IR 05000286/2007006
ML080320244 | |
Person / Time | |
---|---|
Site: | Indian Point ![]() |
Issue date: | 02/01/2008 |
From: | Doerflein L Engineering Region 1 Branch 2 |
To: | Joseph E Pollock Entergy Nuclear Operations |
References | |
FOIA/PA-2011-0258 IR-07-006 | |
Download: ML080320244 (58) | |
Text
February 1, 2008Mr. Joseph E. PollockSite Vice PresidentEntergy Nuclear Operations, Inc.Indian Point Energy Center450 Broadway, GSBP.O. Box 249Buchanan, NY 10511-0249SUBJECT:INDIAN POINT NUCLEAR GENERATING UNIT 3 - NRC COMPONENT DESIGNBASES INSPECTION REPORT 05000286/2007006
Dear Mr. Pollock:
On December 18, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed aninspection of Indian Point Nuclear Generating Unit 3. The preliminary inspection results werediscussed with Messrs. P. Conroy and T. Orlando and other members of your staff at thecompletion of the on-site inspection activities on November 8, 2007. Following in-office reviewsof additional information, the final results of the inspection were provided by telephone toMessrs. P. Conroy and T. Orlando on December 18, 2007, and to Mr. P. Conroy on January 29,2008. The enclosed inspection report documents the inspection results.The inspection examined activities conducted under your license as they relate to safety andcompliance with the Commission's rules and regulations and with the conditions of your license. This particular inspection was performed by a team of NRC inspectors and contractors usingNRC Inspection Procedure 71111.21, "Component Design Bases Inspection." In conducting theinspection, the team examined the adequacy of selected components and operator actions tomitigate postulated transients, initiating events, and design basis accidents. The inspection alsoreviewed Entergy's response to selected operating experience issues. The inspection involvedfield walkdowns, examination of selected procedures, calculations and records, and interviewswith station personnel. This report documents six NRC-identified findings that were of very low safety significance(Green). Five of these findings were determined to involve violations of NRC requirements. However, because of the very low safety significance of the violations and because they wereentered into your corrective action program, the NRC is treating the violations as non-citedviolations (NCV) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contestany NCV in this report, you should provide a response within 30 days of the date of thisinspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission,ATTN: Document Control Desk, Washington, D.C. 20555-0001; with copies to the RegionalAdministrator, Region I; the Director, Office of Enforcement, U.S. Nuclear RegulatoryCommission, Washington, D.C. 20555-0001; and the NRC Resident Inspectors at Indian PointUnit 3.
J. Pollock2In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, itsenclosure, and your response (if any) will be available electronically for public ins pection in theNRC Public Document Room or from the Publicly Available Records component of NRC'sdocument system (ADAMS). ADAMS is accessible from the NRC Web site athttp://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Lawrence T. Doerflein, ChiefEngineering Branch 2Division of Reactor SafetyDocket No. 50-286License No. DPR-64
Enclosure:
Inspection Report 05000286/2007006
J. Pollock2In a
REGION IDocket No.50-286License No.DPR-64Report No.05000286/2007006Licensee:Entergy Nuclear NortheastFacility:Indian Point Nucl ear Generati ng Unit 3Location:450 Broadway, GSBBuchanan, NY 10511-0308Dates:October 1 to November 8, 2007 (on site)November 13 to December 18, 2007 (in-office)Inspectors:L. Scholl, Senior Reactor Inspector (Team Leader)S. Pindale, Senior Reactor InspectorJ. Richmond, Senior Reactor InspectorG. Ottenberg, Reactor InspectorT. Sicola, Reactor InspectorO. Mazzoni, NRC Instrumentation and Controls Contractor S. Kobylarz, NRC Electrical ContractorW. Sherbin, NRC Mechanical ContractorApproved by:Lawrence T. Doerflein, Chief Engineering Branch 2Division of Reactor Safety Enclosure ii
SUMMARY
During the period from October 1 through November 8, 2007, the U.S. Nuclear RegulatoryCommission (NRC) conducted a team inspection at the Indian Point Nuclear Generating Unit 3(IP-3) in accordance Inspection Procedure 71111.21, "Component Design Bases Inspection."The inspection involved four weeks of on-site effort. Additional in-office reviews of informationwere also conducted through December 18, 2007. The inspection procedure is conducted aspart of the NRC's Reactor Oversight Process (ROP).
1 The objective of the inspection was toverify that the IP-3 design bases had been correctly implemented for selected risk-significantcomponents, and that operating procedures and operator actions were consistent with thedesign and licensing bases. This was to ensure that the selected components were capable ofperforming their intended safety functions and could support the proper operation of theassociated systems. The inspection team consisted of eight inspectors, including a team leaderand four inspectors from the NRC's Region I Office, and three contractors. The team selected twenty components for a detailed design review after completing a detailed,risk based selection process. In selecting samples for review, the team focused on thosecomponents and operator actions that have a high relative contribution to the risk of apostulated core damage accident if the component was to fail or if the operator did notsuccessfully complete the action. The team also assessed available margin for the risk-significant components in selecting the samples. The selected samples included components inthe safety injection (SI), residual heat removal (RHR), auxiliary feedwater (AFW), service water(SW), main steam (MS), onsite electrical power, and off-site electrical power systems. Theteam selected five risk-significant operator actions for review using the complexity of the action,time to complete the action, and extent of training on the action as inputs. The team alsoselected six operating experience issues related to the selected components or generic issuesto verify they had been appropriately assessed and dispositioned. For each sample selected,the team reviewed design calculations, corrective action reports, maintenance and modificationhistories, and associated operating and testing procedures. The team also performedwalkdowns of the accessible components to assess their material condition. Overall, the inspection team determined that the components reviewed were capable ofperforming their intended safety functions. The team also found that the operating procedures,operator training and equipment staging adequately supported completion of the operatoractions and were consistent with the design and licensing bases. The team did identify six findings of very low safety significance (Green) and one unresolved item. The six findings arelisted in the "Summary of Findings" section of this report. The team assessed the safetysignificance of each of the findings using the NRC's Significance Determination Process (SDP).
2 Also, for each of the findings where current operability was a relevant question, Entergycompleted an operability evaluation. In each case, Entergy determined the equipment wasoperable. The inspection team independently confirmed Entergy's conclusions. All of thefindings were entered into Entergy's corrective action program to ensure a more comprehensiveassessment of the issue and to identify and implement appropriate corrective actions.
3 As described in Inspection Manual Chapter 0305, Operating Reactor AssessmentProgramEnclosure v Under the NRC's Reactor Oversight Process, findings of very low safety significance (Green)are addressed through the facility's correctiv e action program. Futu re NRC inspections, mostnotably the biennial Problem Identification and Resolution (PI&R) team Inspection, review asubstantial sample of Entergy's response to the Green findings and assess the adequacy of theactions taken to correct the deficiencies.The findings are also an input into the NRC's assessment process.
3 The most recentassessment of IP-3 issued on August 31, 2007 (ADAMS Ref. ML072430942), concluded thatthe plant's performance was in the Regulatory Response Column of the NRC's Action Matrixbased on one White performance indicator in the Initiating Events cornerstone. Subsequently,IP-3 performance transitioned back to the Licensee Response Column when the PI returned tothe Green band at the end of the third quarter of 2007. Because the findings of this ComponentDesign Bases Inspection were all Green, the NRC's overall assessment of IP-3 will not changefrom the Licensee Response Column as a result of this inspection. The recent assessment alsodiscussed an existing substantive cross-cutting issue in the area of human performanceregarding procedure adequacy. The Reactor Oversight Process considers that the areas ofhuman performance, problem identification and resolution and safety conscious workenvironment, contain performance attributes that extend across (cross-cut) all areas of reactorplant operation. As noted in the inspection report, two of the findings had a cross-cuttingaspect. As part of the assessment process, the NRC performs a collective review semi-annually of cross-cutting aspects of all inspection results from the previous twelve months, andmonitors and evaluates a plant licensee's actions to address a substantive cross-cutting issue. This inspection is a key part of NRC's inspection effort to assure overall plant safety, protectionof the public and the environment, and efficacy of key plant design features and procedures. Many other NRC inspection and review activities are also important to NRC's role of ensuringsafety. More detail is provided in the NRC's description of the Reactor Oversight Process athttp://www.nrc.gov/NRR/OVERSIGHT/ASSESS/index.html. A similar inspection was completed for the Indian Point Nuclear Generating Unit 2 on February 15, 2007 (ADAMS Ref.ML070890270).
viSUMMARY OF FINDINGSIR 05000286/2007-006; 10/01/2007 - 12/18/2007; Indian Point Nuclear Generating Unit 3;Component Design Bases Inspection.This inspection covers the Component Design Bases Inspection, conducted by a team of fiveNRC inspectors and three NRC contractors. Six findings of very low safety significance (Green)were identified, five of which involved a violation of regulatory requirements and wereconsidered to be non-cited violations. The significance of most findings is indicated by theircolor (Green, White, Yellow, Red) using IMC 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level afterNRC management review. The NRC's program for overseeing the safe operation ofcommercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process,"Revision 4, dated December 2006.A.
NRC-Identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Green.
The team identified a finding of very low significance involving a non-citedviolation of 10 CFR 50, Appendix B, Criter ion III, "Design Control," in that Entergy did notuse an adequate methodology to determine if the residual heat removal pump dischargeheader isolation valve (AC-MOV-744) was susceptible to the pressure lockingphenomenon. Additionally, the operation of the isolation valve seal water system(IVSWS) was not included in ei ther the pressure locking analysis or actuator capabilitycalculations. In response, Entergy performed a calculation using an appropriatemethodology and as-found leak test results and determined that the valve would notpressure lock. Entergy also performed a calculation which verified that the valveactuator had sufficient margin to overcome the pressure applied by the IVSWS. Entergyentered these performance deficiencies into their corrective action program for longerterm resolution.The finding is more than minor because the methodology and calculation deficiencies represented r easonable doubt r egarding the operability of the AC-MOV-744 valve, eventhough the valve was ultimately shown to be operable. The finding is associated withthe design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systemsthat respond to initiating events to prevent undesirable consequences. In accordancewith NRC Inspection Manual Chapter (IMC) 0609, Appendix A, "SignificanceDetermination of Reactor Inspection Findings for At-Power Situations," the teamconducted a Phase 1 screening and determined the finding was of very low safetysignificance because it was a design deficiency that did not result in a loss of valveoperability. (Sec tion 1R21.2.1.2)*Green. The team identified a finding of very low safety significance involving a non-citedviolation of 10 CFR Part 50, Appendix B, Criterion III, "Design C ontrol," in t hat Entergyhad not verified the adequacy of design for the turbine driven auxiliary feedwater(TDAFW) pump. Specifically, the pump hydraulic analysis was non-conservative, butwas used to verify adequacy of surveillance te st acceptance criteria for pump minimum viidischarge pressure. Entergy subsequently verified that the pump remained operableand entered the finding into their corrective action program to revise the systemanalysis.The finding is more than minor because the design analysis deficiency resulted in acondition where there was reas onable doubt regarding TDAFW pump operability. Thefinding was associated with the design control attribute of the Mitigating Systemscornerstone and affect ed the cornerstone objective of ensuring availability, reliability andcapability of systems that respond to initiating ev ents to prev ent undesirableconsequences. In accordance with NRC Inspection Manual Chapter (IMC) 0609,Appendix A, "Significance Determination of Reactor Inspection Findings for At-PowerSituations," the team conducted a Phase 1 screening and determined the finding was ofvery low safety significance because it was a design deficiency that did not result in aloss of pump operability. The finding had a cross-cutting aspec t in the ProblemIdentification and Resolution area, because Entergy did not thoroughly evaluate a similarproblem, such that the extent of condition adequately considered and resolved thecause. (IMC 0305, aspect P.1(c)) (Section 1R21.2.1.6)*Green. The team identified a finding of very low safety significance involving a non-citedviolation of 10 CFR Part 50, Appendix B, Criterion III, "Design C ontrol," in t hat Entergydid not ensure a change to the design basis was correctly translated into maintenanceprocedures. Specifically, a modification replaced the control element in the emergencydiesel generator (EDG) jacket water temperature control valves, with a control elementwith a higher setpoint, to support EDG operation at a higher service water temperature. Subsequently, using the uncorrected procedure, maintenance technicians re-installedelements with the lower setpoint. Entergy subsequently verified that the EDGs remainedoperable and entered the finding into their corrective action program to revise themaintenance procedure and replace the temperature control elements.The finding is more than minor because the failure to update the maintenance procedureresulted in a diesel engine configuration different than that required to operate atmaximum design cooling water specifications. The finding was associated with thedesign control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring availability, reliability and capability of systems thatrespond to initiating events to prevent undesirable consequences. In accordance withNRC Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination ofReactor Inspection Findings for At-Power Situations," the team conducted a Phase 1screening and determined the finding was of very low safety significance because it wasa design deficiency that did not result in a loss of EDG operability. (S ection 1R 21.2.1.7)*Green. The team identified a finding of very low safety significance involving a non-citedviolation of 10 CFR 50, Appendix B, Cr iterion III, "Design Control," in that measures hadnot been established to verify the proper component operating voltage requirements forbattery sizing calculations. Specifically, the battery calculations did not properly verifythat the minimum voltage needed to operate four-pole Agastat 7000 series timing relayswould be available. Entergy reviewed the most recent battery discharge tests to ensure the error did not impact battery or relay operability and entered the issue into thecorrective action program to resolve the calculation errors.
viiiThe finding is more than minor because it is associated with the design control attributeof the Mitigating System cornerstone and affected the cornerstone objective of ensuringthe availability, reliability, and capability of system s that respond to initiating events toprevent undesirable consequences. In accordance with NRC Inspection ManualChapter (IMC) 0609, Appendix A, "Significance Determination of Reactor InspectionFindings for At-Power Situations," the team conducted a Phase 1 screening anddetermined the finding was of very low safety significance because it was a designdeficiency that did not result in a loss of battery or relay operability. (Section1R21.2.1.11)*Green. The team identified a finding of very low safety significance involving a non-citedviolation of 10 CFR Part 50, Appendix B, Criterion III, "Design C ontrol," in t hat Entergydid not ensure that design inputs in the EDG load analysis were conservative. As aresult, capacity testing for EDG 32 was not sufficient to envelope the design basis loadrequirement at the maximum frequency limit allowed by Technical Specifications. Entergy reviewed the calc ulation errors and determined EDG operability was notaffected and entered the issues into the corrective action program to resolve thecalculation errors.The finding is more than minor because it is associated with the design control attributeof the Mitigating Systems cornerstone and affected the cornerstone objective to ensurethe availability, reliability, and capability of system s that respond to initiating events toprevent undesirable consequences. In accordance with NRC Inspection ManualChapter (IMC) 0609, Appendix A, "Significance Determination of Reactor InspectionFindings for At-Power Situations," the team conducted a Phase 1 screening anddetermined the finding was of very low safety significance because it was a designdeficiency that did not result in a loss of EDG operability. (Sec tion 1R21.
2.1.13)*Green. The team identified a finding of very low safety significance involving the failureto perform a transformer bushing power factor (Doble) test within Entergy, vendor, orindustry recommended frequencies. Entergy had not performed this test on the stationauxiliary transformer (SAT) bushings si nce 1999, and had re-scheduled a 2007 test for2009. Specifically, a ten year interval between tests significantly exceeds Entergy'smaintenance procedure specification to perform testing every 4 years as well as thebushing manufacturer and industry recommended test frequencies. Additionally,Entergy did not provide an appropriate technical bases for deferring the test beyond thenormal interval. Entergy evaluated the 1999 test results and the SAT's current operatinghistory, concluded the SAT remained operable, and entered this condition into thecorrective action program. The finding is more than minor because it is associated with the equipment performanceattribute of the Mitigating Systems cornerstone and affected the cornerstone objective ofensuring the availability, reliability and capability of syst ems that respond to initiatingevents to prevent undesirable consequences. In accordance with NRC InspectionManual Chapter (IMC) 0609, Appendix A, "Significance Determination of ReactorInspection Findings for At-Power Situations," the team conducted a Phase 1 screeningand determined the finding was of very low safety significance because it was not adesign or qualification deficiency, did not result in an actual loss of safety function, anddid not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. The finding had a cross-cutting aspect in the Human Performance -Work Control area, because Entergy had not adequately considered risk insights, job ixsite conditions (i.e., outside work during winter) did not support the test activity, andthere was no planned contingency if the work could not be accomplished within itsscheduled work window. (IMC 0305, aspect H.3(a)) (Section 1R21.2.1.14)
B.Licensee-Identified Violations
None 1RAW is the factor by which the plant's core damage frequency increases if thecomponent or operator action is assumed to fail.
2RRW is the factor by which the plant's core damage frequency decreases if thecomponent or operator action is assumed to be successful.Enclosure
REPORT DETAILS
1.REACTOR SAFETYCornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity1R21Component Design Bases Inspection (IP 71111.21).1Inspection Sample Selection ProcessThe team selected risk significant components and operator actions for review usinginformation contained in t he Indian Point 3 Probabilistic Risk Assessment (PRA) and theNuclear Regulatory Commission's (NRC) Standardized Plant Analysis Risk (SPAR)model. Additionally, the Indian Point 3 Significance Determination Process (SDP)Phase 2 Notebook, Revision 2, was referenced in the selection of potential componentsand actions for review. In general, the selection process focused on components andoperator actions that had a risk achievement worth (RAW)1 factor greater than 2.0 or aRisk Reduction Worth (RRW)2 factor greater than 1.005. The components selectedwere located within both safety related and non-safety related systems, and included avariety of components such as pumps, valves, diesel generators, transformers, batteriesand electrical buses.The team initially compiled an extensive list of components based on the risk factorspreviously mentioned. The team performed a margin assessment to narrow the focus ofthe inspection to 20 components and five operator actions. The team's evaluation ofpossible low design margin considered original design issues, margin reductions due tomodifications, or margin reductions identified as a result of material condition/equipmentreliability issues. The margin assessment evaluated the impact of licensing basischanges that could reduce safety analysis margins. The assessment also includeditems such as failed performance test results, corrective action history, repeated maintenance, maintenance rule (a)(1) status, operability reviews for degradedconditions, NRC resident inspector input of equipment problems, plant personnel input ofequipment issues, system health reports and industry operating experience. Consideration was also given to the uniqueness and complexity of the design and theavailable defense-in-depth margins. The margin review of operator actions includedcomplexity of the action, time to complete action, and extent of training on the action.This inspection effort included walk-downs of selected components, a review of selectedsimulator scenarios, interviews with operators, system engineers and design engineers,and reviews of associated design documents and calculations to assess the adequacyof the components to meet both design basis and risk informed beyond design basisrequirements. A summary of the reviews performed for each component, operatoraction, operating experience sample, and the specific inspection findings identified are 2Enclosurediscussed in the following sections of the report. Documents reviewed for this inspectionare listed in the Attachment..2Results of Detailed Reviews.2.1 Detailed Component Design Reviews (20 Samples).2.1.1No. 33 Safety Injection Pump
a. Inspection Scope
The team reviewed design basis documents, including hydraulic calculations, technicalspecifications, accident analyses and drawings to verify that the safety injection (SI)pump was capable of meeting system functional and design basis requirements. Therefueling water storage tank (RWST) level setpoints and uncertainty calculations werealso reviewed because the RWST is the water source for the SI pump during theinjection phase of a postulated accident. The team also reviewed SI pump surveillancetest results, system health reports, and corrective action documents to determinewhether SI pump design margins were adequately maintained and to verify that Entergyentered problems that could affect system performance into their corrective actionprogram. The team reviewed operating and emergency operating procedures to assesswhether sufficient RWST inventory existed to inject water into the reactor vessel during apostulated accident, and to verify whether pump suction swap-over occurred before theonset of vortexing at the RWST outlet piping. To assess the general condition of thepump, the team performed walkdowns of the SI pump area. The team also reviewed SIpump and motor cooling systems and SI pump minimum flow requirements to assessthe ability of the SI pump to oper ate under design bas is conditions.
b. Findings
No findings of significance were identified..2.1.2Residual Heat Removal Pump Discharge Header Isolation Valve (AC-MOV-744)
a. Inspection Scope
The team selected the residual heat removal (RHR) pump discharge header isolationmotor operated valve (MOV), AC-MOV-744, as a representative high risk MOV sample. The team reviewed calculations, procedures, leakage test results and technical reportsto verify the valve's capability to perfo rm during postulated design basis accidentconditions. The team also interviewed engineers and reviewed correspondence relatedto NRC Generic Letter 95-07, "Pressure Locking and Thermal Binding of Safety-RelatedPower-Operated Gate Valves," to verify that Entergy was meeting its commitments toensure the valve would not be susceptible to the pressure locking or thermal bindingphenomena. Analysis methodology reports were reviewed to determine if appropriateinputs were being used to support the conclusion that the valve was not susceptible topressure locking. Corrective action reports and preventive maintenance work orderswere reviewed in order to assess the performance and operational history of the valve.
b. Findings
Introduction:
The team identified a finding of very low significance (Green) involving anon-cited violation of 10 CFR 50, Appendix B, Criterion III, "Des ign Control," in thatEntergy did not use an adequate methodology to determine if AC-MOV-744 wassusceptible to the pressure locking phenomenon. Additionally, the operation of theisolation valve seal water system (IVSWS) was not included in either the pressurelocking analysis or actuator capability calculations.Description: The team found that Entergy used an inadequate methodology todetermine if valve AC-MOV-744 was susceptible to pressure locking. Specifically,Entergy used an incorrect and non-conservative valve bonnet depressurization rate,which was based on a generic Westinghouse report (ESBU/WOG-96-022) that creditedleakage from the valve bonnet past the valve seats and past the stem packing, to verifythat the valve bonnet would not pressurize under postulated design basis conditions dueto thermal inputs. This depressurization rate was inappropriately used in conjunctionwith a pressurization rate from another Westinghouse report (V-EC-1620) which alsocredited leakage from the bonnet. Additionally, the calculation used to determine thetemperature change of the water in the bonnet post-accident did not include heat inputsdue to conduction from the downstream piping and from the valve yoke and actuator.The team also determined that the IVSWS could be actuated during a postulated designbasis accident, after long term recirculation flow is established using the internalrecirculation system. The IVSWS uses pressurized nitrogen applied to the bonnet ofAC-MOV-744 in order to reduce leakage from containment following a loss-of-coolantaccident (LOCA). Following establishment of internal recirculation flow and a postulatedpassive failure of the internal recirculation discharge header, AC-MOV-744 would haveto reopen against the pressure applied by the IVSWS in order for long term recirculationflow to be established using the RHR system. Neither valve capability calculations northe pressure locking analysis accounted for actuation of the IVSWS. In response to this issue, Entergy performed a calculation using an appropriatemethodology and used as-found leakage test results to determine that the valve wouldnot become pressure locked. Entergy also performed a calculation to show that thevalve actuator had sufficient margin to overcome the pressure applied by the IVSWS.Entergy's immediate corrective actions included performing the calculations discussedabove and performing the associated operability determinations. The team reviewed the calculations and operability assessments fo r the pressure locking and IVSWS issuesand found them to be acceptable. The team verified that the deficiencies did not impactthe operability of the valve. Entergy entered these performance defic iencies into theircorrective action program for longer term resolution.Analysis: The team determined that Entergy's failure to use a correct methodologywhen evaluating AC-MOV-744 for pressure locking represented a performancedeficiency that was reasonably within Entergy's ability to foresee and prevent. Specifically, Entergy did not use a correct methodology when evaluating the valve for 4 3Subsequent to the inspection, the Phase 1 screening process remained unchanged butwas moved from IMC0609, Appendix A, to IMC0609, Attachment 4, "Phase 1 - Initial Screeningand Characterization of Findings."Enclosurethermally induced pressure locking, nor did Entergy include the potential actuation of theIVSWS in the evaluation or design inputs for the valve.The finding was more than minor because it was similar to NRC Inspection ManualChapter 0612, Appendix E, "Examples of Minor Issues," Example 3.j, in that themethodology and calculation deficiencies represented reasonable doubt regarding theoperability of AC-MOV-744. The finding was associated with the design cont rol attributeof the Mitigating Systems cornerstone and affected the cornerstone objective of ensuringthe availability, reliability, and capability of system s that respond to initiating events toprevent undesirable consequences. Traditional enforcement does not apply becausethe issue did not have any actual safety consequences or potential for impacting theNRC's regulatory function, and was not the result of any willful violation of NRCrequirements. In accordance with NRC Inspection Manual Chapter 0609, Appendix A,"Significance Determination of Reactor Inspection Findings for At-Power Situations," theteam conducted a Phase 1 SDP screening 3 and determined the finding was of very lowsafety significance (Green) because it was a design deficiency that was confirmed not toresult in a loss of AC-MOV-744 operability.Enforcement: 10 CFR 50 Appendix B, Cr iterion III, "Design Contro l," requires, in part,that measures shall provide for verifying or checking the adequacy of design. Contraryto the above, as of November 8, 2007, Entergy's design control measures were notadequate to verify the adequacy of the design of the RHR pump discharge headerisolation valve (AC-MOV-744). Specifically, Entergy did not use an appropriatemethodology to evaluate the potential for pressure locking of valve AC-MOV-744. Because this violation is of very low safety significance and has been entered intoEntergy's corrective action program (CR-IP3-2007-04204 and CR-IP3-2007-04217), thisviolation is being treated as a non-cited violation consistent with Section VI.A.1. of theNRC Enforcement Policy. (NCV 05000286/2007006-01, Inadequate Pressure LockingMethodology Used to Ensure Valve Operability)
.2.1.3 Service Water Pump 31
a. Inspection Scope
The team evaluated the service water (SW) pump and strainer to verify that the pumpand strainer performance satisfied design basis flow rate requirements during postulatedtransient and accident conditions, and to assess the potential for common cause failureof the pumps or strainers. To determine design basis performance requirements andoperational limitations, the team reviewed design basis documents including SW systemhydraulic models and flow balance studies, calculations, operating instructions andprocedures, system drawings, surveillance tests, and modifications. The team verifiedthat design requirements and operational limits were properly translated into operating instructions, and procedures. Surveillance test results were reviewed to determine 5Enclosurewhether established test acceptance criteria were satisfied. The acceptance criteriawere compared to design basis assumptions and requirements to verify there wereadequate margins for allowable pump degradation limits, strainer clogging affects, andavailable net positive suction head (NPSH) to ensure actual pump and strainerperformance would be satisfactory during transient and accident conditions. In addition,the team walked down the SW pump house and strainer areas, interviewed system anddesign engineers, and reviewed system health reports and selected condition reports toassess the current material condition of the pumps and strainers.
b. Findings
No findings of significance were identified..2.1.4Recirculation Pump 32
a. Inspection Scope
The team evaluated the recirculation pump to verify that pump performance, duringpostulated accident conditions, would satisfy design basis head and flow raterequirements, and to assess the potential for common cause failure of the recirculation pumps. To determine design basis performance requirements and operationallimitations, the team reviewed design basis documents including NPSH analysis,certified pump curves, technical specifications, accident analysis, and system andvendor drawings. The team assessed whether the licensee adequately translateddesign requirements and operational limits into operating instructions, procedures, andemergency operati ng procedures. Post modification and surveillance test results werereviewed to determine whether established test acceptance criteria were satisfied. Theacceptance criteria were compared to design basis assumptions and requirements todetermine there were adequate margins for allowable pump degradation limits, minimumpump flow, and available NPSH, to ensure actual pump performance would besatisfactory during accident conditions. In addition, the team interviewed designengineers, system engineers and licensed operators, and reviewed selected conditionreports to identify any potential adverse conditions or trends.
b. Findings
Inadequate Design Control of Recirculation PumpsThe team identified an unresolved item concerning the adequacy of design controlassociated with a modification that replaced both internal recirculation pumps in March2007. Specifically, Entergy did not evaluate or determine the minimum flow requirements for the new pumps and did not evaluate or determine whether the newpumps would be susceptible to strong-pump to weak-pump interactions, when operatedin parallel.
6EnclosureBackgroundThe recirculation pump portion of the low-head safety injection system consists of twopumps, located in primary containment, that take suction from a containment sump anddischarge into a common discharge header. Each recirculation pump has a 3/4 inchminimum flow line upstream of the pump discharge check valve and the two pumpsshare a 2 inch minimum flow line on the common discharge header. All three minimumflow lines return to the containment sump. Emergency operating procedure (EOP)ES-1.3, "Transfer to Cold Leg Recirculation," directed operators to sequentially start bothrecirculation pumps during the recirculation phase of a loss-of-coolant accident (LOCA).Strong-pump to Weak-pump InteractionNRC Bulletin 88-04, "Safety-Related Pump Loss," documented industry operatingexperience regarding design deficiencies where the weaker centrifugal pump (i.e., lowerdischarge head at same flow rate) could be dead-headed under low flow conditionswhen operated in parallel with a stronger pump (i.e., higher discharge head at same flowrate), if both pumps shared a common minimum flow line. Letter IP3-89-036, dated May 12, 1989, provided the licensee's Bulletin 88-04 responseto the NRC. The licensee stated that although the recirculation pumps shared acommon minimum flow line, the potential for a stronger pump to dead-head a weakerpump did not exist. The basis, in part, was that having the individual pump minimumflow lines upstream of the pump discharge check valve would ensure flow through thepump even if the stronger pump would cause the discharge check valve on the weakerpump to close. The licensee also credited the EOPs with preventing the weak pumpfrom becoming dead-headed because they assumed that by the time the EOPs directedstarting of the second pump, flow to the reactor core would be sufficient to allow bothpumps to operate at a point on their head verses flow curves where there was adequateflow for both pumps.The team's review of the recirculation pump curves identified that the No. 32recirculation pump had about 10 psi higher discharge head, under low flow conditions,than the No. 31 recirculation pump. The team determined that the No. 31 recirculationpump would likely be susceptible to dead-heading if both pumps were operated inparallel, as required by procedure ES-1.3, and at a low system flow rate, which might beencountered during certain small break LOCAs, such as high head recirculation. Theteam noted that the system valve line-up required the 3/4 inch minimum flow valve to bethrottled to 1.5 turns open, resulting in very low flow through these lines. The mostrecent surveillance test results recorded the as-found flows as approximately zero(No. 31 pump was 0.1 gpm, No. 32 pump was 7 gpm). The team also identified thatEntergy had not assessed the new recirculation pumps for strong-pump to weak-pumpinteractions.
7EnclosureThe team concluded that Entergy had not verified the design adequacy for the newrecirculation pumps for strong-pump to weak-pump interaction. In addition, the previousengineering evaluation for recirculation pump strong-pump to weak-pump interactionappeared to be inconsistent with a small break LOCA accident analysis and with thethrottled configuration of the 3/4 inch minimum flow line. Entergy preliminarilydetermined the weaker pump was only susceptible to dead-heading during high headrecirculation (e.g., other small break LOCA scenarios would not result in weak pumpdead-heading). Entergy entered this issue into their corrective action program asCR-IP3-2007-04212. As an immediate corrective action, Entergy revised EOPs3-ES-1.3, "Transfer to Cold Leg Recirculation," and 3-ES-1.4, "Transfer to Hot LegRecirculation," to not start the second recirculation pump during high head recirculation.Minimum Flow RequirementsNRC Bulletin 88-04 also documented industry operating experience regarding designdeficiencies with individual pump minimum flow rates that did not prevent pump damagewhile operating in the minimum flow mode. Based on Westinghouse analysis SECL-89-508, dated May 22, 1989, the licensee determined that the recirculation pumpmechanical minimum flow rate (flow required to prevent pump mechanical damage atlower than design flow rates) and the thermal minimum flow rate (flow required toprevent fluid inside the pump from reaching saturation conditions) were adequate for all operational modes except surveillance testing. The lower flow rates during testing wereevaluated as acceptable because of the short test duration and infrequent test times. SECL-89-508 Table-1, "Required Minimum Flow vs. Actual Flow Rates," stated for thesmall break LOCA operating mode and a 24-hour duration, recirculation pump total flowwas 1000 gpm, with a minimum required thermal and mechanical flow of 540 gpm.The team identified that design drawing IP3V-2057-0010, "Flowserve RecirculationPump Replacement," stated that sustained pump operation below 900 gpm should beavoided. In addition, the new recirculation pumps had a different suction stage designthan the previous pumps. The team determined that EOP ES-1.3 would allow parallelpump operation if the total system flow was greater than approximately 1440 gpm, notincluding 130 gpm in the common minimum flow line. Since this would result in a totalsystem flow of 1570 gpm, possibly with both pumps operating, the team questionedwhether there were any LOCA scenarios where an individual pump flow might be lessthan 900 gpm. The team determined that Entergy had not evaluated the newrecirculation pumps for thermal or mechanical minimum flow requirements, and had notverified whether the previous 18 year old minimum flow analysis was applicable to thenew pumps. Entergy entered this issue into their corrective action program as CR-IP3-2007-04296.Current Recirculation Pump OperabilityEntergy preliminarily determined that the recirculation pumps were potentiallysusceptible to adverse effects from strong-pump to weak-pump interactions and frominadequate minimum flow protection only during small break LOCA scenarios. Entergyis continuing to evaluate pump susceptibility to adverse affects during other (i.e., non-small break LOCA) scenarios.
8EnclosurePreliminary hydraulic analysis, performed by Entergy, indicated that the highestcontainment sump water temperature for a small break LOCA was about 195 degreesFahrenheit (F). Entergy received an initial evaluation for minimum flow from the pumpvendor (Flowserve) in a letter dated November 9, 2007, which stated, in part, that while900 gpm is recommended for continuous operation, 200 gpm is acceptable for up to athree hour duration in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. In addition, Flowserve stated that if thesuction water temperature was less than or equal to 200F, and the temperature rise inthe pump did not result in flashing, then extended operation would only result inshortened pump life (i.e., not a short term pump failure). Based on the preliminaryinformation, Entergy concluded that the pumps will operate satisfactorily under all designbasis accident conditions. The team evaluated Entergy's immediate corrective actions,including EOP changes, and Entergy's operability assessment and found these actionsand assessments to be reasonable. Entergy is evaluating recirculation system hydraulic models and small break LOCAaccident scenarios to determine expected minimum reactor core flows and individualpump flows. In addition, Entergy is evaluating recirculation pump design characteristics to determine pump minimum flow requirements. The acceptability of Entergy's final determination of pump minimum flow requirements will be an unresolved it em (URI),pending further NRC review. (URI 05000286/2007006-02, Inadequate Design Controlof Recirculation Pumps).2.1.5Auxiliary Feedwater Pump 31 (Motor Driven)
a. Inspection Scope
The team reviewed the motor driven auxiliary feedwater (MDAFW) pump to verify thatthe pump was capable of achieving its design basis requirements. The review includedan assessment of the design capacity of the condens ate storage tank, ability to transferthe pump suction to an alternate water source, available net positive suction head,margin to prevent vortexing, pump minimum flow and run-out protection, andenvironmental and electrical qualification of equipment. The team reviewed drawings,calculations, hydraulic analyses, procedures, system health reports, and selectedcondition reports to evaluate whether maintenance, testing, and operation of theMDAFW pump were adequate to ensure the pump performance would satisfy design basis requirements under transient and a ccident conditions. Surv eillance test resultswere reviewed to assess whether the pump was operated within acceptable limits, andto verify whether established test acceptance criteria were satisfied. The testacceptance criteria were compared to design basis assumptions and requirements todetermine whether there were adequate margins to ensure actual pump performancewould be satisfactory during transient and accident conditions. The team performed awalkdown of accessible areas of the auxiliary feedwater (AFW) system and supportingsystems to determine whether the system alignment was in accordance with designbasis and procedural requirements, and to assess the MDAFW pump and AFW systemcomponent material condition.
b. Findings
No findings of significance were identified..2.1.6Auxiliary Feedwater Pump 32 (Turbine Driven)
a. Inspection Scope
The turbine driven auxiliary feedwater (TDAFW) pump was reviewed to assess its abilityto meet its design basis head and flow rate requirements in response to transient andaccident events. The team verified that the design inputs were properly translated intosystem procedures and tests, and reviewed completed surveillance te sts associatedwith the demonstration of pump operability. Accident analysis evaluations for loss-of-normal feedwater were reviewed to determine whether appropriate design criteria for theTDAFW pump were used. The adequacy of the TDAFW pump for operation during astation blackout condition was reviewed. The team reviewed the design capacity of thecondensate storage tank (CST), which is the preferred water source for the system, andthe potential for vortexing at the pump suction line. The design and operatingprocedures for the service water system were reviewed with respect to supportingoperability of the TDAFW pump when the normal pump suction source (CST) isdepleted. The team also reviewed room temperature requirements and equipmentthermal design requirements to assess whether the TDAFW pump would operate withindesign temperature limits. Lastly, the team performed walkdowns to assess the generalcondition of the TDAFW pump.
b. Findings
Introduction:
The team identified a finding of very low safety significance (Green)involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III,"Design Control," in that Entergy had not verified the adequacy of design for the TDAFWpump. Specifically, the pump hydraulic analysis was non-conservative, but was used toverify the adequacy of surveillance test acceptance criteria for pump minimu m dischargepressure.Description: The team reviewed calculation IP3-CALC-AFW-02581, "AFW PumpDischarge Pressure at Two Flow Rates 340 and 600 gpm." The purpose of thecalculation was to verify the adequacy of the pump discharge pressure acceptancecriteria for TDAFW pump surveillance testing. The test acceptance criteria had beenestablished based on pump curves and allowances for pump degradation. The teamidentified that the analysis did not include the increased AFW flow requirements due tothe IP-3 stretch power uprate (SPU), and did not include the increased pressure at thepump discharge due to the back-pressure between the main steam safety valves(MSSVs) and the steam generators (SGs). As a result, the calculation predicted too lowof a value for pump discharge pressure, which resulted in a non-conservative valuebeing used to assess the adequacy of the pump surveillance te st acceptanc e criteria.
10EnclosureEntergy determined the AFW system remained operable because the most recentsurveillance test results of the TDAFW pump documented an as-found pump dischargepressure greater than the value needed to account for the identified calculationdeficiencies. In addition, Entergy determined that the approved surveillance testacceptance criteria was greater than the value needed to account for the identified calculation deficiencies. The team independently verified there was adequate marginbetween a higher required minimum pressure value and the current test acceptancecriteria.
Analysis:
The team determined that the use of a non-conservative calculation to verifythe adequacy of surveillance te st acceptance criteria was a performance deficiency. Entergy's design control measures were not adequate to ensure that a completeevaluation of TDAFW pump discharge pressure had been performed. Specifically, theTDAFW pump hydraulic analysis was used to verify adequate pump discharge pressurefor surveillance test procedures, but did not include increased AFW flow requirementsfrom the SPU, and did not include the back-pressure from the MSSVs to the SGs.The finding was more than minor because it was similar to NRC Inspection ManualChapter (IMC) 0612, Appendix E, "Examples of Minor Issues," Example 3.j, in that thedeficient hydraulic analysis resulted in a condition where there was a reasonable doubtwith respect to operability of the TDAFW pump. The finding was associated with thedesign control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systemsthat respond to initiating events to prevent undesirable consequences. Traditionalenforcement does not apply because the issue did not have any actual safetyconsequences or potential for impacting the NRC's regulatory function, and was not theresult of any willful violation of NRC requirements. In accordance with NRC IMC 0609,Appendix A, "Significance Determination of Reactor Inspection Findings for At-PowerSituations," the team conducted a Phase 1 SDP screening and determined the findingwas of very low safety significance (Green) because it was a design deficiency that wasconfirmed not to result in a loss of TDAFW pump operability.This finding had a cross-cutting performance aspect in the area of Problem Identificationand Resolution. Specifically, this issue was the subject of CR-IP3-2007-03257, whichidentified the calculation for the MDAFW pumps required revision, in order to verifyadequacy of surveillance test a cceptance criteria for pump minimum discharge pressure. Entergy did not thoroughly evaluate the similar problem that affected the TDAFW pump,such that the extent of condition adequately considered and resolved the cause. (IMC0305, aspect P.1(c))Enforcement
- 10 CFR Part 50, Appendix B, Criterion III, "Desi gn Control," requires, inpart, that design control measures shall provide for verifying or checking the adequacyof design. Contrary to the above, as of November 8, 2007, Entergy's design controlmeasures were not adequate to verify the adequacy of design for the TDAFW pumpminimum discharge pressure. Specifically, the TDAFW pump hydraulic analysis, incalculation IP3-CALC-AFW-02581, Rev. 0, did not include increased flow requirementsfrom the SPU and did not include back-pressure from the MSSVs to the SGs. As aresult, the hydraulic analysis was non-conservative, but had been used to verify the 11Enclosureadequacy of surveillance test acc eptance criteria. Because this violation was of very lowsafety significance and was entered into Entergy's corrective action program (CR-IP3-2007-04174), this violation is being treated as a non-cited violation (NCV), consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000286/2007006-03,Non-Conservative Calculation for TDAFW Pump Discharge Pressure Used forSurveillance Testing).2.1.7No. 31 Emergency Diesel Generator (Mechanical)
a. Inspection Scope
The team reviewed emergency diesel generator (EDG) No. 31 to assess whether theEDG would function as required during postulated transient and accident conditions tomeet design basis requirements. The review included the fuel oil storage and supply,starting air, combustion air, and jacket water and lube oil cooling systems. The teamreviewed drawings, calculations, fuel oil transfer analyses, starting air capabilityanalyses, heat exchanger performance analyses, system health reports, and selectedcondition reports to evaluate whether maintenance, testing, and operation of the EDGsystems were adequate to ensure the EDG performance would satisfy design basis requirements under transient and accident conditions. Surveillance test results werereviewed to assess whether actual EDG performance, including starting air receiverpressures and service water flow rates, adequately demonstrated design basisassumptions would be met, that the EDG was operated within acceptable limits, and toverify whether established test acceptance criteria were satisfied. The test acceptancecriteria were compared to design basis assumptions and requirements to determinewhether there were adequate margins to ensure actual EDG performance would besatisfactory during transient and accident conditions. The team walked down selectedaccessible components and areas associated with the EDG to assess proper componentalignment and verify whether any observed material conditions could adversely impactsystem operability.
b. Findings
Introduction:
The team identified a finding of very low safety significance (Green)involving a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III,"Design Control," in that Entergy did not ensure a change to the design basis wascorrectly translated into maintenance procedures. Specifically, a modification replacedthe control element in the EDG jacket water temperature control valves, with a controlelement with a higher setpoint to support EDG operation at a higher SW temperature. Subsequently, the failure to properly update the affected maintenance procedure tospecify the correct c ontrol element resulted in main tenance technicians re-installingelements with the old setpoint.Description: The team reviewed Modification 90-03-158, "EDG Jacket Water and Lube Oil Cooling," to assess the EDG's capability to operate at a higher SW temperature. Thepurpose of the 1990 modification was to support a design basis change that increasedthe maximum operating SW temperature from 85F to 95F. To allow the EDGs tooperate at a 10F higher SW temperature, the licensee determined, in part, that the 12Enclosurejacket water outlet temperature needed to be increased from 180F to 190F, bychanging the operating setpoint of the three-way temperature control valve (TCV). TheTCV maintains the engine jacket water outlet temperature by controlling the quantity ofwater that bypasses the jacket water cooler. The modification installed a 180Fthermostatic element assembly in the EDG jacket water temperature control valves(TCV-31/32/33), in place of the original 170F elements. A 180F element, in the three-way TCV, is used to control temperature at 190F, due to thermal hydraulic hysteresis. The team identified that the licensee had not documented an evaluation of the impact ofa jacket water temperature increase on the performance of the combustion air aftercooler in either the modification package or in the supporting safety evaluation. Basedon additional vendor information, Entergy subsequently determined the jacket watertemperature increase did not adversely affect the after cooler performance or EDGoperation.While gathering data regarding EDG after cooler performance, Entergy determined thatthe 180F thermostatic elements, installed in 1990 by Modification 90-03-158, hadsubsequently been replaced with 170F elements, while performing routine preventivemaintenance using maintenance procedure 3-GNR-022-ELC, EDG 6-Year Inspection. The 180F elements were sized to maintain jacket water temperature within design limitsand prevent exceeding the maximum flow limits to the combustion air after cooler, for aSW temperature of 95F. Entergy determined the EDGs were currently operable, basedon river water (i.e., source of SW) temperature of approximately 50F, because the 170F elements were originally sized to support EDG operation for a maximum SWtemperature of 85F. Entergy entered this issue into their corrective action program asCR-IP3-2007-04411, and issued a corrective action to replace the elements prior to rivertemperature exceeding 85F.The team identified that jacket water cooling flow thorough the after cooler would haveexceeded the after cooler design flow of 130 gpm, if the EDG were operated with the 170F element and SW temperature at 95F. Based on additional vendor information,Entergy subsequently determined that the after cooler design flow was 130 gpm, with amaximum allowable flow of 150 gpm. Entergy initiated a past operability assessment todetermine whether SW temperature had exceeded 85F while the 170F thermostaticelements had been installed and, if so, to determine whether the after cooler flow wouldhave exceeded the maximum allowable value of 150 gpm.As an immediate corrective action, Entergy evaluated data during the previous two yearperiod and determined that the SW maximum temperature had not exceeded 85F,except for one day when the SW maximum temperature had been recorded as 85.8F. Entergy determined that a SW temperature of 85.8F would result in an after cooler flowonly slightly above the nominal design flow of 130 gpm. Therefore, Entergy concludedthe EDGs had remained operable during the prior 2 year period. The teamindependently reviewed the Indian Point Monthly Environmental Reports for the previous2 year period (October 1, 2005 to September 30, 2007), verified that the SW intakemaximum temperatures did not exceed 85F during that period (except for 1 day), andconcluded that Entergy's past operability assessment for the prior 2 years wasreasonable, based on the after cooler margin between the nominal design and maximumallowable flow rates.
13EnclosureAnalysis: The team determined that the failure to properly update the affected maintenance procedure was a performance deficiency. Entergy's design controlmeasures did not ensure that a change to the design basis was correctly translated intomaintenance procedures. Specifically, a modification replaced the 170F controlelement in the EDG jacket water temperature control valves, with a 180F element, tosupport EDG operation at a higher SW temperature of 95F. Subsequently, using theuncorrected procedure, maintenance technicians re-installed 170F elements.The finding was more than minor because it was similar to NRC Inspection ManualChapter (IMC) 0612, Appendix E, "Examples of Minor Issues," Example 3.b, in that avalve design was changed, but a licensee oversight resulted in a failure to update aprocedure, which could adversely affect an EDG. The finding was associated with thedesign control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systemsthat respond to initiating events to prevent undesirable consequences. Traditionalenforcement does not apply because the issue did not have any actual safetyconsequences or potential for impacting the NRC's regulatory function, and was not theresult of any willful violation of NRC requirements. In accordance with NRC IMC 0609,Appendix A, "Significance Determination of Reactor Inspection Findings for At-PowerSituations," the team conducted a Phase 1 SDP screening and determined the findingwas of very low safety significance (Green) because it was a design deficiency that wasconfirmed not to result in the loss of EDG operability.Enforcement:
10 CFR Part 50, Appendix B, Criterion III, "Desi gn Control," requires, inpart, that measures shall be established to ensure that the design basis are correctlytranslated into specifications, drawings, procedures, and instructions. Contrary to theabove, as of November 8, 2007, Entergy's design control measures were not adequateto ensure that a change to the design basis was correctly translated into maintenanceprocedure 3-GNR-022-ELC. Specifically, in 1990, Modification 90-03-158 installed a 180F thermostatic element assembly in the EDG jacket water temperature controlvalves, in place of the original 170F elements. The modification's purpose was tosupport a design basis change that increased the maximum operating SW temperaturefrom 85F to 95F. As a result of not revising the procedure, during routine preventivemaintenance, the correct 180F element was subsequently removed and replaced with a 170F element, which could have adversely affected EDG operation at SWtemperatures greater than 85F. Because this violation was of very low safetysignificance and was entered into Entergy's corrective action program (CR-IP3-2007-04411), this violation is being treated as a non-cited violation (NCV), consistent withSection VI.A.1 of the NRC Enforcement Policy. (NCV 05000286/2007006-04,Maintenance Procedure Not Revised after Emergency Diesel Modification).2.1.8 Residual Heat Removal Supply from Reactor Coolant System Isolation Valves(AC-MOV-730 and -731)
a. Inspection Scope
The team selected the residual heat removal supply from reactor coolant system isolation valves as a high risk sample and due to their unique operation in that they are 14Enclosureroutinely electrically backseated. The team reviewed calculations, MOV diagnostictests, the valve vendor manual, and system and component level drawings to verify thevalves' capability to perform during design basis acci dent scenarios. The teaminterviewed engineers and reviewed the actuator torque switch settings to verify thatstructural limits of the valves were not being exceeded when the valves werebackseated. NRC Information Notice (IN) 87-40, "Backseating Valves Routinely toPrevent Packing Leakage," was reviewed to determine if the station took appropriatemeasures to prevent failure of the valves. Condition reports were reviewed to determinethe historical performance of the valves and valve actuators.
b. Findings
No findings of significance were identified..2.1.9Main Steamline Atmospheric Steam Dump Valves (MS-PCV-1134, 1135, 1136, & 1137)
a. Inspection Scope
The atmospheric steam dump valves were chosen as a representative high risk airoperated valve (AOV) sample. The team conducted interviews with engineers andreviewed system and component level calculations, procedures, valve diagnostic testresults, and trend data to verify the capabilities of MS-PCV-1134, 1135, 1136, and 1137to perform their intended function during postulated design basis accident conditions. The backup nitrogen supply system for the atmospheric steam dump valves wasreviewed to determine if design assumptions were supported by procedural operation ofthe system. Preventive maintenance requirements and corrective action reports werealso reviewed in order to determine the performance and operational history of thevalves.
b. Findings
No findings of significance were identified..2.1.10Motor Driven Auxiliary Feedwater Flow Control Valves (BFD-FCV
-406A,B,C,D)
a. Inspection Scope
The MDAFW flow control valves were chosen as a representative high risk AOV sample. The team conducted interviews with engineers and reviewed calculations, procedures, and periodic verification and inservice test results to verify the capability of the BFD-FCV-406A, B, C, and D valves to perform their intended function during design basisconditions. The backup nitrogen supply for the AFW system was reviewed to determineif there was sufficient capacity to support design assumptions for system operationfollowing a loss-of-instrument air. Condition reports were reviewed to assess thecondition of the system and to verify previously identified issues had been properlyresolved.
b. Findings
No findings of significance were identified.
.2.1.1 1Station Battery 31
a. Inspection Scope
The team reviewed the station battery, and associated 125 Vdc switchgear, buses,chargers and inverters. The team reviewed the battery calculations to verify that thebattery sizing would satisfy the requirements of the risk significant loads and that theminimum possible voltage was taken into account. Specifically, the evaluation focusedon verifying that the battery and battery chargers were adequately sized to supply thedesign duty cycle of the 125 Vdc system, and that adequate voltage would remainavailable for the individual load devices required to operate during a two-hour copingduration. The team reviewed battery surveillance test results to verify that applicabletest acceptance criteria and test frequency requirements specified for the battery weremet. The team also reviewed condition reports and maintenance work orders for theassociated battery chargers and inverters as well as design change records for the 125Vdc system. The team interviewed design and system engineers regarding designaspects and operating history for the battery. In addition, a walkdown was performed tovisually inspect the physical condition of the station batteries, switchgear and batterychargers. During the walkdown, the team also visually inspected the battery for signs ofdegradation such as excessive terminal corrosion and electrolyte leaks.
b. Findings
Introduction:
The team identified a finding of very low safety significance (Green)involving a non-cited violation of 10 CFR 50, Appendix B, Crit erion III, "Design Control," in that improper component voltage requirements were used when performing batterysizing calculations.Description: The team reviewed calculations IP3-CALC-EL-184 thru 186, "31, 32, 33Battery, Charger, Associated Panels and Cables Component Sizing and Voltage DropCalculations," and associated technical manuals for components powered from thebatteries. The licensee utilized standardized calcul ation methods as described in IEEE-Standard-485-1983, "Recommended Practice for Sizing Large Lead Storage Batteriesfor Generating Substations." The team found that the vendor manual for Agastat 7000series timing relays included a footnote that stated that four-pole models of the timingrelays have an operational voltage range of 85% -120% of the DC bus voltage of 125Vdc. However, the team noted that the 85% (106.25 Vdc) requirement as stated in thevendor manual was not used as the minimum voltage for determining the battery sizerequirements. A review of all IP-3 battery calculations showed that a minimumcomponent voltage of 100 Vdc was used for battery sizing and not the 106.25 Vdcrequired by the timing relays. Interviews conducted by the inspection team with systemengineers confirmed that the four-pole models of the Agastat 7000 series timing relayswere currently in use in IP-3 DC electrical systems powered from batteries 31, 32 and33, and that the 85% voltage requirement was not considered in the sizing calculations.
16EnclosureSpecifically, containment spray pump and high steam flow safety injection timingfunctions are controlled by these relays. A review of the most recent discharge test results for all of the batteries indicated thatcurrent capacity margins are adequate for operation. The team noted that the "StationBattery Load Profile Service Tests" (3PT-R156C, Rev. 13) showed that the batteries arecurrently capable of providing adequate current for the design two hour discharge timebefore they reach the minimum individual cell voltages required to support operation ofthe Agastat 7000 relays. However, the acceptance criteria for these tests, specificallythe minimum individual cell voltages (ICVs) may not be adequate to ensure the batterywill provide for minimum component operating voltages when the batteries reach 80% oftheir maximum capacity, considered to be "end of useful battery life." The licenseedetermined the batteries are operable based on the review of the most recent testresults and initiated a condition report to track and document final resolution of the issue. The team reviewed the results of the battery tests and determined the licensee'soperability assessment was appropriate.
Analysis:
The team determined that Entergy's failure to use the minimum voltageassociated with the limiting component for the battery sizing calculations represented aperformance deficiency that was reasonably within the licensee's ability to foresee andprevent. Specifically, proper sizing of station batteries is vital to ensuring the operationof safety-significant equipment upon a loss of AC power through the battery's end ofuseful life (80% capacity). The minimum component voltage for the Agastat 7000 relays,including a circuit voltage drop of five volts as assumed in the calculations, results in arequired minimum battery terminal voltage requirement of 111.25 volts at the end of thedischarge time. This battery voltage results in a minimum ICV of 1.854 volts versus thepreviously calculated 1.75 volts. The surveillance tests with the current ICVrequirements could result in a battery remaining in service past its end of useful life. Theteam also noted that Agastat 7000 relay replacements in 2002 appears to have been amissed opportunity for prior identification.This issue is more than minor because it was associated with the design control attributeof the Mitigating Systems cornerstone and affected the cornerstone objective of ensuringthe availability, reliability and capability of system s that respond to initiating events toprevent undesirable consequences. Traditional enforcement does not apply becausethe issue did not have any actual safety consequences or potential for impacting theNRC's regulatory function, and was not the result of any willful violation of NRCrequirements. In accordance with NRC IMC 0609, Appendix A, "SignificanceDetermination of Reactor Inspection Findings for At-Power Situations," the teamconducted a Phase 1 SDP screening and determined the finding was of very low safetysignificance (Green) because it was a design deficiency confirmed not to result in a lossof battery operability.Enforcement
- 10 CFR Part 50, Appendix B, Criterion III, "Desi gn Control," requires, inpart, that measures shall provide for verifying or checking the adequacy of design. Contrary to the above, as of October 19, 2007, Entergy's design control measures werenot adequate to verify the adequacy of the battery design. Specifically, Entergy used anon-conservative minimum operating voltage for the Agastat 7000 series timing relays 17Enclosureas an input to the battery sizing calculations. Because this violation was of very lowsafety significance and was entered into Entergy's corrective action program (CR-IP3-2007-03957), this violation is being treated as a non-cited violation (NCV), consistentwith Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000286/2007006-05,Inadequate Design Controls for Station Battery Sizing Calculations)
.2.1.1 2480V Switchgear 32 Bus 6A
a. Inspection Scope
The team reviewed condition reports, corrective maintenance history, and preventivemaintenance procedures for selected Bus 6A breakers, including the bus feeder breaker6A, to evaluate the reliability of the equipment. The team reviewed the electricaldistribution system load flow analysis and the manufacturer's rating data for theWestinghouse type DS-416 and DS-532 circuit breakers and 480V switchgear todetermine the operating margin for components that were identified by calculation aslimiting components during design basis conditions. The team reviewed drawings,calculations, set point information network (SPIN) data sheets, and Amptector calibrationtests to verify that breaker overcurrent trip settings were appropriately selected andcalibration tested in accordance with the established acceptance criteria. The teamreviewed the coordination calculation to verify that breaker 6A trip setting wasdetermined in accordance with design basis conditions and the operating instructions forbus loading during a design basis accident. The team conducted walkdowns of theswitchgear and the switchgear area ventilation equipment, to observe the materialcondition for indications of equipment degradation.
b. Findings
No findings of significance were identified..2.1.13Emergency Diesel Generator 31 (Electrical)
a. Inspection Scope
The team reviewed the EDG 31 drawings and the schematics for the starting air circuitand the vendor nameplate data for the diesel starting air motor solenoid. The teamreviewed the EDG loading study for the worse case design basis loading conditions todetermine the margin available on the EDGs. The team also reviewed the results ofcapacity tests to verify that the diesel generator test conditions enveloped design basisand technical specification requirements. The team reviewed the coordinationcalculation, SPIN data sheet, and Amptector calibration tests to verify that EDG 31generator breaker EG1 overcurrent trip settings were appropriately selected andcalibration tested in accordance with the established acceptance criteria. The teamconducted walkdowns of the EDGs to evaluate the material condition and the operatingenvironment for the equipment and to determine if there were indications of degradationof any components.
18EnclosureThe team also reviewed plant modification ER-05-3-017, "Replacement of Unit ParallelRelay on the EDGs," to verify that the design bases, licensing bases, and performancecapability of the component had not been degraded as a result of the modification.
b. Findings
Introduction:
The team identified a finding of very low safety significance (Green)involving a non-cited violation of 10 CFR 50, Appendix B, Crit erion III, "Design Control." Specifically, Entergy did not use the most limiting design inputs in engineering analysesand surveillance test acceptance criteria for the EDG.Description: The team identified several examples in the engineering analyses for EDGloading in which the most limiting design input values were not used. As a result, theconclusions of the various analyses were non-conservative. For example, the teamreviewed IP-CALC-04-00809, "Brake Horsepower Values Related to Certain Pumps andFans for EDG Electrical Loading," and found that the break horsepower (BHP) requiredfor the primary auxiliary building (PAB) exhaust fans and the auxiliary feedwater pumpmotors were non-conservative in that worst case design conditions for maximum flow, ineach case, were not considered. Also, the licensee assumed that the highest motorload for the containment fan coil units would occur when service water temperature tothe units was at the maximum design temperature. During the inspection, the licensee,working with the nuclear steam supply system (NSSS) vendor, was not able to confirmthat the assumption was correct or whether the lowest design service water temperatureshould have been considered. The team reviewed surveillance test 3PT-R160B, "32EDG Capacity Test," performed on March 14, 2007, and found that the testingperformed at 1900 kW load met Technical Specification surveillance requirement (SR)3.8.1.10.a. which requires the EDG be loaded between 1837 and 1925 kW. However,the actual tested load did not envelope the maximum possible load determined in theEDG load analyses using the most limiting design inputs. (1924.4 kW)In addition, the team found that the maximum frequency limit 61.2 Hz allowed underTechnical Specification SR 3.8.1.2.b was not used by the licensee to determine themaximum load requirement. All of the issues identified by the team were documented incondition reports for additional followup and resolution. As an immediate correctiveaction, Entergy performed additional analyses and determined that the effects of theissues identified did not impact EDG operability. Specifically, fuel rack position data was recorded during surveillance testing. Entergy eval uated the rack pos ition recordedduring the March 14, 2007, test and determined there was sufficient rack travel availableto achieve maximum design load, including higher loading as a result of errors identifiedin the loading analyses. The team reviewed Entergy's analyses and operabilityevaluation and found them to be reasonable.Analysis: The team determined that the failure to adequately evaluate the most limiting load conditions in the EDG loading analysis was a performance deficiency. Specifically,Entergy's design control measures were not adequate to ensure design calculationinputs and assumptions were appropriate for the EDG loading calculation.
19EnclosureThe finding is more than minor because it is associated with the design control attributeof the Mitigating Systems cornerstone and affected the cornerstone objective of ensuringthe availability, reliability, and capability of system s that respond to initiating events toprevent undesirable consequences. Traditional enforcement does not apply becausethe issue did not have any actual safety consequences or potential for impacting theNRC's regulatory function, and was not the result of any willful violation of NRCrequirements. In accordance with NRC Inspection Manual Chapter 0609, Appendix A,"Significance Determination of Inspection Findings for At-Power Situations," the teamconducted a Phase 1 screening and determined that this finding had very low safetysignificance (Green) because it was a design deficiency that was confirmed not to resultin a loss of EDG operability.
Enforcement
- 10 CFR Part 50, Appendix B, Criterion III, "Desi gn Control", requires, inpart, that design control measures shall provide for verifying or checking the adequacyof design, such as by the performance of design reviews, by the use of alternate orsimplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, as of October 23, 2007, Entergy's design control measures werenot adequate to verify the adequacy of the EDG design. Specifically, Entergy did notverify that design inputs to the EDG load analysis enveloped the worse case loadconditions. Because the finding is of very low safety significance and has been enteredinto Entergy's corrective action program (CR-IP3-2007-04002, CR-IP3-2007-04024 andCR-IP3-2007-04098), this violation is being treated as a non-cited violation, consistentwith Section VI.A.1 of the Enforcement Policy. (NCV 05000286/2007006-06,Inadequate Design Inputs and Testing Requirements for EDG Loading).2.1.14 Station Auxiliary Transformer (SAT)
a. Inspection Scope
The team reviewed the design, testing, and operation of the SAT to verify it was capableof performing its design function during normal, transient and accident conditions. Theteam conducted interviews with engineers, conducted walkdowns of equipment, andreviewed the SAT control logic and interlocks. The review included the adequacy ofenergy sources, control circuit supply, field installation conditions, tap changer operation,potential failure modes, and design, testing, and operating margins. The team alsoreviewed maintenance and inspection activities associated with the SAT.The team also reviewed the electrical feed from the transformer secondary to the 6.9 kVBuses 5 and 6 to verify that the design, testing, and operation would result in a reliablesource of offsite power to the safety buses under all conditions. This review included theelectrical bus fast transfer scheme that transfers buses 1,2,3 and 4 from their normalfeed, the unit auxiliary transformer (UAT), to the feed from the SAT, following a plant trip. The team reviewed relevant sections of the study performed to analyze the transientconditions developed under an automatic fast bus transfer. The team reviewed theperiodic test of the closing time for the tie breakers, including methodology and actualtest results. The team also reviewed the settings, control and potential transformerconnections, potential failure modes, and periodic surveillance test results for the 20Enclosuresynchro-check relay, which is connected to supervise the UAT and the SAT voltagephasing conditions.
b. Findings
Introduction:
The team identified a finding of very low safety significance (Green)involving the failure to perform a transformer bushing power factor (Doble) test withinEntergy, vendor, or industry recommended frequencies. Additionally, Entergy did notprovide an appropriate technical bases to defer the test beyond the normal interval.Description: The SAT is an essential component in the circuit that provides thepreferred offsite electrical power source for the plant during both normal and post-accident conditions. A power factor test is an effective industry standard test used toassess the condition of transformers and bushings, and determine whether there isevidence of bushing contamination and/or deterioration. Industry operating experienceshows that high voltage bushings, if allowed to deteriorate, have failed and caused theloss of the transformer, as well as damage to adjacent equipment.During the last refuel outage, in March 2007, a SAT power factor test had beenscheduled, but was not performed due to inclement weather. Entergy determined thatthe test could not be re-scheduled during the remaining outage time frame. Since it isnecessary to remove the SAT from service to perform the test, Entergy determined thenext opportunity for the test would be during the 2009 refuel outage. Entergy performeda deferral evaluation to re-schedule the test, which concluded that not performing thetest for an additional 2 years was acceptable.The team identified that the last power factor test on the bushings had been performedin 1999, and a deferral until 2009 would result in a 10 year interval between tests. Theteam noted that a 10 year interval between bushing tests was significantly longer thanthe 4 year test interval specified in Entergy's maintenance procedure as well as thebushing vendor and industry recommendations for bushing test frequencies. The teamdetermined this test interval was excessive because it did not facilitate identification ofadverse trends, that if identified and corrected could prevent an in-service failure of thetransformer. The team also determined that Entergy's deferral evaluation lacked areasonable technical bases, because it contained errors (e.g. incorrectly assumed thelast test was in 2001), and incorrectly assumed the SAT was a component not importantto safety. The team noted that Indian Point's PRA identified the SAT as a risk significantcomponent, with a RAW value of 6.8, because it is a key component in the offsite powercircuit to the safety buses.Entergy evaluated the SAT and concluded it was operable, in part, based on acomparison of the 1999 power factor test results to the transformer nameplate data, andbecause the transformer was currently energized and operating normally. Entergyentered this condition into the corrective action program. The team determinedEntergy's operability evaluation wa s reasonable.Analysis: The team determined that deferring an offsite power transformer test, to theextent that test results might not be adequate to predict degradation and allow 21Enclosuresubsequent corrective actions to prevent an in-service failure, was a performancedeficiency. Specifically, Entergy did not perform a power factor test that was alreadypast due, because of inadequacies in outage planning, scheduling, and work control,and re-scheduled the test for 2009, resulting in a 10 year test interval.The finding was more than minor because it is associated with the equipmentperformance attribute of the Mitigating Systems and affected the cornerstone objectiveof ensuring the availability, reliability and capability of sy stems that res pond to initiatingevents to prevent undesirable consequences. In accordance with NRC IMC 0609,Appendix A, "Significance Determination of Reactor Inspection Findings for At-PowerSituations," the team conducted a Phase 1 SDP screening and determined the findingwas of very low safety significance (Green) because it was not a design or qualificationdeficiency, did not result in an actual loss of safety function, and did not screen aspotentially risk significant due to a seismic, flooding, or severe weather initiating event.This finding had a cross-cutting performance aspect in the Human Performance - WorkControl area. A past due transformer bushing power factor test was not performed asscheduled, during the 2007 refuel outage and was deferred to the next outage, in 2009. Specifically, risk insights had not been adequately considered (e.g., Entergy's deferralevaluation considered the SAT as a non-risk significant component), job site conditions(i.e., outside work during winter) did not support the test activity, and there was noplanned contingency if the test activity could not be accomplished within its scheduledwork window. (IMC 0305, aspect H.3(a))Enforcement: No violations of NRC requirements were identified. Entergy entered thisissue into the corrective action program (CR IP3-2007-4266).
(FIN 05000286/2007006-07, Inadequate Bushing Testing for the Station Auxiliary Transformer).2.1.15Auxiliary Feedwater Pump and Valve Inst rumentation and Controls
a. Inspection Scope
The team reviewed the design, testing and operation of the instrumentation and controlcircuitry associated with major components in the AFW system to ensure these circuitswould support the system in performing its design functions during transient andaccident conditions.The team inspected the AFW system controls and instrumentation for MDAFW pumpmotor manual and automatic start, and the automatic and manual controls for flowcontrol valves BFD-FCV-406A, B, C, and D. The team reviewed the capability of thevalves to control the discharge pressure/flow of the MDAFW pumps in the automatic andmanual modes. The team also reviewed the motor driven pump control circuit, whichprovides for a motor breaker trip for prevention of overload due to pump run-out. Periodic surveillance tests, energy sources, potential failure modes, as well as theinstrument setting calculations were also reviewed.
22EnclosureThe team inspected the TDAFW pump controls and instrumentation for automatic startand manual operation. The team reviewed the controls and interlocks for steam turbinepressure reducing valve MS-PCV-1139. The team reviewed the capability of the flowcontrol valves (BFD-FCV-405A-D) for automatic and manual control of the dischargepressure/flow of the TDAFW pump. The automatic controls for steam isolation valvesMS-PCV-1310A and -1310B, and their automatic shut off operation in case of a steamline break in the AFW pump room were also reviewed. The team also reviewed theoperation of the speed controller MS-HCV-1118, which included periodic surveillancetests, energy sources, potential failure modes, and the instrument setting calculations.
b. Findings
No findings of significance were identified..2.1.16118 Vac Instrumentation Bus 31 and Inverter
a. Inspection Scope
The team reviewed the design and testing of the 118 Vac Bus 31 and its associatedinverter to ensure it could perform its design function of providing a reliable source of118 Vac power to its associated buses and components during normal, transient and accident conditions. The team reviewed the voltage drop calculations, control diagrams,schematics, block diagrams, past corrective actions, surveillance tests and componentvendor manuals. The team verified proper load analyses, assumptions and calculationmethodologies. In addition, a walkdown was performed to visually inspect the physicalcondition of the bus and inverter. Additionally, the team reviewed change records for theinverter as well as maintenance testing on associated system breakers.
b. Findings
No findings of significance were identified..2.1.17Appendix "R" Standby Diesel Generator
a. Inspection Scope
The team reviewed the design, testing and operation of the Appendix "R" dieselgenerator to ensure it would provide a reliable source of AC power to equipmentnecessary to support plant safe shutdown during a fire that affects the availability ofoffsite and/or emergency diesel generator power and during a station blackout event(total loss of all AC power). Specifically, the team reviewed the Appendix "R" DG drawings and operationsprocedures to verify breaker alignments required for generator operation. The teamreviewed the DG loading study for the design basis loading conditions to determine themargin available on the DG. The team also reviewed the results of DG functional teststo verify that the test conditions enveloped design basis loading requirements. The teamconducted walkdowns of the DG to evaluate the material condition and the operating 23Enclosureenvironment for the equipment and to determine if there were indications of degradationof any components.
b. Findings
No findings of significance were identified..2.1.18480 Vac Motor Control Center MCC-36B
a. Inspection Scope
The team reviewed the design of 480 Vac motor control center MCC-36B to verify that itcould supply power to the necessary loads during normal, transient and accidentconditions. The team reviewed corrective actions, surveillance tests and electricalschematics. A walkdown of the system was also performed to verify load configurationand physical conditions.
b. Findings
No findings of significance were identified..2.1.19Steam Generator Atmospheric Dump Valve (MS-PCV-1134) Control Circuitry
a. Inspection Scope
The team reviewed the design, testing and operation of the valve to ensure it wouldperform its design function of removing heat from the reactor coolant system (RCS)during off-normal conditions when the main condenser is not available.The review included the operation and settings of the proportional/integral/derivativecontrollers which control the atmospheric steam dump valves during automatic andmanual operation. The review also included the instrumentation calibration, periodictesting, potential failure modes, availability of energy sources, adequacy of set points,logic and interlocks, and remote indication system. The team verified that the controllersettings were such as not to unnecessarily challenge the operation of the safety valves. The team also verified that backup nitrogen could be utiliz ed to operate the system inthe event the normal supply of instrument air was lost.
b. Findings
No findings of significance were identified..2.1.20 Switchgear Room Ventilation Fan 33
a. Inspection Scope
The team reviewed the design, operation and testing of the switchgear room ventilationfans to ensure the system would provide adequate cooling for all components within the 24Enclosureroom and prevent exceeding the maximum operating temperature of any components. The review included system modifications, switchgear room heatup calculations,surveillance testing and preventive maintenance activities. The team reviewed theoperating history of the fan to assess the adequacy of corrective actions taken toaddress failures. The team also interviewed design and system engineers andperformed walkdowns of the ventilation system to assess the material condition ofsystem components.
b. Findings
No findings of significance were identified..2.2Detailed Operator Action Reviews (5 Samples)The team assessed manual operator actions and selected a sample of five actions fordetailed review based upon risk significance, time urgency, and factors affecting thelikelihood of human error. The operator actions were selected from a PRA ranking ofoperator action importance based on RAW and RRW values. The non-PRAconsiderations in the selection process included the following factors:* Margin between the time needed to complete the actions and the time available prior to adverse reactor consequences;* Complexity of the actions;* Reliability and/or redundancy of components associated with the actions;* Extent of actions to be performed outside of the control room;* Procedural guidance; and* Training..2.2.1AC Power Recovery
a. Inspection Scope
The team selected the operator action to recover AC power to at least one safeguardselectrical bus via the alternate AC power source (Appendix "R" Diesel Generator). Thisaction must be completed within one hour of losing all AC power, and the potentialconsequence of failure of this action is core damage. The team reviewed theincorporation of this action into site procedures, classroom training, and simulatortraining. The team also accompanied operators and walked through station proceduresand plant equipment associated with the startup and alignment of the alternate ACpower source to safety related 480 Vac buses to verify that Entergy could restore ACpower within one hour of a station blackout event. Finally, the team observed a stationblackout simulator scenario to further evaluate operator training and emergencyoperating and recovery procedures.
b. Findings
No findings of significance were identified.
25Enclosure.2.2.2Initiate Low and High Head Recirculation Flow
a. Inspection Scope
The team selected the operator action to manually align and initiate low and high headrecirculation flow. Specifically, the actions involve providing recirculation cooling flowfrom the recirculation or containment sumps to the reactor via the RHR system heatexchangers and low head or high head pumps. The IP-3 Human Reliability AnalysisNotebook considered this action to be of a moderately high stress level and a moderateto high task complexity. The team observed simulator scenarios that required theinitiation of low and high head recirculation, both by the use of the recirculation pumpsand the RHR pumps. The incorporation of this action into site procedures, classroomtraining, and job performance measures were also reviewed. The team also interviewedoperators and engineers to discuss the details associated with this action.
b. Findings
No findings of significance were identified..2.2.3Manually Trip the Reactor Coolant Pumps Following Loss of Component Cooling WaterSystem
a. Inspection Scope
The team selected the operator action to manually trip the reactor coolant pumps (RCP)following the loss of the component cooling water (CCW) system in order to prevent aninitiating event (RCP seal loss of coolant accident). The team verified that control roomannunciator response and abnormal operating procedures provided adequateinstructions to trip the RCPs following the loss of the CCW system. The teaminterviewed operators and observed a simulator scenario during which RCPs wererequired to be tripped following a significant CCW system malfunction.
b. Findings
No findings of significance were identified..2.2.4Local/Manual Control of Turbine Driven Auxiliary Feedwater Pump Flow
a. Inspection Scope
The team selected the operator action to manually control the TDAFW pump following aloss of all AC power or loss of instrument air. This operator action involved locally andmanually controlling the four flow control valves associated with the TDAFW pump. Theteam observed plant staff walk through the actions required to locally control steamgenerator levels, as well as resetting the TDAFW pump turbine overspeed trip device (inthe event of an overspeed trip of the TDAFW pump turbine). The team verified thatEntergy staged all necessary tools in an appropriate location to effectively and 26Enclosureexpeditiously operate the necessary equipment. The incorporation of this action into siteprocedures, classroom training, and job performance measures was also reviewed.
b. Findings
No findings of significance were identified..2.2.5Local/Manual Operation of Atmospheric Dump Valves
a. Inspection Scope
The team selected the operator action to operate the steam generator atmosphericdump valves. This action included manual activities to locally align the two sources ofbackup nitrogen supply to operate the ADVs (instrument air is normal supply). The teamreviewed the incorporation of this action into emergency and abnormal operatingprocedures, job performance measures, and classroom training. The team observed anoperator locate the local nitrogen supply valves and controls, and walk through theproceduralized actions to locally operate the ADVs.
b. Findings
No findings of significance were identified.
.3 Review of Industry Operating Experience (OE) and Generic Issues (6 Samples)
a. Inspection Scope
The team reviewed selected OE issues for applicability at Indian Point Unit 3. The teamperformed a detailed review of the OE issues listed below to verify that Entergy hadappropriately assessed potential applicability to site equipment and initiated correctiveactions when necessary..3.1NRC Information Notice (IN) 2005-023, Vibration-Induced Degradation of ButterflyValvesThe team reviewed Entergy's evaluation of IN 2005-23 to assess the thoroughness andadequacy of the subject evaluation. IN 2005-23 focused on separation of butterfly valveinternal components due to the vibration-induced loss of taper pins used to connectthem. Entergy's evaluation included conducting a search of the corrective actiondatabase to identify whether there were condition reports involving related valve failures,and reviewing valve preventive maintenance procedures to evaluate the measuresemployed at IP-3 to secure the valve disc-to-stem taper pins. The results of Entergy'sevaluation indicated that the subject butterfly valves were not susceptible to vibrationinduced failure as described in the Information Notice.
27Enclosure.3.2NRC IN 2002-012, Submerged Safety-Related Electrical CablesThe team reviewed Entergy's disposition of IN 2002-012 for applicability and theidentification and effectiveness of corrective actions. This notice addressed submergedsafety-related cables in duct banks. The team reviewed work orders to confirm that ductbanks at IP-3 containing safety-related cables were periodically inspected under thepreventive maintenance program, and were drained when cables were found to besubmerged to minimize the time when cables are exposed to moisture. Entergy alsodetermined that the underground power, control and instrumentation cable procurementspecification for IP-3 required all cables to have a lead sheath under the jacket toprevent insulation damage due to long term moisture exposure..3.3NRC IN 2006-26, Failure of Magnesium Rotors in Motor-Operated Valve ActuatorsThe team reviewed the applicability and disposition of IN 2006-26. The team reviewedEntergy's response to the information notice, conducted interviews and reviewed industry response. The team evaluated Entergy's evaluation of IN 2006-16, their response and subsequent actions to monitor MOVs which may be susceptible to thefailures identified in IN 2006-26.
.3.4 NRC IN 2006-22, Ultra-Low-Sulfur Diesel Fuel Oil Adverse Impact on EDG PerformanceThe team reviewed Entergy's evaluation of IN 2006-22 to assess the potential impact onEDG operation from the use of ultra-low-sulfur fuel oil.
The team reviewed Entergy's fueloil monitoring program, including sample frequency, sample locations, acceptancecriteria, and results from recent samples. The review included a walkdown of the No. 31EDG and it's fuel oil system, and interviews with the system engineer..3.5NRC IN 2005-30, Safe Shutdown Potentially Challenged by Unanalyzed InternalFlooding Events and Inadequate DesignThe team reviewed Entergy's evaluation of IN 2005-30 to assess the potential impact ofinternal flooding events on electrical equipment. The team evaluated internal floodprotection measures for the EDG rooms, the 4 kV switchgear rooms, the AFW pumproom, and the relay room. The team walked down the areas to assess operationalreadiness of various features in place to protect redundant safety-related componentsand vital electrical components from internal flooding. These features includedequipment floor drains, floor barrier curbs, and wall penetration seals. The teamconducted several detailed walkdowns of the turbine building, EDG rooms, 4 kVswitchgear rooms, relay room, the AFW pump room, and cable tunnels to assesspotential internal flood vulnerabilities. The team also reviewed Entergy's internal floodanalysis, engineering evaluations, alarm response procedures, and CRs associated withflood protection equipment and measures.
28Enclosure.3.6NRC IN 1992-16, Supplement 2, Loss of Flow From the Residual Heat Removal PumpDuring Refueling Cavity DraindownThe team inspected the IP-3 response to IN 92-16, Supplement 2 and found that theplant had installed an additional level indication system (Mansel system) to improvemonitoring of RCS level. The team reviewed the operation of the system, the periodicsurveillance tests, energy sources, potential failure modes, as well as the instrumentsettings. The team reviewed all of the condition reports written against the system andnoticed that there were numerous issues at the beginning of operation in the year 2000. However, corrective actions were implemented and the system has performedadequately for the last seven years.
b. Findings
No findings of significance were identified.4.OTHER ACTIVITIES 4OA2Problem Identification and Resolution
a. Inspection Scope
The team reviewed a sample of problems that were identified by Entergy and enteredinto the corrective action program. The team reviewed these issues to verify anappropriate threshold for identifying issues, and to evaluate the effectiveness ofcorrective actions related to design or qualification issues. In addition, condition reports written on issues identified during the inspection, were reviewed to verify adequateproblem identification and incorporation of the problem into the corrective actionprogram. The specific condition reports that were sampled and reviewed by the teamare listed in the attachment to this report.
b. Findings
No findings of significance were identified.4AO6Meetings, Including ExitOn November 8, 2007, the team presented the preliminary inspection results to Mr. P. Conroy, Director, Nuclear Safety Assurance and Mr. T. Orlando, Director,Engineering, and other members of Entergy staff. Based on subsequent in-office reviewof additional information provided by Entergy, a telephone conference call wasconducted with Messrs. P. Conroy and T. Orlando and other members of their staff onDecember 18, 2007, and a followup telephone call was conducted with Mr. P. Conroy onJanuary 29, 2008, to provide the final inspection results. The team verified that noproprietary information is documented in the report.
A-1AttachmentATTACHMENT
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
- R. Altadonna, Program and Components Engineer
- V. Andreozzi, System Engineering Supervisor
- E. Bauer, System Engineer
- J. Bencivenga, Design Engineer
- J. Bubniak, Design Engineer
- R. Carpino, Senior Reactor Operator
- P. Conroy, Director, Nuclear Safety Assurance
- G. Dahl, Licensing Engineer
- J. Dinelli, Assistant Operations Manager
- J. Etzweiler, Operations Coordinator
- M. Imai, System Engineer
- C. Ingrassia, System Engineer
- J. Kayani, Heat Exchanger Component Engineer
- M. Kempski, System Engineer
- T. King, Design Engineer
- C. Kocsis, Senior Operations Instructor
- C. Laverde, MOV Program Engineer
- L. Liberatori, Design Engineer
- T. McCaffrey, Manager, Design Engineering
- I. McElroy, Reactor Operator
- T. Moran, Check Valves Program Engineer
- T. Orlando, Director, Engineering
- R. Parks, Procedure Writer
- M. Radvansky, Design Engineering
- J. Raffaele, Design Engineering Supervisor
- H. Robinson, Design Engineer
- R. Ruzicka, Senior Operations Instructor
- D. Shah, System Engineer
- B. Shepard, Design Engineer
- A. Singer, Superintendent, Training-Nuclear Operations
- D. Vinchkoski, Senior Operations Instructor
- J. Whitney, System Engineer
A-2Attachment
NRC Personnel
- P. Cataldo, Senior Resident Inspector
- C. Hott, Resident
Inspector
- W. Schmidt, Senior Risk Analyst
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
05000286/2007006-02URIInadequate Design Control of Recirculation Pumps (Section 1R21.2.1.4)
Closed
None
Opened and Closed
05000286/2007006-01NCV Inadequate Pressure Locking Methodology Used toEnsure Valve Operability (Section 1R21.2.1.2)05000286/2007006-03NCVNon-Conservative Calculation for TDAFW Pump DischargePressure Used for Surveillance Testing (Section1R21.2.1.6)05000286/2007006-04NCVMaintenance Procedure Not Revised after EmergencyDiesel Modification (Section 1R21.2.1.7)05000286/2007006-05NCVInadequate Design Controls for Station Battery SizingCalculations (Section 1R21.2.1.11)05000286/2007006-06 NCVInadequate Design Inputs and Testing Requirements forEDG Loading (Section 1R21.2.1.13)05000286/2007006-07FINInadequate Bushing Testing for the Station AuxiliaryTransformer (Section 1R21.2.1.14)
LIST OF DOCUMENTS REVIEWED
ModificationsCD-96-3-210, Replacement of Agastat Relays, February 2, 2002DCP-00-3-018, Replace 31 and 32 Batteries, March 19, 2002DCP-01-22-022, Replace 34 Inverter, April 4, 2003DCP-03-3-034, Replacement of Sola Transformer for 34 Inverter, March 18, 2003