.

Service personnel are subjected to the same site access criteria as the Entergy staff.

Therefore, they must either be subjected to the same background investigations, fitness forduty testing and behavioral observations, or they must be treated as visitors and be escorted at all times. The Team found IPEC practice in this respect to be appropriate for this issue.

July 31, 2008 ISE 87

Indian Point Independent Safety Evaluation (ISE)

Security During Outages During refueling outages, the reactor plants are, typically, in a condition that is supportive of the maintenance activities that need to be conducted, as opposed to the restricted access conditions associated with the radiological conditions inherent with power operations. This means that there are many contractors onsite conducting support activities and that the equipment in service at any given point in time may not support the concepts of redundancy and diversity.

As part of its security program, IPEC has instituted the IMP as described above. This program is especially important during outage periods because without it, there would be a need for all outside staff to be fully escorted during their time onsite.

The different equipment lineups that can be found during outage and maintenance periods are, likewise, something that bears consideration. Already, the station closely monitors which equipment is and is not in service and places a risk perspective upon such conditions. During these periods, the attention provided by management and the operations staff supplement the security program in place.

During periods of refueling, outages, or at any time when critical equipment or systems are out of service, the security posture should provide for increased attention. At IPEC, administrative controls are more stringent, operator rounds are more intense, and overall site attention is more pronounced than in nonoutage periods. Altogether, this serves to supplement the security posture at the site and precludes the need for increased security postings or controls.

July 31, 2008 ISE 88

Indian Point Independent Safety Evaluation (ISE) 4.6 Security Strategies and Their Effectiveness The Security Plan The IPEC has a written security plan. The Team reviewed this plan and compared its content, approach and requirements to those recommended in military manuals and security handbooks for commercial institutions; additionally, it was compared to the expectations promulgated by the IAEA for nuclear facilities. The Team also questioned security supervisors and officers to gauge their familiarity with the responses required by the plan during different emergency situations. We found the plan to be comprehensive and adequate to meet the needs of the facility.

OffSite Vulnerabilities The Security Team spent considerable time investigating the feasibility of affecting IPEC operations from offsite interventions during both normal periods of operation and during emergencies. The details and the associated mitigation strategies are discussed in the safeguards portion of the report; however, it is appropriate to note that the IPEC Security Force and the security support organizations in the local area are knowledgeable of these potentialities and can respond to any such occurrences, as needed.

ForceonForce Exercises The IPEC Security Force conducts forceonforce exercises to practice its defensive capabilities. Force onforce exercises are also conducted at regular intervals at the IPEC by the NRC as part of their regulatory oversight responsibilities; in its assessments, the NRC utilizes former military operations personnel to attempt to compromise the facility. During both the IPEC and NRC exercises, attacking forces use a variety of simulator weapons including Multiple Integrated Laser Engagement Simulation. The assistance of an insider is a common part of such exercises. Consistently, these assessments are conducted across a broad spectra of challenges, using a number of scenarios and attack locations. The details of these exercises are not available for public dissemination; however, as part of its review, the Team affirmed that the IPEC forces are capable of defending against these threats.

July 31, 2008 ISE 89

Indian Point Independent Safety Evaluation (ISE)

Tabletop Exercises In addition to reviewing the reports of forceonforce testing used by other authorities to verify the competency and capabilities of the IPEC Security Force, the ISE Security Team employed the technique of tabletop exercises to test the effectiveness of IPEC security strategies and to ascertain the effectiveness of the IPEC Security Force in adapting to changing threats, dealing with a multipronged insurgence and defeating an intervention of greater proportions than that prescribed by federal regulations. Additionally, in these simulations the Team assessed the interactions and cooperation between security force and the operations staff in responding to armed intrusions bent on compromising nuclear safety. The Team also assessed the effectiveness of cooperative and mutual support agreements that would be needed to harness the composite IPEC, NYNG, NYSP and federal resources that would respond to a nuclear incident.

The tabletop process provides a means to assess the synergistic attributes of:

- IPEC security procedures

- IPEC abnormal and emergency operating procedures

- IPEC emergency plan implementing procedures

- Federal response plan

- State emergency management operations.

The four tabletop scenarios proposed by the Team were supported by the training lieutenant on the Security Department staff. This allowed for the complete use of audio visual support during the exercises. A qualified RTL provided to the Team what actions would be taken by the security force; a shift manager from the Operations Department provided similar information relative to plant consequences and operator actions. With the background of the Team members, the capabilities of the physical detection systems could be verified, as well as the expected contributions that NYNG or NYSP forces could make.

The scenarios run by the ISE Security Team affirmed that processes and technologies in place at the IPEC station consistently were able to detect a legitimate threat before unauthorized access to the PA was achieved. Moreover, the intervention strategies in place were effective in precluding the compromise of the planned target set, although limited pieces of equipment were lost. To ascertain the depth of response capabilities, threats more severe than those prescribed by the DBT were posed. In all instances, intruders were effectively identified and defeated.

Altogether, the Team noted that conditions associated with IPECs previous dual ownership, with two reactors plant separately licensed and operated sharing a single site, has in fact been beneficial in developing and implementing defensive strategies. The previously separate security organizations, each independently selfsufficient, together make available an unusually strong set of security resources to address postulated threats.

July 31, 2008 ISE 90

Indian Point Independent Safety Evaluation (ISE)

Further, the independence of each units safety design inherently provides mutual support capabilities between the two units that allow for extended engagement times and distances before any damage of consequence can be achieved.

In the tabletop exercises, cooperation between the Security and Operations staffs was impressive. Execution of planned defensive strategies and tactics thwarted the capabilities of the postulated intruders from meeting their goals. The ability of Operations personnel to respond to equipment challenges and mitigate their consequences, even during security situations, was evident.

In all scenarios, substantial IPEC security resources remained after the exercise - they were fully adequate to effectively continue their site defense role, should the need have arisen.

External (NYNG and LLEA) resources were not needed to engage and defeat the attacking forces. Instead, they were available to intercept any of the intruding force that sought to retreat to safety. The command post for the NYNG was able to communicate with that of the IPEC forces, so field adjustments in tactical deployment would have been possible.

Details of the followup activities that would be accomplished by the LLEAs and federal responders were not part of the simulations and could only be surmised by the IPEC security organization. But, followup discussions with leaders from these organizations confirmed that the response methods identified by the IP staff were correct. It should be noted, however, that more detailed planning and coordination, especially with those organizations outside of the immediate response team, would be beneficial and improve the effectiveness of such support efforts should they be needed.

The Team concluded that the Emergency Plan Implementing Plan responsibilities associated with security could be effectively completed.

Opportunity for Improvement, re tabletop exercises:

The IPEC security organization should undertake a program of familiarization visits with potential organizations (e.g., West Point Provost, New York City SWAT) that could be expected to provide critical but longterm assistance in the event of a significant security event.

July 31, 2008 ISE 91

Indian Point Independent Safety Evaluation (ISE) 4.7 Protection from Terrorist Attack Protection against terrorist attack - by land, sea or air - is central to the role of the Security organization and was the prime focus of the ISE Security Team. The Teams conclusions in that respect are implicit in this entire section.

Is a Nuclear Plant an Attractive Target for Terrorists?

It is often presumed that nuclear plants are particularly inviting targets for those wishing to harm Americans. But this is not necessarily the case. In particular, there are several factors that make nuclear facilities very unattractive as targets:

• Nuclear plants are among the most secure and protected industrial facilities in the nation. Entry would be very difficult. Once in, they will have a large, well armed and well trained security force to contend with.

• Both the radioactive materials and the safety systems that protect them are housed in massive, virtually impenetrable structures. Studies and tests have shown that even a fully loaded commercial airliner, crashing into a nuclear plant containment structure at hundreds of miles per hour, could not penetrate it.

• The defenseindepth design of nuclear plants is particularly problematic from the terrorists standpoint, because it means that to effect enough plant damage to release large amounts of radioactivity, multiple such rugged boundaries would have to be penetrated, at multiple different locations. This would take time, equipment and people.

Certainly, the prudent assumption from a public protection standpoint is that every nuclear plant is a potential terrorist target. That is the posture of IPEC security force, the NRC, the state of New York and all those responsible for public protection.

The possibility of airborne terrorism - using hijacked airliners as weapons - is among the most common of public concerns regarding IPEC. For that reason, the ISE Panel studied that issue in more depth than any other single public interest issue. It is a multidimensional issue that includes considerations of security, nuclear safety system and plant structural design, and fire fighting and other emergency response measures.

The potential for and consequences of an attack from the air involve many factors. There are security factors - particularly the steps taken to prevent such an attack in the first place; there are nuclear safety factors - the effectiveness of the plants design, construction and security force in preventing core damage in such an event; there are July 31, 2008 ISE 92

Indian Point Independent Safety Evaluation (ISE) mitigation factors - the effectiveness of site and offsite fire protection; and the overall emergency preparedness apparatus in protecting people and equipment, onsite and off site.

Given this broad set of implications, the topic of aircraft crash at IPEC is covered in Section 6 of this report, Crosscutting Technical Issues, which summarizes the ISE Panels overall evaluation of this issue and its conclusions. Appendix 3, Issues of Expressed Public Concern provides a more detailed summary of this topic.

July 31, 2008 ISE 93

Indian Point Independent Safety Evaluation (ISE) 4.8 Indian Point Security, In Summary Based on its evaluation of IPEC security, the ISE Security Team concludes that the security posture at the station is sufficient to meet the DBT imposed upon it by regulation.

Furthermore, as confirmed by personal observation and tabletop exercises, the Team concludes that the IPEC security force would be able to defend the station from land and waterbased interventions from forces armed to levels beyond the DBT.

Considering IPEC security in terms of its detection, assessment and response capabilities, the Team concludes:

The equipment and procedures for detecting challenges to the safety and security of the station are in compliance with NRC requirements. Some of the equipment, however, is old and should be brought up to current technological standards; likewise, some process could be enhanced.

The equipment and procedures by which the security force assesses potential interventions onto the site is also in compliance with federal requirements and allows for an accurate determination of vulnerabilities and challenges. Again, efficiencies can be realized by aggressively pursuing the upgrade programs that have been identified to replace older facilities and equipment.

The capabilities of the IPEC security force to respond to intrusions from land, water or airborne forces have been confirmed by the NRC and Department of Homeland Security as part of their oversight responsibilities and by the Team through the use of tabletop exercises. The presence of the NYNG, NYNM and NYSP are not needed to assure the security of the station, but do provide resources that enhance the IPEC security presence.

Throughout all of its interactions, the Team found the security program to be implemented with an enlightened management team and to be staffed with competent and highly qualified individuals. The redundancy and diversity that was inherent to the individual designs of the IPEC nuclear units provides additional levels of security assurance in that the defeat of reactor safety would require the compromise of numerous systems in diverse and varied locations.

Indian Point security compares favorably to highperforming U.S. nuclear plants in a number of areas, but needs upgrading in others. The ISE Panel judges Indian Point security to meet the highest standards of international nuclear facilities and to be superior to most complex nonnuclear U.S. industrial facilities.

July 31, 2008 ISE 94

Indian Point Independent Safety Evaluation (ISE)

Section 5: Emergency Preparedness By charter, Emergency Preparedness (EP) is one of the central areas of Independent Safety Evaluation (ISE) investigation. EP is a matter of particularly high importance and visibility to those who live and work near the Indian Point station. Moreover, it is the primary interface among public, plant and government (federal, state, county and local), one that demands strong communications and effective coordination. And it has been subject of significant controversy, criticism and dissatisfaction among stakeholders and public, and extensive (generally negative) media attention.

EP therefore warranted, and received, significant attention by the ISE Panel, as summarized in this section.

5.1 The ISE Emergency Preparedness Team EP Team Leader Cristine McCombs is a nationally known expert in emergency management. She is the former Director of the Massachusetts Emergency Management Agency (MEMA), and in that role was directly responsible for development and implementation of emergency plans for Massachusetts communities within the emergency planning zones of three nuclear plants.

Just as Ms. McCombs is an expert in the state, county and municipality elements of emergency management, Marty Vonk is an expert in the plantside aspects of nuclear EP.

He has over 30 years of experience in nuclear plant operations, health physics and emergency management, with the U.S. Navy, Commonwealth Edison Company and the Nuclear Management Company. He is now a private consultant, specializing in EP programs.

To assess the effectiveness of Indian Point EP, the Team pursued two parallel tracks:

Developing a full understanding of the effectiveness of interactions between Entergy Corporation and the federal, state, county and municipality organizations responsible with Entergy for emergency plan implementation.

This was accomplished primarily through interviews and meetings with key personnel in these organizations, and through observations of the planning and conduct of the Indian Point emergency exercise on May 14, 2008. Ms.

McCombs took the lead in this area.

Comprehensive examination of the Entergy/Indian Point effectiveness in all areas of EP within its purview. This included assessment of the Entergy/Indian Point EP organization, the emergency response organization (ERO) of station personnel having collateral duties in emergency response, July 31, 2008 ISE 95

Indian Point Independent Safety Evaluation (ISE) adequacy of Entergy onsite and offsite emergency response facilities and equipment, drill performance, and compliance with standards and requirements.

A particular area of attention in this review was the installation of the new Indian Point siren system. This project has had a great deal of local and national attention and some degree of notoriety due to protracted schedule delay and resultant fines by the NRC.

Because of its importance to EP, and also because such a review may be instructive regarding IPEC performance in other areas, the ISE Panel chose to thoroughly assess this issue.

Mr. Vonk was the primary investigator on the plant aspects of EP, including the siren issue.

It is important to point out that the ISE scope in EP examined an unusually wide (relative to conventional plant reviews) spectrum of EP issues. The Team reviewed areas directly within the responsibility and under the control of Entergy and extended as well to areas of responsibility shared by Entergy and offsite organizations, including Entergys supporting role in offsite protective actions.

July 31, 2008 ISE 96

Indian Point Independent Safety Evaluation (ISE) 5.2 Entergy Interaction with Offsite EP Organizations In meetings with officials of counties and communities within the Indian Point Emergency Planning Zone (EPZ), several advised ISE Emergency Planning Team Leader Cristine McCombs of their dissatisfaction with Entergy/IPEC emergency management. Participants in these discussions raised concerns regarding inadequate funding of EP cost, communications breakdowns, equipment failures, outdated training materials, reductions in staffing and unavailability of Entergy EP personnel during outages.

While there may be differences in details and perceptions among various individuals, the ISE Panel concludes that the central points are consistent and need to be addressed.

Further, the ISE Panel concludes that the fundamental issues revolve around communications and trust.

The communications shortcomings take many forms, and include daytoday communications (or lack thereof), effectiveness of communications during emergency exercises, and concerns regarding the notification process, during exercises and presumably in a real event. They involve all levels of personal interactions, including reduction in communications among workinglevel emergency plan participants (due in turn to reductions in staffing) and inadequate interactions between Entergy/IPEC and stakeholders. Many assert that there has been a distinct decline in communications effectiveness since Entergys purchase of the plants - and while difficult to verify, the frequent repetition of that view suggests that it is valid.

The mistrust of Entergy expressed by some is judged by the ISE Panel to be an exceptionally significant issue. In all likelihood it is linked to the communications issues noted above, but it seems more pervasive - to the point, potentially, of being an endemic issue that obstructs all efforts, on all sides, to resolve problems. Once lost, trust normally cannot be regained without constant demonstrable effort, over the longterm. Such a course is now essential.

A related and very significant issue - albeit one not within Entergys control - is Westchester Countys expressed resolve not to participate in Indian Point EP exercises17.

Arguably, the most challenging aspect of managing any emergency is achieving effective coordination among the utility, state, county and municipalities. In New York - a home rule state - this is particularly important because of the counties accountability for protective action determinations, including whether and when evacuation is warranted.

17 Associated Press, article by Jim Fitzgerald, as carried in the New York Daily News, November 30, 2007, and numerous other newspapers.

July 31, 2008 ISE 97

Indian Point Independent Safety Evaluation (ISE)

The practices and skills needed to achieve the level of coordination to cope with any serious emergency - nuclear or otherwise - are developed and honed through practice.

The venue for such practice in Westchester, Rockland, Putnam and Orange Counties is Indian Point emergency management exercises. Westchesters absence affects not only that countys preparation for disasters of any kind, but the readiness of the other counties, the state and municipalities and Entergy as well - a consequence potentially adverse to public health and safety. That situation deserves strong attention from all sides.

Participation by all of the counties in the EPZ is highly desirable, and in the absence of one or more counties, there needs to be an effective way to communicate directly with cities and towns in those areas.

July 31, 2008 ISE 98

Indian Point Independent Safety Evaluation (ISE) 5.3 Emergency Preparedness People and Plans Emergency Preparedness Staff The Indian Point dedicated EP staff is slightly larger than industry norms for a twounit station. The current onsite staff includes a manager and four direct reports, supported by the Entergy fleet EP staff in nearby White Plains offices. It was estimated that the White Plains EP staff currently provides to Indian Point the equivalent of two additional staff members (through parttime participation by four people). The current staff is highly experienced at Indian Point with sufficient years in EP experience to support the onsite program.

During the course of the ISE Panel review, Entergy management approved an increase in site EP staffing. The approved increase will provide an offsite issues project manager and an additional onsite planner. These augmented staff will provide additional strength to the EP program.

Entergy staffing support to offsite EP needs is currently falling short of the expectations of the offsite organizations supported. This is an important and very visible area of Indian Point/stakeholder interface, and one which is viewed as having deteriorated since Entergys acquisition of the station.

Under the previous separate ownership of the Indian Point units, each owner assigned separate personnel to the offsite EP support role. The combined complement of four Indian Point personnel provided substantial support to and frequent contact with the off site stakeholders. Initially, following the Entergy acquisition, the consolidated units continued to supply the same four individuals for the offsite interface function. But, as part of the Entergy Alignment Process (as described in Section 3 of this report), the offsite interface responsibilities were reduced to a single individual supported by the EP Manager, consistent with Entergys practice at other sites.

While this reduced level of staffing follows the Entergy fleet model and is generally in line with nuclear industry practice, it in fact constituted a significant disruption in the level of support to which Indian Point offsite stakeholders had come to rely upon for many years

- and it contributed significantly to the diminished stakeholder confidence in Indian Point that is discussed earlier in this section. The Panel notes as well that the perceived loss to the outside organization is more than just numbers of support personnel - the Indian Point individuals who served in those positions were evidently very well suited for that role, and were known, respected and trusted by their offsite counterparts. That positive relationship was therefore harmed when their support was withdrawn.

July 31, 2008 ISE 99

Indian Point Independent Safety Evaluation (ISE)

It was reported by stakeholders that this situation is compounded during outages, when EP personnel have additional temporary outage support responsibilities and have correspondingly less time available to work with offsite stakeholders.

The recent corporate approval to add an Offsite Project Manager will improve the situation, but the Panel does not expect it to be sufficient to restore stakeholder confidence in Indian Point EP in the nearterm. It is similarly important for Entergy to restore two offsite planner positions to support the EP interface, as recently decided.

Emergency Response Organization Consistent with standard practice at U.S. nuclear plants, the Indian Point ERO comprises a cross section of site personnel trained and committed to serving in assigned emergency response positions in the event of an emergency event. The EP Team reviewed the management assignments to the ERO and concluded that the designated senior management personnel are qualified for their assigned ERO positions. The Team also concluded that the overall makeup of the ERO is satisfactory.

However, it is the EP Teams view that the Indian Point method of selecting personnel to fill ERO vacancies is unusual and likely results in lessthanoptimal ERO staffing. It is common practice among highperforming plants for station line management to take the lead role in assigning personnel to the ERO - in that way, making available a cadre of well qualified personnel and also sending a clear signal to their employees of the importance and value of ERO service. As an example, the site Radiation Protection Manager would ordinarily be responsible to assign personnel from his or her organization to fill the radiation protectionrelated positions on the ERO.

By contrast, at Indian Point, it is common practice that ERO managementlevel positions are filled when vacant by EP staff exploring and determining who might be available to fill the roll. The Panel considers this approach to be less effective and a lost opportunity for strengthening the ERO.

ISE Panel Recommendation, re ERO:

Assign line management responsibility for designating personnel to fill ERO vacancies and/or develop ERO position candidates July 31, 2008 ISE 100

Indian Point Independent Safety Evaluation (ISE)

Drill Performance The ISE Panel observed one drill, on May 14, during its onsite review period18. The Panel also assessed Indian Point drill performance by reviewing the previous two years of drill reports and the past two years of NRC performance indicators related to drill performance.

The Panel considered overall Indian Point drill performance to be adequate. The ERO responders were aware of their assigned responsibilities and adequately trained to carry them out. The critique process following the drill generally addressed issues observed and opportunities for improvement.

There was a missed opportunity in this drill to more fully challenge the ERO to deal with the offsite pressures that would be present in an actual event. Specific examples include:

The interaction with the NRC was not tested or realistically simulated in this drill, and evidently had not been in others, based on review of drill reports.

In an actual event involving NRC response (that is, during an Alert level or higher, and sometimes at the Notice of Unusual Event level19), the NRC would request a continuously manned line of communications on the Emergency Notification System (ENS). Similarly, for an event with radiological implications, a continuously staffed Health Physics Network (HPN) line may be maintained between NRC response centers and the utility. During the observed drill, there was very limited interaction with the NRC and that was limited to the ENS line.

Since 9/11 the NRC has also modified their use of the Management Counterpart Link (MCL). While this line in the past has been an NRC internal link, the current expectations are for the NRC to periodically request a managementlevel briefing on this line from the utility Emergency Director or the overall manager of the event at the Emergency Operations Facility (EOF).

Major, extendedterm emergency events would also involve dispatch of an NRC team of about 20 persons to the utility incident response centers. Two or three of those responders would support the NRC Resident Inspectors in the Technical Support Center (TSC)/Operations Support Center (OSC) or the control room of the affected unit, perhaps three others would respond to the 18 The May 14 drill was a training exercise. It included only partial participation by offsite stakeholder organizations and was not graded by the NRC.

19 There are four standard classifications of emergencyresponse levels, with increasing severity: Notice of Unusual Event, Alert, Site Area Emergency and General Emergency.

July 31, 2008 ISE 101

Indian Point Independent Safety Evaluation (ISE)

Joint Information Center (JIC), and the remainder would respond to the EOF.

It is likely that state and county participation would also be greater than during emergency drills. The addition of approximately 15 people to the current Indian Point EOF would stress space availability.

An additional challenge to Indian Point emergency management would be the demand on the county emergency manager hot line. While the observed drill did not involve full county participation, recent drill reports noted concerns with the plant Emergency Managers ability to adequately brief county personnel on the hot line. This line was not simulated in the observed drill.

In that the observed drill was for training purposes, and the scenario, drill structure and limitations were at the option of the utility, the above are not considered by the ISE Panel to be deficiencies - but they do represent lost opportunities to better prepare the ERO for a real event.

Opportunities for Improvement, re drill performance:

- For drills in which the NRC does not participate, include phone response by trained personnel simulating NRC participants demanding an open ENS line, a continuously staffed HPN line as appropriate and challenge the Emergency Managers through the use of the Management Counterpart Link.

- Periodically, develop a simulated NRC response team to challenge the staff to deal with the additional burden of NRC response to the site.

- For any drill in which the counties are not participating, the county managers hot line response should be simulated by trained, experienced personnel familiar with the county needs, in order to present more realistic conditions for the responding emergency team.

Nuclear Oversight on the EP Program Recent summaries of the Indian Point and Entergy corporate oversight reviews20 of Indian Point EP were reviewed to determine the overall effectiveness of the oversight program as related to EP.

20 Entergy Nuclear Assurance fleet summaries for the fourth quarter of 2007 and the first quarter of 2008 July 31, 2008 ISE 102

Indian Point Independent Safety Evaluation (ISE)

The overall rating for Indian Point EP for the fourth quarter of 2007 was white21.

However, the summary identified serious issues with respect to gaps in the ERO caused by the Alignment Process and an ongoing trend of equipment deficiencies. The 2008 first quarter report indicated success in addressing the ERO issues, but downgraded EP to yellow based on the ongoing uncorrected equipment issues. Both reports are silent with respect to the significant offsite issues identified in this report and wellknown to Indian Point and Entergy staff. The EP Team considers the yellow designation to be appropriate.

The value of the oversight reviews of the EP Program appears limited. Drill summaries are superficial. Findings seem to be oriented toward easily measurable component issues (equipment issues, vacancies in the ERO roster, etc.) rather than human performance issues and interactions which are at the heart of effective EP.

Opportunities for Improvement, re EP oversight:

Expand the scope of the current oversight review process to include offsite issues of importance to the EP program Examine the qualifications of oversight staff assigned to review EP activities to determine if more specific EP knowledge is required 21 Normal practice in nuclear plant performance indicator processes is to establish quantitative criteria, with thresholds and color codes to provide high visibility on measured performance. The color codes, from best to worst, are Green, White, Yellow and Red.

July 31, 2008 ISE 103

Indian Point Independent Safety Evaluation (ISE) 5.4 Emergency Preparedness Equipment and Facilities In the main, the EP Team found that Indian Point EP equipment and the respective Emergency Response Facilities (ERF) are compliant with existing regulatory requirements, but have not been updated to reflect current industry best practices. This section summarizes the findings in that respect.

The New Siren Installation A significant and very visible exception to the Teams overall observation regarding compliant EP equipment is the Indian Point Siren Upgrade Project.

For over two years, Entergy has been at work to replace the Indian Point siren system with an entirely new system, to comply with the requirements of the 2005 Energy Policy Act and subsequent NRC direction. At the time of the ISE on site review, the project had not yet been successfully completed and approved.

Because of its importance and visibility of the siren upgrade work, and because the project history may be illustrative of broader Entergy project management shortcomings, the ISE Panel chose to give this episode an indepth review. Observations and findings regarding the project are presented in Section V.5.

Public Interest Issue #4: Is there a functioning emergency siren system at Indian Point?

The highly publicized failure of Entergy to successfully execute the congressionally mandated upgrade of a system intended to enhance public protection has been viewed by many as symbolic of all that is asserted to be wrong with Entergy and Indian Point -

validation of those who assert that the company is not capable or willing to do what is necessary to protect those who live near the plant.

It is important to note, however, that the existing alert and notification system is compliant with all requirements in effect prior to the Energy Policy Act of 2005 - and the requirements still applicable to all other U.S. nuclear power plants - and has been maintained in an operable condition throughout the siren upgrade project.

Entergys failures in meeting its commitments to upgrade the Indian Point siren system are important, for the many reasons discussed in this ISE report. However, the notification July 31, 2008 ISE 104

Indian Point Independent Safety Evaluation (ISE) capability provided by the existing siren system remains intact and is comparable to that at all other U.S. nuclear stations.

Entergys failures in meeting its commitments to upgrade the Indian Point siren system are important, for the many reasons discussed in this ISE report. However, the notification capability provided by the existing siren system remains intact and is comparable to that at all other U.S. nuclear stations.

Emergency Response Facilities As noted above, the ERFs supporting EP are generally compliant with existing regulatory guidance, but are not up to practices at highperforming plants. In particular, these facilities are not well optimized for human performance and, therefore, may not efficiently support the assigned ERO personnel and their functional roles, particularly for challenging drill or accident scenarios. Specific issues identified at these facilities include:

Emergency Operations Facility The current EOF is located onsite22. It is compliant with requirements, but is a dated and relatively small facility. And while it has been updated to include improved methodology for dissemination of data within and between facilities, its inherent size and layout restrictions limit its ability to utilize these capabilities efficiently and to support effectively all the plant, federal, state and local responders who must use the facility as their base of operations over the course of an emergency event.

Importantly, the EOF is a central point of interface between onsite (Entergy) and offsite (government) emergency management organizations.

As such, it is a very visible part of the stations emergency management capability. The effectiveness, equipment reliability and overall professional appearance of the EOF speak volumes to public officials about Entergys commitment to supporting their needs in emergency management.

Technical Support Center/Operations Support Center These inplant emergency facilities are compliant with requirements, but like the EOF they are undersized and cramped, and they lack the human factors considerations that would facilitate efficient and effective use, particularly over an extended period. The overall condition and appearance of these facilities is neither professional nor inviting.

22 By NRC regulation, the EOF may be located onsite or offsite, but if within a potential evacuation area (i.e.,

within the plant EPZ) a suitable backup EOF must also be provided.

July 31, 2008 ISE 105

Indian Point Independent Safety Evaluation (ISE)

Joint Information Center The Indian Point JIC is a very new facility, colocated with the Hudson County Traffic Management Center (operated by the New York State Police) in Hawthorne, N.Y. The facility is hightech and very professional in appearance, and its shared location with the New York State Police is efficient from an accident management and communication standpoint.

Although the JIC is compliant with NRC requirements and a dramatic improvement from the prior Indian Point JIC (located at the White Plains Regional Airport), its use has revealed several shortcomings that bear evaluation and possible modification. The overall space seems adequate, but the layout provides disproportionately little room for several key functions, particularly the area for Entergy event monitoring, internal briefing and development of communications materials. And the location designated for media briefing - the main entrance and lobby area to the facility - is impractical and likely to be spatially inadequate to handle the number of media personnel expected in a major event. Also, the facilitys parking area is inadequate.

Backup Emergency Operations Facility The Backup EOF23 is a compliant and welldesigned facility. However, it is not large enough to efficiently support longterm operation as the EOF, if relocation from the primary were required by security or radiological factors.

Emergency Management Equipment and Systems EP Team observations regarding the Entergyprovided equipment and systems employed in emergency management are as follows:

Dose Assessment Software The process and software used for dose modeling is compliant with requirements, but antiquated compared with currently available ones. In particular, Indian Point dose modeling utilizes transparency based isopleths to detail the progression of the plume. And while Entergy has adopted the MIDAS dose assessment software as the fleet standard, Indian Point has not yet adopted the MIDAS software. Adoption of the MIDAS software will allow more effective display and communication of near real time plume behavior in the atmosphere.

23 By regulation, if a nuclear plants EOF is located within the EPZ, a Backup EOF is also required. The Indian Point EOF is located on the plant site.

July 31, 2008 ISE 106

Indian Point Independent Safety Evaluation (ISE)

Equipment Important to EP A lesson learned in the nuclear industry over the years is that equipment important to the EP function requires special attention. Historically, much of the equipment needed to support the EP was not included in a stations work control system, usually because that equipment was not classified as safetyrelated, was located and controlled outside of the plant proper, and was used infrequently. Hard experience taught that this omission often led to unreliability of key equipment when most needed.

Entergy, at the fleet level, determined that equipment important to EP needs to be effectively identified, integrated into the site work control process and evaluated for needed contingencies. Indian Point completed an initial identification of that equipment, but the project has not proceeded since that time, ostensibly because of competing priorities and disruptions associated with the Alignment Process. As a result, monitoring of equipment important to EP remains peopledriven rather than processcontrolled. This shortcoming is a vulnerability that should be addressed.

Offsite Communications Equipment One contributor to the offsite confidence factor discussed previously in this section is the repeated instance of functionality problems in systems used to communicate with offsite organizations. These systems include the primary phone/fax communications systems and data transfer systems to the counties.

Performance problems during recent drills challenged the county decisionmaking process, because information perceived to be critical to decisionmaking was not available or untimely. The observed problems were of three types:

- Actual equipment failures

- Failures due to personnel error (infrequently used equipment)

- Errors due to drill setup While minor problems of the first two types are not unexpected and usually correctible, the third category is more problematic, and deserves particular attention, because it relates to effectiveness and validity of the emergency exercise process.

July 31, 2008 ISE 107

Indian Point Independent Safety Evaluation (ISE)

ISE Panel Recommendations, re equipment important to EP:

Implement current Entergy fleet programs for:

- Equipment important to EP

- MIDAS dose assessment software

- Look into new technology to support EPZ - Global Information Systems, plume modeling Improve the emergency response facilities:

- Evaluate the merits and implications of a single EOF outside the EPZ and/or improving and expanding the current EOF and Backup EOF

- Conduct human factors reviews of all ERFs

- Evaluate the spatial needs for the ERFs

- Consider the adequacy of the media briefing areas and parking at the JIC Evaluate all communications equipment and protocols to offsite facilities:

- Improve equipment reliability

- Develop drill setup that ensures reliability

- Work to incorporate Code Red/New York Alert into standard communications protocols July 31, 2008 ISE 108

Indian Point Independent Safety Evaluation (ISE) 5.5 The Siren Upgrade Project - A Case Study The current Indian Point sirens system has been in place since the specific design criteria for Federal Emergency Management Agency (FEMA) REP10 were established for siren systems supporting the 10mile EPZ around nuclear power plants. The system, like most in the nation at the time, did not include battery backup power to the sirens.

Due to post9/11 concerns and occasional siren outages reported by Indian Point per 10 CFR 50.72, the lack of battery back up became a matter of public concern. On August 8, 2005, the Energy Policy Act of 2005 was approved with a special provision requiring the NRC to order any plant with EPZs exceeding a certain population density to have backup power for its siren system. This provision of the act was applicable only to the Indian Point.

Entergy began its work on the siren upgrade project in the fall of 2005, prior to the NRCs formal order to Indian Point regarding the installation of backup power. Early on, Entergy decided to address other alert and notification system problems along with its work to provide backup power to the sirens, and to install at Indian Point an entirely new stateoftheart siren system. This initial decision to provide a worldclass system that exceeds regulatory requirements, while wellintentioned, had substantial bearing on the ultimate project failures.

During the fall and early winter of 2005, Entergy proposed to the NRC that January 2007 was a reasonable completion date for operation of the new siren system. The NRC issued order EA05190 on January 31, 2006, directing Entergy to meet the requirements of the Energy Policy Act by January 2007. On February 27, 2006, Entergy designated Acoustic Technology Incorporated as the contractor of choice and proceeded with the project.

Conduct of Project The design report for the additional siren system (150 sirens nominally rated at 122 dB) was submitted to FEMA for approval on April 27, 2006. Because of the time restrictions of the NRC order, system construction started in May of 2006 without FEMA approval.

July 31, 2008 ISE 109

Indian Point Independent Safety Evaluation (ISE)

A series of issues related to construction, system design and contractor performance surfaced throughout 2006 resulting in system design and subcontractor changes. The attendant delays led Entergy to request an extension of the January 2007 operability date.

The NRC granted that extension to April 15, 2007. On April 13, 2007, Entergy tested the system. The system failed to meet acceptance criteria.

On April 14, 2007, Entergy asked for a second extension. The NRC denied that extension, issuing a Notice of Violation (NOV) and imposing a $130,000 fine. Accepting the NOV and fine, Entergy proposed a new operability date of August 24, 2007, along with an expansion of the original 150 sirens to 155 based on FEMA sound propagation concerns. Entergy completed the system as proposed by the prescribed operability date, but was unable to obtain FEMA approval.

The NRC denied Entergys subsequent request for an extension to obtain FEMA approval and issued a second NOV. In January of 2008, the NRC issued a third NOV with a $650,000 fine for failure to comply with the second order. After its evaluation of the project failures to date, Entergy proposed to the NRC a new due completion date of August 14, 2008. The NRC has recently accepted this proposed milestone schedule.

Most of the issues prompting FEMAs initial withholding of approval have been resolved.

Twelve additional sirens have been added (one of which was in response to a municipality request not impacting the system design) to the siren field. The additions addressed FEMA concerns over sound boundaries based on differences in FEMA data from the design report.

Status and Outlook for Completion As of the time of the ISE onsite reviews, there were two central issues remaining:

reliability of the newly installed system and siren coverage:

Through the course of the ongoing process of system testing, analysis, adjustments and retesting, Entergy has been unable to achieve fully reliable and repeatable system performance. Some aspects of the technology are new, and there have been some technical issues associated with the interaction of the new system and the currently installed siren system, which must remain fully operable until the new system is operational.

Entergy has been applying very substantial management and technical expert attention to these issues, but at the time of review, full success remained elusive.

Subsequently, in June of 2008, FEMA challenged Entergys basic assumptions for required coverage in the various segments of the EPZ as lacking sufficient conservatisms. Resolution of this issue is not yet clear, but July 31, 2008 ISE 110

Indian Point Independent Safety Evaluation (ISE)

Entergy expects to add at least five additional sirens and a quantity of tone alert radios to resolve this issue.

As a separate but related matter, there has been an ongoing and as yet unresolved issue regarding the selection of a backup system for the new sirens24. Conventional practice among most U.S. nuclear plants has been to employ route area alerting - truckmounted loudspeakers - as the backup, and that is the currently established and accepted backup method at Indian Point. There has been concern expressed that such a method may not be suitable for an EPZ as densely populated as that at Indian Point. This is an issue that must be resolved to FEMA and county satisfaction, although one not directly linked to the requirements for the new IPEC siren system. There are several new technologies that offer promise for improved notification, as primary or backup methods, as noted in Section 5.6.

The ISE Panel encourages full consideration of such new methods at Indian Point.

Indian Point continues with an action plan targeted to complete the project by August 14.

The ISE Panel has observed the activities of the Entergy team currently assigned responsibility for siren project completion and concluded that the project is being aggressively managed but based on the open issues outlined above, likelihood of success by this date is uncertain.

What went wrong?

Entergy conducted two formal rootcause investigations, one in May 2007 after being fined for failure to meet the April 2007 completion date (noncompliance with NRC Order EA05190) and the second in January 2008 after the third missed date and NRC NOV and major fine (noncompliance with NRC Order EA07189). These two investigations attributed the successive failures to numerous specific root causes and contributing causes. In summary, the May 2007 investigation concluded that the failures were primarily due to insufficient project planning and lack of full understanding of the technical implications of the application of radio simulcast.

The second investigation (which followed Entergys inability to secure FEMA approval of the completed system) identified inadequate interaction between Entergy and FEMA and the resultant unresolved technical disagreements regarding system acceptance criteria as the primary cause.

Clearly, the initial root cause evaluation failed to focus sufficient management attention on the project. The second root cause highlighted the misunderstandings between FEMA and 24 By regulation, and in light of the high potential for some localized failures in a system with multiple components in widely dispersed locations, all siren systems require backup means of alerting those in areas where the primary system may fail. This is not a requirement unique to Indian Point.

July 31, 2008 ISE 111

Indian Point Independent Safety Evaluation (ISE)

Indian Point with respect to system requirements, but the emerging issues related to the basic coverage assumptions indicate less than fully effective corrective actions.

Looking at the matter more broadly, and with the benefit of 20/20 hindsight, the EP Team of the ISE Panel notes that a series of errors appears to have been made. They include:

- Selection of a firstofakind system without adequate contingencies

- Poor vendor selection and supervision

- Inadequate project management

- Inadequate contractor support, leading to system design inadequacies and inadequate experience or skill to resolve problems with key components

- Failure to recognize the political sensitivity of interactions with local governments, the public and the media

- Inadequate understanding of system requirements (both the NRC order and FEMA approval specifications)

- Unclear and at times inconsistent criteria established by FEMA for system approval Overall, the entire siren upgrade program was not conducted with the rigor demanded of a regulatory driven major nuclear plant project. In concert with the public sensitivity regarding EP matters at Indian Point, the companys inability to meet this regulatory requirement has both undermined NRCs confidence in the licensee and aggravated Entergys relationship problems with Indian Point stakeholders.

ISE Panel Recommendations, re the Siren Project:

Continue to aggressively address and resolve all siren system operational and reliability issues. This effort demands top management attention and full resources.

Fully consider and evaluate alternatives for backup methods.

Maintain continuing close interactions with all organizations at the county, state and federal level having roles and responsibilities related to the new siren installation and use.

Upon completion of the project, conduct a detailed postproject analysis to develop lessons learned. The review should include:

- Interactions with the regulators (NRC/FEMA)

- Contract management and oversight

- Contract selection process

- Effectiveness of root cause analyses July 31, 2008 ISE 112

Indian Point Independent Safety Evaluation (ISE) 5.6 LongerTerm Considerations for Indian Point Emergency Preparedness Alternate Systems for Alerting the Public Sirens have long been accepted as a fundamentally important element in EP because they can provide fast, simultaneous warning, across the entire EPZ. However, there are inherent limitations in all siren systems. They do not necessarily reach all people in the affected area (particularly many who are indoors at the time) and they convey no information about the event, its severity or the need for public protective action. For this reason the use of supplementary communication tools to alert the full population and provide event information and protective action guidance is important.

There has been encouraging progress in the development and implementation of automated callout systems that support the outdoor warning (siren) system by rapidly notifying the affected public of emerging situations via phone, cell phone and email.

Development of an automated notification system capable of widespread indoor notification is an important next step in improving emergency response effectiveness.

Such methodologies have been considered by Entergy, by the respective EPZ counties and to some extent by the offsite regulators as backup for the siren systems, and over the longer term, as possible alternatives. The Team is hopeful that the siren upgrade project discussed above will increase Entergys and the emergency management organizations interest and attention on application of new notification technologies.

ISE Panel Recommendation, re alternate notification systems:

Continue the work with the counties to put in place an automated alerting system to support the outdoor siren warning system - look to incorporate Code Red/New York Alert and fully integrate existing systems into emergency plans.

Emergency Planning in the Post9/11 Era In August 2002, New York Governor George Pataki commissioned a special investigation into the effectiveness of emergency response to possible attacks on nuclear plants near New York City, to be conducted under the direction of James Lee Witt, former Director of FEMA. Mr. Witt issued his draft report in January 2003 and his final report that March25; both achieved a great deal of notoriety because of their conclusion that current emergency 25 Review of Emergency Preparedness at Indian Point and Millstone - Draft, James Lee Witt Associates, January 2003. Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone, James Lee Witt Associates, March 2003.

July 31, 2008 ISE 113

Indian Point Independent Safety Evaluation (ISE) response capabilities in the Indian Point area could not sufficiently protect the public in the event of a successful terrorist attack at the station.

Public Interest Issue #5: The Witt Report - What is It?

The Witt report is a very broad assessment of all aspects of emergency response. It presents a detailed description of emergency response policies, capabilities, practices and participants. It catalogs the myriad of challenges facing emergency responders including such matters as road and bridge congestion, communications with multilingual public, dealing with a hightransient population (e.g., during normal working hours), shadow evacuation, possible weather issues and the like. These issues are real - nearly all had been long recognized and most are applicable to major incident response everywhere.

Many, but not all, were being actively addressed by emergency response communities in this area and elsewhere.

Contrary to popular perception, the Witt report was not an assessment of the likelihood of a terrorist attack on a nuclear station or of the potential consequences should one occur.

The report itself acknowledges that such an assessment was beyond the scope and capability of the assessors - rather, they simply postulated, without basis, an extraordinarily successful attack (i.e., major plant damage with rapid and severe offsite radiological release), and then evaluated, qualitatively, whether the existing emergency response capability would be equal to the task of protecting the public in such an event.

The Witt report served a valuable purpose of calling attention to the daunting challenges attendant to protecting the public from harm in the event of any cataclysmic event -

whether caused by accident, by natural disaster or by terrorists - and whether it involves a nuclear plant or other industrial facility.

But it sheds little light on the risks associated with terrorism targeted at a nuclear plant.

Following the issuance of the draft Witt report, Entergy convened a task force of outside experts to evaluate the report and recommend corrective actions. The task force issued an initial report in response to the draft Witt report and another in response to the final Witt report. These included recommendations for EP improvements by Entergy in some areas addressed by Witt. The task force has reconvened on several occasions for followup assessment.

As of late 2007, many of the Witt recommendations had been acted upon, at Indian Point and elsewhere. In a broader sense, the nation is becoming ever more effective in recognizing and dealing with outside threats.

July 31, 2008 ISE 114

Indian Point Independent Safety Evaluation (ISE)

Improved Protective Actions In recent years, across the nuclear industry, there has been a growing body of work on developing a more complete understanding of the potential causes, mechanisms and consequences of severe nuclear plant accidents and the steps needed to protect the public if one should occur. To some degree, this is a logical outgrowth of the post9/11 public anxieties about nuclear safety, but it is also a reflection of a maturing industry and a maturing technology. In the United States, with over 100 commercial nuclear units and nearly 40 years of operating experience, there is now a vast knowledge base on which to review and refine the assumptions and projections made decades ago.

Participants in these analyses have included nuclear plant owners or owners groups, manufacturers, industry support organizations - the NRC, the Electric Power Research Institute (EPRI) and the Nuclear Energy Institute (NEI) - and various consulting firms. The work includes several parallel and largely independent studies, and there is growing convergence on their conclusions. The NRC has been a leader of portions of this work and will ultimately decide what conclusions to draw and what actions to take. Entergy has been an active participant in this work, conducting several important evaluations.

Among these, Entergy has been sponsoring a comprehensive examination of the adequacy of the 10mile EPZ around the plant26 and the protective actions planned to be taken in the event of a serious nuclear accident or terrorist event. The work is being coordinated by Entergy, with analyses performed by several consulting firms. The primary objective of Entergys work has been to take advantage of advances in analysis and technology to develop significantly improved strategies, tailored specifically for the Indian Point area, for protecting the public in the event of a nuclear accident/terrorist event.

These evaluations reflect the convergence of several very important technological advances: there is now a much better understanding, based on extensive testing and modeling, of reactor core failure mechanisms; there are better analytical tools to quantify the transport of radioactivity released from a damaged plant through the atmosphere and the effects of weather conditions; there are better tools to project the time it would take to evacuate the public from affected areas and to determine the optimal evacuation paths based on actual road networks; and there are far more effective state police traffic control and communication capabilities than ever before.

This work is still in progress and it is far too early to count on its full success. But results today are encouraging. It now seems quite plausible that with practical and timely public protective actions, even an extreme and extraordinarily unlikely nuclear plant release 26 Ten miles is the standard EPZ radius for commercial nuclear plants, mandated by the NRC.

July 31, 2008 ISE 115

Indian Point Independent Safety Evaluation (ISE) could be sustained with few, if any, public casualties. This is a picture starkly different from widely held assumptions regarding emergency management effectiveness and realistic nuclear accident consequences.

Until any such evaluations are completed, fully vetted and adopted by regulatory agencies, the conservative current assumptions and planned actions will remain in effect and are the basis for the conclusions and recommendations of the ISE Panel. But as the nation deals with energy shortages and looks to new nuclear plants as part of the solution, it is encouraging to know that a very high degree of public protection may be realistically achievable and demonstrable. Success in this area would benefit those in proximity to nuclear plants everywhere, including those near Indian Point.

ISE Panel Recommendation, re nuclear protective action strategies:

Entergy should continue its active engagement in evaluations supporting better understanding of nuclear release events and related development of improved public protective action strategies.

July 31, 2008 ISE 116

Indian Point Independent Safety Evaluation (ISE) 5.7 Indian Point Emergency Preparedness, In Summary Based on its evaluation of Indian Point EP, the ISE Panel concludes that there are serious issues that must be addressed, with significant room for improvement. Areas of concern cover the gamut of stakeholder and public relations, organization and staffing, and facilities and equipment.

First and foremost, EP is an area that demands full and effective interaction among the plant owner/operator, public officials at multiple levels, and the publicatlarge. And it is the most publicly visible of all aspects of nuclear plant operation. For those reasons, a strong and mutually trusting relationship between plant and offsite organizations is essential. In the ISE Panels view, this relationship is not healthy at present and must be improved.

Similarly, the Indian Point equipment and facilities used in emergency response (and particularly those shared by plant and offsite personnel) should be of uniformly high quality, comparable to those of highperforming plants around the country. This is currently not the case. Several Indian Point emergency response facilities, while compliant with regulations, are undersized, and some equipment is old and/or not in good repair.

So far, the siren upgrade project has been a visible failure, and Entergys initial intent to put in place a worldclass system has given way to further erosion of confidence on the part of both regulators and the public. Successful resolution of the remaining siren system technical issues and securing FEMA acceptance are very important and are receiving appropriate levels of Entergy management attention, in the Teams view.

Given the special importance of emergency management at Indian Point, Entergy should strive to achieve and demonstrate bestinclass capability in all aspects of EP at Indian Point.

July 31, 2008 ISE 117

Indian Point Independent Safety Evaluation (ISE)

Section 6: Crosscutting Technical Issues The previous sections in this report address, individually, the Independent Safety Evaluation (ISE) evaluations of Public Interest, Nuclear Safety, Security and Emergency Preparedness (EP) issues. But in a broader sense, the primary interest of the federal, state and local authorities, the plant owners, and the publicatlarge is the overall plant. Is it physically sound? Is it well operated? Does it pose a threat to the people who live nearby?

The four specific areas of ISE review are all important components of this whole plant review. The objective of this section is to examine technical issues that apply to the plant as a whole, rather than to just one of the areas of focused ISE review. And in that way to develop a more complete picture of the Indian Point Energy Center (IPEC).

As an example, this section addresses fire protection - a significant element in all three areas of ISE technical review.

The process employed in the ISE intentionally supported this wholeplant look. Each of the review teams participated with members of other teams in crosscutting review activities

- interviews with plant managers, as an example. And one day of each week during the ISE onsite review period was dedicated to Panel information sharing and group discussion on composite issues and emerging conclusions and recommendations.

6.1 Fire Protection The composite fire protection system that serves the site is very robust, compared to those at most multiunit nuclear power plant sites.

Units 2 and 3 have independent fire protection systems that include automatic detection and suppression by water and/or chemicals in specific areas, as well as pressurized fire mains for each unit. Each unit's fire mains are supplied by one dieseldriven and two motordriven pumps. The location of Unit 2 at the northern end of the site and Unit 3 at the southern end provides physical separation of the pumps. Unlike some multiunit sites, which rely on a shared water supply for firefighting, the independent Unit 2 and 3 systems can be crossconnected so that either unit can supply water to the other, effectively doubling the firefighting capacity of a typical twounit site.

The Fire Brigade As with most commercial nuclear plants, immediate response to a fire onsite is from an internal fire brigade - a cadre of plant workers who are organized, trained, equipped and willing to fight fires. The obvious advantage of using an internal fire brigade is that it is an immediately available 24/7 resource, and that its members are intimately familiar with July 31, 2008 ISE 118

Indian Point Independent Safety Evaluation (ISE) the site, plant systems, plant procedures and implications of firefighting in radiation areas.

However, it is not an organization expected to be able to deal with extreme fire situations.

IPEC Fire Brigade members receive 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> of initial training and an additional 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> of training during the year. They must meet specific requirements regarding individual health and physical conditioning and must be trained and able to properly utilize the equipment available for their use to fight a variety of fire types. IPEC Fire Brigade personnel will be the first responders to any fire and their rapid efforts to fight and control the fire will likely dictate the level of damage sustained by the plant.

The Panel recognizes that the likelihood of an aircraft crash at IPEC is significantly lower than the likelihood of fires for which the Fire Brigade is trained to deal with normally. The IPEC Fire Protection management, however, has proactively undertaken a program of preparedness and training to ensure that the brigade has had familiarization training sufficient to deal with all of the potential fire types that could be expected. This includes the potential of large flammable liquids.

The National Fire Protection Association (NFPA) has established fire protection standards, nationwide; in this regard, their guidelines address the equipment needed to fight all types of fires, as well as the proficiencies expected of its firefighting personnel. IPEC has, likewise, established medical requirements for its Fire Brigade staff, and has implemented an aggressive proficiency program for all of the equipment onsite.

Opportunity for Improvement, re firefighting capabilities:

Verify that the training and qualifications requirements are developed from a site specific Fire Brigade task analysis, and that appropriate NFPA insights are used.

Local Firefighting Support Assistance in extinguishing any fire beyond the capabilities of the stations fire brigade is provided by the Verplanck Fire Department, as confirmed through an agreement of support. The Verplanck fire station is located about onehalf mile from IPEC. Their anticipated initial response time, to include notification, is five minutes. Obviously, as with all volunteer fire departments (VFDs), additional resources will continue to arrive over time. All of the 60 firefighters who man the station at various times are volunteers who live close to the site. All have received NFPAcertified training. The station is equipped with two pumpers and an ambulance.

The Verplanck Fire Department has a mutual aid plan with the Buchanan and Montrose Fire Departments, thereby allowing for additional firefighters and equipment to be able to respond to a call for assistance. Both of these departments are within a threemile radius July 31, 2008 ISE 119

Indian Point Independent Safety Evaluation (ISE) of the IPEC site. Firefighters in all three departments carry beepers, facilitating their rapid response when off duty.

Opportunity for Improvement, re coordinated firefighting support:

Continue actual and tabletop exercises simulating extraordinary firefighting scenarios to maintain proficiency and to improve the knowledge, skills and abilities of both organizations Extraordinary Fire Event Plant Response Through interviews, the team examined the capability of both the Fire Brigade and the local supporting VEDs to deal with extraordinary fire events such as fires involving large quantities of aviation fuel. The Team probed matters such as specific training, familiarity with response techniques such as the various types of foam, source and availability of foam, and the like. The local VFDs are confident in their training and have practiced such techniques. They have worked in concert with the IPEC Fire Brigade and have the necessary tools and materials needed to respond to the gamut of potential fires at the IPEC site.

The equipment needed to fight against such extraordinary challenges is located throughout the site; however, a central location has been established for much of the equipment. The storage of this equipment in a centralized facility allows for easy accessibility, but the Panel notes that if this location were destroyed or made unavailable, then the facilitys response capabilities would be accordingly limited.

Opportunity for Improvement, re firefighting equipment storage:

The centralized storage location could be placed under a more formal security envelope.

July 31, 2008 ISE 120

Indian Point Independent Safety Evaluation (ISE) 6.2 Managing Radioactive Materials An ongoing challenge in the operation of any nuclear facility is the safe handling, protection, packaging and disposal of radioactive wastes. The Indian Point ISE examined two specific issues: (1) the onsite storage of high level waste - spent nuclear fuel - and (2) the implications of future unavailability of a disposal facility for low level waste materials.

Spent Fuel Storage IPEC spent nuclear fuel - that is, nuclear fuel assemblies that have been used in Units 1, 2 and 3 and have expended their useful power producing capability -

are being stored on the IPEC site. This on site storage must continue, until the availability of a federallyprovided central storage facility, a process which has been mired in political, technical and regulatory problems for decades.

Therefore, onsite storage facilities must be demonstrably safe and secure, for an indefinite period. In that sense, the challenge facing IPEC is no different than at any other U.S. nuclear plant.

July 31, 2008 ISE 121

Indian Point Independent Safety Evaluation (ISE)

Public Interest Issue #9: Spent Nuclear Fuel - An Overview The fuel used in commercial nuclear plants like IPEC is in the form of large fuel assemblies.

The actual fuel is enriched uranium, bonded in small ceramic pellets encased in long (approximately 12 feet) tubes of a metal alloy of zirconium - these tubes, or rods, are in turn aggregated in precisely engineered bundles, or fuel assemblies. At any point in time, the IPEC operating reactors each contain 193 such assemblies, each comprising 204 fuel rods.

Through the course of operation in the reactor, radioactive materials called fission products build up in the fuel rods. As a result, at the end of its useful life, each fuel assembly is intensely radioactive. This concentration of radioactivity requires the fuel assemblies to be heavily shielded, to protect workers from high radiation levels, and also to be actively cooled, since the internally generated heat could cause the assemblies to crack or in extreme circumstances to melt, thereby releasing the radioactive fission products to the surrounding cooling water and possibly the environment.

The intensity of the radioactivity and the heat produced by the fuel decreases over time by radioactive decay, reducing both the necessary shielding and the amount of cooling required to protect the fuel. This reduction in heat generation occurs rapidly at first, then more gradually over many years. Following its use in the reactor (normally a fouryear period), the spent fuel is placed in fuel pools onsite for at least five years - at that point, it is cool enough to be stored in specially designed dry storage casks.

All nuclear plants in the United States must store their spent fuel. The U.S. Department of Energy (DOE) had planned to begin taking spent fuel by 1998, but the federal government has failed in this responsibility and is not expected to be ready until after 2017, at the earliest. As individual plants have exhausted their fuel pool storage capability, the U.S.

Nuclear Regulatory Commission (NRC) has licensed dry fuel storage in Independent Spent Fuel Storage Installations (ISFSI). About half of the nuclear plants in the United States, including IPEC, have installed such dry storage facilities - the remaining plants will need to build them in the future.

IPEC has licensed and constructed an ISFSI to serve all three units. The ISFSI has the capacity to store all of the spent fuel created during the lifetime of all three of the IPEC units. If the Unit 2 and 3 licenses are renewed, and absent the government performance, Entergy Corporation will need to license and construct additional ISFSI storage onsite.

At Unit 1, the final 160 fuel bundles from operation are remaining in the unit spent fuel pool at the time of the ISE onsite review (June 2008). Entergy has plans to move all of this July 31, 2008 ISE 122

Indian Point Independent Safety Evaluation (ISE) fuel to drycask storage before the end of 2008. At the end of 2008, the inventory of fuel bundles in the Unit 1 fuel pool will be zero and the inventory in the ISFSI will be 160 in five dryfuel storage modules.

The Unit 2 fuel pool is close to full capacity, storing 1,243 spent fuel assemblies as of June 2008. Entergy plans to load and move nine canisters of fuel (32 fuel assemblies per canister) in the spring and summer of 2009 into dry storage to make pool space more available. After that, the station will fill and transfer three to six canisters every two years.

The fuel pool inventory will be maintained at about 1,000 plus or minus for the foreseeable future.

The fuel inventories at Unit 3 are lower because the plant has not been operating as long as Unit 2. At each refueling outage, 96 or 97 fuel assemblies are added to the fuel pool.

Routine transfers to the ISFSI will be accomplished in the future to maintain the fuel pool inventory at about 1,200 plus or minus. By the end of 2013, there will be 224 Unit 3 fuel bundles stored in the ISFSI (seven canisters).

By 2012, there will be about 576 spent fuel assemblies (18 full casks) stored in the ISFSI awaiting U.S. DOE to take ownership and ship these fuel bundles to the national repository.

July 31, 2008 ISE 123

Indian Point Independent Safety Evaluation (ISE)

Lowlevel Radioactive Waste The IPEC plants, like all nuclear power plants and many other industrial and medical facilities, produce radioactive materials as a part of their normal work and operation.

Lowlevel radioactive wastes are classified as A, B or C wastes, with C having the highest levels of radioactivity. Rags, coveralls, gloves, paper wipes and tools become slightly contaminated as they are used for work in radiologically controlled areas. These lowactivity items are classified as A waste and comprise, by volume, the largest component of plant lowlevel radioactive waste. Plant systems use filters and resins to remove impurities from liquids used in the plant; they are categorized as appropriate among the three waste classifications. The characterization is important, because it dictates the subsequent treatment, processing and disposal, as well as disposal costs for the waste.

Federal law requires the states to form compacts and create disposal sites for Class A, B and C lowlevel waste categories. Three states, New Jersey, Connecticut and South Carolina, have formed the Atlantic Compact and ship their lowlevel waste to a licensed facility in Barnwell, S.C. As of 2008, Barnwell no longer accepts waste from outside the compact states. New York has not created or joined a compact with disposal rights.

Class A waste can continue to be shipped to the Energy Solutions Company treatment and burial site in Clive, Utah. However, there are currently no disposal sites for Class B and C wastes available27. For that reason, IPEC, like all other plants, must store its Class B and C waste onsite.

IPEC and other nuclear plants are constantly working on methods and procedures to reduce waste generation and volume. These efforts will continue with added impetus.

Onsite storage of waste has been in practice at nuclear plants for decades. IPEC will need to do so until other options for processing or burial are available. Disposal methods for Class B and C wastes are currently being developed by two companies, Energy Solutions and Studsvik. The latter is partnering with Waste Control Specialists in Texas, and proposing to take ownership of the waste, consolidate it and store and/or bury it at the Texas facility. Entergy considers this approach to be viable and is following it closely.

27 There are other waste storage facilities currently in operation or planned, but none yet available to IPEC.

There is a site in Richland, Wash. that accepts these higherclass waste products, but is only receiving waste from nine Western states plus Alaska and Hawaii. These nine states are located in the Northwest and Rocky Mountain Compacts. The Texas Compact includes Texas and also Vermont. Waste Control Specialists has planned a disposal facility in Texas, but it is not yet licensed and it is not clear whether it will accept waste from outside the Texas Compact. Another company is planning to negotiate with the Texas Compact to accept waste it collects and process waste from plants outside the Compact states.

July 31, 2008 ISE 124

Indian Point Independent Safety Evaluation (ISE)

In the interim, the waste will remain onsite in the Interim Radwaste Storage Facility. This facility is a concrete building, measuring 97 feet by 108 feet, and designed and built for this purpose. It is a reinforced concrete structure with walls and roof designed to provide necessary radiation shielding. The facility was built to all of the NRC and U.S.

Environmental Protection Agency (EPA) applicable standards and regulations.

The waste in this facility is stored in the same types of containers that have been used for safe shipment from the site to disposal facilities for many years. Resins from the plant systems that remove radioactive constituents from water in the plant are mostly Class B and C wastes and are stored in the concrete transportation casks used for transport by truck to treatment or storage sites discussed above. Lowerlevel Class A waste is stored in 55gallon drums, which are also used for shipment of this waste. The facility is sufficient to store the waste for many years as the waste storage issues are resolved and additional storage capacity can be added onsite if needed.

The ISE Panel concludes that the storage of lowlevel radioactive waste at IPEC meets federal regulations, is technically sound, and does not pose a threat to the environment or the public. Entergy is actively exploring options for disposal of this waste so that protracted storage at the IPEC site is not necessary, although the ultimate solution to this problem involves broader regulatory and political issues that Entergy alone cannot resolve. In the interim, management of these wastes must continue to be careful and proactive.

Also, the Panel notes that a 2007 earthquake in Japan caused some tipping and leakage from drums of lowlevel waste. While IPEC continues to be able to ship Class A waste for offsite burial, if future circumstances dictate storage of quantities of 55 gallon waste drums in the interim storage facility, it may be prudent to consider banding or other means of support for these drums.

More detail on lowlevel waste storage at IPEC is provided in Appendix 3.

Radioactive Contamination Potential - In Soils, Groundwater, the River The leakage of radioactivity from the IPEC plants into the ground, and the possible migration of that radioactivity to the Hudson River or to offsite soils or groundwater has been a matter of high public concern for years. In particular, the radioactive isotope, tritium, has been detected in water samples from monitoring wells on the plant site and traced to water leakage from IPEC spent fuelpools and from underground piping.

Public Interest Issue #6: Tritium in Groundwater - A Safety Issue?

The tritium contamination detected on the IPEC site does not and cannot pose any public health threats, on or offsite. Tritium is very different from most radioactive isotopes in July 31, 2008 ISE 125

Indian Point Independent Safety Evaluation (ISE) several important ways. It emits only lowenergy beta radiation, too weak, in fact, to penetrate human skin. And because it is a variant form of hydrogen, usually found in the form of tritiated water (H2O with some of the hydrogen atoms replaced with tritium atoms) and behaves chemically and physically just as water does, there is no way for it to concentrate in the human body. For that reason, the EPA permissible levels of tritium in drinking water is much, much higher than for any other radioisotope.

Tritium is hard to contain - its very small atomic structure (again, like hydrogen) allows it to migrate easily through plastics, rubber and some metals. For that reason, while undesirable, it is not uncommon for there to be detectable tritium levels at nuclear plant sites. But given the obvious public sensitivities regarding radioactive contamination of any sort, all U.S. plants, including I, have committed to inform local, state and federal authorities of an unplanned release even if it is below the threshold required to report to the NRC.

The levels of tritium detected on the Indian Point site are quite low and the doses from tritium are an insignificant percentage of allowed values. But their presence in groundwater is nevertheless important because it is an indicator - a tracer - of problems with piping or structural integrity.

Entergy has taken and is taking several actions - transferring of spent fuel from the Unit 1 pool to dry storage casks and repairing the Unit 2 pool to stop its leakage. Further, the Panel has recommended inspection or testing of affected underground piping.

Release to the environment of radioactivity of any kind, and in any quantity, must be taken seriously. And in examining this issue, the ISE Panel concluded that it is being taken seriously at IPEC, with thorough and effective corrective actions. See previous parts of this section, Section 3 and Appendix 3 for additional details.

July 31, 2008 ISE 126

Indian Point Independent Safety Evaluation (ISE) 6.3 Indian Point Vulnerability To Terrorist Attack From the Air For every New Yorker, the knowledge that on September 11, 2001, two hijacked commercial airliners flew over IPEC en route to their World Trade Center targets raises the obvious and terrifying question: what if the hijackers had chosen one of the IPEC reactors as their target?

The potential for, and consequences of airborne terrorism - using hijacked airliners as weapons, as on 9/11 - is among the most common of public concerns regarding IPEC. For that reason, the ISE Panel studied that issue in more depth than any other single public interest issue. It is a multidimensional issue that includes considerations of security, nuclear safety system and plant structural design, and firefighting and other emergency response measures.

The Panels evaluation of the potential for and consequences of a 9/11 type attack on IPEC followed a methodical, faulttree logic - and unlike conventional risk assessments, it assessed aspects of the hypothetical attack even if they were considered improbable enough to be of no concern. The stepwise elements of evaluation were as follows:

Element Lines of Inquiry

1. Potential for a successful terrorist What measures are in place to prevent a successful hijack of a commercial airliner hijack? Would they be effective?

2. Potential that the aircraft could strike a If hijacked, is it likely or even possible for the airliner to vital part of the plant be flown into one of the IPEC containment buildings, fuel pools or dry fuel storage facility?

3. Consequences of a large aircraft impact If the hijacked aircraft were successfully flown into a on the containment building containment building, would it penetrate the structure?

Would it damage the reactor or other vital equipment inside the building?

4. Consequences of a large aircraft impact If the hijacked aircraft were successfully flown into a on the fuel pools spent fuel pool, would it cause the pool to fail? Would the ensuing fire cause the fuel to overheat? Could adequate fuel pool cooling be maintained?

5. Consequences of a large aircraft impact If the hijacked aircraft were successfully flown into the on dry fuel storage dry fuel storage facility, would the impact or the ensuing fire cause the fuel canisters to fail?

6. Other direct or indirect consequences Would the combination of direct impact of the crashing aircraft or the ensuing fire cause sufficient damage to vital plant systems to cause significant radioactivity release to the environment?

July 31, 2008 ISE 127

Indian Point Independent Safety Evaluation (ISE)

The Panels investigation into these issues included extensive discussions with Entergy personnel with expertise in the above areas, interviews with outside experts and review of numerous technical assessments by outside organizations. Regarding the latter, there has been a great deal of industry, NRC and scientific community sponsored testing and analysis of the capability of safety structures to withstand the effects of an aircraft crash.

Some of this work is classified and some available for public review. ISE Panel members had access to both classified and unclassified work.

Participants in the ISEs aircraft impact evaluations included members of each of the four teams, the cochairs and staff members.

Potential for a Hijacked Airliner to Strike an Indian Point Safety Structure From a security standpoint, the first lines of defense against an airborne attack on the IPEC are the responsibility of federal and state agencies, far from the IPEC. While assessment of these governmental and other nonsite factors is beyond the ISE scope, they form an important part of the overall risk assessment and therefore are included here, in summary form.

In order for terrorists to hijack and then succeed in crashing an aircraft into the IPEC facility, there would need to be a collective failure of all of the barriers - regulatory, procedural, institutional and societal - which stand in the way of such an event. These include:

Multiple terrorists would have been able to avoid detection by federal, state and local law enforcement agencies to plan a coordinated attack, to acquire the weapons they need to take over the aircraft, and to penetrate airport security.

The terrorists would have to successfully wrest control of the aircraft from its crew and successfully resist the opposition of one or more sky marshals, if aboard, and of perhaps 100 determined passengers. (Evidence from United Flight 93, the apprehension of shoebomber Richard Reid, and the widespread recognition that the pre 9/11 tactic of passive acceptance by airline passengers of hostile acts in the air strongly suggests that this is unlikely.)

Federal Aviation Administration (FAA) Air Traffic Controllers, who continually monitor the adherence of aircraft to authorized flight patterns, would have to have been ineffective in detecting the airspace violation and mobilizing the interdiction capabilities now in place.

July 31, 2008 ISE 128

Indian Point Independent Safety Evaluation (ISE)

The terrorist hijackers would then have to successfully maneuver and control their large aircraft near the ground at a high rate of speed, in the difficult terrain surrounding IPEC, and score a direct hit on a target (an IPEC reactor containment or fuel pool) that is tiny by comparison with the World Trade Center. This would be an extraordinary feat of airmanship.

None of the above defenses involve the IPEC security forces. They are outside of the scope of this ISE and their effectiveness is difficult to quantify. But they are nonetheless central to protection of IPEC from a terrorist attack from the air. The reasonable conclusion is that the potential for the crash of a hijacked airliner into a critical safety structure at IPEC is extraordinarily low.

Crash Analysis The exceedingly low probability of occurrence notwithstanding, the ISE Panel nonetheless conducted an extensive evaluation of the consequences of such an event, should it occur.

To explore the consequences of a large aircraft crash, however unlikely, the ISE Panel studied four separate scenarios involving plane impact and jetfuel fire damage on plant July 31, 2008 ISE 129

Indian Point Independent Safety Evaluation (ISE) structures and equipment. A Boeing 767, fully loaded with fuel and travelling at a ground speed of 350 mph, was assumed. (While smaller craft may be more maneuverable and therefore more capable of striking the site buildings, the mass and fuel load are less and the consequences are bounded by the use of the large aircraft.)

The evaluation considered the implications of crashing of this aircraft into the Unit 2 or 3 containment buildings, the Unit 1, 2 or 3 fuel pools, the dry spent fuel storage facility or safetyrelated equipment needed for safe shutdown and cool down of the two reactors.

Each of these is discussed in the following paragraphs.

Containment Building The walls of the IPEC containment buildings are constructed of reinforced concrete of thicknesses varying from 31/2 to 41/2 feet. This concrete is reinforced with layers of large (most are 21/4 inches in diameter) welded steel bars. The critical areas of the containment building are located at the lowest level of the building where the concrete walls are the thickest. The wall surfaces are all curved, adding substantial strength in comparison to flat surfaces. The buildings are completely lined, on their interior surfaces, with welded steel sheets. They are airtight and leak resistant, and are regularly inspected and pressure tested.

Public Interest Issue #30: Containment Structure Integrity A public concern has been identified that questions the integrity of the containment structure based on the watertocement ratio used in the concrete for the IPEC containment buildings. The concern is that the strength and durability (aging) of the concrete could be affected.

Visual inspection of the concrete for signs of cracking and spalling are required by the American Society of Mechanical Engineers (ASME) Section 11 IWL Code and are performed regularly. The structural integrity of the buildings and its leak tightness are regularly verified by testing. The buildings were pressurized to 54 pounds per square inch (psi) (115 percent of the accident rating) - Unit 2 was tested in March 1971 and Unit 3 in January 1975. Integrated leak rate tests are performed periodically to pressurize the containment buildings to 47 psig and measure total leakage. During these tests, the building expands several inches and the concrete is therefore expected to experience minor cracking due to the physical growth of the structure. Visual inspections are performed during and following the test to observe for unexpected cracking or spalling of the concrete. The last tests were performed on Unit 2 in 2006 and on Unit 3 in 2005 with no structural concerns identified. More details on this issue are contained in Appendix 3.

July 31, 2008 ISE 130

Indian Point Independent Safety Evaluation (ISE)

Numerous tests and analyses by research organizations conclude that the large commercial aircraft and turbojet engines in use today would not penetrate a containment structure like that at IPEC, even on a direct hit at 350 mph. Structural integrity and leak tightness of the buildings would be maintained. Furthermore, the energy of impact would be absorbed by the structure, causing only minor movement, and would not dislodge or damage equipment on the interior of the building.

Spent Fuel Storage Spent nuclear fuel removed from the IPEC reactor cores at the end of its useful life for power production is relocated to spent fuel pools. The fuel is vertically stored in racks at the bottom of the pools. These pools are full of water - normally to a level of about 23 feet above the top of the fuel. The water provides both cooling and shielding, allowing workers to function at the surface of the pool with very lowdose levels.

Unit 1 spent fuel pools contain the last of the Unit 1 fuel assemblies which have been decaying for decades. The Unit 1 fuel is still radioactive, but no longer has sufficient energy to pose an overheating problem even if cooling water were lost - the air surrounding the fuel would provide adequate cooling. The pools in Unit 1 are completely below ground level and all of the fuel in Unit 1 pools will be removed before the end of 2008. For these reasons, the ISE Panel did not consider aircraft impact on the Unit 1 pool to be a significant problem.

The Unit 2 and 3 fuel pools are constructed of sixfeetthick reinforced concrete walls similar in construction to the containment walls (flat, but much thicker), and the inside of the pools are lined with a continuous welded stainless steel barrier. The bottom half of the pools, where the fuel is stored, is below grade except for about onethird of one wall on Unit 3, which is above a depression in the ground.

Except for the aboveground portion of the Unit 3 pool, impact of an aircraft on the lower pool walls where the fuel is located is impossible; a strike on that very small and low portion would be nearly impossible since other buildings, transmission lines and terrain are in the way. Furthermore, analyses have shown that the aircraft impact could not penetrate that thick wall.

The Panel also considered the potential from damage of a direct hit on the fuel pool from above. An airframe or large jet engine could not penetrate the heavily reinforced wall separating the truck bay from the pool itself, and the aircraft and/or engine falling directly on top of the pool would cause a large July 31, 2008 ISE 131

Indian Point Independent Safety Evaluation (ISE) water wave which could displace up to nine inches of water. Furthermore, the water would slow the speed of the falling mass such that it would be unlikely to cause damage to the racks or the fuel. (The analysis shows it causes no damage.)

In such an event, the water remaining would provide sufficient fuel cooling, provided that cooling circulation could be restored or the boiledoff water could be replenished. The Panel examined multiple scenarios of pool and equipment damage, and concluded that the time requirements (many hours, even under the highest fuel loading scenarios) and technical challenges of doing so are manageable.

Based on the multiple generic and IPEC analyses, it is highly unlikely that any fuel damage or significant release of radioactivity would result, even if an aircraft were to strike the aboveground portions of any of the IEPC fuel pools.

Dry Fuel Storage Spent fuel taken from a fuel pool is stored in 2inch thick stainless steel cylinders welded shut on both ends. This canister provides a leakproof shell around the fuel and acts as a heat transfer surface for keeping the fuel temperature within a safe range via conduction of the heat energy from the fuel to air passing over the canister surface. The canister also provides some radiation shielding.

The canisters are stored on an outside concrete pad, surrounded by a substantial concrete shield structure (or overpack) which reduces external dose rate to very low levels. The combination of the canister and overpack are known as the HOLTEC HiStorm 100S Version B system which is specifically licensed for this purpose by the NRC. This is a very robust package. The canister enclosing the fuel is about six feet in diameter and 16 feet high, and the shield is about 11 feet by 19 feet. Together, the assembly weighs about 140 tons. While the fuel is generally old and its thermal content is low, the level of radioactivity in a fuel cask is significant.

Analyses demonstrate that the overpack and fuel canister can survive a direct hit from a large aircraft engine at high speed (350 mph) without any penetration of the fuel canister and, therefore, without any leakage of radioactive material. In some cases the dry fuel module could be dislocated horizontally and can crash into adjacent modules, or the module may be tilted or turned on its side. But in no case is the fuel canister penetrated or breached so there are no radiological consequences to the public around the site.

July 31, 2008 ISE 132

Indian Point Independent Safety Evaluation (ISE)

Jet Fuel Fires A large airplane crash onsite would almost certainly cause a very large fire fed by the aircrafts fuel. In considering this very unlikely event, the ISE Panel assumed the full load of fuel of the most dominant (more than 85 percent) commercial aircraft used in the United States. The fuel was assumed to start a large fire at different locations on the site and, the impact from each fire was reviewed in terms of its effects on makeup water and cooling to the reactors and fuel pools.

The IPEC plant site is hilly and the storm drain design routes water to low spot drains which empty into the Hudson River. Due to the assumed speed of the crash, the fuel would likely spread over a large area in the direction of impact. The resultant fire could be expected to cover a large area on the ground, as well as inside any structures breached by the aircraft. But it is unlikely that large amounts of fuel would accumulate in any one place, and, therefore an intense fire could not sustain itself for long. The IEPC site is equipped and prepared to battle fuel fires. It is expected that such a fire could be extinguished by the site forces - which are well equipped to deal with fuel fires - in a matter of a few hours at most. This analysis took no credit for offsite fire department assistance which would surely arrive in that time frame.

Because of the structural capability of the containment buildings, no fire inside these buildings is considered credible. A fuel fire outside the containment structures (and the fuel pools) would affect the concrete walls of those buildings, but the thick concrete provides sufficient structural protection and insulation to prevent wall penetration or extensive interior damage.

Other buildings were considered in terms of the impact of a massive fuel fire. While it can be expected that there would be very substantial equipment damage, the robust and redundant nature of the installed safety systems makes it very unlikely that core damaging consequences would ensue. Furthermore, IPECs redundant and robust fire protection system is expected to function adequately in these circumstances.

Conclusion, re Aircraft Impact Given structural design and configuration of the IPEC containment buildings and fuel storage facilities, the redundancy and separation of accident mitigation systems, the design and redundancy in fire protection, the capability of onsite firefighting and emergency response, and the availability of offsite support systems, the Panel concludes that the probability of a large aircraft part striking the buildings with nuclear fuel inside and causing a significant release of radioactivity is extremely low, to the point of being noncredible.

July 31, 2008 ISE 133

Indian Point Independent Safety Evaluation (ISE)

Section 7: Management, Ownership and Financial Issues Beyond the crosscutting technical issues discussed in the previous section, there are several very broad nontechnical issues that are germane to the overall health and safety of the Indian Point Energy Center (IPEC) station as well as to its political and public acceptability. These include such diverse matters as public relations, Entergy Corporations (Entergy) corporate structure and management policies, and near term and long term financial viability of the station.

7.1 Relations with Public/Stakeholders Constructive interactions with the public and government officials are important for any large industrial facility, and particularly so for facilities that pose possible public health and safety implications. In the context of nuclear energy these relationships are challenged by attitudes, politics and perceptions - or in some cases misperceptions - regarding nuclear energy.

At Indian Point, there is an unusually strained relationship between the stations owner/operator and the stakeholders and public. Indian Point seems to inspire advocacy, among both ardent supporters and strident critics. In the Panels view, such polarization is a major obstacle to achieving progress on the issues that matter to both sides.

The people who run Indian Point take their jobs very seriously. They know their plant provides a vital service to the New York area. They are acutely aware of the importance of safe operation and they see themselves as hardworking, dedicated and very capable professionals. They are proud of what they do and they are consequently often dismissive of criticism from media and the public.

On the other hand, some in the public who live near Indian Point fear nuclear power and are suspicious of its owners. They frequently hear rumors (some true) about problems in the plant and they have no way to separate fact from fiction or to view the facts in perspective. While some recognize the value of the plant as an electricity provider for the greater New York City area, they believe themselves to be saddled with the lions share of the risk for a disproportionately small share of the benefit.

This polarized and politicized environment can be very frustrating to Entergy management. However, this frustration does not relieve Entergy of the need to continue to attempt to interact constructively with state and local officials and the public. Indeed, it argues for an even greater effort to overcome the perception of some in the region who feel that the plant is run by a distant, unsympathetic landlord. Entergy appears to July 31, 2008 ISE 134

Indian Point Independent Safety Evaluation (ISE) recognize this and has taken some positive steps, but it has learned the hard way that earning trust is a very difficult and ongoing task.

The Independent Safety Evaluation (ISE) Panel offers observations regarding several aspects of this relationship issue:

Community Entergy is a generous donor to local organizations and receives ample credit for this from most local officials. Further, the new Indian Point leadership is encouraging plant employees to become actively involved in community roles such as local boards, charitable organizations and notforprofits. The Panel understands that consideration is being given to crediting such community participation activities in employee job performance reviews, an action that would clearly communicate management's endorsement. Also, Entergy has been working to educate local business persons about the economic importance of the plants to the region. It actively participates in business and networking organizations, which helps build local relationships and facilitates the company's ability to work with community leaders.

Public Face As described in Section 3 of this report, the physical appearance of the plant to the public is poor and requires significant improvement. This is especially true in light of the plants location in one of the most beautiful and environmentally sensitive parts of the region. Many people choose to live in this region as much because of these attributes as its proximity to New York City, and their attitudes about the station reflect these values.

Corporate Presence Indian Point, in Westchester County, N.Y., is owned and controlled by a corporation in New Orleans, La., more than 1000 miles away. While the plant has taken numerous, creative steps to increase its corporate presence, such efforts must be ongoing and consistent. The Panel suggests that Entergy and senior plant management host public meetings on a regular basis. This has been successful for other troubled nuclear facilities in putting a human face on the corporation for people in the region. It creates an environment for communications outside of controversial issues such as relicensing.

NRC/IPEC Relationship There is a perception among many, particularly those who oppose the Indian Point plants politically, that the Nuclear Regulatory Commission (NRC) is an unduly gentle regulator. One manifestation is granting of July 31, 2008 ISE 135

Indian Point Independent Safety Evaluation (ISE) waivers by NRC to IPEC, viewed by some as official sanction of a violation or a shortcut around safety or other important requirements. In examining specifics in this area, the Panel concluded that requests for variances have been generally consistent with industry practice and regulatory provisions.

Even so, plant management should be sensitive to the fact that these waivers reduce confidence in the management and safety of the plant and weigh this against the benefits of requesting a waiver.

Emergency Preparedness As noted in Section 5, effective Emergency Preparedness is heavily dependent upon cooperation and communications between the plant owner/operator and local, state and federal officials. It is the Panels view that Emergency Preparedness is the area of Indian Points poorest performance. Entergy should consider increasing the number of personnel in EP along with should carefully select the individuals to serve in these positions based on qualifications and capability. Also, Entergy should clarify the process for locality requests for EP funding and significantly upgrade the emergency response facilities and equipment it provides for company and outside party use.

July 31, 2008 ISE 136

Indian Point Independent Safety Evaluation (ISE) 7.2 Entergy Ownership and Management As a rule, fleet ownership of U.S. nuclear plants has proven to be beneficial to both owners and plants.

Successful nuclear operating companies like Entergy offer proven practices and processes, extensive operating experience and timely technical support, a supply stream of seasoned managers, layers of oversight and other sources of strength to their operating plants. At Indian Point, there has been dramatic improvement in the performance of both units, by many measures, since the acquisitions early in this decade. As an example, station capacity factors and forced outage rates28 have improved from near the bottom of the industry to levels typical of highperforming U.S. nuclear plants. It is the collective experience of the Panel that there is strong correlation between operational stability and safety. It is very reasonable to conclude that Indian Point is a safer plant now than when initially acquired by Entergy.

Clearly there are aspects of Entergy ownership that merit close scrutiny. The recent announcement of the Entergy corporate restructuring, now under review by two state public utility commissions, including New York's, is a good example. This is a complex change, and while it may prove financially beneficial to the corporation, its effect on Indian Point (if any) is not yet fully understood. Also, the stakeholder relationship issue discussed earlier in this section is influenced in a very real way by the absentee owner concern held by some in the public. This places additional burden on the plant owners to maintain a strong and constructive relationship with public and stakeholders.

28 Capacity factor is the quotient of actual electrical energy generated by a plant divided by the total electrical energy could have generated, usually averaged over a oneyear period. Thus, a plant operating at full power for a full year would have an annual capacity factor of 100% for that year. Forced outage rate is the quotient of the electrical energy lost due to forced, unplanned outages divided by the total electrical energy that the plant could have generated usually averaged over one year that the plant. Both are standard industry measures of plant performance.

July 31, 2008 ISE 137

Indian Point Independent Safety Evaluation (ISE)

Plant Funding Ongoing funding of capital improvements, operations and maintenance is central to the safety of a nuclear facility. Several public officials expressed concerns about the level of funding of the plant, particularly since inception of the corporate alignment and fleet programs.29 Of greater concern, however, was that these issues were also raised by some senior Entergy personnel and union leaders at the plant.

While there seemed to be general agreement that items involving nuclear safety were adequately supported by Entergy, some suggested that the company has not funded the Indian Point plants in a way that recognizes the unique issues these plants face, including their age, value, location and cost of labor.

To ascertain whether overall Entergy funding for Indian Point is adequate, the Panel reviewed cost and staffing data for all similar plants (dualplant Westinghouse 4loop designs) in the U.S. over the past 10 years. From this review, the Panel found that since Entergy acquired IPEC:

Operating and maintenance costs have decreased to levels typical of similar plants.

Capital costs have fluctuated and have settled to levels typical of similar plants.

Staffing has decreased to levels typical of similar plants.

On that basis, the Panel concluded that while greater resources could and perhaps should be provided by Entergy in some areas given the unique circumstances of IPEC, the resources being provided are in line with that of similar U.S. plants.

Decommissioning Fund All nuclear power plants are required by NRC regulations to collect money and put it in escrow to fund the endoflife decommissioning of the radiologically contaminated parts of the plant. The question is often asked whether that funding and its growth will be adequate to accomplish the decommissioning project.

29 The potential funding implications of the proposed nuclear spinoff are discussed later in this Section.

July 31, 2008 ISE 138

Indian Point Independent Safety Evaluation (ISE)

The schedule and annual contributions to each plants decommissioning fund are dictated by law and regulation30. The funds are required to be conservatively invested so that the fund is constantly growing. Annual contributions plus interest result in a fund that is growing much faster than inflation. Periodically each company revises the forecast for decommissioning cost at the end of the projected useful life of the plant. Projections of the value of the fund are then compared with the projected cost to ensure the fund will be adequate. Eventually the fund is large enough, as defined by NRC regulation, that annual contributions are no longer needed and interest alone will create a fund adequate to pay for decommissioning.

The decommissioning funds for all three Indian Point units are already funded to the level that no longer requires contributions. Escalation of 3 percent is assumed and a rate of earnings of 5 percent is also assumed. The estimates of the current fund amount (as of December 2007), the decommissioning cost, and the fund balance projected to the middle of the decommissioning project are shown in the table below for each IPEC unit:

Indian Point Decommissioning Funds31 (Millions of dollars)

Current (12/2007) Decommissioning Projected Fund Fund Balance Cost Estimate Balance at Decommissioning Unit 1 271 413 420 Unit 2 347 500 539 Unit 3 468 529 801 In each case, the current fund is adequate to produce a balance in the middle of the decommissioning range using the inflation rate and investment rate of earnings.

The ISE Panel notes that the assumed inflation rate and rate of earnings are typical of what is used in similar analyses at other nuclear plants. In addition, it is evident that the decommissioning funds for each Indian Point nuclear unit are adequate to pay for the decommissioning of the unit at the end of its licensed life.

Corporate Restructuring The ISE Panel examined Entergys recently announced corporate restructuring plan. In essence, this restructuring involves separation of the Entergy regulated nuclear plants 30 10 CFR 50.75.

31

Reference:

Entergy Report to the NRC, Decommissioning Fund Status Report, May 8, 2008.

July 31, 2008 ISE 139

Indian Point Independent Safety Evaluation (ISE) from its unregulated (merchant) plants, by setting up two new separate corporate entities.

Concern has been raised from public officials and others as to the financial soundness of Enexus - the name of the new entity being formed - once it is spunoff from Entergy. The concern is focused primarily on the ability to finance needed capital improvements and to sustain a firsttier nuclear operation. Entergy has made a number of presentations to financial analysts which suggest that it was contemplating putting $4.5 billion dollars of debt on the new nuclear company. The Panel has interviewed the senior officials at Entergy as well as examined public documents provided by Wall Street analysts.

The ISE Panel concludes that Enexus will have sufficient capital to operate and continue to invest provided that Entergy takes a conservative approach regarding the amount of debt put upon this new company at the time of the spinoff. In this regard, the Panel recommends that the spinoff be structured in such a way as to ensure the financial soundness of the nuclear company, and hence the safe operation of Indian Point, in the future. A prudent amount of debt will reassure various regulators and the general public in this regard.

Comments have been made about the possibility of Enexus debt being rated below investment grade. Based on discussions with financial experts, the Panel is convinced that a standalone nuclear energy company is not likely to get an investment grade rating regardless of the underlying health of its finances. The Panel is persuaded that the correct standard is financial strength to assure capital investment and industryleading performance.

July 31, 2008 ISE 140

Indian Point Independent Safety Evaluation (ISE) 7.3 Workforce Issues Staffing - meeting current and future resource needs The nuclear industry generally is facing significant challenges with respect to attracting and maintaining a skilled workforce. Just as the industry is gearing up to develop new nuclear generating facilities, in the next five years up to 19,600 nuclear workers - 35 percent of the workforce - will reach retirement age.32 Across the country, nuclear owners are aggressively recruiting employees with significant signing bonuses and attempting to compensate for attrition through retention packages.

These challenges are exacerbated at Indian Point for several reasons. The plant's location in the expensive real estate market that serves as a key bedroom community of New York City translates into either high housing costs or significant commutes for Indian Point employees. The location also means that the plant must be competitive with other salaries in the region, which are among the highest in the country. Furthermore, the very visible political opposition to Indian Point and attendant uncertainties regarding plant re licensing, and employee concerns regarding Entergys corporate restructuring are also factors in attracting and retaining Indian Point's skilled workforce. Attrition unrelated to the Entergy Alignment Process (Alignment) is an ongoing, and indeed increasing, problem for the plant.

It appears that Entergy has begun to appreciate the magnitude of this challenge and to apply significant management attention to it. It is addressing these workforce issues from both an Entergy and an IPEC perspective that provides perhaps a strong example of the benefits that a fleet approach can bring to a complex problem with both short and long term dimensions.

Entergy has recently approved a workforce planning program that applies to its licensed operators, with the expectation that it will eventually be applied to nearly the entire workforce33. Key features of this program are:

The capability to extend onthespot hiring offers (contingent on appropriate background checks) which enable recruiters to move swiftly when viable candidates are identified.

Permissible overstaffing. Starting next year, budgets will include sufficient resources to temporarily exceed authorized staffing requirements in order to stay ahead of projected attrition.

Phased Retirement. Several programs are being established in order to encourage operators to retain experienced services to Entergy beyond 32 Marianne Lavelle. A Worker Shortage in the Nuclear Industry U.S. News and World Report 13 March 2008 :

p. 2.

33 An exception may be the Security Department, because the pool of security candidates is generally robust.

July 31, 2008 ISE 141

Indian Point Independent Safety Evaluation (ISE) normal retirement dates, including the availability of parttime employment, the ability to return as a consultant and "role change" training.

Advanced Planning Tools. Entergy is working with new computer models that are capable of projecting staffing requirements under varying circumstances.

Partnership with New York colleges and universities to develop programs and to attract candidates for a future generation of skilled nuclear employees.

There are additional steps that may be considered as well, such as additional flexibility in setting salary schedules to reflect regional differences and rapidly changing economic circumstances.

With respect to the short term issues, Entergy is taking immediate measures to better understand and deal with the situation. These include:

Revision to the exit interview process to include outside consultants who aggregate data on an anonymous basis. This approach is believed to facilitate more candid input from departing employees.

Collecting and trending reasons and motivations cited by departing employees Engagement with industry via benchmarking and national working groups Financial retention programs While Entergy's proposed workforce plan appears to be innovative and forward thinking, it is not yet clear that it can adequately address the potentially serious staffing issues facing Indian Point, both in the short term and the long term. For it to succeed, sufficient resources must be allocated by Entergy for retention purposes, and employees must have confidence that these programs have full corporate support. In the Panels view, this is essential if Entergy hopes to compete with the programs being offered by other nuclear owners for valued employees.

July 31, 2008 ISE 142

Indian Point Independent Safety Evaluation (ISE) 7.4 Employee Concerns In several ISE Panelists interviews with public officials, mention was made of increased incidents of "whistle blowing" over the past year. The officials speculated that this increase was due to a decreased confidence in Indian Point's management by employees and/or a lack of confidence in the usual avenues available to employees when they have a complaint. The allegations were nonspecific, but the mere fact of that perception prompted examination by the Panel.

The three primary avenues for employees to raise concerns at Indian Point, like other nuclear facilities, are:

Normal management channels Employee Concerns Program (ECP)

Nuclear Regulatory Commission In 2006, the NRC issued an inspection report34 which noted that there was a lack of confidence in the confidentiality maintained by the ECP, which may have had a chilling effect with respect to the use of the program. The NRC requested Entergy to provide a plan to address this issue, which it filed in 2007.35 In addition to review by the NRC, Entergy hired outside consultants to review its plan and conducted surveys to determine employees' familiarity with, and confidence in, the ECP. These studies and surveys indicate that employees who have utilized the program since the NRC reports believe that the program maintains confidentiality, although some employees who have not utilized the program remain skeptical regarding confidentiality. It is reasonable to conclude from these surveys that this lack of confidence arises from previous breaches, as opposed to ongoing failures.

Entergy appears to appreciate that building and maintaining confidence in the program and its confidentiality requires an ongoing effort and support from management both in terms of resources and corporate tone.

Regarding resources, Entergy has authorized the use of outside firms to investigate ECP complaints and has funded an educational program to increase awareness of the availability of the program. With respect to management tone, it has taken several actions intended to ensure that personnel actions do not constitute retaliation and that all plant decisions are made in such a way as to support a safe and ethical environment. These include:

Employee meetings to discuss safe work environment concepts 34 "Indian Point Nuclear Generating Units 2 and 3 Problem Identification and Resolution Inspection Report Nos. 05000247/2006006 and 05000286/2006006 and NRC Request for Response." December 21, 2006.

35 "Plan to Address the Safety Conscious Work Environment at the Indian Point Center." January 22, 2007.

July 31, 2008 ISE 143

Indian Point Independent Safety Evaluation (ISE)

Management training regarding methods to detect and prevent retaliation in the workplace In summary, Indian Point has made impressive progress in remedying the issues raised by the NRC in 2006. However, the maintenance of an open, ethical environment where employees are confident to raise concerns, particularly regarding plant safety and security, will remain a challenge while the company continues to go through dramatic structural changes. Meeting this challenge is absolutely vital to the safe operation of Indian Point.

July 31, 2008 ISE 144

Indian Point Independent Safety Evaluation (ISE) 7.5 License Renewal On April 30, 2007, Entergy submitted to the NRC its application to extend the operating licenses of Indian Point Units 2 and 3. Since then, the renewal process has been underway and the public hearing is ongoing. A number of issues have been raised by members of the public and the state of New York and are currently in contention.

U.S. Industry Practice, re Nuclear plant License Renewal License Renewal is an NRC regulatory process available to owners of operating nuclear plant licensees, by which they can seek to extend the useful life of their plant(s).

Regulatory requirements, guidance and process are provided in the United States Code of Federal Regulations, 10 CFR Parts 51 and 54, and other NRC guidance documents.

The process is a plantspecific review of the potential nuclear safety and environmental implications of licensed operation for an additional 20 years beyond the plants initial (usually 40year) licensed lifetime.

The primary areas of interest in the NRCs evaluation of license renewal applications are the safety and environmental impacts of continued operation. Much of the safety review focuses on the impact of aging on the plants structures, systems and equipment. Generic research and analyses has been done to measure and predict the aging of plant components, particularly those related to the safe operation of the nuclear plants. Each licensee is required to apply the results of this work and conduct specific analyses to demonstrate that the plant can be safely operated. Each licensee must also create a monitoring program for the life of the plant to confirm that aging components continue to meet their safety design and purpose.

Through 2007, 49 nuclear units have been granted licenses for 20year license extensions, and 14 more have license renewal applications in process, including Indian Point Units 2 and 3. The process typically takes 22 to 30 months. Members of the public can and do raise concerns about the potential regulatory approval and can request a public hearing to resolve these concerns. The NRC Atomic Safety and Licensing Board (ASLB) is accountable for resolution of issues raised in the process, including those raised in public hearings.

The ISE Charter excludes IPEC license renewal as an element of the Panels scope. The ISE was intended to examine the current health of the plant, not its suitability for extended licensed operation.

The Panel takes no position on the efficacy of renewing the Indian Point 2 and 3 operating licenses.

July 31, 2008 ISE 145

Indian Point Independent Safety Evaluation (ISE)

Section 8: Principal Conclusions and Recommendations From the entirety of its work - the evaluations by the Nuclear Safety, Security, Emergency Preparedness and Public Policy Teams, and its composite plant assessment - the ISE Panel has reached several principal conclusions.

ISE Conclusions There are two overarching principal conclusions:

1. Indian Point is a safe plant.

The Panel found that Indian Point nuclear safety meets the U.S. nuclear industry highest standards in most respects. Indian Point nuclear operations are conducted competently and professionally, plant safety systems are well maintained, reliable and are backed with full resource commitment by the plant owner. Control Room operations - a key indicator of plant nuclear safety culture - were observed frequently by the Nuclear Safety Team and other ISE Panelists and found to be consistently professional and effective. Indian Point management, at all levels, is clearly attentive to nuclear safety.

2. The Indian Point relationship with public and stakeholders on matters of emergency preparedness is not healthy.

Public protection from a sizable radiological release from a nuclear reactor - whether caused by natural disaster, accident or terrorism - is by law a shared responsibility among federal, state and local authorities, with defined support by plant personnel.

Effective public protection therefore demands close cooperation and communications, and in turn joint planning, preparation and practice. Most importantly, it must be founded on mutual respect and trust among all participants.

The Panel found numerous indicators that a sufficiently respectful and trusting relationship between Entergy/Indian Point and public/stakeholders is not in place today.

And the Panel has drawn additional principal conclusions:

3. The Indian Point emergency response facilities and equipment do not meet high industry standards.

July 31, 2008 ISE 146

Indian Point Independent Safety Evaluation (ISE)

Both the Indian Point Emergency Operations Facility (EOF) and the backup EOF, although compliant with regulatory requirements, are undersized and would be sub optimal for extended use in a major emergency. Other Indian Point emergencyuse facilities and equipment, on and offsite, are inadequate in some respects.

Communications and other equipment used by these facilities is dated and in many cases difficult to use or unreliable.

In an actual emergency, public safety would depend on effective use of these facilities, by Entergy personnel and public officials, under very trying conditions. The ISE Panels view is that these facilities and equipment should be upgraded to meet top standards.

4. Security at Indian Point is strong in many respects, but has some shortcomings.

The ISE Security Team found the Indian Point security force to be welltrained, proficient and professional. The IPEC Security organization has developed sound strategies for dealing with a range of possible security threats including some scenarios well beyond those that the plant is required to prepare for by regulation.

However, there is inadequate staffing (and resultant excessive overtime work) in some security functions, and some security systems and equipment are old and difficult to maintain.

5. The physical condition of the plant in nonsafety areas is visibly deficient.

While station personnel pay close attention to the care, maintenance and operation of plant safety systems, the care and maintenance of some other plant systems and structures do not meet the standards of highperforming plants. Also, the external visible condition of the plant is poor in many respects. While these have no direct bearing on safe operation of the plant, it is the Panels view that the maintenance and preservation of noncritical plant systems, equipment and structures is important because it communicates to employees and the public alike the owners and operators commitment and professionalism.

6. The new leadership team at the station is strong, and morale and attitudes among workers are distinctly positive.

Nuclear power plants are operated by people. The capability, dedication and attitudes of the staff affect every aspect of plant safety and performance. And while these are intangibles and difficult to assess, the ISE Panel was favorably impressed in its extensive interviews and observations of plant personnel.

The station senior management team is experienced, capable, energetic and well respected. This is a relatively new team, and its long term effectiveness remains to be seen, but it exhibits the strengths central to successful and safe operation. Similarly, July 31, 2008 ISE 147

Indian Point Independent Safety Evaluation (ISE) the ISE Panelists found Indian Point workers to be welltrained, professional and positive about their jobs. Also noteworthy is the mutually respectful and constructive relationship between union and station management.

It is the Panels judgment that the caliber of Indian Point staff is very good, consistent with highperforming plants.

7. The station is facing potentially critical staffing shortages.

The Panel found staffing issues, of different kinds, in several areas. The combined effects of several factors an aging IPEC work force, high cost of living in the U.S.

Northeast, internal corporate changes at Entergy and a very competitive hiring climate in nuclear specialty areas around the country is already affecting Indian Point hiring and retention and portends even more serious future challenges. Particularly critical needs are foreseen in licensed nuclear operators, technicians, and EP personnel.

Entergy and IPEC have formulated ambitious plans to deal with this situation, but it is not yet clear that they will be adequately implemented and ultimately successful.

8. Station effectiveness in work management and project management needs improvement.

The processes of work management and project management - the planning, preparation and execution of the myriad of daytoday tasks and longer term projects necessary to keep the plants running smoothly and safely - is not as effective as at most highperforming plants. Inadequacies in these areas are considered by the Panel to be a contributing factor to many of the observed problem areas at Indian Point -

poor execution of the siren system replacement project and the backlog of maintenance work are two key examples and are an impediment to lasting station improvement. The pace of improvement has been unnecessarily slow.

9. Change Management at Indian Point is important and should be improved.

In recent years, the Indian Point workforce has been deluged with change - new ownership of both plants, integration of previously separated Unit 2 and Unit 3 functions, adoption of new Entergy standards and procedures and significant plant software modifications, as examples. The steps taken to plan for and accommodate these changes, and particularly to prepare and train the workforce, have been inadequate in some respects, with ripple consequences in station performance. Better implementation of change management processes is needed.

July 31, 2008 ISE 148

Indian Point Independent Safety Evaluation (ISE)

10. Acquisition by Entergy has affected Indian Point in many ways - most of them good.

Fleet ownership of nuclear plants has proven to be beneficial to both owners and plants. Successful nuclear operating companies like Entergy offer proven practices and processes, extensive operating experience and timely technical support, a supply stream of seasoned managers, layers of oversight and other sources of strength to their operating plants. At Indian Point, there has been dramatic improvement in the performance of both units since the acquisitions early in this decade. As examples, plant capacity factors and forced outage rates have both improved to levels comparable to highperforming U.S. plants, and in the experience of the Panel, there is strong correlation between a plants operational stability and its safety. It is very reasonable to conclude that Indian Point is a safer plant now than when initially acquired by Entergy.

On the other hand, there are aspects of Entergy ownership that merit close scrutiny.

The recent announcement of the Entergy corporate restructuring, now under review by two state public utility commissions, is a good example. This is a complex change, and while it may prove financially beneficial to the corporation, its effect on Indian Point (if any) is not yet known.

Applying these 10 principal findings to the central ISE evaluation criterion of judging Indian Point relative to highperforming nuclear plants and other facilities, the Panel concludes that the comparison must be drawn separately in each of its three primary areas of evaluation, as follows:

In nuclear safety, Indian Point performance is good, and compares favorably to highperforming plants in most aspects of nuclear safety.

Indian Point security compares favorably to highperforming U.S. nuclear plants in a number of areas, but needs upgrading in others. The ISE Panel judges Indian Point security to meet the highest standards of international nuclear facilities and to be superior to most complex nonnuclear U.S.

industrial facilities.

Emergency Preparedness at Indian Point requires improvement. The relationship and interaction between EP station personnel and local, county and state officials is not healthy, and the emergency response facilities and equipment provided by Entergy, while compliant with regulatory requirements, are inadequate in some respects. Indian Point emergency July 31, 2008 ISE 149

Indian Point Independent Safety Evaluation (ISE) preparedness clearly does not meet the standards of highperforming U.S.

nuclear plants.

With respect to its public and stakeholder interactions, Indian Point is uniquely challenged - compared to all other U.S. nuclear stations - because of its location and political visibility. Entergy/Indian Point management has not been sufficiently proactive in dealing with this unique challenge.

Principal Recommendations In the course of its examinations, the Panel identified numerous recommendations and areas for improvements. These are presented throughout the report, in each applicable section. From these, the Panel has derived eight principal recommendations, including two overarching recommendations that relate to the plant as a whole, and six additional major recommended actions, as follows.

Overarching principal recommendations that affect the viability of the entire station:

1. Investment commitment as needed to achieve and maintain top levels of safety, security and emergency preparedness at Indian Point Entergy must continue its financial commitment to accelerate visible, meaningful and convincing improvement to the station. The Panel acknowledges the progress already made, but given the history of the station, its national visibility, its precarious position in terms of public and political acceptance, its importance to the New Yorks supply of electrical power and its financial value to its owner, Entergy must commit to achieving unequivocal excellence.

2. Aggressive, proactive communication and outreach Maintaining a strong, mutually respectful and trusting relationship between the company and the community is central to long term viability of the station. This relationship is not healthy today - it must be rebuilt, and Entergy must take the lead in making that happen. The Panel recommends that Entergy and IPEC executives commit to a structured process of continuing proactive and frequent interactions with the surrounding communities, including both private citizens and local officials. While resourceintensive, such an initiative could be very effective in replacing the distant, faceless owner with a personal and (over time) familiar contact.

Other principal ISE recommended actions include:

3. Comprehensive upgrade of Emergency Response Facilities and equipment July 31, 2008 ISE 150

Indian Point Independent Safety Evaluation (ISE)

As detailed in Sections 5 and 7, The Panel strongly recommends nearterm, significant upgrades to the Entergyprovided emergency response facilities and equipment, including:

- Emergency Operations Facility (both main and backup) replacement

- Technical Support Center and Operations Support Center upgrades

- Joint Information Center upgrade

- Substantial equipment upgrades, including the offsite Notification System (RECS), Low Band Radio, satellite phones and the Plant data system.

Additionally, the Panel recommends that Entergy consider and act upon, as appropriate, reasonable requests from the counties for EP financial support. And as part of this action the company should establish a clear and consistent process for dealing with requests for EP resources and support.

4. Aggressive staffing actions The Panel notes the encouraging plan of action to address immediate and potential longerterm critical staffing shortages at IPEC. However, Entergys corporate commitment to effective implementation of this comprehensive staffing plan remains to be seen. The Panel urges close management attention to this action plan.

As a related matter, the Panel recommends immediate action to restore the EP staff positions that were eliminated as part of aligning Indian Point with Entergys corporate structure. These positions support daytoday offsite interface with county EP organizations and are important to both EP effectiveness and the Entergy relationship with the offsite EP personnel. The reductions in these positions had the unintended consequence of undermining stakeholder trust and confidence in Entergy, just at the time it was most important to strengthen their relationship.

5. Security improvements The Panel recommends a number of improvements and enhancements in Security equipment, in order to improve reliability, maintainability and effectiveness of these systems. Items needing upgrading include the plant entrance, Central Alarm Station (CAS) and Secondary Alarm Station (SAS), the Access Authorization system and the fence line/barrier.

6. Station cleaning and preservation A major sitewide campaign is recommended to accelerate cleaning, painting or removal (as appropriate) of deteriorating nonsafety exterior features such as the containment ventilation ductwork and plant stack. This work is needed to properly July 31, 2008 ISE 151

Indian Point Independent Safety Evaluation (ISE) reflect overall station quality and to convey to workers and the public Entergys commitment to care and protection of their workplace.

Relationship with the Public On a plane above the specific conclusions and recommendations previously summarized, the ISE Panel is compelled to call attention to the unusually polarized relationship between the Indian Point owner/operator and the larger public. Indian Point seems to inspire strong advocacy among both its ardent supporters and its strident critics. In the Panels view, such polarization is a major obstacle to achieving progress on the issues that matter to both sides.

July 31, 2008 ISE 152

Indian Point Independent Safety Evaluation (ISE)

Looking to the Future As directed by its charter, the ISE Panel has conducted an intensive investigation into what is at Indian Point - an important, but largely static determination of the plants current health and the degree to which it could be considered a threat to the surrounding public. Consistent with its standard of independence, the Panel consciously attempted to minimize its reliance on past investigations and in that way to avoid adopting past biases, pro or con.

On the other hand, no large scale industrial operation is truly static. It can be said that every operation is either in a state of improvement or decline. In that context, the nuclear industry, including both NRC and INPO, places high importance on the ethic of continuing improvement and on measuring and addressing plant performance trends.

In the course of its review, the ISE Panel developed many insights into the direction of Indian Point performance. It found evidence of declining performance in some areas, particularly in the relationships between company/plant management and public/stakeholders, as discussed in several parts of this report. It also found refreshing examples of positive trends. For example, Panelists were uniformly impressed with the upbeat, enthusiastic attitudes and professionalism of plant personnel. Similarly, actions being taken to address the short and long term staffing issues, and early improvements in project management practices were instructive indicators.

On balance, the ISE Panel believes that Indian Point is headed in the right direction. Mr.

Richard Smith, Entergy President and Chief Operating Officer, advised the Panel that Entergys intent is to make Indian Point one of the nations best run and best performing nuclear plants. That is a lofty goal, but Entergy has demonstrated at other stations that it is capable of achieving high performance, and the Panel finds no reason why that cannot be achieved at Indian Point.

July 31, 2008 ISE 153

Indian Point Independent Safety Evaluation (ISE)

In Closing This report presents the results of an extensive and highly unusual assessment of Indian Point. It was performed by a highly qualified Panel, and it reflects their objective and independent evaluation of the station. It considers the gamut of technical, institutional and public policy issues germane to Indian Point safety, security and emergency preparedness as well as crosscutting technical and management matters affecting the plant as a whole.

The Panel finds that there is need for improvement in a number of areas. And while Indian Point performance is excellent in some respects, the plant as a whole cannot fairly be characterized - in the Panels judgment - as one of the U.S. highperforming plants. On the other hand, the Panel found no example of plant or performance problem at Indian Point that is not realistically fixable, and is confident that the station and its owners have the capability and the willingness to make the needed corrections.

In that sense, Entergys objective of taking Indian Point to bestinclass status is achievable

- but only with unwavering commitment and additional significant investment.

The Panel presents its report with the hope that it will guide future actions by Entergy and it will contribute in a meaningful way to decisions by company and public officials regarding the future of the station.

July 31, 2008 ISE 154

Indian Point Independent Safety Evaluation (ISE)

Acknowledgements The Panel acknowledges the contributions made by the professional staff for their dedicated and thorough work supporting the Panels evaluation of Indian Point and the development of this report: John C. DeVine, Jr., Thomas M. Crimmins and James E.

Bouchard.

Mr. DeVine is a cofounder of Polestar Applied Technology, Inc., now a subsidiary of WorleyParsons LTD, where he works with Mr. Crimmins and Mr. Bouchard. A former nuclear utility executive, he has assessed operational and managerial effectiveness at nuclear power plants in the U.S. and has led independent assessment teams for government spent fuel management and deactivation and decommissioning of government facilities.

A former CEO of BNFL, Inc., Mr. Crimmins has had extensive experience in all facets of nuclear power. He served as plant manager and chief engineer for the Susquehanna Nuclear Power Plant and vice president of nuclear engineering for Public Service Electric and Gas.

Mr. Bouchard has more than 20 years of nuclear engineering and project management experience. He has worked on major nuclear projects for Progress Energy and Northrop Grumman, following his 12 years of service in the U.S. Navy.

July 31, 2008 ISE 155

Indian Point Independent Safety Evaluation (ISE)

Appendix I: Indian Point Independent Safety Evaluation Panel Biographies Cochairs James T. Rhodes Neil E. Todreas Nuclear Safety William Kane T. Gary Broughton Elmer J. Buzz Galbraith Clayton Scotty Hinnant Emergency Preparedness Cristine McCombs Martin Vonk Security Harvey Stevens Kenneth Brockman Public Policy John S. Dyson Maureen Helmer July 31, 2008 ISE 1

Indian Point Independent Safety Evaluation (ISE)

James T. Rhodes, CoChair Dr. James T. Rhodes serves as cochair of the Indian Point Independent Safety Evaluation Panel. He is a trained nuclear engineer and respected utility executive with more than 40 years of experience in the energy industry.

He currently serves on the board of directors of Duke Energy Corporation, one of the nations largest nuclear utilities, where he is chairman of the Nuclear Oversight Committee. Rhodes also serves on the Electric Power Research Institutes Advisory Council. He has served on the boards of the Institute of Nuclear Power Operations (INPO),

the organization that promotes excellence in the operation of nuclear power facilities, as well as the Nuclear Energy Institute, Virginia Electric & Power Company, Dominion Resources Inc., Edison Electric Institute, Southeastern Electric Exchange, Virginia Manufacturers Association, NationsBank N.A., Richmond Renaissance and Greater Richmond Partnership.

Rhodes served as president and chief executive officer of Virginia Electric & Power Company in Richmond, Virginia, from 1989 to 1997. He served as chairman, president and chief executive officer of INPO from 1998 to 2001. Rhodes began his career as a project engineer in the U.S. Army nuclear power program and was employed by Martin Mariettas nuclear division.

Rhodes earned a Bachelor of Science in physics from North Carolina State University, a Master of Science in nuclear engineering from Catholic University and a Ph.D. in nuclear engineering from Purdue University, where he was an Atomic Energy Commission Fellow.

July 31, 2008 ISE 2

Indian Point Independent Safety Evaluation (ISE)

Neil E. Todreas, CoChair Dr. Neil E. Todreas, cochair of the Indian Point Independent Safety Evaluation Panel, has spent nearly 40 years as a member of the nuclear engineering faculty at the Massachusetts Institute of Technology, one of the worlds leading engineering institutions. He is a renowned expert in thermal and hydraulic aspects of nuclear reactor engineering and safety analysis.

Todreas is currently the Korea Electric Power Corporation professor of nuclear engineering and professor emeritus of mechanical engineering at MIT. From 1981 to 1989, he headed the MIT Nuclear Engineering Department. Since 1975, Todreas has been co director of the MIT Nuclear Power Reactor Safety summer course, which presents current issues of reactor safety significant to an international group of over 30 nuclear engineers each summer in a single week course. Todreas began his professional career with nine years of service with the U.S. Atomic Energy Commission, the first four as a naval officer in the headquarters of the naval nuclear power organization.

Todreas has served on the nuclear energy advisory committees of the U.S. Department of Energy, the U.S. Nuclear Regulatory Commission, several DOE national laboratories including Idaho National Lab, Los Alamos National Lab, Argonne National Lab and Brookhaven National Lab, as well as on utility industry review committees and international scientific review groups. He is a member of the National Academy of Engineering and has served on several of their National Research Council study panels.

Todreas holds bachelors and masters degrees in mechanical engineering from Cornell University and a doctorate in nuclear engineering from MIT. He is the author of three books on nuclear reactor energy extraction and safety features.

July 31, 2008 ISE 3

Indian Point Independent Safety Evaluation (ISE)

William Kane, Nuclear Safety William Kane, a private consultant, heads the Nuclear Safety effort of the Indian Point Independent Safety Evaluation Panel. Kane brings more than three decades of nuclear safety engineering and regulatory experience to the task.

Kane retired from the Nuclear Regulatory Commission in November 2007, after 34 years of government service. He had most recently served as deputy executive director for reactor and preparedness programs. In that capacity, he oversaw the Office of Nuclear Reactor Regulation, the NRCs four regional offices, the Office of New Reactors and the Office of Nuclear Security and Incident Response.

From March 2001 to June 2003, Kane was the NRCs deputy executive director for reactor programs, responsible for licensing, inspection and incident response for safety, security and emergency preparedness for all reactor programs. From September 1999 to March 2001, he was director of nuclear materials safety and safeguards, in charge of licensing, inspecting and performing environmental reviews of all materials and waste activities regulated by the NRC.

Kane began his long career with the NRC as a project manager. Over the years he served in several other capacities, including associate director of inspections and programs for the Office of Nuclear Reactor Regulation, director of the Spent Fuel Project Office, deputy regional administrator of Region I in King of Prussia, Pennsylvania, and director and deputy director of the Division of Reactor Projects in Region I.

Kane is a registered Professional Engineer and a member of the American Nuclear Society and the Cal Beta Pi Association. He earned a Bachelor of Science in mechanical engineering in 1961 from Widener University in Chester, Pennsylvania, and completed graduate work in nuclear engineering at Catholic University in Washington, D.C.

July 31, 2008 ISE 4

Indian Point Independent Safety Evaluation (ISE)

T. Gary Broughton, Nuclear Safety T. Gary Broughtons nuclear power experience ranges from serving in the U.S. Navys nuclear submarine force to investigating the accident at Three Mile Island (TMI).

He is former president and chief executive officer of the nuclear subsidiary of General Public Utilities Corporation, GPU Nuclear, where he oversaw operations of all nuclear facilities in the GPU system, including Oyster Creek Nuclear Generating Station and TMI.

Broughton served for eight years at TMI as plant manager and vice president, with direct contact with neighboring communities through a Citizens Advisory Panel.

Broughton was a member of the GPU team that investigated the TMI2 accident, and he served as secretary to a team of experts from outside the nuclear industry to identify best practices for training, procedures and human factors engineering. Broughton was involved in making changes in these areas at TMI Unit 1 prior to returning that unit to operation, and later at Oyster Creek.

Before joining GPU in 1976, he served for 10 years in the U.S. Navys nuclear power program.

Broughton currently volunteers as an income tax preparer in the AARP TaxAide program and coordinates electronic filing activities for the state of New Jersey.

Broughton earned a bachelors degree in mathematics from Dartmouth College.

July 31, 2008 ISE 5

Indian Point Independent Safety Evaluation (ISE)

Elmer J. Buzz Galbraith, Nuclear Safety Elmer J. Buzz Galbraith has extensive experience in evaluating nuclear energy organizations and providing critical feedback that improves performance. He has a successful track record on improving problem areas and starting new organizations.

From 1996 to 2007, Galbraith served as senior assistance representative and team manager at the Institute of Nuclear Power Operations. As team manager, he oversaw plant evaluation teams that conducted evaluations at nuclear power stations.

Galbraith is also a 20year veteran of the U.S. Navy. From 1961 to 1981, he served primarily on nuclear submarines, attaining the rank of commander and serving as commanding officer of the USS Ray (SSN653), a nuclear attack submarine.

He coordinated the development of a comprehensive completion plan for a single unit boilingwater reactor, which contributed to a highly successful startup. He also managed organizations at two different nuclear power stations which achieved significant performance improvement in all areas.

A 1961 graduate of the U.S. Naval Academy, with a Bachelor of Science in engineering, Galbraith also completed the Senior Reactor Operator Equivalency Training Program conducted by Westinghouse Electric Corporation on the standard nuclear unit power plant system pressurizedwater reactor.

July 31, 2008 ISE 6

Indian Point Independent Safety Evaluation (ISE)

Clayton Scotty Hinnant, Nuclear Safety Clayton Scotty Hinnant has nearly four decades of experience in managing nuclear power plants. He recently retired from Progress Energy as senior vice president of nuclear generation and chief nuclear officer, after 35 years of service. In that role, he oversaw all aspects of the companys four nuclear generating plants, as well as security, and nuclear engineering and services.

In 1972, Hinnant joined Progress at the Brunswick Nuclear Plant near Southport, North Carolina, where he held several positions in the startup testing and operating organizations. He left Progress Energy in 1976 to work for Babcock and Wilcox in the Commercial Nuclear Power Division, returning to Progress Energy in 1977. Since that time, he served in various management positions at three of Progress nuclear plant sites.

Hinnant has experience in nuclear power plant design, construction engineering, operation and management of both pressurizedwater and boilingwater reactors. Before joining Progress, Hinnant worked for Newport News Shipbuilding as an electrical design engineer on naval nuclear reactors.

Hinnant is an electrical engineering graduate of North Carolina State University, with post graduate credits in business administration from Christopher Newport College and the College of William and Mary. He also attended the Progress Energy Management Institute at the University of North Carolina at Chapel Hill School of Business, and the Executive Business Management Program at the University of Michigan School of Business.

July 31, 2008 ISE 7

Indian Point Independent Safety Evaluation (ISE)

Cristine McCombs, Emergency Preparedness Cristine McCombs brings a depth of experience in managing emergency preparations to her role as leader of the Emergency Preparedness team for the Indian Point Independent Safety Evaluation Panel. In January 2004, she was appointed Director of the Massachusetts Emergency Management Agency (MEMA) by Governor Mitt Romney, becoming the first woman in the history of the Commonwealth to head this particular agency. During McCombs tenure, Massachusetts became only the eighth state to receive full accreditation from the Emergency Management Accreditation Program and one of only 10 states to achieve the highest grade level from the U.S. Department of Homeland Securitys Nationwide Plan Review. As director, McCombs oversaw the emergency planning in the emergency planning zone communities surrounding three nuclear power plants near cities and towns in Massachusetts.

Beginning with the impact of Hurricane Bob in 1991, McCombs provided federal and state disaster assistance in her role as MEMAs Disaster Recovery Manager. She has served as the state coordinating officer for 12 presidential disasters and seven state declared disasters. She has also been directly responsible for all aspects of fiscal monitoring of federal and state disaster grants, including Housing and Urban Development, Federal Emergency Management Agency and Hazard Mitigation Grants. Additionally, McCombs developed the interagency strategy for administration of the Commonwealths mitigation programs with the Department of Conservation and Recreation.

McCombs responsibilities with MEMA included: leading the MEMA Team, composed of federal, state, and local, public, private and volunteer agencies and organizations; serving as chairperson for the State Emergency Response Commission; and acting as Region I vice president for the National Emergency Management Association (NEMA), chairperson for the Northeast States Emergency Consortium and chairperson for the NEMA Legislative Committee.

In 2006, she was selected as one of the 40 emerging state leaders from across the nation to participate in the prestigious Henry Toll Fellowship Program, sponsored by the Council of State Governments. She was also the recipient of the Clara Barton Humanitarian Award from the American Red Cross for her work with Hurricane Katrina evacuees.

McCombs received an associates degree in general studies from Mount Ida College.

July 31, 2008 ISE 8

Indian Point Independent Safety Evaluation (ISE)

Martin Vonk, Emergency Preparedness Martin Vonk specializes in emergency preparedness support services, guided by his 13 years of experience in the U.S. Navy and nuclear power utility sector. He currently provides consultant services to a variety of nuclear utilities.

From February 2003 to July 2007, Vonk was a senior emergency preparedness specialist for the Nuclear Management Company, responsible for oversight of nuclear power plant emergency preparedness programs at six utility sites. From March 2003 to December 2003, Vonk was the emergency preparedness contractor for the Institute of Nuclear Power Operations, responsible for the pilot program for oversight of industry preparedness operations.

From 1995 to 2002, Vonk was emergency preparedness manager at Commonwealth Edison/Exelon Nuclear, where he held corporate management responsibility for radiological emergency preparedness for the multisite nuclear power utility. He interfaced with utility, county, state, federal and industry representatives for the emergency preparedness program and managed integration of radiological emergency preparedness programs through the merger of Commonwealth Edison, Philadelphia Electric Company and AmerGen sites.

He has previously held a Senior Reactor Operators License issued by the NRC.

Vonk began his career as a submarine officer in the U.S. Navy, serving from 1974 to 1979.

After that, Vonk served as generic issues licensing administrator and senior environmental health physicist at Commonwealth Edison.

Vonk received a Bachelor of Science from Michigan Technological University and a Master of Business Administration from Governors State University in Park Forest, Illinois.

July 31, 2008 ISE 9

Indian Point Independent Safety Evaluation (ISE)

Harvey Stevens, Security Harvey Stevens brings over 25 years of professional experience as a program manager, physical security specialist, security engineer, and law enforcement/public safety telecommunications specialist to his role as leader of the Security evaluation effort for the Indian Point Independent Safety Evaluation Panel. He has an extensive technical background in security engineering and possesses international experience in vulnerability and risk analyses, threat assessments, expert witness work, special operations/low intensity conflict, counterterrorism, counterdrug/counternarcotics, biological/chemical warfare mitigation, and emergency action and evacuation planning.

Stevens is currently president of Stevens Associates Inc., a technology firm that specializes in technical and engineering support to government and industry. He is a director of APEX Security Consultants, based in the United Arab Emirates, and he currently provides consulting services in Dubai for privately owned islands, palaces and some of the tallest buildings in the world.

Previously, Stevens served as the physical security consultant for 29 Port Authority of New York and New Jersey facilities and managed the acquisition of some of the most modern and complicated security installations available. As a lead technical practitioner he was responsible for providing specialized technical support to public safety enforcement programs in the areas of tactical communications, information security, and command and control. This support included the conduct of feasibility studies and analyses, assessment of applicable technologies, conduct of threat and vulnerability assessments, and analyses and general programmatic support of law enforcement and public safety initiatives.

More specifically, Stevens managed, conducted and prepared facility vulnerability studies to identify areas of vulnerability to sabotage and terrorist attacks. He reviewed construction designs and plans for new facilities, and modifications to existing facilities, ensuring that adequate security defenses and countermeasures were included.

Stevens was certified as a Protection Professional in 1985 and has maintained that certification. He served as a member of the American Society for Industrial Security Standing Council for Physical Security from 1993 to 2006, and has been a member of the Education Subcommittee since 2007. Stevens is a Protection Partners International Alliance Member and a member of the International Association for Counter Terrorism &

Security Professionals.

He graduated from Adelphi University with a Bachelor of Science in communications science/management and received a Ph.D. from Pacific University.

July 31, 2008 ISE 10

Indian Point Independent Safety Evaluation (ISE)

Kenneth Brockman, Security Kenneth Brockman has 29 years of experience in nuclear power security and safety and emergency response. He is an independent consultant, President of MEM, LLC and a Senior Nuclear Safety Consultant at Talisman International, LLC. Brockman also recently completed a tour in a senior diplomatic position as the director of the Division of Nuclear Installation Safety for the International Atomic Energy Agency (IAEA) in Vienna, Austria.

In this capacity, he was responsible for the development of international standards for safety and security that are being applied at nuclear reactor and fuel cycle installations throughout the world.

From 1995 to 2002, Brockman was the director of the Division of Reactor Projects, Region IV for the Nuclear Regulatory Commission (NRC), where he managed the inspection and assessment program related to safety and security for the 21 commercial nuclear power reactors in the western United States.

From 1993 to 1995, as the senior executive manager for the NRCs emergency response organization, Brockman coordinated the NRCs response program for nuclear emergencies with those of the rest of the federal government and managed the operations center that serves as the 24 hourperday communications link between the NRC and its licensees.

During this time, he oversaw the construction of, and subsequent move into, the new operations center in Rockville, Maryland. Brockman joined the NRC in 1984 as a license examiner in the agencys Atlanta region. He subsequently served in the NRC headquarters as a senior regional coordinator on the staff of the executive director for operations and as a technical assistant for NRC Chairman Ivan Selin.

He has been recognized in many capacities, most notably by the president of the United States with the Meritorious Rank Award, and as a member of the IAEA when it was awarded the 2005 Nobel Peace Prize.

Brockman holds a Bachelor of Science in general engineering from the U.S. Military Academy. He also completed postgraduate studies in nuclear engineering with the Bettis Atomic Power Laboratories and holds a masters degree in public administration from The American University.

July 31, 2008 ISE 11

Indian Point Independent Safety Evaluation (ISE)

John S. Dyson, Public Policy John S. Dyson brings 21 years of public policy experience and six years of nuclear operations experience to the Indian Point Independent Safety Evaluation Panel. He currently serves as the chairman of Millbrook Capital Management and is the founder and chairman of MMI Investments, a hedge fund focused on small capitalization valuebased equity investment.

Dyson served parttime in the Giuliani administration from 1996 to 2002 as chairman of the Mayors Council of Economic Advisors. In this role, Dyson worked on economic issues affecting the city following the September 11th terrorist attacks on the World Trade Center.

In 1994, Dyson was appointed as deputy mayor of New York City by Mayor Giuliani. As deputy mayor, Dyson was in charge of economic development and finance for the city. He served as deputy mayor until 1996, when he returned to private life.

In 1979, Governor Hugh Carey appointed Dyson Chairman of the New York Power Authority, which runs a series of power plants throughout New York State. Dyson was retained as NYPA chairman by Governor Mario Cuomo and served at NYPA until 1985.

Under his leadership, NYPA made significant investments and operating improvements in Indian Point Unit 3. Dyson served in New York state government for a decade, including four years in the cabinet of Governor Carey. In April 1975, Governor Carey appointed Dyson as Commissioner of Agriculture and Markets. In December 1975, Dyson was appointed to serve as Commissioner of Commerce, which put him in charge of economic development and tourism.

From 1975 to 2001, Dyson was an appointee of the Governor of New York on the Board of Trustees of Cornell University.

Dyson is an alumnus of Cornell University and holds a masters degree in public affairs from the Woodrow Wilson School of Public and International Affairs at Princeton University.

July 31, 2008 ISE 12

Indian Point Independent Safety Evaluation (ISE)

Maureen Helmer, Public Policy Maureen Helmer spent more than 25 years in New York State government in various positions involving energy policy. She is currently a member of Green & Seifter Attorneys, PLLC, practicing in the areas of energy and telecommunications law, corporate and professional ethics, business regulation and the New York legislature.

Helmer is the former chair of the New York State Public Service Commission (PSC), which she led from 1998 to 2003. She also served as chair of the New York State Board on Electric Generation Siting and the Environment.

She served as PSC commissioner from May 1997 and was general counsel from January 1995 through May 1997. Helmer led the PSC during a time of sweeping change in the telecommunications and energy industries. She played a leadership role in increasing coordination between New York and its neighboring U.S. and Canadian Independent System Operators and was a vocal advocate for enhancing regional reliability.

While serving as Chair of the PSC, Helmer also served as a board member of the New York State Energy Research and Development Authority, the New York State Environmental Board and the New York State Disaster Preparedness Commission. She was vice chair of the Electricity Committee of the National Association of Regulatory Utility Commissioners (NARUC) and was a member of the NARUC Board of Directors. Helmer was appointed to serve on the U.S. Department of Energys Electricity Advisory Board, and she has also served as a member of the New York State CyberSecurity Task Force.

Prior to her positions with the PSC, Helmer served in staff positions with the state legislature, including Counsel to the Senate Energy Committee, and the State Commission of Investigation, where she led several investigations related to corruption in the construction industry.

Helmer earned a Bachelor of Science degree in economics from the State University of New York at Albany and a Juris Doctorate from the University of Buffalo School of Law.

July 31, 2008 ISE 13

Indian Point Independent Safety Evaluation (ISE)

Appendix 2: Charter An Independent Safety Evaluation of Indian Point An independent safety evaluation is planned to be conducted at the Indian Point Energy Center (IPEC) early in 2008. This Charter defines the objectives, scope, panel structure and composition, evaluation process and deliverables for this important effort, and will serve as an operational framework and guideline for the independent safety evaluation panel (from here forward to be referred to as the independent panel).

The ISE, in Summary The Indian Point independent safety evaluation is to be a thorough andobjective assessment of the IPEC. It will examine a range of nuclear safety and plant performance factors, with particular attention to matters of importance to those who live and work near the station, including plant security and emergency management.

Although sponsored by the Entergy Corporation, the IPEC owner and licensee, this evaluation will be an independent effort conducted by a blue ribbon panel - a diverse team of highly credible, independent, experienced, knowledgeable and capable examiners.

The evaluation shall be completely separate from the plant assessments conducted regularly by the Nuclear Regulatory Commission (NRC), the Institute for Nuclear Power Operations (INPO) and by Entergy. While the evaluation may employ similar review methods in some instances and it will complement and supplement those reviews, it is nonetheless a voluntary, separate and one-time evaluation called for by the owner.

The results of this evaluation will be made available to stakeholders including the public.

Objectives The objectives of the independent evaluation are:

1. To make available to internal and external decision makers a body of technically sound and reliable information about the safety of the Indian Point nuclear station.

2. To address issues of particular interest to IPEC stakeholders including the public.

Scope The evaluation will examine:

July 31, 2008 ISE 1

Indian Point Independent Safety Evaluation (ISE)

1. Nuclear safety - from multiple perspectives, such as IPECs compliance with regulations and implementation of nuclear safety requirements (rooted, for example, in station procedures),

conservative decision making, and identification and resolution of issues or problems that may have safety implications. The evaluation will also consider the material condition of the plant.

2. Plant security - IPEC capability to deal with credible security events. (Note that because of stringent requirements to prevent disclosure of classified security information, information developed by the evaluation in this area will be separated from the main report and restricted appropriately.)

3. Emergency preparedness / emergency management - The independent assessment of the IPEC organizations on-site accident response and accident management capabilities (that is, the organizations ability to deal with a core-damaging event in order to limit and contain its consequences), and also to interface with and support those off-site organizations (state, county, municipality) in emergency management activities.

Lines of Inquiry (LOIs) in each of these areas will be established by the panel co-chairs prior to commencement of the evaluation. Early in the review process, the independent panel will revisit this starting set of LOIs and propose additions or refinements based on its initial observations -

in that way taking full advantage of the Panelists experience and insights, and reducing the likelihood of omitting a potentially valuable assessment element.

Deliverables The evaluation will produce two primary deliverables:

• A formal written report, documenting the panel examinations, and delineating its findings and recommendations. Following its transmittal to Entergy and stakeholders, the report will be made available to the public without editing by any party.

• Oral briefings, by the independent panel co-chairs, to Entergy management and to IPEC regulators, stakeholders and public. The timing, scope, venue and participants for these oral presentations will be established by the team co-chairs, in consultation with third parties, as appropriate.

The Evaluation Panel The independent panel will be comprised of 10 professionals with outstanding credentials and extensive (broad and deep) experience in the areas of investigation. Most (but not all) members will have direct commercial nuclear power experience, in areas such as operations, safety analysis, engineering, and plant management. Some members will be selected based on in-depth July 31, 2008 ISE 2

Indian Point Independent Safety Evaluation (ISE) knowledge and experience in one or more areas of special importance such as security or emergency management.

The independent panel may be augmented by one or more members at large, whose role will be to help the panel to see and frame issues from the point of view of New York opinion leaders and the general public. Members at large are also expected to be independent in that they should have no clear existing bias with respect to the shutdown of IPEC or extension of the operating license at the end of the current term.

The independent panel will be co-chaired by two individuals, one who has been highly successful as a senior leader in the nuclear industry, and another selected from outside of direct industry line management to provide an informed but different perspective. The co-chairs must have stature and excellent reputations across the industry, and unquestioned commitment to nuclear safety. They will have had no prior direct association with IPEC or Entergy.

Consultants may be assigned to assist the co-chairs in the management, coordination and logistics of panel activities as needed. Consultants are not members of the independent panel, and their roles will be clearly defined.

The objective is for the panel membership to be diverse, comprising individuals whose capabilities are compatible and complementary - rather than uniform. One or more members from the academic community may be selected. At least one member will have extensive knowledge of the regulatory requirements pertaining to nuclear plant operation. In composite, the independent panel will offer both extraordinary capability and multiple viewpoints on every issue.

Individual panelists credentials and capabilities shall include:

• Demonstrated expertise, knowledge and experience in one or more areas of investigation

• Independence and strong reputation for personal integrity

• Commitment to apply the requisite time and attention to this task Independence The Evaluation Panel must be transparently independent in that the independent panel as a whole, and each individual member, must be free of any relationship or other circumstance, present or past, which could reasonably be expected to unduly influence his or her judgment on IPEC matters reviewed. Such factors could include recent prior employment by Entergy, recent prior employment or significant contract engagement at IPEC, prior agreement regarding future employment or contract engagement, and the like. It is noted, however, that previous professional engagement at IPEC is not necessarily a disqualifier, and needs to be balanced against merits of having direct knowledge and experience germane to this review. Members will July 31, 2008 ISE 3

Indian Point Independent Safety Evaluation (ISE) be asked to sign affidavits outlining any present or past affiliations or relationships with Entergy or IPEC.

Independence shall be a significant factor in the selection of each team member. The suitability of the co-chairs, from an independence standpoint, will be confirmed and documented. The co-chairs shall be appointed by the Entergy Chairman. In turn the co-chairs will select independent panel members for their unique qualifications and independence of relationships with Entergy which could compromise their judgment.

ISE Process The following are key aspects of the evaluation process and modus operandi:

1. This will be an open and transparent assessment. For example:

• Team activities will be pre-scheduled and communicated.

• Provisions will be made for third party observation by appropriate regulators and public officials within practical limitations such as security, safety and space availability.

• The independent panel will provide regular feedback via briefings on its activities to the site leadership team.

• The Panel will host a public meeting to learn firsthand of public views and concerns early in the process before its planned extensive on-site examination of the state of the plants.

2. Multiple, parallel review methods will be employed:

• Reviews of records, documents, work products (to include review of previous NRC and INPO evaluations - and consideration, but not excessive reliance, on their conclusions)

• Observation of work in progress

• Examination of the physical plant and work spaces via walk-downs

• Individual and group discussions with plant personnel

3. Evaluation Criteria and Standards:

Specific evaluation protocols, including criteria and standards, will be formulated in advance of the evaluation, for each evaluation element. These will be an amalgam of selected parts of established NRC and INPO methodology, along with free form inquisitive examination by the team based upon their own expertise or experiences on state of the art performance criteria or evaluation technique.

Regarding evaluation criteria and standards, it is important to note that it will be the team members collective judgments - rather than quantified evaluation scores - that determine the evaluations findings and recommendations. The team of panelists will be selected based on their exceptional knowledge, experience, and demonstrated capability in the areas being evaluated, and it is expected that the independent cochairs will rely heavily on those capabilities.

July 31, 2008 ISE 4

Indian Point Independent Safety Evaluation (ISE)

4. Focus on the present:

The purpose of the independent evaluation is to examine the IPEC in its current state - to ascertain what is rather than what was. The examination will address prior IPEC issues only to the extent, in the Panels judgment, that they affect current or future plant performance in the areas of nuclear safety, security or emergency management.

Schedule and Duration The most intensive on-site portion of the evaluation is intended to commence in the second quarter of calendar year 2008. Some evaluation activities which are best performed during the scheduled refueling outage may occur earlier. The overall duration, from the start of the on-site portion of the assessment to issuance of the formal report, is expected to be approximately ten weeks, of which the Panelists will be on site for three weeks (one two-week period and one one-week period). The evaluation will not be constrained by the expected time frame or the cost needed to adequately accommodate its objective. The independent panel co-chairs will determine when the evaluation is complete.

July 31, 2008 ISE 5

Indian Point Independent Safety Evaluation (ISE)

Appendix 3: Issues of Expressed Public Concern As described in Section 2 of the Independent Safety Evaluation (ISE) report, a key element of the ISE was the identification and indepth evaluation of numerous issues at Indian Point Energy Center (IPEC) which have been in the public eye in recent years and are matters of concern to many who live and work near the station. This appendix summarizes these issues, describes how and where they are treated in the report, and provides additional detail on those issues we believe merit further attention via issue summary papers developed by Panel members and support staff.

To develop a more complete, firsthand understanding of public views and concerns, the Panel hosted two public meetings on April 28, 2008, and set up a public email address and hot line phone number. Comments gathered from these sources were cataloged and documented for consideration by the Panel, as was feedback from the Panelists interviews with local and state officials, and items from media reports in recent years. In all, several hundred comments were received from more than 90 different sources, many on the same or similar topics.

The ISE Panel determined some of these issues to be beyond the scope of its charter, as described in Section 1 of the report, such as global warming, thermal discharges to the Hudson River, government support and subsidies, and the performance of the Institute of Nuclear Power Operations (INPO) and the U.S. Nuclear Regulatory Commission (NRC).

A number of public concerns are related to IPEC license renewal and in some cases are identical to contentions raised separately to the Atomic Safety and Licensing Board (ASLB) as part of the licensing renewal proceedings. The licensing renewal process focuses on the implications of operating the plant after its original licensed period of 40 years. The ASLB will address any issues raised in its proceedings in accordance with established regulations. The ISE is an evaluation of the current health of the IPEC station, focusing specifically on Nuclear Safety, Security and Emergency Preparedness. License renewal issues are not within the ISE scope. However, some licensingrelated concerns, such as the condition of aging equipment, pertain to the plants operations during their current license lives - which end in 2013 and 2015 for IPEC Units 2 and 3 respectively - and have therefore been included in this evaluation.

A total of 39 public interest issues were determined by the Panel to be within the scope of the ISE. In some cases the issues fell within the ISEs main body of review, and were investigated as such. In other cases, special review sessions were required for focused examination of the issues by the Panel. In each case, the Panels conclusions are documented in this report - either in the main report (in some cases embedded in the text, and in others presented as standalone text boxes for clarity), or here in Appendix 3, ISE 1

Indian Point Independent Safety Evaluation (ISE) where a more detailed Panel evaluation is provided. The table below provides references to the treatment and location of each public interest issue addressed by the ISE Panel.

Issue Number/Title Public Concern ISE Report Reference

1. ISE Scope Adequacy of the IPEC ISE in light of Section 1.3 (with text box) the scope of the Independent Safety Appendix 3 (Issue #1)

Assessment performed at Maine Yankee

2. Terrorist Attack Vulnerability of IPEC to terrorist Section 4.3 attacks in general Section 4.7

3. Aircraft Attack Vulnerability of IPEC to aircraft Section 4.7 attack similar to those on September Section 6.3 11, 2001 Appendix 3 (Issue #3)

4. Emergency Sirens Reliability of sirens in light of recent Section 5.4 problems managing the siren Section 5.5 upgrade project

5. Evacuation Plan Adequacy of Evacuation Plan in light Section 5.6 (with text box) of the Witt report

6. Tritium Significance of finding detectable Section 6.2 (with text box) tritium contamination in Appendix 3 (Issue #6) groundwater from sampling wells onsite

7. Spent Fuel Pool Leakage of water containing Section 3.5 Leakage radioactivity from spent fuel pools Section 6.2 Appendix 3 (Issue #7)

8. Underground Deterioration of underground piping Section 3.3 (with text box)

Piping causing leakage and detectable Appendix 3 (Issue #8) tritium

9. Spent Fuel Implications of longterm storage of Section 3.5 Storage spent fuel on site in dry casks Section 4.7 Section 6.2 (with text box)

Section 6.3 Appendix 3 (Issue #9)

10. Lowlevel Implications of anticipated Section 6.2 Radioactive unavailability of Barnwell facility for Appendix 3 (Issue #10)

Waste disposal of IPEC lowlevel radioactive waste

11. Seismic Design Adequacy of seismic design, given the Appendix 3 (Issue #11) proximity of the Ramapo fault.

ISE 2

Indian Point Independent Safety Evaluation (ISE)

Issue Number/Title Public Concern ISE Report Reference

12. Reactor Vessel Potential for, and implications of, Appendix 3 (Issue #12)

Head crack formation in reactor vessel heads due to aging

13. Reactor Vessel Potential for failure of reactor vessel Appendix 3 (Issue #13)

Internals internals due to mechanisms observed elsewhere in industry

14. Fire Protection Adequacy of fire protection and the Section 3.4 use of HEMYC fire wrap. Section 6.1

15. Cable Separation Adequacy of cable separation for Appendix 3 (Issue #15) purposes of preventing fire damage to multiple redundant safety circuits

16. Containment Potential for impact forces outside of Section 6.3 Missiles containment to cause missiles (and Appendix 3 (Issue #3 therefore plant damage) within included in aircraft impact containment structures discussion)

17. Unplanned Significance of numerous unplanned Section 3.3 Shutdowns events in terms of plant safety and operator performance

18. Plant Programs Adequacy of IPEC programs and Section 3.4 processes to support safe, sustained operation

19. Entergy Implications of Entergy ownership, Section 3.2 Organization including fleet management Section 8 (Conclusion #10) structure

20. Staffing Level Concerns about recent decreases in Section 3.2 staffing Section 7.3 Section 8 (Conclusion #7, and Recommendation #4)

21. Safety Culture Adequacy of IPEC safety culture Section 3.2

22. NRC Exemptions Excessive number of regulatory Section 7.1 exemptions sought and obtained

23. Worker Reliability Worker reliability in light of past Section 4.3 (text box) incidents of employees sleeping on Section 4.5 watch or using drugs; also, security implications of possibly unstable ISE 3

Indian Point Independent Safety Evaluation (ISE)

Issue Number/Title Public Concern ISE Report Reference workers.

24. Safety Upgrades Adequacy of Entergy investment in Section 3.3 plant safety and upgrades

25. Decommissioning Adequacy of funds set aside for IPEC Section 7.2 Funds decommissioning Appendix 3 (Issue #25)

26. Operator Implications of apparently excessive Section 3.3 Workarounds number of operator workarounds

27. Procedures Adequacy of procedures and the use Section 3.2 of common (Unit 2 and 3) procedures

28. Employee Reported reluctance of employees to Section 7.4 Concerns raise concerns to management; approaching outside officials instead

29. Fire Watches Need for and effectiveness of hourly Appendix 3 (Issue #29) fire watches

30. Containment Integrity of containment structures Section 6.3 (textbox)

Integrity in light of questions about waterto Appendix 3 (Issue #30) cement ratio in construction

31. Cranes Implications of plant cranes built to Appendix 3 (Issue #31) standards now outofdate

32. Turbine Fire Implications of April 2003 fire in high Appendix 3 (Issue #32) pressure turbine

33. Cooling System Vulnerability of plant cooling Appendix 3 (Issue #33)

Debris/Ice systems to blockage by debris and ice Blockage from the Hudson River

34. Transformer Fire Implications of April 2007 Section 3.3 transformer fire

35. Containment Adequacy of containment sumps, in Section 3.3 Sumps light of NRC/industry sump issues

36. Flow Accelerated Potential that FAC could cause piping Appendix 3 (Issue #36)

Corrosion (FAC) failures and attendant safety problems

37. Asbestos Degree to which presence of asbestos Appendix 3 (Issue #37) in plant is a problem ISE 4

Indian Point Independent Safety Evaluation (ISE)

Issue Number/Title Public Concern ISE Report Reference

38. Equipment Adequacy of refurbishment actions Section 3.3 Refurbishment

39. Microbiological Safety implications of MIC on Appendix 3 (Issue #39)

Influenced stainless steel components Corrosion (MIC)

ISE 5

Indian Point Independent Safety Evaluation (ISE)

Compendium of Public Issue Summaries The following is a compilation of summary papers prepared by the Panel and its support staff documenting the results of their indepth examination of several of the more complex issues of public concern.

Each summary presents: (1) a statement of the public concern, (2) key background information, (3) summary of how IPEC has addressed the issue and (4) the Panels assessment of the matter as a whole.

ISE 6

Indian Point Independent Safety Evaluation (ISE)

ISE Scope (Issue #1)

A public concern was identified regarding the ISE scope, which some feel may not adequately assess safety at IPEC. This concern was based on comparison of the ISE with another major assessment of nuclear plant safety, the Independent Safety Assessment (ISA) performed at Maine Yankee in 1996.

The NRC addressed the uniqueness, size and scope of the Maine Yankee ISA in a letter dated June 28, 2007 to Eliot Spitzer, then governor of New York. The NRC noted that while the exact data was no longer available it was estimated that the ISA team spent about 4,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of onsite inspection, over half of which were directed to a highly technical and detailed allegation related to transient and accident safety analysis codes.

The scope of the inspection activities of the IPEC ISE is broader than that of the Maine Yankee ISA in that it includes security and emergency preparedness, as well as issues of public concern. The onsite time for the ISE teams inspection is estimated to be about 2,500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br /> - and more than 6,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> overall - which is comparable to the onsite inspection portion of the overall effort of the Maine Yankee ISA, not including the NRC inspection hours used for followup of the allegations. As a matter of comparison, the NRC expends about 2,700 hours0.0081 days <br />0.194 hours <br />0.00116 weeks <br />2.6635e-4 months <br /> each year inspecting a typical wellperforming twounit nuclear power plant. The composition of the ISE team is quite distinct from that of the Maine Yankee ISA and that envisioned in the proposed legislation36, both of which were based on an NRC inspection with the assistance of consultants.

The broad scope of the charter for the IPEC ISE allows the Panel to address a wide range of elements impacting the safe operation of IPEC. In addition, the depth to which particular elements were analyzed was based on the Panels judgment of their complexity and safety implications. The Panel conducted very detailed evaluations on a few key issues revealing possible systemic issues at IPEC. The ISE Panel does not believe that the scope or depth of their investigations of any issue was limited by the ISE Charter or the report timeline.

36 S.649 sponsored by Senator Hillary Clinton and H.R. 994 sponsored by Congressman John Hall ISE 7

Indian Point Independent Safety Evaluation (ISE)

Aircraft Attack (Issue #3)

Through its public outreach efforts, the ISE Panel was made aware of widespread public concern regarding the potential use of commercial aircraft as a terrorist weapon at IPEC.

Subsequent to the events of September 11, 2001 at the World Trade Center, the Pentagon and Pennsylvania, the issue of a similar airplane crash at nuclear plants became more central in the thinking of the government, the nuclear industry and the public. The NRC, national laboratories and the nuclear industry, as well as the U.S. Congress, were instrumental in initiating analyses and testing to determine the adequacy of protection of nuclear fuel in commercial reactors and spent fuel storage facilities at nuclear power plants.

NRC requested information and possible changes that might enhance the safety and security of structures and facilities at nuclear plants that contain these radioactive materials. The Nuclear Energy Institute commissioned a team to investigate the vulnerability of nuclear plant structures to aircraft crashes. In addition, the U.S. Congress requested the National Academy of Sciences to provide insights on improving the safety and security of commercial spent nuclear fuel storage. A series of reports on these various efforts has been published. Some have been designated safeguards/proprietary due to the detail provided which might be useful to terrorists. But others are available to the public, and each nuclear station (including Entergy plants) has performed evaluations to assess the protection provided to spent fuel, and has planned the mitigating actions if the spent fuel were to be threatened by any major damage, including that caused by terrorists.

As a result of all this work, the NRC has concluded that: The results of security assessments completed to date show clearly that storage of spent fuel in both spent fuel pools and in dry storage casks provides reasonable assurance that public health and safety, the environment and the common defense and security will be adequately protected. (NRC letter to Senator Domenici dated March 14, 2005). Furthermore, publicly available reports, backed by extensive analysis and testing, have concluded that structures that house reactor fuel [including the reactor] are robust, and adequately protect the fuel from impacts of large commercial aircraft.37 Extensive European, Japanese and Canadian testing and analyses were used, in addition to a large base of U.S.

government and industry testing, to benchmark and substantiate the methods and results of this work. Peer review by the most prestigious experts was also used to confirm the validity of the analyses results.

37 Nuclear Energy Institute, Aircraft Crash Impact Analyses, December 2002 ISE 8

Indian Point Independent Safety Evaluation (ISE)

Since 9/11 the federal government has taken steps to minimize the potential for hijacking a commercial aircraft for use as a weapon against any piece of infrastructure. Both hardware and procedural changes have been instituted to help assure that aircraft in or approaching the United States cannot be inappropriately diverted to endanger lives or property in our country. These provisions are discussed in Section 6.3 (Crosscutting Issues) of this ISE report. The conclusion is that the probability that a rogue commercial aircraft could approach a nuclear plant is very low.

Generic Analyses Applicable To IPEC Nevertheless, the nuclear industry, the NRC and the Congress of the United States have proceeded from the very conservative assumption that such an aircraft manages to reach a nuclear power plant, in order to determine whether the plants are robust enough, and to study the potential results of this type terrorist attack. While steering a large aircraft into one of the buildings at a nuclear plant that contains nuclear fuel is known to be very difficult for even the most experienced pilots, it is assumed that this has been accomplished by a terrorist who makes the desired direct hit on the structure.

The results of the generic analyses have been published in reports by the National Academy of Sciences, the NRC and the Nuclear Energy Institute. Nonproprietary versions of all of these reports are available to the public. This paper is based on the industry supported studies and analyses of plants with large dry containments like IPEC Units 2 and 3 available to the Panel and the results are summarized here. To the degree that industry safeguards and proprietary data and analyses were available to the Panel, they were found to confirm the conclusions included herein.

U.S. nuclear power plants considered the potential for accidental aircraft crashes in the initial licensing of the plants. But the probability of such crashes was so low that the detailed evaluation of them was not required in the design or licensing process, except for three sites that were located near major airports. At the time these plants were evaluated and designed for the possible crash of typical commercial aircraft flying at the time.

A Boeing 767400 was chosen as the representative aircraft in the generic post9/11 analyses reviewed by the Panel because its weight envelopes more than 85 percent of the aircraft flying in this country and includes heavy engines weighing almost five tons each.

This engine, which is generally regarded as the most dangerous piece of the aircraft when striking a building like reactor containment, envelopes about 90 percent of the engines used on contemporary commercial aircraft. A speed of 350mph was assumed for analyses and a perpendicular strike to the centerline of the structure or equipment was the target used because it results in the maximum force on the structure. The speed was chosen because lower speeds would require flaps to be used which would further reduce the speed, and above 350 mph the aircraft is unstable when close to the ground and is very difficult to steer with any accuracy according to experienced pilots.

ISE 9

Indian Point Independent Safety Evaluation (ISE)

The analyses performed were both simple scoping analyses and very sophisticated finite element analyses using different analytical tools, calibrated on actual tests of aircraft crashes into reinforced concrete walls and other tests where large components were hurled at high speeds into walls representative of todays operating nuclear plant structures. Global impact analyses focused on the effect of the whole plane hitting the structure and looked at the stability and survival of the entire building being studied. The other set of analyses addressed the local impact and potential damage from the heaviest component of the plane, the turbojet engine, to see if it would penetrate the walls.

Analyses of the containment buildings, fuel pools and spent fuel dry storage casks were conducted.

The conclusion for reinforced concrete containments like those at IPEC Units 2 and 3 was that no parts of the plane including the fuselage, the engines, wings, fuel or any other part entered the containment building. Concrete crushing and spalling (cracking and removal of concrete at the impact point) did occur and the concrete on the inside surface of the wall was damaged. But under no circumstance was the steel liner penetrated, and containment structural integrity and leak tightness were maintained.

Similar assumptions were used for the perpendicular strike on the side of a spent (used) fuel pool. The midpoint of the longest wall was used as the target. Concrete damage was extensive, but the liner for the pool was not penetrated, and no water was lost from the pool. The building maintained its structural integrity and the fuel remained covered with water so no radioactive release occurred.

The dry fuel storage casks are very small in size and are, therefore, very difficult for the airplane to hit. The analyses, however, assumed a direct impact of the engine on the cask identical to the IPEC dry fuel casks at the midplane and near the top of the storage module. The first created the maximum force to displace the module while the second evaluated the likelihood and potential damage if the cask were to tip over. In no case was the steel canister containing the used fuel breached and no leaks occurred. Therefore, no release of radionuclides occurred.

In all three cases (power plant reinforced concrete containments, spent fuel pools and dry cask fuel storage modules) the fuel containing structures withstood the most damaging impact of the assumed plane crash.

The methods used in these analyses are the best available and were properly applied to ensure realistic results. All of these analyses contained conservative assumptions. For example, the weight of the aircraft was assumed to be the maximum takeoff weight of the plane with a full fuel load. In reality, the plane would already have expended a good portion of its fuel since much more fuel is required for takeoff than for normal flying and landing. Also, the direct perpendicular impact is assumed, which requires perfect control ISE 10

Indian Point Independent Safety Evaluation (ISE) of the plane. For round containments any deviation from the perpendicular hit would result in more of a glancing blow. Any angle of impact other than perpendicular reduces the impact force on a wall.

In the case of the fuel pool analyses, a perpendicular impact at the centerline of the pool maximized the impact forces at the most flexible portion of the wall. Damage consequences would be less if the impact were elsewhere on the wall or at an impact angle. Fuel pools are normally partially underground, thus eliminating the large part of the target containing the spent fuel. No credit was taken for the likely interference from other buildings, transmission lines or terrain that might thwart or eliminate direct access to the fuel pool building or any of the other structures considered.

And, in the case of dry fuel storage casks, the impact of the engine is assumed to be perpendicular to the cask so maximum impact forces are applied. The fuselage of the plane is large compared to the cask so it may very well be impacting the ground before an engine could reach the cask and provide the maximum impact force.

The size of the target is key to the likelihood that it will be struck. The World Trade Center was 1,353 feet tall and 208 feet wide, about three times larger than a side of the Pentagon.

The side of the Pentagon is 1,489 feet wide by 71 feet tall. This structure is more representative of the low structures present on nuclear sites.

Relative sizes of World Trade Center, Pentagon and IPEC structures Spent Fuel Pool Containment Dry Cask Storage ISE 11

Indian Point Independent Safety Evaluation (ISE)

IPEC Specific Analyses The IPEC ISE Panel reviewed the public generic information and was able to apply it to IPEC structures in an independent evaluation to create its own view of the adequacy of protection. Access to some of the protected information provided the Panel with an opportunity to confirm the methods and assumptions used in the analyses and testing. The Panel determined that the information did apply to IPEC, and provided a sound basis to judge the capability of the IPEC structures in the unlikely event of an aircraft crash into these important fuel containing structures. In addition the Panel requested and was provided with several calculations of specific events involving the structures and possible mitigating actions at IPEC to further validate their conclusions.

There are three spent fuel pools at IPEC, two reactor containment buildings with active reactor operations and one dry fuel storage installation. The operating units each have an inventory of highly radioactive reactor fuel with the potential to be a substantial hazard were all or a portion of the inventory released to the environment. The Unit 1 spent fuel pool contains very low energy fuel bundles remaining from Unit 1 operation. All of these fuel containing facilities have been considered in this evaluation.

For this evaluation we assumed the same aircraft that was used in the generic analyses discussed above. It is important to note that smaller craft may be more maneuverable, thus increasing the likelihood of striking the site buildings, but the mass and fuel load are less and the consequences from hitting the structures are bounded by the use of the large aircraft.

IPEC topography provides a protective advantage that is not accounted for in the generic industry analyses. While control of lowflying large commercial aircraft is very difficult, it is further complicated at IPEC because the terrain is hilly. The surrounding buildings and transmission lines plus the terrain create significant impediments to access of a plane. Any damage to the plane or diversion because of these obstacles lessens the likelihood of hitting the desired building.

To capture all of the implications of this potential aircraft hazard, the ISE Panel studied four separate scenarios involving the Boeing 767400 impact.

1. The containment buildings at Units 2 and 3

2. The fuel pools at Units 1, 2 and 3

3. The dry spent fuel storage facility

4. Safetyrelated equipment needed for safe shutdown and cool down of the two reactors.

ISE 12

Indian Point Independent Safety Evaluation (ISE)

The Panel also assessed the potential for, and the damage from, a jet fuel fire and crashes into other buildings containing safety related equipment as well as the ability of the station firefighters and supporting outside fire companies to manage such a fire.

Containments The containment buildings at IPEC and other nuclear plants are designed to contain the radioactive materials in the unlikely event of damage to the nuclear core under extreme circumstances. These buildings at IPEC Units 2 and 3 are robust, built of reinforced concrete. Heavy steel reinforcing bars (21/4 inches in diameter) are arranged in several layers running horizontally, vertically and diagonally (see image below) within the solid concrete walls ranging from 31/2 to 41/2 feet thick. These buildings are circular in shape so glancing blows are more likely than direct hits. Each of the containment buildings is approximately 160 feet high and 140 feet in diameter. As a target, this is a much smaller and lower to the ground target than the World Trade Center (1,353 feet tall and 208 feet wide). In comparison with the Pentagon (lower to the ground and therefore more comparable to IPEC structures) building attacked on 9/11, a containment building is twice as tall but onefifth the area.

Photograph from IPEC construction showing layers of reinforcing steel bars in the containment wall ISE 13

Indian Point Independent Safety Evaluation (ISE)

In addition, the location of the plant in a valley, with other buildings, terrain and transmission lines in the way, suggests that control of the plane to hit the target is even more difficult than would be the case of a building sitting on flat ground.

The potential to dislodge equipment inside any of these containments due to the impact energy of a plane crash was assessed. The lack of large equipment (something that could cause damage if propelled into the containment space) mounted on the inside walls of the containment buildings and, most importantly, the dissipation of the crash energy through the walls, make this extremely unlikely. Likewise, there would be no damage to any equipment, especially equipment important to the safe control of the reactor. Other buildings onsite containing safetyrelated equipment are not as robust and are included in the evaluation of jet fuel fires on site discussed below.

The generic testing and analyses presented above are directly applicable to the containments at IPEC. The representative concrete reinforced containment used as the model in the industry analysis is very close in construction and dimensions as these containments. The direct perpendicular hit of a 767400 aircraft at 350 mph does not result in sufficient damage to hamper the structural capacity of the containment.

Furthermore, the direct impingement of the massive jet engine does not have sufficient force to penetrate the containment shell and liner. The mass of concrete and extensive steel reinforcing bar network within the walls decelerates the engine, destroying parts of it, and the wall absorbs the energy of the engine so that the shape and form of the back wall and the metal liner inside the wall remain intact. The Panel was also supported with simple analyses and calculations specific to the IPEC structures to describe or confirm individual effects involved in these events. These evaluations led the ISE Panel to conclude that large commercial aircraft and turbojet engines in use today would not penetrate either of the IPEC containments even with a direct hit at 350 mph. Structural integrity and leak tightness of the building would be maintained. Furthermore, the energy of the impact would not result in equipment inside containment becoming missiles, because the energy of impact would be absorbed by the structure with only minor movement of the building.

Spent Fuel Pools Spent fuel removed from the reactor core at the end of its useful life for power production, is relocated to spent fuel pools. These pools are full of water and provide a level of water that is about 23 feet above the top of the fuel which is vertically stored in racks at the bottom of the pool. The water provides both cooling and shielding allowing workers to function at the surface of the pool within very low dose levels. The Units 2 and 3 fuel pools are 33 feet wide by 38 feet long and 39 feet deep.

At each refueling (every two years for both Units 2 and 3) about 96 fuel bundles are removed from the core to that Units fuel pool. Right after removal from the core the assemblies continue to produce energy at about a few percent of their fullpower level in ISE 14

Indian Point Independent Safety Evaluation (ISE) the core. This heat rejection decreases rapidly with time such that after 200 days it produces only about one twelfth of its initial power one day after the reactor is shutdown.

The power decays slowly and after five to 10 years the cooling water is no longer necessary and the fuel bundle can be cooled by airflow.

Unit 1 contains the last of the Unit 1 fuel assemblies which have been decaying for more than 34 years. While still radioactive, this fuel no longer has sufficient energy to pose a problem of heating up to damaging temperature if water cooling were lost. The air surrounding the fuel would be adequate for cooling even without the special arrangement of fuel discussed below. The pools in Unit 1 are completely below ground level and the building housing the pools is a lower profile in comparison with the other buildings on site, thus providing a much lower risk of airplane crash damage. All of the fuel in Unit 1 pools will be removed before the end of 2008.

The Unit 2 and 3 fuel pools are constructed of thick (six feet) reinforced concrete walls similar to the containment walls, and the pools are lined with a continuous stainless steel barrier on the inside of these substantive walls. The bottom halves of both pools, where the fuel is stored, are under the surface of the ground, except for about onethird of one wall on Unit 3 (about 8 percent of the wall surface of the pool), which is exposed above ground. The protection of the ground results in no direct hits for the parts of the pool containing the fuel. The one exception is this small part of the Unit 3 fuel pool wall. Access to this wall by an airplane is very limited due to other buildings, rough terrain and transmission lines, so a direct hit by an aircraft is very unlikely. The aircraft impact tests and analyses discussed above apply to the fuel pool walls at IPEC. So, for this wall portion exposed above ground, the maximum engine direct hit does not cause penetration. The fuel pool concrete walls and imbedded steel reinforcing bar absorb practically all of the energy of the engine crash, and the liner stays intact so no water leaks out.

To assess the potential from damage of a direct hit on the top surface of the fuel pool from above, the Panel requested and received analysis of the effects of one of the turbojet engines of the plane falling at terminal (maximum) speed directly into an IPEC fuel pool.

This engine would cause a large water wave. Conservatively assuming all of the displaced water does not return to the pool, nine inches of water would be lost. Furthermore, the water would cushion the landing, slowing the speed of the engine such that it would not hit the fuel at a speed that would damage the racks or the fuel. All other initial water remains in the pool and provides shielding for workers at the top of the fuel pool.

The ISE Panel went further in this analysis because if the pool is not full, the normal pool cooling system is ineffective, and fuel assemblies recently discharged from the reactor do require water cooling. The water in the fuel pools is normally continuously cooled by installed redundant systems with redundant power supplies and numerous sources of water. A full pool provides 23 feet of water above the top of the fuel. Makeup water will be required before restarting the installed cooling systems if they are intact. Nevertheless, ISE 15

Indian Point Independent Safety Evaluation (ISE) if these systems are damaged by the crash, many hours are available to get additional cooling water or spray (which would be effective in some cases) into the pool and over the fuel. With a recently offloaded partial core from a refueling, the water would reach the boiling temperature in about five hours and then boil off at the rate of nine inches per hour. This provides more than a day before the fuel would start to be uncovered. This time period could be as long as 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> if the most recent fuel has been in the pool many months or years.

After this time, continued boiling will uncover an increasing fraction of the fuel. Even in this condition, the cooling of the hottest fuel and the time available to initiate water flow to the pool can be enhanced by a certain arrangement of the fuel. To maximize the heat removal from the hottest (newly discharged) fuel, other materials with good heat capacity, can serve as heat sinks (heat absorbers). The proper arrangement of the fuel (e.g.,

surrounding newly discharged fuel bundles with older, less heat producing fuel bundles),

maximizes the effectiveness of cooling during boil down even if the water level is below the top of the fuel. The heat of the hottest bundles is radiated to the colder fuel and structures during this period. The IPEC plant staff utilizes this arrangement to assist in fuel cooling during time when these extreme conditions might occur. The resulting delay in heatup of the fuel provides additional time for the plant staff to restore the water level in the pool thus cooling the fuel.

If the water in the pool were to completely boiled away, it is expected that the fuel would be sufficiently cooled by air convection provided that the fuel arrangement discussed above was in place, the fuel in the pool was not recently discharged, and the convective air flow path was established through the bottom of the fuel assembly expeditiously enough by the boil off progression. Radiated heat transfer would continue to work to keep the hottest bundles from reaching critical temperatures. The efficiency of this potential cooling mechanism must be evaluated using sitespecific fuel operating and cooling histories and spent fuel storage arrangements. There are numerous ways to provide makeup water or spray to the pool, and the trained personnel, written strategies and dedicated equipment are all available and located in diverse and separated locations in both units, providing high assurance that some of it will survive any event. The sources of water and the delivery mechanisms at IPEC provide adequate - and in some respects superior - options compared to other plants in the United States (see fire protection capability below), and are adequate to provide cooling to avoid a zirconium cladding fire.

A separate mobile diesel powered fire pump is provided specifically for this purpose.

Even if the pool walls were breached in some way above ground (the Panel has not found a realistic scenario to do so), the fuel racks and the fuel casks would remain covered since they are below ground level. Reduced inventory of water in the pool shortens the time for boiloff, so action must be taken more quickly to prevent boiloff to the top of the fuel. In addition, this loss of shielding over the fuel increases the dose rate above the pool, hampering the operators and others who are restoring cooling. Nevertheless, the water ISE 16

Indian Point Independent Safety Evaluation (ISE) sources and methods to keep the fuel cool enough to avoid damage are abundant, and able to be implemented in this high dose environment such that the Panel believes the temperature of the fuel will be controlled, and overheating will not occur. Temperatures of 900 degrees centigrade (1,655 degrees Fahrenheit) are required before the fuel is damaged in a selfstarting zirconium cladding fire. Analyses have demonstrated that water flows of about 200 gallons per minute (gpm) are adequate to keep fuel cool. Should all of the other systems used to supply water to the pools become unavailable, fire water systems are capable of supplying greater than 200 gpm, and can be introduced from a distance within the building or from outside through the breach in the wall. Dedicated and positioned nozzles, hoses and system adaptors/connectors are provided just for this purpose.

As of a result of these IPEC analyses, the Panel determined that fuel damage and release of radioactivity (i.e., from a zirconium cladding fire) are very unlikely even if the analyzed aircraft were able to strike an IPEC fuel pool. The effects of an aircraft fuel fire on the spent fuel pool are discussed below in the Jet Fuel Fire section.

Dry Spent Fuel Storage Spent fuel taken from a fuel pool is stored in thick (two inches) stainless steel cylinders welded shut on both ends. This canister provides a leakproof shell around the fuel and acts as a heat transfer surface for keeping the fuel temperature within a safe range by means of conduction of the heat energy from the fuel to air flowing over the surface.

Convection then removes the heat from the canister. The canister also serves as a radiation shield, although it is insufficient by itself to reduce dose rates to acceptable levels. When the canister is stored on an outside concrete pad, it is surrounded by a substantial steel and concrete shield which reduces the dose rate to acceptable, low levels.

The shield contains ports at the top and bottom that allow air flow through the bottom and out the top cooling the enclosed canister. The combination of the canister and shield module is known as the HOLTEC HiStorm 100S Version B system which is specifically licensed for this purpose by the NRC. The canister enclosing the fuel is about six feet in diameter and 16 feet high and two inches thick stainless steel. The shield is about 11 feet in diameter and 19 feet high. This shield surrounding the fuel canister is 28 inches thick and is composed of concrete encased in steel. The whole assembly with fuel weighs about 140 tons. The hazard is the simultaneous damage of the fuel inside with a breach of the canister without any mechanism to isolate the breach from the environment. While the fuel is generally old and its heat content is low, and this would limit the heatup and thermal dispersion, the level of radioactivity in a fuel cask is still significant.

The size of an individual dry fuel cask is a very small target for an airplane (207 square feet compared to the size of the walls of the Pentagon). This comparison demonstrates what a small target a dry cask module is (about a factor of 500 smaller). Its low profile and surrounding terrain and structures make it a very difficult target for an aircraft. Even the ISE 17

Indian Point Independent Safety Evaluation (ISE) whole of an Independent Spent Fuel Storage Installation (ISFSI) is a small low target for a large airplane. Nevertheless, the Panel has considered the potential damage and release that might occur in the unlikely event of an aircraft crash into a dry spent fuel module.

The ISE Panel has reviewed the industry analyses that demonstrate that the module and fuel canister can survive a direct hit from a large aircraft engine at high speed (350 mph) without any penetration of the fuel canister and, therefore, without any leakage of radioactive material. In some cases the dry fuel module can be dislocated horizontally and can crash into adjacent modules. In other cases the module may be tilted or turned on its side. But in no case is the fuel canister penetrated or caused to breach, so there are no radiological consequences to the public around the site. The potential for a jet fuel fire at the ISFSI is discussed below. The ISE Panel is satisfied that while an airplane crash into a dry cask storage module by a very large and fast moving jet engine will cause substantial damage to the module it will not penetrate the fuel canister or cause it to leak.

Jet Fuel Fires Onsite Were a large airplane able to hit any structure on the IPEC site, it is certain that a very large fire fed by the fuel on the aircraft would occur. In considering this very unlikely event, the Panel used the full load of fuel of the Boeing 767400 (24,000 gallons). To assess the potential damage, the fuel was assumed to start a large fire at different locations on the site and the impact from each fire on the ability to provide makeup water and cooling to the reactors and fuel pools was reviewed.

The IPEC plant is hilly and the storm drain design routes water to low spot drains which empty into the Hudson River. Due to the speed of the crash, the fuel is likely to spread over a large area in the direction the airplane was moving. This spreading, plus the drain system, is expected to create a fire covering a large area on the ground and in some structures if they are breached by the crash. But the amount of fuel in any one place is likely to be only enough to sustain a shortlived fire. The IPEC site is equipped and prepared to battle fuel fires and in evaluating the extent and intensity of fires produced under the assumptions above, it has been concluded that any of these fires could be extinguished in less than one hour. This analysis took no credit for offsite fire department assistance which would surely arrive in that timeframe.

Because of the capability of the containment buildings, no fire inside these buildings is considered credible since the containment would not be penetrated by the aircraft. A fuel fire outside the containment structures (or outside the fuel pools) would affect the concrete walls of the building. But concrete is universally used as a fire barrier because of its capability to withstand fire damage. Jet fuel burns at about 1,200 degrees centigrade (2,192 degrees Fahrenheit) and Underwriters Laboratory tests demonstrate that less than a few inches of concrete will be destroyed after burning for hours. Concrete material on the surface of the walls in contact or near the fire would be degraded. But after four hours ISE 18

Indian Point Independent Safety Evaluation (ISE) of this very hot fuel fire up against the containment, calculations show that at a depth 10 inches inside the wall, the temperature would still be only 75100 degrees Fahrenheit, not sufficient to further destroy the concrete. The concrete ablation (destruction) rate on the surface would about 3/4 inch per hour for this intense, adjacent jet fuel fire, so the fire could be extinguished long before significant damage could be done to the containment reinforced concrete wall (31/2 41/2 feet thick). The oneinch thick steel liner on the inside of the containment provides additional integrity against fire causing a leak path from the containment to the outside.

The impact of a massive fuel fire on other buildings, including the location of the fuel pools, was also considered. In all cases significant equipment would be lost and large sections of buildings could be engulfed in flames. Combustible material in nuclear plants is minimized as part of the fire protection normal practices. Redundant equipment strings are separated by fire barriers, but a fuel fire is not part of the design basis for these barriers so they may not protect redundant equipment in this extreme situation. While the fire burned, a good deal of equipment would be destroyed. Nevertheless the robust and redundant nature of the installed safety systems and, especially, fire protection systems allow for their effective use in these circumstances. Additional capabilities and procedures for the numerous ways to provide makeup and spray to the fuel pool have been instituted at the plant over the period since 9/11. This overall ability to get water to the spent fuel pool and the reactor, even after major damage to large parts of the plant, has been demonstrated by the station personnel and, if needed, the plant staff can be assisted by offsite responders which are numerous and nearby.

Fuel pools present a further unique situation because the jet fuel could make its way into the pool. For analyses purposes the Panel assumed the pool could be filled with burning fuel. A conservative assumption was made that three feet of fuel were deposited in one of the fuel pools and ignited. The major energy from the fire is directed upward as the gases burn and the temperature beneath the fire is much less. Analysis shows that even with no mitigation this fuel would burn off and the water beneath the fire would be reduced by less than one foot. With firefighting and action to provide makeup water and/or spray into the fuel pool, the spent nuclear fuel would be kept from overheating even in this situation.

The ISFSI consists of a very substantial reinforced concrete pad on the IPEC site that is designed and installed to be smooth and flat. The dry fuel storage modules are located on this pad at 16 feet on center. The result is an array of modules about 2.5 feet apart.

The pad is designed to minimize or eliminate standing water from rain and has perimeter drains that direct water away from the facility. These same provisions would serve to route jet fuel away from the modules and the pad. A thin layer of fuel might remain and it would burn off quickly. If the fire were to continue, it could be extinguished in no more than an hour. The dry spent nuclear fuel modules are concrete and steel, are non ISE 19

Indian Point Independent Safety Evaluation (ISE) combustible and would not be significantly damaged by a shortterm fire (less than one hour). Jet fuel that landed on top of these modules would also run off like rain, thus limiting the duration of the fire. The top of each module is also protected by metal. While the Panel is not aware of any specific testing of these modules in fire, readily available fire tests support this evaluation.

As a result of these evaluations and an evaluation of the firefighting capability of onsite personnel around the clock, the ISE Panel has concluded that:

1. Regardless of the crash scenario, introduction of jet fuel into the containment is not considered credible.

2. Some damage to structures, systems and components in the plant buildings would occur in the event of an aircraft fuel fire, but redundant equipment and power and water are available from dispersed locations on the site. Strategies for the cases of large fires or explosions onsite are well developed, and would serve to guide the station personnel to methods for supplying makeup for nuclear fuel cooling and coverage and for fighting the fire(s).

3. Sufficient makeup and cooling options are available to provide cooling and to keep the core covered. These options are the subject of instruction, and are practiced.

The unknown nature of the damage from such an unlikely fire requires a full set of mitigation strategies to keep the core covered and cooled until the fire burns out or is extinguished. These multiple strategies are available onsite.

4. Even if a full load of jet fuel from todays commercial aircraft (24,000 gallons) were deposited at the bottom of the exterior wall of a containment or fuel pool and ignited, the damage to the wall would not cause penetration, even if it burned for many hours. Fire protection projections determine that even a fire this large and hot would be extinguished within one hour.

5. The ISFSI design is such that jet fuel fires would be limited in duration and the spent fuel modules would withstand the fires without consequential damage.

6. The agreements with local fire and rescue emergency agencies would provide significant backup capability in controlling fires and their aftermath.

Overall Conclusions The ISE Panel noted that public concern about the potential for a 9/11aircraft type attack on IPEC remains high. Therefore, the Panel studied the likelihood and the possible consequences of such an attack, to gauge the risk that such events could cause harm to the health and safety of the public around IPEC. After its evaluation the ISE Panel concluded:

1. Because of the defenses put in place by the federal government, the probability of a threatening commercial aircraft reaching IPEC is very, very low.

2. Even if it did, the damage from the crash and the fire, while very substantial - and in some extreme cases beyond the capability of the normal plant safety systems to ISE 20

Indian Point Independent Safety Evaluation (ISE) mitigate - would not cause release of radioactivity to the environment. This is because of the robust nature of the nuclear structures and the response capabilities and strategies developed at IPEC.

3. The nuclear structures are robust because they are designed for large internal dynamic forces and/or earthquakes, and have been shown to be excellent protection from air crashes.

4. Response capabilities include inplace dispersed water sources, delivery systems, power supplies and mitigation strategies in addition to the normal safety systems.

These capabilities are adequate to provide makeup and cooling to the reactor, the containment and the fuel pool. Nonnuclear systems including the fire water system at IPEC have substantial capability to deliver water anywhere onsite, even more than most industrial and power plant sites.

5. Terrorist aircraft attacks are aimed at causing damage and death, leading to fear and economic chaos. There are many targets for terrorist aircraft attacks. The nuclear fuel areas of the IPEC nuclear units are hardened, well protected, and extremely difficult to hit and damage to the degree that the public would be harmed by a radiological release.

ISE 21

Indian Point Independent Safety Evaluation (ISE)

Tritium (Issue #6)

The public residing in the region around IPEC has expressed concern about possible tritium contamination in the groundwater around the plant. Leakage from the Units 1 and 2 fuel pools and underground auxiliary steam piping brought this issue to the forefront in the last few years (see Issues #7 and 8, respectively, of this appendix). In addition, in the spring of 2007, Entergy reported that tritium had been detected in the sewage system that flows into the city of Buchanan system. An aggressive monitoring program overseen by the NRC was conducted over a period of weeks, using different laboratories and quality control measures, and no further tritium was detected. The conclusion was that the original example was a false positive. Radiological sampling and analyses continue as a routine part of the IPEC monitoring programs and no tritium has been found in the sewage since that time. Nevertheless, incidents like this do raise public concern.

Tritium (H3) is a radioactive isotope of the element hydrogen (H). It is produced naturally in the upper atmosphere, through nuclear weapons testing and in special production reactors where tritium is produced for commercial and government uses. Tritium is also produced in operating reactors as a byproduct of about 2 percent of the fissions in the core, and in reactions with lithium, boron and hydrogen in the reactor coolant. A typical 1,000 MW nuclear power plant produces about 1,000 Ci of tritium in a year. Luminescent devices are the typical commercial use (replacing radium because tritium has very much lower dose effect) and the government uses large quantities of tritium in triggers for thermonuclear (fusion) weapons. It also has uses in life science research and in new drug safety studies. This isotope is commonly found in its water form where tritium replaces one of the H atoms in water (H2O) which is then referred to as tritiated water (H3O). It has the same physical characteristics as water and it is common to find trace levels of beta radiation, mostly tritium, in municipal and well drinking water supplies. Tritiums halflife is 12.3 years and when it decays it emits very weak beta radiation and transforms itself into nonradioactive lithium.

Like hydrogen, tritium is hard to contain because it can migrate through plastic, rubber and some types of steel.

People are exposed to tritium everyday, since it is widely dispersed in the environment and in the food we regularly eat. The primary path to the body comes from drinking water, but it also may be inhaled or absorbed through the skin. In the human body it disperses quickly, in the same way water does, and is excreted in urine within a month or so. In the body tritium goes directly to tissue and organs, where it can cause only very minor damage since the beta ray it emits is weak and does not always penetrate the tissue. Even if it does, its energy is small and therefore cell damage is minimal because the beta radiation it emits is low energy. In fact, tritiums beta radiation is too weak to penetrate human skin. As with all ionizing radiation, exposure to tritium increases the risk of developing cancer. However, because it emits very low energy radiation and leaves the ISE 22

Indian Point Independent Safety Evaluation (ISE) body relatively quickly, for a given amount of activity ingested, tritium is one of the least dangerous radionuclides.38 The U.S. Environmental Protection Agency (EPA) has established limits on tritium release from power plants and for the amount that is permissible in drinking water. In the United States the limit is 20,000 pci/liter, which is calculated to yield a dose of 4 mrem per year for a person who drinks water containing tritium at the limit all year long. As a part of the NRC regulation of the whole dose impact of releases from the site, the limit for tritium is set lower to deliver a dose of no more than 3 mrem/year to any member of the public.

In 2005, environmental monitoring at two U.S. nuclear plants detected elevated levels of radioactivity in groundwater. At the Braidwood Generating Station in Illinois, elevated tritium levels were found in groundwater near an underground pipe inside the plants boundary. Elevated tritium levels were also detected outside the plants boundary.

According to the NRC, these levels did not present a public health or safety risk to anyone in Braidwood or the surrounding area. In September 2005, during construction excavation, IPEC discovered a tritium leak from the Unit 1 spent fuel pool. Elevated tritium levels were detected at one monitoring well near the spent fuel pool at Unit 1, but not beyond the plant boundary. The NRC concluded that the leak posed no health or safety risks to plant employees or the surrounding community. Several other nuclear power plants also found higher than expected levels of tritium.

In response to these events, the nuclear industry launched the Nuclear Energy Institute Initiative on Groundwater Protection39 to improve the management of situations involving radiological releases in groundwater. The initiative is intended to provide additional assurance of the safe, effective management of U.S. nuclear plants. Every company that operates nuclear power plants in the United States committed to inform local, state and federal authorities of any unplanned release, even if it is below the threshold for reporting to the NRC.

The NRC released a report on the findings of a group of experts from the NRC and the state of Illinois on unplanned releases of radioactive liquids (October 2006). The task force found no impact on public health from these events. We looked at a wide range of releases that go back to 1996, and even included a substantial release from the Hatch plant in 1986, and none of these events led to appreciable radiation doses to people outside the plants, said Stuart Richards, the NRC senior manager who led the task force.

In February 2007, the industry held a workshop with the NRC and other stakeholders to capture lessons learned from implementing the voluntary industry program. Following that workshop, the industry formed a task group to redraft industry guidance on the 38 See http://www.epa.gov/radiation/radionuclides/tritium.html#peopleshealth 39 Nuclear Energy Industry Unveils New Policy to Manage Inadvertent Radiological Releases, May 9, 2006 ISE 23

Indian Point Independent Safety Evaluation (ISE) program to incorporate the lessons learned. The industry issued the final guidelines in a document titled Industry Ground Water Protection Initiative, NEI 0707, in August 2007.

It is available to the public on the NRC Web site at www.nrc.gov/reactors/operating/ops experience/tritium/publicmeetings.html, and can be found under the Sept. 27 public meeting.

IPEC annually reports all detection of tritium release from the plants. In addition, Entergy has embraced the voluntary Nuclear Energy Institute guidelines referenced above for monitoring and reporting tritium in groundwater beneath the plant. The maximum concentration of H3 in the groundwater monitoring wells around the plants has been 600,000 pci/l near the Unit 2 fuel pool and 5070 pci/l in a well near the river. This latter concentration results in less than 0.01 percent of the NRC permitted level associated with 3 mrem exposure to the public. It has been confirmed that tritium in the groundwater has not migrated to adjacent property around the IPEC site, but some has migrated to the Hudson River. Any tritium entering the Hudson River would mix with the existing tritium caused by the other methods previously described, and because of the large dilution effect would likely be undetectable.

The ISE Panel recognizes that any radioactivity above background in the environment can be a concern to members of the public. Radioactivity is with us everywhere in our normal lives and we receive doses from natural sources from the ground, the air, water and cosmic rays. The EPA and the NRC are tasked with ensuring that public exposure is limited to very safe levels of additional dosage above that received from normal background sources. The levels of tritium introduced into the environment have been well below the limits established by the regulatory agencies and the impact on overall dosage to the public is insignificant. The maximum increased dose that any member of the public could have received is less than one millionth of the dose that the public receives from natural background sources. The Panel finds that Entergy and the IPEC staff are dedicated to controlling and minimizing the release of radioactive materials from the site into the environment, and that the programs they use to carry out this responsibility are sound and effective. Entergys own Nuclear Oversight organization and the NRC provide independent inspections, audits and observations on these activities to ensure compliance with regulatory requirements and the companys goals and requirements.

References:

Institute for Energy and Environmental Research, Tritium ReportJanuary 1996; U.S. Safe Drinking Water Act; USEPA Radiation ProtectionTritium web page; NEI 0707 Industry Groundwater Protection InitiativeFinal Guidance DocumentAugust 2007; NEI Fact Sheet: Industry Closely Monitors, Controls Tritium at Nuclear Power Plants October 2007 ISE 24

Indian Point Independent Safety Evaluation (ISE)

Spent Fuel Pool Leakage (Issue #7)

Leakage of radiologically contaminated water has been an ongoing public concern regarding IPEC since the mid1990s due to leakage from the Unit 1 spent fuel pool, and since October 2005 due to leakage from the Unit 2 spent fuel pool.

The Unit 1 fuel pool leak has released the isotope strontium90, Sr90, which entered the pool from failed fuel stored in the pool. In August 2007, an ion exchange cleanup unit was installed to capture Sr90 and reduce its rate of release by more than 98 percent from the peak level of release which occurred during the period of leak discovery in the mid1990s.

The Unit 2 fuel pool leak has released the isotope tritium, H3, which enters the pool from mixing of primary reactor system water with pool water during normal reactor refueling operations. No leakages from the Unit 3 spent fuel pool have been observed.

The ground area around these pools and throughout the site is monitored by an extensive array of excavated wells in which an ongoing comprehensive groundwater sampling program is conducted. The maximum level of Sr90 on the site was measured at 110pci/l near Unit 1 and for wells nearest the river 27.1 pci/l. If a person consumed fish from the Hudson River, over the course of the year they would receive a dose of less than one thousandth of the NRC limit40. The analogous levels of H3 are 600,000 pci/l near the Unit 2 fuel pool and 5070 pci/l in wells near the river, and the analogous dose would be less than one tenthousandth of the NRC limit.

The Unit 1 fuel pool leak is being resolved by action to remove spent fuel from the pool and then drain the pool. The pool drainage process involves two sequential steps:

drainage to a level of approximately two to three feet to safely conduct removal of resident sludge, followed by final drainage. Fuel removal is scheduled to be completed in October 2008, pool drainage to the two to three feet level by the end of the year 2008, and sludge removal and final drainage by April 2009.

The Unit 2 fuel pool leak has been remediated by repair of a pinhole leak found in the transfer canal. Leakage from the pool was first discovered by moisture emanating from a concrete shrinkage crack in the fall of 2005 which was subsequently contained by installation of a collection box soon after detection. Water collected by the box has decreased significantly since first detected in 2005 from two liters/day to several tablespoons per day on average. This small but ongoing periodic detection of water could indicate the continued presence of a very small leak, or could indicate that external groundwater intrusion is occurring between the concrete and steel liner.

40 3 mrem is an annual regulatory guideline for plant effluents which can be compared to natural radiation background in the U.S. of approximately 300 mrem in a year.

ISE 25

Indian Point Independent Safety Evaluation (ISE)

The Panel believes that the plan of action for resolution of the Unit 1 fuel pool leak is an effective path to eliminate this concern. Regarding the Unit 2 fuel pool, the decreasing rate of the pool leak source and its collection are favorable developments. However, means are not available to ascertain the nature and location of the current source of collected water.

Consequently, the station should remain vigilant regarding detection and repair of the leak source. In particular, the station should remain highly alert to any evidence that the leak is not being fully captured during its monitoring of adjacent wells. Should such evidence appear, additional steps should be taken to locate and terminate the leak source, even though it may be demonstrated that the level of tritium in the leak poses no threat to the public health.

ISE 26

Indian Point Independent Safety Evaluation (ISE)

Underground Piping (Issue #8)

Public concern has been expressed regarding radiological releases from leakage of buried piping. Such a leak of tritiated steam occurred in the spring of 2007 in six inch diameter carbon steel piping, necessitating the replacement of 225 linear feet of Units 1 and 3 auxiliary steam piping. Unanticipated corrosion rates have been experienced in underground piping principally due to the breakdown or incorrect installation of protective coatings and wraps. The corrosion of buried piping is being addressed throughout the nuclear industry by the following multistep program. At IPEC, action on this program has progressed to the implementation of Step 3.

1. Identify all buried pipe

2. Assess the risk of each pipes failure to nuclear safety, radiation safety/releases, and impact on plant operations using the categories of HIGH, MED, and LOW

3. Evaluate the corrosion risk for the highest impact pipes first by taking into consideration: pipe material, soil condition, pipe coatings and cathodic protection

4. Determine what inspection or replacement actions to take for each pipe.

At IPEC there are three categories of underground piping:

1. Service and circulating water systems (large diameter pipe) - nonradioactive water - cement lined, carbon steel material

2. Safety injection (three and six inch diameter) and containment spray piping (12 inch diameter) supply from the refueling water storage tank -radioactive water -

stainless steel material

3. Auxiliary feed water and steam systems (eight and 12 inch diameter/six inch diameter piping) - very low tritium levels - carbon steel material The emphasis in the following discussion will be on Category (3) piping, which contains very low levels of tritiated steam and water and has been the focus of public concern.

Category (1) piping is inspected by robot and has not experienced leaks. Small and mediumdiameter service water piping does experience several leaks per unit per year, but this piping is above ground, readily repaired and carries nonradioactive water. For Category (2) piping no leakage has been identified in any of the buried portions of these piping systems which are pressure tested once every 3 1/3 year period to insure leak tightness, and are constructed of stainless steel.

The remaining 725 linear feet of Category (3) Unit 2 auxiliary feed water piping is vulnerable to future tritiated steam leaks. Specifications for the buried portion of the Unit 2 auxiliary feed water piping, and the Units 1 and 3 auxiliary steam piping, which failed in ISE 27

Indian Point Independent Safety Evaluation (ISE) 2007, have similar fabrication and installation requirements. Based on the inspections performed during repair of the auxiliary steam piping, it appears that the protective insulation was not installed as required by design specification, which led to corrosion.

However, a comprehensive investigation of the nature and rate of wall corrosion was not conducted in 1998, when wall thinning of the auxiliary steam piping was detected. The piping condition was sufficiently degraded by the 2007 leak as to preclude effective investigation of the leak source.

The implications of the 2007 auxiliary steam piping failure on the potential of other unexpected failures are:

1. The design requirements for both of these systems are similar. However, the piping was installed by different work crews at different times, making it unlikely that the same auxiliary steamline installation deficiencies were introduced during the installation of the Unit 2 auxiliary feed water piping. Further, inspection of the exposed end of this feed water piping shows the existence of protective coating on the piping.

2. The operating conditions of the auxiliary steam piping (i.e., higher temperature) are more conducive to corrosion than the operating conditions of the feed water piping.

3. The auxiliary feed water piping is nuclear safety piping, and therefore subject to the requirements of the ASME Section XI Code, which requires that the system be pressure tested on a prescribed schedule. Successful performance of these pressure tests would provide assurance that the auxiliary feed water system remains leak tight and structurally sound. The last pressure test was conducted in November 2002, since the May 2006 test - although successful and regulation compliant - was only conducted as a leakage test. The next scheduled test is in April 2010, which per code could be conducted as either a leak or a pressure test.

4. Industry led nondestructive methods of inspection to measure wall thinning in buried piping is ongoing on two approaches - UT guided wave and remote field eddy current.

However, the lead laboratory has not established a date when either of these techniques will be fully qualified to yield reliable inspection results. IPEC anticipates that these techniques could start to be used by them in the next two years.

The Panel notes that the application of qualified inspection techniques to the feed water piping vulnerable to tritium leakage could well exceed two years. While the risk to public health from such a leak would be insignificant compared to allowable standards given the level of tritium involved, this vulnerability is an undesirable impediment to public confidence in IPEC operations. Consequently IPEC should explore options for reducing the vulnerability of the piping to unanticipated leakage in the future. Such options include (1) excavating a few selected locations to confirm the presence of protective coating on the piping, and to measure and confirm the existence of sufficient wall thickness, using ISE 28

Indian Point Independent Safety Evaluation (ISE) existing inspection techniques, and/or (2) performing a pressure test to confirm wall thickness sufficient to obviate vulnerability to tritiated water leakage. The panel recommends that at least one of these options should be completed no later than calendar year 2008.

ISE 29

Indian Point Independent Safety Evaluation (ISE)

Spent Fuel Storage (Issue #9)

Members of the public near IPEC inquired about the total spent fuel pool and dry storage inventories at the site.

The life cycle of a fuel assembly (also called a fuel bundle) at IPEC is:

1. Fuel delivered to the site as new fuel for the reactors and stored in the new fuel storage area adjacent to the spent fuel pool storage

2. Placement in the proper spot in the reactor core during refueling and removal after irradiation (nominally four years)

3. Placement in a predetermined location in the spent fuel pool for cool down and decay for at least five years

4. Loaded into a spent fuel dry storage cask (stainless steel container welded shut) at some later time

5. Transport of the cask (or canister) which holds 32 fuel assemblies to the Dry Cask Storage Facility (also called the ISFSI)

6. Placement of the canister into a permanent shield that surrounds and shields the canister, and there cooled by air

7. Assumption of possession of the fuel canister and its spent fuel by DOE (this step could happen after Step 6 above if DOE were ready for it)

8. Shipment of the cask and fuel to the national repository (Yucca Mountain, Nev.) for perpetual storage The inventory of fuel onsite is tracked for control and planning purposes. While not mandatory, each plant owner desires to maintain a full core offload capability (FCOC) to make it convenient to do maintenance if all the fuel needs to be removed from the reactor.

To do so, 193 spaces in each of the Units 2 and 3 fuel pool would need to be left vacant while the plant is operating. All nuclear plants in the United States have been storing fuel since they started up. The spent fuel was to be removed by the DOE starting in 1998 but the federal government has failed in this responsibility and is not expected to be ready until after 2017. When the pools are nearly full, another option for storage is required. The NRC has licensed dry fuel storage in ISFSI for about half the plants in the United States.

The remaining plants will need to build ISFSIs in the future.

IPEC has licensed and constructed an ISFSI to serve all three units. The ISFSI has the capacity to store all of the spent fuel created during the current lifetimes of all three of the IPEC units. Should the lives of the Units 2 and 3 and their licenses be extended, Entergy anticipates that both DOE acceptance and shipping will occur or, absent the government performance, it will need to license and construct an additional pad as an extension of the existing ISFSI.

ISE 30

Indian Point Independent Safety Evaluation (ISE)

At Unit 1, 160 fuel bundles remain in the spent fuel pool as of June 2008. Entergy plans to move all of this fuel to dry cask storage before the end of 2008. This will result in an additional five casks in the ISFSI. At the end of 2008 the inventory of fuel bundles in the Unit 1 fuel pool will be zero, and the inventory in the ISFSI will be 160 in five dry fuel storage modules.

The Unit 2 fuel pool is close to full capacity, with 1,243 spent fuel assemblies as of June 2008. Three casks of fuel were loaded and transferred to the ISFSI in early 2008 in order to free up enough space for an FCOC. After the discharge of 96 fuel bundles from the Unit 2 spring 2008 outage (RFO 18) the FCOC was no longer available. Entergy plans to load and move nine canisters of fuel (32 fuel assemblies in each canister) in the spring and summer of 2009 to restore the FCOC. After that, the station will fill and transfer three to six canisters every two years to constantly provide FCOC, plus some free space in the pool even after the discharge of fuel at each refueling outage. The fuel pool inventory will be maintained at about 1,000 assemblies for the foreseeable future. By 2012 there will be about 576 spent fuel assemblies (18 full casks) stored in the ISFSI awaiting DOE taking ownership and shipping these fuel bundles to the national repository.

The fuel inventories at Unit 3 are lower, because the plant has not been operating as long as Unit 2. It is currently maintaining a FCOC. At each refueling outage, 96 or 97 fuel assemblies are added to the fuel pool. After the 2009 refueling outage the FCOC will be temporarily lost, however the transfer of 96 fuel bundles in the fall of 2009 and another 96 in the spring of 2011 will restore the FCOC. Routine transfers to the ISFSI will occur in the future to maintain the fuel pool inventory at about 1,200. This will continually reserve the FCOC. By the end of 2013 there will be 224 Unit 3 fuel bundles stored in the ISFSI.

ISE 31

Indian Point Independent Safety Evaluation (ISE)

Lowlevel Radioactive Waste (Issue #10)

IPEC, like all other nuclear plants in the United States, produces radioactive waste in the course of its normal work and operation. Rags, coveralls, gloves, paper wipes and tools become slightly contaminated, as they are used to work on contaminated equipment, floors and walls. These lowactivity items are classified as A waste.

Plant systems use filters and resins to remove impurities from liquids used in the plant and they are categorized as classes A, B and C wastes, with C having the highest associated radioactivity. This characterization is important because it dictates the treatment, processing, disposal and disposal costs for the waste.

Federal law requires that states form compacts and create disposal sites for these Class A, B and C lowlevel waste categories. Waste that is more radioactive than Class C is the responsibility of the DOE, and it includes spent fuel and other highlevel radioactive waste.

Three states - New Jersey, Connecticut and South Carolina - have formed the Atlantic Compact, and ship their lowlevel waste to Barnwell, S.C., which as of this year no longer accepts waste from outside the compact states. New York State has not created or joined a compact with disposal rights.

Class A waste can continue to be shipped to the Energy Solutions company treatment and burial site in Clive, Utah, and IPEC will continue this method of disposal. However, there are no current disposal sites for Class B and C waste. IPEC, like all other plants, will be storing its Class B and C waste onsite. There is a site in Richland, Wash. that accepts these higher class waste products, but is only receiving waste from nine Western states plus Alaska and Hawaii. These nine states are located in the Northwest and Rocky Mountain Compacts. The Texas Compact includes Texas and Vermont. A company called Waste Control Specialists has planned a disposal facility in Texas, but it is not yet licensed, and it is not clear whether it will accept waste from outside the Texas Compact. Another company is planning to negotiate with the Texas Compact to accept waste it collects and processes waste from plants outside the Compact states.

IPEC and other nuclear plants are constantly working on methods and procedures for reducing waste generation and volume. These efforts will continue, with added impetus.

Nuclear plants and other nuclear facilities (research centers, government facilities, hospitals, etc.) around the country have been safely transporting radioactive waste for decades. The shipments are packaged in containers specifically designed for the different levels of radioactive waste described above.

Onsite storage of waste has been practiced by nuclear plants for some time. IPEC will continue to do so until other options for processing or burial are developed. Proposals for ways to dispose of Class B and C wastes are being developed by two companies, Energy ISE 32

Indian Point Independent Safety Evaluation (ISE)

Solutions and Studsvik. The former is in the process of licensing a consolidation process that will result only in Class A waste burial under its existing license; it is not clear that Energy Solutions can obtain an NRC license for this approach. The second company, Studsvik, is partnering with Waste Control Specialists in Texas to take ownership of the waste, consolidate it and store and/or bury it at the Texas facility. Entergy considers this to be a more viable option.

For the time being, the waste will remain on site in the Interim Radwaste Storage Facility (IRWSF). This facility is a concrete building measuring 97 feet by 108 feet, designed and built for this purpose. Its walls are concrete two to three feet thick, and the roof is concrete one foot thick to maintain doses ALARA (as low as reasonably achievable). The facility was built to all of the NRC and EPA applicable standards and regulations. The waste is stored in the same containers that have been used for shipment from the site to disposal facilities.

Resins from the plant systems that remove radioactive constituents from water in the plant are mostly Class B and C wastes and are stored in the concrete transportation casks used for transport by truck to the treatment or storage sites discussed above. Lower level Class A is dry waste stored in 55 gallon drums which are also used for the shipment of this waste. The facility is sufficient to store the waste for many years as the waste storage issues are resolved.

In July 2007, the Kashiwazaki nuclear plant in Japan was subjected to a magnitude 6.8 earthquake. The four operating units safely shut down as designed. The health and safety of the public in the vicinity of the plant was protected, although there was a leak of about 315 gallons of radioactive water into the Sea of Japan. Authorities said the leak posed no problems to people or the environment. The plant, as designed, was able to withstand the earthquake without any significant operational problems. A 12member team from the International Atomic Energy Agency inspected the plant and concluded that there was no significant damage to the nuclear plant.41 Fiftyfive gallon drums containing Class A dry waste were stored at the Japanese plant in a facility similar to the IPEC IRWSF. These drums were stacked three high and several hundred were tipped over, some lids were opened as a result of the earthquake motion.

There was no airborne contamination detected in the facility and the contents were placed back in the drums which were resealed and restacked. As a corrective action, the Japanese plant decided to strap groups of drums together to prevent tipping under these circumstances.

The ISE Panel concludes that Entergy is carefully storing lowlevel radioactive waste as required by federal regulations. The storage is designed for interim storage between the closure of the Barnwell waste repository this year and the resolution of the national/state 41 AP, July 18, 2007 and February 1, 2008. NEI, July 19, 2007.

ISE 33

Indian Point Independent Safety Evaluation (ISE) radwaste issues or the licensing of additional waste repositories. Entergy is being proactive in its attempts to develop solutions for the ultimate disposal of this waste, so that it does not require storage at the IPEC site. The Panel recognizes that the station continues to ship Class A waste to a contractor for burial. Nevertheless, if 55gallon waste drums are stored in the IRWSF in the future, banding of groups of drums is a prudent precaution to preclude tipping due to earthquake motion.

ISE 34

Indian Point Independent Safety Evaluation (ISE)

Seismic Design (Issue #11)

A public concern was identified relating to a series of faults that are situated near IPEC, collectively known as the Ramapo fault system. There is additional concern that seismic hazard analysis needs to be updated.

The Ramapo fault is part of a system of faults, which run from southeastern New York to eastern Pennsylvania and beyond (see below42). The closest point of the fault is approximately five miles north of IPEC. The faults were active at different times during the evolution of the Appalachian Mountains. A proceeding held before a NRC Atomic Safety and Licensing Board in 1977 determined the Ramapo fault in the IPEC area has not moved in at least the last two million years and is considered to be old, inactive and therefore not a capable fault.

IPEC General Design Criterion 2 of Appendix A to 10 CFR Part 50 requires that nuclear power plant structures, systems and components important to safety be designed to withstand the effects of natural phenomena such as earthquakes without loss of capability to perform their safety functions. IPEC Units 2 and 3 were built to requirements of Zone 2 of 42 Figure obtained from www.earth.columbia.edu ISE 35

Indian Point Independent Safety Evaluation (ISE) the Uniform Building Code which corresponds to a Design Basis Earthquake (DBE) with an intensity of VII on the Modified Mercalli Scale. The range of expected horizontal acceleration of ground motion for earthquakes of this intensity is 70 to150 cm/sec2 near the epicenter or about 0.15g max. At a distance of 100 miles from the epicenter, the acceleration would be half of this. Since the Unit 1 reactor was shutdown and the fuel removed, it was found acceptable that it was designed for a lesser value. If it were to be reactivated it must be retrofitted to sustain an acceleration of 0.15g. The Operating Basis Earthquake (OBE) is a smaller earthquake than the DBE and therefore plant equipment is designed to remain functional during and after the OBE. The OBE has a maximum horizontal peak ground acceleration of 0.1g versus 0.15g for the DBE. IPEC monitors seismic activity at the site using seismic recorders located in the Unit 3 containment building. The recorders are set to alarm in the Unit 3 control room when seismic activity is recorded at a level well below the OBE.

The licensing basis for existing nuclear plants used historical data at each site to analyze design basis loads from the areas maximum credible earthquake. This process assumes an earthquake could happen at any time. While the initial licensing process did not include a probabilistic assessment of earthquake hazards or their potential impact, the NRC later required all nuclear plants to assess their potential vulnerability to earthquake events, including those that might exceed the design basis, as part of the Individual Plant Examination of External Events Program. This process considered the available safety margins of existing nuclear plants for various earthquakes, and ensured these margins -

together with the plants accident management programs - continue to protect public health and safety. In December 2004, the NRC responded to Riverkeeper questions identifying concerns about existing seismic hazard analysis for IPEC (NRC letter to Riverkeeper, Inc. dated 12/15/04 (ML042990090)). The NRC concluded that the seismic conditions at the IPEC site have undergone thorough geologic and seismic investigations, and that the seismic design provides a sufficient safety margin from potential damaging earthquakes.

In recent years, new methodologies for performing probabilistic seismic hazard analyses have been developed, as captured in ASCE 43 (Seismic Design Criteria for Structures Systems and Components in Nuclear Facilities). Hence new nuclear reactors will be built to meet the NRCs new seismic criteria 10 CFR Part 100.23 (Geologic and Seismic Siting Criteria), which will result in a probabilistic, performancebased approach to establish the plants seismic hazard and the seismic loads for the plants design basis. For new siting applications, the NRC issued Regulatory Guide 1.208, A PerformanceBased Approach to Define the SiteSpecific Earthquake Ground Motion, which reflects these innovations.

Application of the new methodologies results in probabilistic seismic hazard ground spectra that differ from traditional ground motion spectra developed based on previous guidance in terms of frequency, content and amplitudes.

ISE 36

Indian Point Independent Safety Evaluation (ISE)

Consistent with the scope of the ISE, the expertise of ISE Panel members in the technical aspects of seismic design does not compare with the technical expertise that has been involved to date in the technical discussion and resolution of the original and ongoing seismic licensing basis at IPEC. However, since the issue of seismic qualification is a question that is frequently raised by the public, particularly in light of recent earthquakes in Japan that impacted operating nuclear plants, the Panel conducted a review of the history of seismic design requirements and licensing at IPEC. Upon this review, the Panel determined that the current seismic licensing basis of IPEC is technically sound, and that the approach to seismic design is consistent with the approach of nuclear plants throughout the country.

ISE 37

Indian Point Independent Safety Evaluation (ISE)

Reactor Vessel Head (Issue #12)

Reactor vessel heads for pressurized water reactors like those at IPEC have sleeves designed to penetrate the heavy metal wall of the head for the control rod drive shafts.

These sleeves, or tubes, are shrink fitted into drilled holes in the six inch thick vessel head and then seal welded to the underside of the head by a Jgroove weld.

The head is made of a carbon steel material with a weld applied layer of stainless steel on the underside surface to prevent corrosion from contact with the primary coolant water, which contains boric acid. The control rod drive tubes are fabricated from a nickel alloy corrosion resistant metal, Inconel 600. Operating experience has shown that some of these tubes, or the Jgroove welds, can experience small cracks that can allow the water to come in contact with the carbon steel of the head resulting in corrosion of the carbon steel.

The NRC and the U.S. nuclear industry have studied the factors that can cause this cracking and have classified plants into one of three risk categories based on materials used, time in service and operating temperature of the head. These risk categories defined the order and frequency in which plants were required to perform visual and volumetric (UT) examinations of the welds and penetration sleeves. In late 2007, Beaver Valley in Pennsylvania, a plant with moderate risk for cracking, found a small axial indication in a penetration sleeve during a routine planned inspection. Axial indications are less safety significant than circumferential indications. This finding like all new inspection data, was evaluated to determine if inspection frequency changes should be made by the NRC. No changes in inspection frequency were deemed necessary as a result of the Beaver Valley data.

Volumetric examinations of reactor vessel heads are expensive, and often require critical path refueling outage time to complete. The examinations are required by the NRC at a frequency that ensures safety is maintained. A number of nuclear plant owners have made a business decision to replace the existing heads with new heads containing penetration sleeves made from a different material, Inconel 690, which is less susceptible to cracking.

These new heads have a less frequent inspection cycle.

The IPEC Units 2 and 3 head penetrations have been volumetrically examined and no cracks or indications of concern have been detected. Unit 3s head was last examined in 2007 and will be inspected every two years going forward. Unit 2 was volumetrically examined in 2006 and was visually inspected in 2008. Going forward, it will be volumetrically examined every two years until the current operating license expires, or the head is replaced. Entergy has purchased steel forgings for new reactor vessel heads for Units 2 and 3. The replacement dates are tentatively planned for Unit 2 in 2012 and Unit 3 in 2013. However, head replacement requires a large capital expenditure. It also has a significant impact on the refueling outage length in the year of replacement. The final decision on replacement awaits the results of the license renewal application that has ISE 38

Indian Point Independent Safety Evaluation (ISE) been filed with the NRC. The current licenses expire in 2013 and 2015 for Units 2 and 3 respectively.

ISE 39

Indian Point Independent Safety Evaluation (ISE)

Reactor Vessel Internals (Issue #13)

A public concern was identified regarding the adequacy of IPECs plan to manage the aging of reactor vessel internal components due to embrittlement and fatigue beyond the current license period.

The reactor pressure vessel is the primary container that holds the nuclear fuel and serves as a key part of the reactor coolant's pressure boundary. Reactor vessel internal components such as split pins, baffle/former bolts, edge bolts, and corner edge bracket bolts are made of metal, and therefore are susceptible to fatigue and embrittlement due to neutron irradiation. Extension of the operating license beyond the existing licensing period will result in increased fatigue and embrittlement of these components.

Entergy has submitted an Aging Management Plan for the reactor vessel internals as part of the license renewal application process. Entergys approach to aging management is consistent with NRC guidelines and with other plants in the industry. Reactor vessel internals are currently monitored for aging and degradation via periodic inspections of reactor vessel internals, as well as inspections in response to industry issues. Additionally, reactor vessel internals are monitored in real time for failure with a metal impact monitoring system which would immediately detect reactor vessel internal component failures before the failures would jeopardize the integrity of the reactor coolant system.

Two current industry issues with reactor vessel internals are:

• Baffle bolt cracking, which has been observed at a few nuclear plants where 5 percent or fewer of the bolts were found to be cracked. The Westinghouse Owners Group analyzed the structure and bolting finding that up to 50 percent of the bolts could fail before structural integrity, and therefore safety, was compromised. Based on Westinghouses analysis, and routine visual inspections that have not found cracking, IPEC has continued to monitor developments, new bolt materials and replacement methods, but has not replaced any bolts to date.

• Split pin failures have been observed in a few nuclear plants. These pins support the control rod guide tube by orienting and holding the guide tube in proper alignment with the upper end fitting of the fuel assembly. The failures of this pin have been attributed principally to the material heat treatment of the pins during the original fabrication and installation.

Modification of the split pins improves component performance, reducing the potential for a failure causing loose parts to migrate to the steam generator. IPEC has replaced split pins in Unit 3 in 1989 and has plans to replace them again in March 2009 based on vendor recommendations. Unit ISE 40

Indian Point Independent Safety Evaluation (ISE) 2 split pins were replaced in 1995 and are scheduled to be replaced again in 2012 based on vendor recommendations.

The ISE Panel reviewed programs and plans for monitoring and replacement of reactor vessel internal components and concluded that they are appropriate to support safe operations of the plant. The license renewal application process is considered adequate to ensure aging management plans cover the aging of reactor vessel internal components beyond the current license period.

ISE 41

Indian Point Independent Safety Evaluation (ISE)

Cable Separation (Issue #15)

A public concern was identified regarding the accuracy of the IPEC Unit 2 cable and raceway electronic database following the execution of a software program conversion.

The conversion resulted in numerous data conversion anomalies.

In 2001 Entergy converted IPEC Unit 2s Wire and Raceway System (WARS) to the Electrical Cable and Raceway System (ECRIS) which is a standard program for Entergy.

The Data Transfer Verification Report (DTVR) consisted of over 300 pages of anomalies as a result of the conversion process. In February 2004, a former Entergy employee filed a formal allegation letter with the NRC concerning these anomalies. In March 2004, the NRC performed an inspection of the specific issues associated with data anomalies generated from conversion from WARS to ECRIS and examined more broadly electrical cable separation at IPEC Unit 2. The NRCs assessment of the database conversion issues determined that the anomalies in the database conversion report represented inaccurate data in the WARS database and inconsistencies between the unique cable separation logic used at IPEC Unit 2 and the generic cable separation logic used by ECRIS.

The NRC inspectors concurred with Entergys determination that the conditions did not impact system operability for installed cables because Entergys processes for cable routing were manual and did not rely on the WARS or ECRIS databases. None of the anomalies reviewed by the NRC inspectors impacted the capability of plant equipment to perform its intended function or involved installed cables that did not meet cable separation criteria. The inspectors findings were related to cable separation program documentation, implementation of design controls, and the timeliness of corrective actions associated with the database anomalies and design activities. IPEC Unit 2s Design Basis Initiative (DBI) Project, identified as DBI Project PI10, Electrical Separation Program Improvements was revised to resolve the NRC inspection report findings. The PI10 project included reviewing and updating criteria documents, training, walk downs, resolution of data anomalies and new cable installation reviews. From 2004 to 2006, Entergy implemented the PI10 DBI Improvement Project plan resulting in, among other things, a major rewrite of the ECRIS program. The PI10 Project was closed in 2007 upon resolution of the allegation and all related NRC findings. Items remaining to be completed are administrative in nature and include ECRIS and drawing updates as well as the formalization of engineering evaluations. The remaining open items are planned to be completed by the end of 2009.

The ISE Panel reviewed the concerns related to cable database conversion anomalies and cable separation and concluded that there is no safety concern related to cable separation at IPEC.

ISE 42

Indian Point Independent Safety Evaluation (ISE)

Decommissioning Funds (Issue #25)

All nuclear power plants collect money and put it in escrow to fund the endoflife decommissioning of the plant. The question is often asked whether that funding and its growth will be adequate to accomplish the decommissioning project.

The schedule and annual contributions to each plants decommissioning fund are dictated by both federal and state laws and regulation. The funds are required to be conservatively invested so that they are constantly growing. Annual contributions plus interest result in a fund that is growing much faster than inflation. Periodically, each company revises the forecast for decommissioning costs at the end of life. Projections of the value of the fund are then compared with the projected cost to ensure the fund will be adequate. Eventually the fund is large enough that annual contributions are no longer needed, and interest alone will create a fund adequate to pay for decommissioning.

All three IPEC units have sufficient money in their decommissioning funds that contributions are no longer required. Escalation of 3 percent and a rate of earnings of 5 percent are assumed. The estimates of the current fund amount (as of December 2007),

the decommissioning cost and the fund balance projected to the middle of the decommissioning project are shown in the table below for each IPEC nuclear unit43:

IPEC Decommissioning Funds (Millions of dollars)

Current Fund Amount Decommissioning Projected Fund (Dec 2007) Cost Estimate Balance at Decommissioning Unit 1 271 413 420 Unit 2 347 500 539 Unit 3 468 529 801 In each case the current fund is adequate to produce the needed balance in the middle of the decommissioning using the inflation rate and investment rate of earnings.

The ISE Panel notes that the assumed inflation rate and rate of earnings are typical of those used in similar analyses at other nuclear plants. In addition, it is evident that the 43 Entergy Report to the NRC, Decommissioning Fund Status Report, May 8, 2008 ISE 43

Indian Point Independent Safety Evaluation (ISE) decommissioning fund for each IPEC nuclear unit is adequate to pay for the decommissioning of the unit at the end of its licensed life.

Entergy has the liability for decommissioning Units 1 and 2 and the funds for these two plants were provided to Entergy by the previous owner, Consolidated Edison. The New York Power Authority (NYPA), the former owner of IPEC Unit 3, retained both the liability and funding for the Unit 3 decommissioning. We understand that NYPA can transfer the liability for decommissioning of Unit 3 to Entergy as long as they simultaneously transfer an adequate Unit 3 decommissioning fund as well.

ISE 44

Indian Point Independent Safety Evaluation (ISE)

Fire Watches (Issue # 29)

The public near IPEC questions whether the control, execution and documentation of fire watches at IPEC can be assured in light of a significant problem that emerged at another nuclear power plant. A related concern is whether performing fire watches degrades security operations effectiveness.

The failure referred to occurred at the San Onofre Nuclear Station and involved a complete breakdown of the plant managements oversight of the conduct of fire watches being performed by a contractor. The contractor willfully violated the requirements of his directions and responsibility and covered up his negligence. The plant management and staff failed to catch the negligent performance for several years.

Fire watches consist of a monitoring assignment for location(s) in the plant. These watches are temporary and compensatory when there is a deficiency in the installed fire alarm system, or some other exception to the requirements of the plants fire protection programs required for safe operations. These measures are allowed by the program requirements. Typically, the licensed plant operators interpret the requirements and identify the need for a fire watch. The manner in which a fire watch is conducted is spelled out in the formal fire protection program at each plant.

At IPEC, the responsibility for initiating and ensuring the proper conduct of fire watches lies with the Operations Department. The actual conduct of the watches is monitored by Operations Department management and the Security Department assists by providing random monitoring of the card readers (computerlinked locks on certain doors) throughout the plant to make sure the fire watch assignee is at his/her post or conducting their firewatch tours. At IPEC, most fire watches are carried out by plant personnel, although contractors under the supervision of the Operations Department are used on occasion. Security officers may also be utilized to perform this task, but only when it can be shown that it will not interfere with the officers security duties in the opinion of the Security Department management. Other personnel will be utilized if security personnel are not available or approved for these assignments.

The ISE Panel determined that the use of IPEC personnel for fire watches and the clearly defined accountability for the IPEC program implementation by IPEC management and supervision provides a high and proper level of assurance of performance for this important activity. Furthermore, the Panel concludes that the assignment of IPEC security officers to these duties is carefully controlled by Security Department management, resulting in no degradation of overall plant security.

ISE 45

Indian Point Independent Safety Evaluation (ISE)

Containment Integrity (Issue #30)

A public concern was identified regarding the integrity of the containment structure based on the watertocement ratio used in the concrete for the IPEC containment buildings. The concern is that the strength and durability of the concrete could be affected over time.

Watertocement ratio is a measure of the density and strength of the concrete used. In general the lower the ratio, the stronger the concrete, however low ratios make the concrete less fluid, and therefore harder to fabricate. The containment buildings at IPEC were constructed of reinforced concrete. Records show that watertocement ratios of up to 0.57 were used during the construction of the containment buildings. These ratios met the specifications at the time of construction. NRC guidance for license renewal Aging Management Programs contained in NUREG1801 (Generic Aging Lessons Learned Report) suggests that ratios of 0.35 to 0.45 are desired in inaccessible areas to minimize the need for additional evaluation when developing an Aging Management Program, but this range is not a requirement. The aging mechanism of concern for an Aging Management Program is loss of material (spalling, scaling) and cracking from freezing and thawing. Typical inspections would find such problems in accessible areas, so the concern is only for inaccessible areas. While the watertocement ratios for some of the concrete at IPEC did exceed 0.45, samples of all concrete were collected during construction, cured and tested to verify the specified strength. IPEC watertocement ratios were in accordance with requirements of the version of American Concrete Institute (ACI) 318, Building Code Requirements for reinforced concrete at the time of construction, which allowed a ratio of up to 0.576.

Visual inspection of the concrete for signs of cracking and spalling are required by the ASME Section 11 IWL Code and are being performed. Visual inspections have shown only minor spalling where surface grout repairs were made during construction, but no structural concerns have been observed. The structural integrity of the buildings and their leak tightness has been verified by testing. A structural integrity test to verify the design accident condition was performed on both units. The buildings were pressurized to 54 psig (115 percent of the peak pressure calculated for worst accident conditions). Unit 2 was tested in March 1971 and Unit 3 in January 1975. Integrated Leak Rate Tests (ILRT) are performed periodically to pressurize the containment buildings to 47 psig and measure total leakage. During these tests the building expands several inches, and the concrete is therefore expected to experience minor cracking due to the physical growth of the structure. Visual inspections are performed during and following the test to observe for unexpected cracking or spalling of the concrete. The last tests were performed on Unit 2 in the spring of 2006 and Unit 3 in the spring of 2005 with no structural concerns identified.

The ISE Panel reviewed program and test records and interviewed structural engineers, and concluded that there are no safety concerns related to the watertocement ratio of ISE 46

Indian Point Independent Safety Evaluation (ISE) the concrete used in the construction of IPEC containment buildings. The containments are in good condition and the continued routine monitoring and testing will assure the quality is maintained.

ISE 47

Indian Point Independent Safety Evaluation (ISE)

Cranes (Issue #31)

A public concern was identified regarding the adequacy of crane specifications since some IPEC crane requirements come from standards that are more than 30 years old. Additional questions were raised about load testing of IPEC cranes in light of a May 2008 incident at Vermont Yankee where the brakes on the crane lifting a loaded spent fuel cask out of the spent fuel pool failed to work properly.

The following major cranes (listed with their capacity and the applicable standards to which they were designed) are used for nuclear operations at IPEC:

Units 2 and 3 polar cranes (175ton capacity) were designed/constructed prior to issuance of specifications CMAA70 (Specifications for Top Running Bridge and Gantry Type Multiple Girder Electric Overhead Traveling Cranes) and ASME B30.2 (Overhead and Gantry Cranes) but have been evaluated and found compliant with these standards.

Unit 2 dry cask storage gantry crane (110ton capacity) was designed to CMAA70, NOG1 (Rules for Construction of Overhead and Gantry Cranes), NUREG0612 (Control of Heavy Loads at Nuclear Plants), and 0554 (Single Failure Proof Cranes).

Units 2 and 3 fuel storage building overhead cranes (40ton capacity) were designed/constructed to purchase specifications since current codes/standards were not in existence.

Unit 1 fuel handling building crane (75 ton capacity) was designed/constructed to purchase specifications since current codes/standards were not in existence.

AMSE B30.2 requires that, prior to initial use, all new, extensively repaired, or altered cranes should be load tested using not more than 125 percent of the rated load. The gantry crane installed in the Unit 2 fuel storage building was load tested to 125 percent of rated capacity. A Safety Evaluation Report has been issued by the NRC indicating that this crane was safe for use in handling dry cask storage components. In preparation for the Unit 1 dry cask storage operation, the Unit 1 fuel handling building crane was modified and both visually inspected and nondestructively examined. Prior to lifting any of the Unit 1 dry cask components, the crane will be proofload tested to its rated capacity.

All cranes at IPEC are maintained and inspected per station procedures and in accordance with ASME B30.2. All cranes are operated in accordance with station procedures and movement of loads greater than 2,000lbs are controlled in accordance with Entergy procedure ENMA119, Material Handling Program. All movements of heavy loads must be performed with a safe load path defined and qualified riggers/crane operators. Any heavy load movements made in the vicinity of safetyrelated equipment must also have a review ISE 48

Indian Point Independent Safety Evaluation (ISE) performed in accordance with 10 CFR 50.59 (Changes, Tests and Experiments). Crane operators are required to perform frequent visual inspections of the crane prior to each use or at the beginning of each shift. Since failure of the upper limit switches could cause a twoblock event, severely damage the crane, drop the hook load block and cause personnel injury, the operator is required to test upper limit switches prior to lifting. EN MA119 specifies that existing plant cranes that were installed prior to 1967 are not required to be retrofitted to meet the latest revision ASME B30.2. However, if a crane or component of the crane is modified in a way that substantially changes its performance, then the crane or component should be brought up to the latest revision of ASME B30.2.

The ISE Panel reviewed the status of the cranes that are used for lifting heavy loads at IPEC and determined that the programs and procedures used are appropriate to support safe operations of the plants.

ISE 49

Indian Point Independent Safety Evaluation (ISE)

Turbine Fire (Issue #32)

A public concern was identified regarding an incident at IPEC Unit 3 that involved a fire in the highpressure turbine.

In April 2003, following a refueling outage, oilsoaked insulation pads on the Unit 3 high pressure turbine caught on fire due to the heat of the turbine. Operators manually tripped the reactor and turbine and the fire was put out by the fire brigade with the use of the turbine CO2 fire suppression system and local suppressant application. Due to the large quantities of lube oil used by large turbine generators, it is not uncommon in the electrical generation industry to experience small fires. Therefore, firefighting capabilities such as CO2 fire suppression systems are factored into the design of electric generation plants.

An analysis of the fundamental causes of this fire determined that inadequate reassembly of a turbinebearing oil deflector after maintenance resulted in an oil leak that went undetected, and soaked the turbine insulation. The inadequate assembly was found to be due to inadequate supervision and enforcement of quality standards, along with inadequate planning and contractor procedures. Corrective actions included procedure changes, modification of the turbine project planning process, and the involvement of the Quality Assurance organization in turbine work oversight. The event did not present a substantive challenge to any systems, structures or components important to safety, and redundant safeshutdown capability was not compromised by the fire.

The ISE Panel reviewed the plants evaluation of the causes and corrective actions taken for the highpressure turbine fire incident, and considers them appropriate.

ISE 50

Indian Point Independent Safety Evaluation (ISE)

Cooling System Debris/Ice Blockage (Issue #33)

The public is aware that incidents involving debris blocking the service water bay have occurred at IPEC, and members of the public expressed concern that debris or ice could continue to block the service water bay and affect the safety of the plant.

The intake structure consists of a series of vertically mounted rails, called trash racks, to filter out large debris from entering the common intake bay. A wiremesh screen was attached to the trash racks in 1997 to extend three feet above and below the mean river level. The screen mesh prevents small debris from entering the traveling water screens and clogging the debris and fish return trough. Once the water passes the traveling water screens, it enters the pumps for the circulating water and service water systems.

In November 2005, Unit 3 operators discovered that low tides and debris on the intake structure trash racks were adversely impacting service water pump bay level, so the plant hired a contractor to clean the screens. At that time concerns were raised about the ability to determine when the station had entered an unusual event as defined in the emergency plan. As a result of these concerns, the plant required operators to enter the service water bay each shift and log whether the level was acceptable or not. In addition, a level monitoring device was installed to provide information on service water bay level. It was later determined that the expedited process used to install this level indicator was incorrect and resulted in the level detector being installed six inches too high. The level indicator should have been installed using the more rigorous design modification process normally used to modify most plant equipment, especially equipment important to safety.

In February 2007, a Notification of Unusual Event was issued due to Unit 3 service water bay level being lower than required. The direct causes of the low water level in the service water bay were (1) the trash racks were significantly clogged with debris, and (2) the actual low tide was 21/2 feet lower than expected due to strong winds. The debris accumulating on the screens was heavier on the lower parts of the screens; therefore the water passing through the intake at lowtide levels encountered more resistance to flow.

The root cause investigation of this event concluded that the preventative maintenance program to clean the screens once every four years did not adequately ensure debris on the trash racks was minimized. Following the incident, the frequency of cleaning the trash racks for preventive maintenance was dramatically increased to every 6 months, due to the high debris loading in the fall and spring months. The root cause evaluation also determined that operating procedures did not consider actions that could be taken to preclude reaching the unusual event threshold. Appropriate procedures have since been modified.

Historically, IPEC has not experienced issues associated with intake structure blockage due to ice loading, pancake ice or frazil ice and therefore the installed deicing systems ISE 51

Indian Point Independent Safety Evaluation (ISE) were retired. Diver reports indicate that while small portions of ice can be seen, the ice that is present is predominantly above the flow of water and does not block intake flow.

The ISE Panel determined that appropriate procedures, instrumentation and equipment are currently in place to detect intake blockage and prevent blockage from having adverse safety consequences.

ISE 52

Indian Point Independent Safety Evaluation (ISE)

Flow Accelerated Corrosion (Issue #36)

During the work of the ISE Panel, members of the public raised a concern about the adequacy of IPECs program to minimize the effects of FlowAccelerated Corrosion (FAC).

FAC is a corrosion mechanism in which the normally protective oxide layer on metal surfaces is removed or dissolves in a fast moving flow of water. The metal beneath then corrodes to create another protective oxide and the sequence continues, thinning the wall of the pipe. A failure caused by this mechanism occurred in a nuclear plant nonsafety system in 1986 with very severe consequences to the plant and its staff.

Stainless steel, which is used in the reactor and safety systems, is not affected by this corrosion mechanism. The Electric Power Research Institute (EPRI), funded by the nuclear industry, performed work to better define the mechanism of FAC and to develop a successful FAC program. The documents published about the FAC programs can be used by each steam power plant or process plant to organize its engineering resources, industry experiences and technology to identify pipe wall thinning due to FAC as early as possible.

EPRI also created, and has since improved, a family of computer codes (CHECWORKS) which can be used as a predictive tool to assist in the planning of inspections and in evaluating inspection results to prevent pipe failures due to FAC. Training and workshops are conducted by EPRI to help power plant staffs get the most out of the codes and program elements. These learning opportunities allow for sharing of industry knowledge and success factors for FAC programs. While the application of these techniques has not completely stopped leaks and ruptures of large pipes, it has substantially reduced the probability of a consequential event from FAC.

Entergy has established FAC programs at all of its plants and has continued the programs started at IPEC by the previous owners. This program is based on EPRI Report NSAC 202L R3 and NRC Generic letter 8908. It requires constant work and planning so that the most vulnerable areas of steam and hotwater pipes can be inspected during plant outages and repaired or replaced depending on the inspection data. The corrosion rate of FAC can be estimated, so careful data analyses and inspection is highly successful in identifying piping sections that should be watched and inspected frequently. The IPEC staff conducts about 100 piping inspections each refueling outage to monitor FAC.

The ISE Panel notes that an FAC program at IPEC, consistent with the EPRI recommendations, is in place and operating such that inspections and repairs are made at every refueling outage. This program has been successful at precluding major leaks and ruptures of large steam and hot water piping. The effectiveness of this program is not only important to personnel safety, but also to plant operation, safety and availability. The program has also been shown to reduce forced outages, improve capacity factors and has reduced the cost of operation and maintenance of IPEC Units 2 and 3.

ISE 53

Indian Point Independent Safety Evaluation (ISE)

Asbestos (Issue #37)

A public concern was identified regarding the asbestos existing at IPEC due to the construction vintage of the plants. The concern is that existing asbestos in the plant presents a personnel safety hazard.

Asbestos was the insulation of choice in power plants and other industrial settings for decades due to its strength, flexibility and its high resistance to heat and fire. However, loose asbestos fibers in the air could be inhaled by workers, lodge in the lungs, and eventually build up to cause scarring and inflammation over long periods of time. OSHA first regulated asbestos in 1971, and has adopted existing federal standard for asbestos which consist of permissible exposure limits.

Prior to 2004 at IPEC, control of asbestos was implemented using a bulk sampling method to determine and quantify the amount of Asbestos Containing Material (ACM) in a specific area or designated system. After 2004, asbestos sampling was performed on a caseby case basis for a specific job scope to determine if and where ACM existed. Asbestos repair, encapsulation or removal is performed in support of ongoing work scope and projects.

Currently, Entergy Nuclear Northeast has an Operations and Maintenance Asbestos Program at IPEC which is fully integrated with the plants maintenance program and complies with Part 56 of Title 12 of the Official Compilation of Codes, Rules and Regulations of the State of New York (12 NYCRR Part 56) for all asbestos repair, encapsulation or removal projects. Repair, encapsulating and removing minor quantities of asbestos materials occur on an asneeded basis to support scheduled work activities by licensed Entergy employees or licensed supplemental workers. Variance petitions for miscellaneous removals are implemented for specific activities as needed.

Additionally, Hillmann Environmental Group acts as an independent thirdparty project monitor and project designer for repair, encapsulation or removal projects.

The ISE Panel has determined that IPECs asbestos program meets industry standards, and that there are no personnel safety concerns related to asbestos at IPEC.

ISE 54

Indian Point Independent Safety Evaluation (ISE)

Microbiological Influenced Corrosion (Issue #39)

Members of the public have raised a concern about the longterm effect of Microbiologically Influenced Corrosion (MIC) on stainless steel components at IPEC.

MIC is corrosion that is promoted by microorganisms or bacteria. Whereas general corrosion affects the entire surface or at least the wetted surface, MIC is localized. The primary concern with MIC is that it can result in an extremely accelerated rate of corrosion in localized areas. It affects most alloys, including stainless steel. This form of corrosion attack is characteristic of open loop raw service water systems, in which the water is from untreated sources around the plant, so called raw water. While MIC, under the right conditions can attack various types of metal pipes, experience has shown that it is primarily an issue in low flow or stagnant portions of cooling water systems, where the pipe surface is not protected from the untreated cooling water. Plant process systems that use treated water or other fluids are not usually affected by MIC, and are covered by inspection and testing programs to detect any degradation in piping integrity.

Entergy has implemented a Generic Letter 8913 (Service Water System Problems Affecting SafetyRelated Equipment) Service Water Program at IPEC. This program provides instructions for performing service water pipe inspections, and giving particular attention to areas subject to MIC, such as dead legs of piping. The program specifies that the service water system should be continuously chlorinated, or treated with an equally effective biocide, whenever the potential for a macroscopic biological fouling species exists (for example, during spawning). Standby and infrequently used cooling loops are flushed and flow tested periodically at the maximum design flow to ensure that they are not fouled. Other components in the service water system are tested on a regular schedule to ensure that they are not fouled. Service water cooling loops are filled with chlorinated or equivalently treated water before layup. Systems that use raw service water as a source, such as some fire protection systems, are also chlorinated or equally effectively treated before layup to help prevent MIC44.

The ISE Panel notes that the Generic Letter 8913 Service Water Program at IPEC effectively results in frequent inspections and timely repairs when necessary.

44 EPRI Recommendations for an Effective FlowAccelerated Corrosion Program (NSAC202LR3) May 2006 ISE 55

Indian Point Independent Safety Evaluation (ISE)

Appendix 4: List of Acronyms Abbreviation Description 9/11 September 11, 2001 terrorist attacks 24/7 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day, 7 days a week Alignment Corporate Alignment ASLB Atomic Safety and Licensing Board ASME American Society of Mechanical Engineers ATC Air Traffic Controllers CAS Central Alarm System CBOP Continuing Behavioral Observation Program CCTV Closed Circuit Television CEO Chief Executive Officer CFR United States Code of Federal Regulations ConEd Consolidated Edison Company CR Condition Report DBT Design Basis Threat DOE United States Department of Energy ECP Employee Concerns Program ENS Emergency Notification System EOF Emergency Operations Facility EP Emergency Preparedness EPA United States Environmental Protection Agency EPIP Emergency Plan Implementing Plan EPRI Electric Power Research Institute ISE 1

Indian Point Independent Safety Evaluation (ISE)

EPZ Emergency Planning Zone EQ Environmental Qualification ERF Emergency Response Facility ERO Emergency Response Organization FAA Federal Aviation Administration FBI Federal Bureau of Investigation FEMA Federal Emergency Response Agency FFD Fitness for Duty FIN fixitnow FRP Federal Response Plan GIS Global Information System GPU GPU Nuclear Corporation HPN Health Physics Network HVAC Heating, Ventilation and Air Conditioning System I&C Plant Instrumentation and Controls IAEA International Atomic Energy Agency IMP Insider Mitigation Program INPO Institute of Nuclear Power Operations IPEC Indian Point Energy Center ISA Independent Safety Assessment ISE Independent Safety Evaluation ISFSI Independent Spent Fuel Storage Installations JIC Joint Information Center kV Kilovolt ISE 2

Indian Point Independent Safety Evaluation (ISE)

LFA Lead Federal Agency LLEA Local Law Enforcement Agencies MEMA Massachusettes Emergency Management Agency MIT Massachusettes Institute of Technology MMPI Minnesota Multiphasic Personality Inventory mph miles per hour MW Megawatt NEI Nuclear Energy Institute NFPA National Fire Protection Association NOV Notice of Violation NRC U.S. Nuclear Regulatory Commission NYNG New York National Guard NYNM New York Naval Militia NYPA New York Power Authority NYSP New York State Police OCA Owner Controlled Area ODMI operational decisionmaking issue OSC Operations Support Center OWAs operations workarounds PA Protected Area PI&R problem identification and resolution PMs critical preventive maintenance actions POD plan of the day PRA Probabilistic Risk Assessment ISE 3

Indian Point Independent Safety Evaluation (ISE)

PS&O Plant Scheduling and Outage PSC Public Service Commision psig Pounds per Square Inch QA Quality Assurance RECS Offsite Notification System RO Reactor Operators RTL Response Team Leaders SAS Secondary Alarm System SRO Senior Reactor Operators SSC power block system, structure or component SWAT Special Weapon and Tactical TSC Technical Support Center VA Vital Area VFD volunteer fire department an integrated automated status board system that can be viewed WebEOC throughout the system ISE 4