IR 05000458/2011008

IR 05000458-11-008, September 26, 2011 Through October 27, 2011, River Bend Station, Baseline Inspection, NRC Inspection Procedure 71111.21, Component Design Basis Inspection

ML113400127
Person / Time
Site:	River Bend
Issue date:	12/06/2011
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Olson E Entergy Operations
References
IR-11-008
Download: ML113400127 (67)

Text

December 6, 2011

SUBJECT:

RIVER BEND STATION-NRC COMPONENT DESIGN BASES INSPECTION-INSPECTION REPORT 05000458/2011008

Dear Mr. Olson

On October 27, 2011, the US Nuclear Regulatory Commission (NRC) completed a component design bases inspection at your River Bend Station. The enclosed report documents our inspection findings. The findings were discussed on October 27, 2011, with Mr. Eric Olson and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed cognizant plant personnel.

Based on the results of this inspection, the NRC has identified seven findings that were evaluated under the risk-informed significance determination process in accordance with NRC Manual Chapter 0609. Additionally, the NRC has identified one finding that was evaluated using traditional enforcement in accordance with the NRC Enforcement Policy. Violations were associated with all of the findings. Seven of the findings were found to have very low safety significance (Green). One of the findings was found to have a Severity Level IV safety significance. The violations associated with these findings are being treated as noncited violations, consistent with Section 2.3.2 of the NRC Enforcement Policy.

If you contest any of the noncited violations, or the significance of the violations you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the US Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 East Lamar Blvd., Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, US Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the River Bend Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305. In addition, if UNITED STATES NUCLEAR REGULATORY COMMISSION RE GIO N I V 1600 EAST LAMAR BLVD ARLINGTON, TEXAS 76011-4511

E.W. Olson-2-

you disagree with the characterization of the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at River Bend Station.

In accordance with Code of Federal Regulations, Title 10, Part 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS)

component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety

Dockets: 50-458 License: NPF-47

Enclosure:

Inspection Report 05000458/2011008 w/Attachments:

1 - Supplemental Information 2 - Emailed List of Components to Licensee

Distribution via electronic distribution for River Bend

ML113400127 ADAMS No 5 Yes 5 SUNSI Review Complete Reviewer Initials: GAG

5 Publicly Available 5 Non-sensitive

Non-publicly Available Sensitive SRI/EB1 SRI/EB1 RI/EB2 PE/DRP SOE/OB GAGeorge RMLatta SMakor JBraisted KDClayton

/RA/

/RA/

/RA/

/RA/

/RA/

12/2/2011 12/5/2011 12/3/2011 12/2/2011 12/3/2011 C:EB1

TRFarnholtz

/RA/

12/6/2011

-1-Enclosure U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket:

50-458 License:

NPF-47 Report Nos.:

05000458/2011008 Licensee:

Entergy Operations, Inc.

Facility:

River Bend Station Location:

River Bend Station 5485 US Highway 61N St. Francisville, LA 70775 Dates:

September 26, 2011 through October 27, 2011 Team Leader:

Gerond George, Senior Reactor Inspector, Engineering Branch 1 Inspectors:

Kelly Clayton, Senior Operations Engineer, Operator Licensing Branch Bob Latta, Senior Reactor Inspector, Engineering Branch 1 Jonathan Braisted, Project Engineer, Project Branch C Shiattin Makor, Reactor Inspector, Engineering Branch 2 Accompanying Personnel:

Neil DellaGreca, Contractor, Beckman and Associates Charles Edwards, Contractor, Beckman and Associates Approved By:

Thomas R. Farnholtz, Branch Chief Engineering Branch 1

-2-Enclosure

SUMMARY OF FINDINGS

IR 05000458/2011008; September 26, 2011 to October 27, 2011; River Bend Station; baseline inspection, NRC Inspection Procedure 71111.21, Component Design Basis Inspection.

The report covers an announced inspection by a team of four regional inspectors, two contractors and one inspector in training. Eight findings were identified. Seven of the findings were of very low safety significance. One of the findings was a Severity Level IV violation. The final significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, which states, in part, A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Specifically, prior to October 27, 2011, the licensee failed to ensure surveillance testing procedures of Division I and III standby diesel generators incorporated the correct acceptance limits for maximum expected load at max frequency and voltage specified in design basis documents. This finding was entered into the licensees corrective action program as Condition Reports CR-RBS-2011-07132, CR-RBS-2011-07294, and CR-RBS-2011-07518.

The team determined that the failure to ensure that the test procedures required to demonstrate that Division I and Division III standby diesel generators will perform satisfactorily in service incorporated the requirements and acceptance limits contained in applicable design documents was a performance deficiency. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability and capability of safety systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee could not ensure that the standby diesel generators would reliably provide power for the maximum expected post-accident loads including maximum frequency and voltage. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The finding had a crosscutting aspect in the area of problem identification and resolution, corrective action program component, because the licensee failed to thoroughly evaluate problems such that the resolutions address causes and extent of condition P.1(c) (Section 1R21.2.5).

Green.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Specifically, prior to October 27, 2011, the licensee failed to assure that the design basis information for expected heat loads to the ultimate heat sink was correctly translated into the ultimate heat sink 30-day inventory analysis. The analysis used a less conservative, frictionless form of the conservation of energy equation to determine heat load in the standby service water system during a 30-day design basis event. This finding was entered into the licensees corrective action program as Condition Reports CR-RBS-2011-07430 and CR-RBS-2011-07654.

The team determined that the failure to correctly translate expected heat loads into the ultimate heat sink inventory analysis was a performance deficiency. The finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to undesired consequences. Specifically, the neglect of friction heat load in the ultimate heat sink analysis system resulted in a condition where there was reasonable doubt on the operability of a system to meet its 30-day mission time without a makeup water source. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4,

Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Specifically, the licensees revised analysis to determine operability removed overly conservative assumptions for operating the low pressure core spray pump for 30 days to account for the friction heat load added to the system. The finding has a crosscutting aspect in the area of problem identification and resolution, corrective action program component, because the licensee failed to thoroughly evaluate problems such that the resolutions address cause and extent of condition P.1(c) (Section 1R21.2.7).

Green.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, which states, in part, A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Specifically, from October 1998 to October 27, 2011, the licensee failed to establish a NRC Generic Letter 89-13 test program which incorporated a final test frequency for the residual heat removal heat exchangers and perform an adequate trending analysis upon which to base a final test frequency. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07713.

The team determined that failure to establish a NRC Generic Letter 89-13 test program which incorporated a final testing frequency of the residual heat removal heat exchangers was a performance deficiency. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Specifically, the inappropriate test frequency affected the licensees ability to ensure residual heat removal heat exchangers, when called upon, were available and capable to reliably perform as expected. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determine to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significance contributor did not reflect current licensee performance (Section 1R21.2.9).

Green.

The team identified a Green, noncited violation of 10 CFR 50, Appendix B,

Criterion V, Instruction, Procedures, and Drawings, which states, in part, Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished.

Specifically, prior to October 27, 2011, the licensee failed to provide appropriate quantitative or qualitative acceptance criteria in station and abnormal operating procedures to determine if actions for leak detection were satisfactorily accomplished to protect the standby service water system and ultimate heat sink during design basis events. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07555.

The team determined that the failure to include appropriate acceptance criteria for leak detection in abnormal operating procedures for the standby service water system and ultimate heat sink was a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Specifically, the inadequate procedure guidance could lead to operators not recognizing conditions that would degrade the availability of the standby service water system. In accordance with NRC Inspection Manual Chapter 0609,

Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance (Section 1R21.3.5).

• Severity Level IV. The team identified a Severity Level IV, noncited violation of 10 CFR 50.59, Changes, Tests and Experiments which states, in part, that a licensee shall obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if this activity would; result in more than a minimal increase in the likelihood of occurrence of a malfunction of a SSC important to safety previously evaluated in the final safety analysis report (as updated). Specifically, from December 16, 2002, to October 27, 2011, the licensee changed the design basis of the ultimate heat sink inventory requirements to provide a 30-day cooling water supply without makeup capability to providing a less than 30-day cooling water supply with makeup capability without obtaining a license amendment. This finding was entered into the licensees corrective action program as Condition Report CR 2011-07674.

The team determined that the failure to obtain a license amendment prior to implementing a proposed change, test or experiment to the ultimate heat sink requirements was a performance deficiency. The performance deficiency was evaluated using traditional enforcement because the finding has the ability to impact the regulatory process. The finding was more than minor because it involved a change to the updated final safety analysis report description where there was a reasonable likelihood that the change would require NRC approval. In accordance with the NRC Enforcement Policy, the team used insights from MC 0609, Significance Determination Process, to determine the final significance of the finding. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding represented a loss of system safety function in that the ultimate heat sink could not meet its 30-day mission time to provide decay heat removal.

Therefore, a Phase 2 evaluation was necessary. The significance of the finding could not be assessed quantitatively through a Phase 2 or Phase 3 analysis. Consequently, an assessment was performed in accordance with IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. The finding was determined to have very low safety significance because the frequency of events that would require long term use of the ultimate heat sink is very low and the difference in the failure probability to replenish the ultimate heat sink in 10 days versus 30 days is very small. This was because an early depletion of the inventory would be easily detected and would become a priority. At the time that replenishment would be needed, plant conditions should be stable and local transportation arteries should be restored. Therefore, since the finding had very low safety significance, the finding was determined to be Severity Level IV, in accordance with the NRC Enforcement Policy. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance (Section 1R21.3.5).

Green.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, which states, in part, Instructions, procedures, and drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Specifically, prior to October 27, 2011, the licensee failed to include appropriate qualitative and quantitative acceptance criteria in abnormal operating procedures for control room operators to recognize the need to reduce loads on the standby diesel generators during design basis accidents. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07716.

The team determined that the failure to include appropriate quantitative or qualitative acceptance criteria in abnormal operating procedures for control room operators to recognize the need to reduce loads on the standby diesel generators during design basis accidents was a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating System Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesired consequences. Specifically, a control room operating crews failure to recognize the need to reduce loads to prevent the standby diesel generator failure during design basis accidents adversely affected the reliability of the standby diesel generators. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4,

Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a crosscutting aspect in the area of human performance, resources component, because the licensee did not ensure that personnel, equipment, procedures, and other resources were available and adequate to assure nuclear safety for the correct training of licensed operator personnel

H.2(b) (Section 1R21.4).

Green.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, which states, in part, Instructions, procedures, and drawings shall include appropriate qualitative and quantitative criteria for determining that important activities have been satisfactorily accomplished.

Specifically, prior to October 27, 2011, the licensee failed to include appropriate quantitative or qualitative acceptance criteria in procedures for control room operators to recognize and recover a standby diesel generator that starts but fails to load with the remaining standby diesel generator out of service during a loss-of-offsite-power event.

This finding was entered into the licensees corrective action program as Condition Reports CR-RBS-2011-07716, CR-RBS-2011-07717, and CR-RBS-2011-07718.

The team determined that the failure to include appropriate quantitative or qualitative acceptance criteria to determine that important activities are satisfactorily accomplished in emergency and abnormal operating procedures used during loss-of-offsite-power events was a performance deficiency. The finding was more than minor because it is associated with the procedure quality attribute of the Mitigating System Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesired consequences. Specifically, a control room operator crews failure to diagnose recoverable conditions adversely affected the availability of standby diesel generators during a loss-of-offsite-power event. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green)because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a crosscutting aspect in the area of problem identification and resolution, operating experience component, because the licensee did not implement and institutionalize operating experience through changes to station processes, procedures, equipment, and training programs P.2(b) (Section 1R21.4).

Green.

The team identified a Green, noncited violation of 10 CFR 55.46(c)(1),

Simulation Facilities, which states, in part, that a plant-referenced simulator used for the administration of the operating test must demonstrate expected plant response to operator input and to normal, transient, and accident conditions to which the simulator has been designed to respond. Specifically, prior to October 27, 2011, the River Bend Station simulator did not demonstrate the expected plant response for standby diesel generator loading during accident conditions to which the simulator was designed to respond. The electrical loading on the emergency diesel generator in the simulator was approximately 800 kW less than the expected full load for the diesel generator. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07682.

The team determined that the failure of the plant-referenced simulator to demonstrate expected plant response for standby diesel generator loading during accident conditions to which the simulator has been designed to respond was a performance deficiency.

The finding was more than minor because it is associated with the human performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Specifically, the incorrect simulator response adversely affected the control room operator crews capability to assess standby diesel generator loading conditions. In accordance with NRC Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets and the associated Appendix I, the finding was determined to be of very low safety significance (Green). Specifically, Manual Chapter 0609, Appendix I, Operator Requalification Human Performance Significance Determination Process, block 12, establishes a Green finding for failure to correctly replicate the plants response on the simulator that either has the potential to cause or actually causes negative training to operators. Negative training did occur for this finding because operators thought they had electrical load margin on the emergency diesel generators when the diesels were actually fully loaded with minimal margin without securing other equipment. This finding had a crosscutting aspect in the area of human performance, resources component, in that the licensee did not ensure that equipment (plant-referenced simulator) was adequate to assure nuclear safety for the correct training of licensed operator personnel

H.2(b) (Section 1R21.4).

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. As plants age, their design bases may be difficult to determine and important design features may be altered or disabled during modifications. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully.

This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Bases Inspection

The inspection team selected risk-significant components, industry operating experience issues, and operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included components, industry operating experience issues, and operator actions that had a risk achievement worth factor greater than two or a Birnbaum value greater than 1E-6.

.1 Inspection Scope for Components Selected:

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15 to 25 risk-significant samples, including 11 to 16 risk significant and low design margin components, 1 to 3 components associated with containment structures, systems, and components which are considered for large early release frequency (LERF) implications, and 3 to 6 operating experience issues. The sample selection for this inspection was 12 components, 1 containment related component, and 5 operating experience items.

The selected inspection items supported risk significant functions as follows:

(1) Electrical power to mitigation systems: The team selected several components in the offsite and onsite electrical power distribution systems to verify operability to supply alternating current

(ac) and direct current

(dc) power to risk significant and safety-related loads in support of safety system operation in response to initiating events such as loss-of-offsite-power accident, station blackout, and a loss-of-coolant accident with offsite power available. The team also reviewed the licensees response to Information Notice 2010-25, Inadequate Electrical Connections, and Information Notice 2010-26, Submerged Electrical Cables.

As such the team selected:

(a) The division I dc to ac inverter ENB-INV01A

(b) The division I 125 Vdc switchgear 1ENB*SWG01B

(c) The division I 125 Vdc ENB-PNL-02A

(d) The division III high pressure core spray 125 Vdc battery E22-S001BAT

(e) The division II standby diesel generator 1EGS*EG1B and the licensees response to Information Notice 2010-04, Diesel Generator Voltage Regulation System Components Due to Latent Manufacturing Defects

(f) The division II 4.16 kV emergency electrical bus 1ENS*SWG1B

(g) The division II standby diesel generator fuel transfer pump EGF-P1B

(2) Initiating events minimization:

The division III high pressure core spray standby diesel generator 1E22-S001G1C.

(3) Decay heat removal:

(a) A division II standby service water pump SWP-P2D and the licensees response to Information Notice 2007-05, Vertical Deep Draft Pump Shaft and Coupling Failures

(b) A residual heat removal valve E12-MOV-F068A

(c) The residual heat removal heat exchangers E12-EB001B & D

(d) The ultimate heat sink leak detection system

(e) The standby service water valve SWP-MOV-40D

(4) Containment integrity following design basis accident:

(a) The containment venting system

.2.1 Division I Inverter, ENB-INV01A:

a. Inspection Scope

The team reviewed the updated safety analysis report, voltage drop calculations, short circuit calculations, and coordination studies. The team also reviewed one-line diagrams, maintenance documents, quality assurance audit reports, and vendor manuals. Specifically, the team reviewed:

• Vendor manual requirements for agreement with operating and maintenance procedures and records.

• Current system health report, trend data, inspection frequency, applicable operating experience, as well as significant corrective action documents and their impact on design basis margin.

• 120 Vac Class 1E instrument ac short circuit study, voltage drop study, and backup supply feeder cable ampacity study calculations.

• Thermography, clean and inspection work instructions, and overhaul instructions.

b. Findings

No findings were identified.

.2.2 Division I 125 Vdc Switchgear, 1ENB*SWG01B:

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures and condition reports. This review included the licensees design basis documentation as well as various calculations, procedures, and test results. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its required design basis function. Specifically, the team reviewed:

• Preventive maintenance procedures and the results of the most recent preventive maintenance and refurbishment activities, to confirm that they were consistent with

selected vendor manual requirements and that, as-found conditions were being properly resolved.

• Circuit breaker trip device settings, protective relay setpoints, plant load flow, and short circuit calculations.

• 125 Vdc electric distribution & battery charger system health report.

b. Findings

No findings were identified.

.2.3 125 Vdc Distribution Panel, ENB-PNL-02A:

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures and condition reports. This review included the licensees design basis documentation as well as various calculations, procedures, and test results. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its required design basis function. Specifically, the team reviewed:

• Preventive maintenance procedures and the results of the most recent preventive maintenance and refurbishment activities, to confirm that they were consistent with selected vendor manual requirements and that, as-found conditions were being properly resolved.

• 125 Vdc electric distribution & battery charger system health report.

b. Findings

No findings were identified.

.2.4 Division III High Pressure Core Spray 125 Vdc Battery, E22-S001BAT:

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures and condition reports. This review included the licensees design basis documentation as well as various calculations, procedures, and test results. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its required design basis function. Specifically, the team reviewed:

• Calculations that established the methodology, assumptions, selected design inputs, and included results for the battery sizing, short circuit, load flow, charger verification, cable verification, and voltage drop calculations, to confirm that the batteries would have sufficient capability and were adequately sized.

• Surveillance procedures and selected results for the weekly, monthly, and quarterly surveillance tests; the 18-month surveillance tests, the service discharge tests, and performance discharge tests.

• 125 Vdc electric distribution & battery charger system health report

• Selected sample of condition reports.

b. Findings

No findings were identified.

.2.5 Division II Standby Diesel Generator, 1EGS*EG1B:

a. Inspection Scope

The team reviewed the River Bend Station Safety Evaluation Report, the updated safety analysis report, technical specifications, and the design basis document to determine the design requirements of the standby diesel generators. The team also reviewed the equipment specifications and the vendor nameplate rating to determine the standby diesel generators rated power output capability. Specifically, the team reviewed:

• Standby diesel generator loading calculation to assure that the worst case loading was considered and that load increase due to over-voltage/over-frequency conditions had also been considered. The review included an evaluation of selected motor loads to confirm that the horsepower/kilowatt ratings used in the calculation were based on conservative design and operating conditions.

• Standby diesel generator start sequencing and dynamic test data to confirm that the standby diesel generator was capable of starting, accelerating, and carrying loads during loss-of-offsite-power with and without a loss-of-coolant accident.

• Load breaker ampacity and short circuit rating to confirm that the standby diesel generator breaker was capable of carrying maximum calculated loads and interrupting anticipated faults.

• Standby diesel generator protection scheme, including protective relay settings and time vs. current curves coordination to assure that the breaker did not trip under maximum loading and that faults were quickly interrupted.

• Standby diesel generator and breaker start-stop logic, control power, and control wiring diagrams were also reviewed to confirm compliance with the system description and operation requirements.

• Normal and abnormal operating procedures to confirm that they incorporated appropriate load ratings and standby diesel generator loading limitations.

• Results of recent surveillance tests to confirm that test conditions were consistent with the design basis loading and the technical specification requirements.

b. Findings

(1) Inadequate Testing of Division I and Division III Standby Diesel Generators

Introduction.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, because the licensee failed to perform standby diesel generator surveillance testing in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Specifically, the licensee failed to ensure surveillance testing procedures for Division I and Division III standby diesel generators incorporated the correct acceptance limits for maximum expected load at max frequency and voltage specified in design basis documents.

Description.

The River Bend Station emergency electrical power system includes three safety-related 4.16 kV buses: 1ENS*SWG1A, 1ENS*SWG1B and 1E22*S004.

Associated with each of these buses there are three standby 4.16 kV standby diesel generators: 1EGS*EG1A, 1EGS*EG1B, and 1E22*S001G1C, respectively. The 1ENS*SWG1A and 1ENS*SWG1B buses supply power to Division I and Division II safety-related emergency shutdown equipment. Bus 1E22*S004 energizes the Division III high pressure core spray system. As described in Section 8.3.1.1.3.6.1 of the River Bend Station updated safety analysis report:

the standby diesels for 1EGS*EG1A and 1EGS*EG1B are Transamerica Delaval, Inc. type DSR 48 and provide 4869 [brake horsepower] bhp in continuous duty.

However, special requirements are imposed by the Facility Operating License for continuous operation of these two standby diesels above 4197 bhp (3130 kW).

The updated safety analysis report also states that these standby diesel generators have a continuous rating of 3500 kW and a 2-hour rating of 3850 kW. Regarding standby diesel generator 1E22*S001G1C, Section 8.3.1.1.3.6.2 of the updated safety analysis report states that the diesel is a Stewart and Stevenson type EMD 20645-E4, that provides 3600 brake horsepower in continuous duty and that the high pressure core spray synchronous generator, an Ideal SM-100 model, has a 2,000-hour rating of 2850 kW.

Discussions regarding the derating of the Transamerica Delaval, Inc. diesel are contained in NUREG 0989, Supplement No. 3, Safety Evaluation Report related to the Operation of the River Bend Station, dated August 1985. As indicated in this safety evaluation report supplement, manufacturer testing was performed at the nameplate ratings stated in the updated safety analysis report. Additionally, the manufacturer performed a preoperational test at 3500 kW for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. However, the NRC set the qualified rating of the Division I and Division II standby diesel generators at 3130 kW because of crankshaft cracking concerns. Consistent with this qualified rating of the diesels, the technical specifications specified a periodic surveillance testing between 3000 and 3100 kW. Both the rating and the testing criteria identified in the technical specification were reasonable based upon, a) an originally specified maximum loading of 2886 kW, and b) operator actions to shed automatically sequenced loads before manually adding other required loads. Consistently, Technical Specification Surveillance Requirement SR 3.8.1.14 specified that the standby diesel generators be tested at a range between 3030 and 3130 kW and the Technical Specification Bases SRB 3.8.1.14 stated that the standby diesel generators are tested at a load greater than or equal to the maximum expected post accident load.

During the 2008 River Bend Station component design basis inspection (NRC Inspection Report 05000458/2008006), the inspection team observed that the standby diesel generator loading calculation did not account for maximum frequency and voltage, as allowed by the technical specifications. In response to the NRC finding, the licensee recalculated the loading for each standby diesel generator. Calculation E-192, Standby Diesel Loading Calculation, Revision 8, concluded that, at maximum voltage and frequency, the automatically initiated loading of Division I and Division II standby diesel generators were 3122.06 kW and 2971.59 kW, respectively. Calculation E-192 also showed that the post-accident manual loading for each diesel was approximately 358 kW for the standby cooling tower fans and the fuel pool cooling pump. As stated in the safety evaluation report, before adding the manual loads, the operators must secure some automatic loads. The calculation indicated that the low pressure core spray pump (917.5 kW) and the residual heat removal pump C (470.3 kW) should be secured from the Division I and Division II standby diesel generators, respectively. The removal of the low pressure core spray pump and residual heat removal pump C from their respective buses will prevent overloading of the diesels. However, as indicated in Section 1R21.4 of this report, the applicable abnormal operating procedure did not specify such removal.

Instead, it cautioned not to load the diesels in excess of their rating, 3130 kW.

While the amount of loading calculated for the Division I standby diesel generator (3122 kW) did not exceed the rating of the diesel, Technical Specification Surveillance Requirement SR 3.8.1.14 was inconsistent with its technical specification bases statement described above and the 24-hour surveillance testing conducted every refueling outage in accordance with technical specification surveillance requirements no longer assured the capability of the diesel to carry the maximum expected loads, when instrument accuracy is considered. Regarding the Division II diesel, the automatic loads were calculated to be enveloped by the current surveillance testing requirements, including expected instrument error. When the abnormal operating procedure is revised to require the securing of the residual heat removal pump C, as specified in the safety evaluation report, the addition of manual loads will result in the standby diesel generator loading remaining below the technical specification surveillance requirements.

Regarding the Division III high pressure core spray diesel, Table 7.0 of Calculation G13.18.3.6*019, HPCS (Division III) Diesel Generator Loading, Revision 302, showed that the diesel expected loading at maximum voltage and frequency was 2647 kW, including momentary valve loading, and 2581 kW without the valve loading. These values are below the continuous rating (2600 kW) and the 2-hour rating (2850 kW) of the diesel. As in the case of the Division I standby diesel generator, the 24-hour surveillance testing required by the technical specification did not envelop the maximum anticipated standby diesel generator loading when the instrument accuracy is considered. The teams review of the River Bend Station technical specifications determined that Technical Specification Surveillance Requirement 3.8.1.14 specified testing of the Division III standby diesel generator with a load between 2750 and 2850 kW for two hours and with a load between 2500 and 2600 kW for 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />. Therefore, the surveillance testing requirement was not consistent with the technical specification bases statement described above and the 24-hour surveillance testing conducted during

past refueling outages did not assure that the diesel was capable of supplying maximum loading for the duration of the accident, when instrument accuracy is considered.

Analysis.

The team determined that the failure to ensure that the test procedures required to demonstrate that Division I and Division III standby diesel generators will perform satisfactorily in service incorporated the requirements and acceptance limits contained in applicable design documents was a performance deficiency. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability and capability of safety systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee could not ensure that the standby diesel generators would reliably provide power for the maximum expected post-accident loads including maximum frequency and voltage. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The finding had a crosscutting aspect in the area of problem identification and resolution, corrective action program component, because the licensee failed to thoroughly evaluate problems such that the resolutions address causes and extent of condition P.1(c).

Enforcement.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, which states, in part, A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to the above, the licensee failed to assure that all testing required to demonstrate that structures, systems, and components would perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Specifically, prior to October 27, 2011, the licensee failed to ensure surveillance testing procedures of Division I and III standby diesel generators incorporated the correct acceptance limits for maximum expected load at max frequency and voltage specified in design basis documents. This finding was entered into the licensees corrective action program as Condition Reports CR-RBS-2011-07132, CR-RBS-2011-07294, and CR-RBS-2011-07518. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-01, Inadequate Testing of Division I and Division III Standby Diesel Generators.

.2.6 4.16kV Standby Switchgear Bus 1ENS*SWG1B:

a. Inspection Scope

The team reviewed the updated safety analysis report, technical specifications, design bases documents, calculations, functional and protective relays settings, testing, health report, and maintenance activities related to the 4.16 kV standby switchgear bus 1ENS*SWG1B to verify the capability of the bus to supply quality electrical power to safety-related loads. The team performed a visual nondestructive inspection of the switchgear equipment to assess the installation configuration, material condition, and potential vulnerability to hazards. Specifically, the team reviewed:

• Load flow calculations, short circuit calculations, and incoming breakers protective relay trip setpoints to evaluate the adequacy of the switchgear bus and breakers to carry anticipated loads under limiting condition including withstanding maximum available faults. The review included electrical protection settings versus equipment ratings, prevention of spurious tripping, upstream-downstream coordination, and capability of protective devices to guard against low magnitude faults.

• Voltage profile of the offsite system, voltage drop calculations, and the degraded voltage relays setting to confirm that adequate voltage was available at the terminals of the safety-related loads under worst operating and accident conditions.

• Breaker logic and control wiring diagrams to ensure that the breakers operation conformed to the system description and the system operation requirements. The review also verified that adequate voltage was available to the control circuits for the proper closing and tripping of breakers.

• Automatic transfer of loads from the preferred to the alternate offsite source to confirm that it could be accomplished under postulated conditions and that actuation of the degraded and loss of voltage relays initiated the standby diesel generator starting sequence.

• Maintenance and testing procedures to confirm that maintenance and testing of breakers and buses were in accordance with industry standards and manufacturer recommendations.

• Recent system health reports and a selected sample of condition reports.

b. Findings

No findings were identified.

.2.7 Division II Standby Service Water Pump, SWP-P2B:

a. Inspection Scope

The team reviewed the updated safety analysis report, design bases documents, calculations, corrective maintenance, and post-maintenance tests of the standby service water pump SWP-P2B to ensure that the equipment was capable of meeting design requirements. Specifically, the team reviewed:

• Design basis requirements in response to transient and accident events, including supply of cooling water to the reactor safeguard and auxiliary equipment under all credible seismic, flood, drought and storm conditions.

• Standby service water system hydraulic model and the design basis hydraulic calculations to verify that required total dynamic head, required submergence and potential for vortex formation have been properly considered under all design basis accident conditions.

• Inservice testing procedures, recent test results, and trends in test data were reviewed to verify that pump performance remains consistent with design basis requirements.

• Inservice test reference values for flow rate and total dynamic head to verify appropriate correlation to accident analyses conditions, taking into account set point tolerances and instrument inaccuracies.

• Conducted a detailed walkdown to visually inspect the physical condition of the pump and its support systems and to ensure adequate configuration control.

• Motor and pump performance curves to confirm that the electrical load was correctly included in the standby diesel generator and bus loading calculations.

• Motor feeder ampacity, short circuit capability, and protective relays setting to assess the adequacy of the circuit protection under normal and faulted conditions. The team included a review to ensure that trip setpoints would not permit the feeder breaker to trip during pump motor highest loading conditions.

• Standby service water pump available motor voltage to confirm the availability and capability of the pump to perform its safety function under most limiting conditions.

• Motor control logic and wiring diagrams to ascertain compliance with system operation requirements.

b. Findings

(1) Failure to Use Conservative Design Assumptions in the Ultimate Heat Sink Inventory Calculation

Introduction.

The team identified a Green, noncited violation 10 CFR Part 50, Appendix B, Criterion III, Design Control, because the licensee failed to assure that the design basis information for expected heat loads to the ultimate heat sink was correctly translated into the ultimate heat sink 30-day inventory analysis. Specifically, the licensees analysis used less conservative assumptions for heat loads by using a frictionless form of the conservation of energy equation to determine the 30-day inventory necessary for the ultimate heat sink during a design basis event.

Description.

In 2008, the NRC component design basis inspection (IR 05000458/2008006) concluded that Calculation G13.18.14.0*190, Post-Accident Heat Load Development for Power Uprate Service Water Evaluations, Revision 1, was not conservative because the licensee neglected to include a potential heat source which is created from the energy supplied by the residual heat removal and emergency core cooling pumps as flow velocity and pressure increases which converts to heat as fluid travels through the system. The corrective actions for this deficiency included: 1) a revision of Calculation G13.18.14.0*190 to account for accurate pump heat and decay heat loads on the standby service water system via the suppression pool cooling mode; and 2) a revision of the ultimate heat sink evaporative loss calculation, PM-194, Standby Cooling Tower Performance and Evaporation Losses without Drywell Unit Coolers.

Consistent with the conservation of energy and General Electrics methodology for calculating pump heat loads on the suppression pool (Ref. GE 10 CFR Part 21 Communication No. SC06-01), Revision 2 of G13.18.14.0*190 correctly assumed that all electrical motor energy input to the emergency core cooling pumps (i.e., 100 percent of the pump brake horsepower) is converted into friction heat. The only conservatism in this calculation was that it used the pump rated horsepower rather than the brake horsepower at the actual system flow conditions. Calculation PM-194 was revised to include the new emergency core cooling heat loads into the standby cooling tower inventory calculation. The new revision determined that there was an available margin of 73,387 gallons in the standby cooling tower basin.

However, upon further inspection of Calculation PM-194 Revision 8, the team noted that the licensee chose to calculate the heat load in the standby service water system using a frictionless version of the conservation of energy equation. The team determined this alternate methodology to be incorrect and less conservative because, by using the frictionless form of the conservation of energy equation, the licensee neglected the addition of a friction heat load caused from the operation of standby service water pumps SWP-P2A and SWP-P2C, and the spent fuel cooling pump SFC-P1A. The addition of this friction heat load added a 1.7 E6 Btu/hr heat load to the standby service water system or 1.22 E9 Btu for the entire 30-day mission time. The addition would cause the standby cooling tower inventory to have no margin.

In response to the finding, the licensee issued Condition Report CR-RBS-2011-07654 to address the condition and initiate an operability evaluation. The evaluation determined that Calculation PM-194 was overly conservative by assuming that the low pressure core spray pump will be operating during the entire 30-day accident period when, in fact, the accident analysis water level is restored at 1600 seconds after initiation of the event.

Therefore, the low pressure core spray pump could be secured at 30 minutes to remove a 1.8 E6 Btu/hr heat load from the standby service water system. (Note: Revision 2 of G13.18.14.0*190 already uses the lower run time of 30 minutes for the low pressure core spray pump). Since the low pressure core spray pump heat load could be removed to compensate for the addition of friction heat added by the standby service water and spent fuel cooling pumps, the licensee determined that the ultimate heat sink was confirmed operable.

Analysis.

The team determined that the failure to correctly translate expected heat loads into the ultimate heat sink inventory analysis was a performance deficiency. The finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to undesired consequences. Specifically, the neglect of friction heat load in the ultimate heat sink analysis system resulted in a condition where there was reasonable doubt on the operability of a system to meet its 30-day mission time without a makeup water source. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss

of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Specifically, the licensees revised analysis to determine operability removed overly conservative assumptions for operating the low pressure core spray pump for 30 days to account for the friction heat load added to the system. The finding has a crosscutting aspect in the area of problem identification and resolution, corrective action program component, because the licensee failed to thoroughly evaluate problems such that the resolutions address cause and extent of condition P.1(c).

Enforcement.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.

Contrary to the above, the licensee failed to assure that the design basis information for expected heat loads to the ultimate heat sink was correctly translated into the ultimate heat sink 30-day inventory analysis. Specifically, prior to October 27, 2011, the licensee failed to assure that the design basis information for expected heat loads to the ultimate heat sink was correctly translated into the ultimate heat sink 30-day inventory analysis.

The analysis used a less conservative, frictionless form of the conservation of energy equation to determine heat load in the standby service water system during a 30-day design basis event. This finding was entered into the licensees corrective action program as Condition Reports CR-RBS-2011-07430 and CR-RBS-2011-07654.

Because this violation is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-02, Failure to Use Conservative Design Assumptions in the Ultimate Heat Sink Inventory Calculation.

.2.8 Standby Diesel Generator Fuel Oil Transfer Pump and Tanks, EGF-P1B:

a. Inspection Scope

The team reviewed the updated safety analysis report, design bases documents, calculations, corrective maintenance, and post-maintenance tests of the standby diesel generator fuel oil transfer pump EGF-P1B to ensure that the equipment was capable of meeting design requirements. Specifically, the team reviewed:

• The ability to meet the design basis requirement to transfer fuel oil from the Division II fuel oil storage tank to the Division II standby diesel generator fuel oil day tank under all credible transient and accident conditions.

• Design basis hydraulic analysis/calculations to verify that required total dynamic head, required submergence and potential for vortex formation have been properly considered under all design basis accident conditions.

• Sizing basis for the fuel oil storage tank and low level set point to verify adequate margin in maintaining minimum storage tank inventory.

• Pump inservice testing procedures, recent test results, and trends in test data to verify that pump performance remains consistent with design basis requirements.

• Inservice test reference values for flow rate and total dynamic head to verify appropriate correlation to accident analyses conditions, taking into account set point tolerances and instrument inaccuracies.

• Maintenance and functional history of the pump by sampling corrective action reports, the system health report, and preventative maintenance/corrective maintenance records.

• Conducted a detailed walkdown to visually inspect the physical/material condition of the pump and its support systems and to ensure adequate configuration control.

b. Findings

No findings were identified.

.2.9 Residual Heat Removal Heat Exchangers, E12-EB001B & D:

a. Inspection Scope

The team reviewed the updated safety analysis report, design bases documents, calculations, corrective maintenance, and post-maintenance tests of the residual heat removal heat exchangers E12-EB001B&D to ensure that the equipment was capable of meeting design requirements. Specifically, the team reviewed:

• Design basis documentation, including procurement specifications and Tubular Heat Exchanger Manufacturers Association data sheet, and heat exchanger analysis to verify equipment heat removal capability under design basis conditions.

• Heat exchanger inspection procedures, test procedures, recent inspection and test results, and trending data to assess the licensees efforts to maintain the performance capability of this equipment and to verify compliance with licensing commitments under NRC Generic Letter 89-13.

• Tube plugging analysis to confirm that adequate margin on heat transfer capability had been maintained.

• Conducted a detailed walkdown to visually inspect the material condition and configuration control of the heat exchangers.

b. Findings

(1) Failure to Establish Residual Heat Removal Heat Exchanger Testing Frequency

Introduction.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, because the licensee failed to establish a NRC Generic Letter 89-13 test program which incorporated a final test frequency for the residual heat removal heat exchangers and perform an adequate trending analysis upon which to base a final test frequency.

Description.

Although the tube side (standby service water side) of the residual heat removal heat exchangers was changed to a closed cooling water system in the mid-

1990s, the licensee made a decision to retain the residual heat removal heat exchangers in the Generic Letter 89-13 testing program because of continuous problems with water quality on the shell side. In the last official correspondence with the NRC on this subject, dated October 21, 1998, River Bend Station stated that for the residual heat removal heat exchangers that test frequency will be re-evaluated after the conduct of three tests. However, the licensee did not conduct of three consecutive tests before establishing a future test frequency for the heat exchangers. The current preventative maintenance program plan frequency for testing of all residual heat removal heat exchangers is as required. The licensee was unable to tell the inspectors how the plant staff actually determines when testing of the residual heat removal heat exchangers was required.

Because of fouling of the residual heat removal heat exchangers, from 1995 to 2002, the plant was never able to go more than one test cycle (each refueling outage) without the Division II residual heat removal heat exchanger performance degrading near, and in one case below, the required design heat removal duty of 126.4 MBtu/hr. During refueling outages RFOs 6, 7, and 9, it was found necessary to hydrolaze the tube side of the Division II residual heat removal heat exchanger and/or chemically clean the shell side of the Division II residual heat removal heat exchanger in order to restore heat exchanger performance to acceptable levels.

In 2001, procedural changes were made to allow plant staff to complete residual heat removal heat exchanger testing during at-power conditions versus testing only during refueling outages. The first at-power test was performed on March 13, 2001. This test determined that performance capability of the Division II residual heat removal heat exchanger was at 136.3 MBtu/hr. A re-test on March 4, 2002, determined that the Division II residual heat removal heat exchanger had degraded to 128.0 MBtu/hr. River Bend Station Condition Report CR-RBS-2002-00376 was written to address the degraded condition. Condition Report CR-RBS-2002-00376 stated that because the value was above the design duty requirement there is no immediate operability issue.

However, subtracting the test uncertainty of 2.63 MBtu/hr, the inspectors noted that actual performance could have been below the required design duty of 126.4 MBtu/hr.

Two of the recommendations of the root cause analysis in Condition Report CR-RBS-2002-00376 were to: a) evaluate the need for additional performance testing; and b) to hydrolaze the tube side during refueling outage RFO-12. According to the test engineer, hydrolazing was not completed, but beginning on November 2, 2002, a program of bi-weekly flushing with suppression pool water was instituted and is currently in use.

After this corrective action was initiated, two at-power tests were completed. The at-power test dated November 11, 2002, determined the performance level to be at 142.1 MBtu/hr, representing an unexplained improvement of ~14 MBtu/hr. A second at-power test completed approximately four years later on December 6, 2006 determined the performance level to be at 142.8 MBtu/hr, indicating a slightly improving performance trend. Though the two tests indicated an improving trend, the inspectors noted that if the test uncertainty of +/- 2.8 MBtu/hr is taken into consideration, the 2002 actual performance value could have been as high as 145 MBtu/hr and the 2006 actual performance value could have been as low as 141 MBtu/hr, representing a decline in performance as opposed to an improvement. Extrapolating this degrading trend line

linearly forward, the licensee then estimated that Division II residual heat removal heat exchanger performance could fall below the design duty level in early 2013. Given the inherent nonconservatisms associated with a trending analysis that is based on only two data points, neither the licensees test engineer or chemistry department representative could state with 95 percent confidence level, the licensees minimum confidence level criterion for residual heat removal heat exchanger testing, that if this heat exchanger is tested again in early 2012, as has been requested by the test engineer, that it will be above the minimum design duty level.

NRC Generic Letter 89-13 states, in part, that:

tests should be performed for the heat exchangers after the corrective actions (in this case bi-weekly flushing) are taken to establish baseline data for future monitoring of performance. In the periodic retest program, a licensee should determine after three tests the best frequency for testing to provide assurance that the equipment will perform the intended safety functions during the intervals between.

The team determined that the licensee 1) failed to perform the first retest immediately after starting the bi-weekly flushing; 2) failed to properly consider the uncertainty in test results; and 3) failed to perform the pre-requisite three tests. This resulted in a potentially inaccurate trend line being created for use in establishing a schedule for future testing, inspection, and cleaning activities over the remaining lifetime of the plant.

Furthermore, as noted above, 22 years after first responding to NRC Generic Letter 89-13, the licensee still has an undefined schedule in place for performing these activities.

Analysis.

The team determined that failure to establish a NRC Generic Letter 89-13 test program which incorporated a final testing frequency of the residual heat removal heat exchangers was a performance deficiency. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Specifically, the inappropriate test frequency affected the licensees ability to ensure residual heat removal heat exchangers, when called upon, were available and capable to reliably perform as expected. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determine to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significance contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, which states, in part, A test program shall be established to assure that all testing required to demonstrate that structures, systems,

and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to the above, the licensee failed to establish a test program to assure all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents.

Specifically, from October 1998 to October 27, 2011, the licensee failed to establish a NRC Generic Letter 89-13 test program which incorporated a final test frequency for the residual heat removal heat exchangers and perform an adequate trending analysis upon which to base a final test frequency. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07713. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-03, Failure to Establish Residual Heat Removal Heat Exchanger Testing Frequency.

.2.10 Residual Heat Removal Valve, E12-MOV-F068A:

a. Inspection Scope

The team reviewed the updated safety analysis report; design basis documents, relevant calculations, maintenance history, and recent corrective and preventive action documents for motor operated valve E12-MOV-FO68. The team also performed visual inspections of these components to identify and evaluate visible material condition as well as potential vulnerability to external hazards including seismic interaction and flooding. Specifically, the team reviewed;

• Applicable electrical calculations to confirm that adequate voltage would be available at the motor terminals for design basis accidents.

• Schematic diagrams to evaluate potential vulnerability to common cause failures and to evaluate testing of circuit functions as evidenced by surveillance procedures.

• Recent system health reports associated with the selected motor operated valves and relevant operational experience.

b. Findings

No findings were identified.

.2.11 Standby Service Water Valve, SWP-MOV-40D:

a. Inspection Scope

The team reviewed the updated safety analysis report; design basis documents, relevant calculations, maintenance history, and recent corrective and preventive action documents for motor operated valve SWP-MOV-40D. The team also performed visual inspections of these components to identify and evaluate visible material condition as

well as potential vulnerability to external hazards including seismic interaction and flooding. Specifically, the team reviewed;

• Applicable electrical calculations to confirm that adequate voltage would be available at the motor terminals for design basis accidents.

• Schematic diagrams to evaluate potential vulnerability to common cause failures and to evaluate testing of circuit functions as evidenced by surveillance procedures.

• Recent system health reports associated with the selected motor operated valves and relevant operational experience.

b. Findings

No findings were identified.

.2.12 Division III High Pressure Core Spray Standby Diesel Generator:

a. Inspection Scope

The team reviewed the updated safety analysis report; design basis documents, maintenance history, operational requirements, modifications, system drawings, specifications, test data, associated calculations, system health reports, recent condition reports, as well as operating and surveillance procedures. The team focused on recent operational conditions and reliability issues. The team also performed a walkdown of the Division III high pressure core spray standby diesel generator to confirm that the installed configuration was consistent with design basis information and to visually inspect the material condition of the system. Specifically, the team reviewed:

• The high pressure core spray standby diesel generator vendor manual and correspondence file, system drawings and bill of materials, and recent operability evaluations.

• Design basis documents, including performance characteristics, calculations, maintenance documentation and recent surveillance testing results.

• Design change documents to assess component degradation, performance margins, corrective and preventive actions, and operational experience.

b. Findings

No findings were identified.

.2.13 Containment Venting System:

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, calculations, recent corrective action documents, and technical specifications, for the containment venting systems and the containment personnel airlocks. Inspection activities included system walkdowns of the containment building and associated support systems. Specifically the team reviewed:

• Condition Report CR-RBS-2011-03471, concerning the use of the containment ventilation path during severe accident conditions.

• AOP-0050, Station Blackout

• Emergency Operating Procedure EOP-0005, Emergency Operating and Severe Accident Procedure, Enclosure 21

• Calculation G13.18.12.4*4, Primary Containment Conditions During Station Blackout, Revision 0

• Calculation G13.18.12.4*4, Primary Containment Conditions During Station Blackout, Revision 1

b. Findings

(1) Station Blackout - Containment Venting

Introduction.

The team identified an unresolved item concerning the licensees strategy to vent containment through containment personnel airlocks as written in River Bend Station Abnormal Operating Procedure, AOP-0050, Station Blackout, and Emergency Operating Procedure, EOP-0005, Emergency Operating and Severe Accident Procedure, Enclosure 21.

Description.

The team reviewed Condition Report CR-RBS-2011-03471, concerning River Bend Stations severe accident management program associated with 4-hour station blackout coping duration issues. As documented in Condition Report CR-RBS-2011-03471, Abnormal Operating Procedure, AOP-0050, Station Blackout, provided instructions for venting pressurized containment vapor to the annulus through a 3-inch hardened vent path. However, the licensees evaluation of these actions determined that the hardened vent path was too small to prevent containment over pressurization in an extended station blackout greater than the 4-hour coping period. It can delay but not prevent containment failure which is calculated to occur at 50-55 psia approximately 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> into an extended station blackout.

Based on the licensees analysis Calculation G13.18.12.4-030, the operator actions which specified venting containment through the containment/hydrogen purge ventilation system components have been deleted from Abnormal Operating Procedure, AOP-0050 and revised in Emergency Operating Procedure, EOP-0005 because of the potential personnel hazards. The licensees revised station blackout coping strategy involves venting through one of the containment personnel airlocks and out to the environment through an open auxiliary building door.

In order to support the revised venting through one of the containment personnel airlocks to the environment described in procedures AOP-0050 and EOP-0005, the licensee performed a 10 CFR 50.59 review for these procedures. Based on the results of this review, both of these procedural changes were screened out and a 10 CFR 50.59 evaluation was not performed.

Calculation G13.18.12.4*4, Revision 0, evaluated the conditions in containment resulting from a station blackout of indefinite length with reactor core isolation cooling and high

pressure core spray as the only available makeup sources. The team reviewed the respective cases described in this calculation and determined that several of these cases resulted in exceeding the heat capacity temperature limit prior to the 4-hour station blackout coping limit. Accordingly, containment venting currently described in procedures AOP-0050 and EOP-0005, through the containment air-lock would be initiated before the 4-hour coping time.

Based on these reviews, the team determined that the licensing basis for containment and the associated systems including the containment personnel airlock described in the updated safety analysis report are to maintain containment integrity during and following a design basis accident. Additionally, the team determined that the use of the personnel airlock as a vent path to depressurize containment during a station blackout event did not appear to be described in any of the available licensing basis documents.

Accordingly, the team views that the licensees strategy of venting through one of the containment airlocks and out to the environment through an open auxiliary building door appears to represent an unreviewed safety question.

The inspectors determined that more inspection is necessary to resolve the issue. Since more information is necessary, the issue is considered an unresolved item pending further NRC review.

Analysis.

An unresolved item is an issue requiring further information to determine if it is acceptable, if it is a finding, or if it constitutes a violation of NRC requirements. As such, no analysis of this issue has occurred.

Enforcement.

Additional inspection is necessary to determine whether a violation of regulatory requirements occurred. Pending further NRC review of additional information provided by the licensee, this issue is being treated as an unresolved item: URI 05000458/2011008-04, Station Blackout-Containment Venting.

.3.1 Inspection of Information Notice 2010-26, Submerged Electrical Cables:

a. Inspection Scope

The team reviewed the licensees documented evaluation and disposition of NRC Information Notice 2010-26, Submerged Electrical Cables, under their operating experience program. Specifically the team confirmed that the cable submergence issues discussed in this and earlier NRC notifications had been addressed, that a program was in place to evaluate and correct cable submergence conditions at the plant site, and that the corrective actions specified were appropriate. The team reviewed selected condition reports to determine the existence of cable submergence issues.

b. Findings

No findings were identified.

.3.2 Inspection of Information Notice 2010-04, Diesel Generator Voltage Regulation System

Component Due to Latent Manufacturing Defects:

a. Inspection Scope

The team reviewed the licensees evaluation and disposition of NRC Information Notice 2010-04, Diesel Generator Voltage Regulation System Component Due to Latent Manufacturing Defect, under their operating experience program. Specifically, the team confirmed that the issues discussed in the information notice had been adequately addressed and that corrective actions had been initiated as applicable. The team reviewed selected condition reports to evaluate the plant operating experience with voltage regulation system components and adequacy of resolution.

b. Findings

No findings were identified.

.3.3 Inspection of Information Notice 2010-25, Inadequate Electrical Connections:

a. Inspection Scope

The team reviewed the licensees evaluation of NRC Information Notice 2010-25, Inadequate Electrical Connections, to verify that the review adequately addressed the industry operating experience. The team verified that the licensees review adequately addressed the issues in the information notice. The team verified that the licensee addressed common electrical connection problems and implemented adequate maintenance practices for installed electrical connections.

b. Findings

No findings were identified.

.3.4 Inspection of Information Notice

2007-05, Vertical Deep Draft Pump Shaft and Coupling Failures:

a. Inspection Scope

The team reviewed the licensees evaluation of NRC Information Notice 2007-05, Vertical Deep Draft Pump Shaft and Coupling Failures, to verify that the review adequately addressed the industry operating experience. The team verified that the licensees review adequately addressed the issues in the information notice. The team verified that the licensee addressed potential material stress corrosion cracking problems with the standby service water pumps and implemented adequate maintenance practices for periodic future inspections.

b. Findings

No findings were identified.

.3.5 Ultimate Heat Sink Leak Detection:

a. Inspection Scope

The team reviewed the licensees evaluation of internal operating experience with Regulatory Guide 1.97 Category 2 instrumentation for detection of leakage from the standby service water system at the Grand Gulf Nuclear Station (LO-LAR-2011-00165).

The team verified that the licensees review adequately addressed the issues and that pulsation problems with similar leak detection instrumentation at River Bend Station had been corrected.

b. Findings

(1) Inadequate Procedures for Monitoring Standby Service Water System Leakage

Introduction.

The team identified a Green, noncited violation of 10 CFR Appendix B, Criterion V, Instruction, Procedures, and Drawings because the licensee failed to include appropriate quantitative or qualitative acceptance criteria for determining important activities have been satisfactorily accomplished. Specifically, Abnormal Operating Procedures AOP-009, Loss of Normal Service Water and AOP-0016, Loss of Standby Service Water did not provide clear quantitative or qualitative acceptance criteria for monitoring standby service water flow mismatch to determine if operator action is necessary once a leak is detected in the standby service water system.

Description.

To comply with 10 CFR Part 50, Appendix A, General Design Criteria 13 requirements for preservation of ultimate heat sink inventory, the standby service water system is equipped with instrumentation for monitoring potential leakage. As stated in Section 9.2.7 of the River Bend Station updated safety analysis report, during system operation, potential leakage is monitored from the control room by comparing flow recorders SWP-FR60A and 60B which read flow through the supply and return headers of the standby service water system. A mismatch in these flows indicates large-scale leakage. To facilitate this process, Engineering Request 2000-0721 was implemented in 2004 to add a composite third point to the strip chart recorder that plots the actual difference in the two flow readings. The scale for this third point ranges from 0 to 600 gallons per minute.

At the request of the team, the licensee retrieved the archived original strip chart roll for operation of the standby service water system during the most recent refueling outage.

Review of this chart by the licensees operations department representative concluded that it is extremely difficult to read or evaluate the readings with regard to whether or not the system actually has any leaks. For most of the outage period, the point oscillated rapidly and somewhat erratically between readings of 0 to approximately 250 gallons per minute. For shorter periods of time, the point oscillated erratically and rapidly between 0 and the scale limit of 600 gallons per minute, possibly indicating that some system valves were being opened or closed for re-alignment or test purposes. There is no record that at any point in time that operations personnel took actions to inspect the system for potential leakage as a result of the mismatch in any of these readings.

Working under the assumption that the observed mismatch between supply and return header flow recorder readings are due to instrument inaccuracies rather than actual system leakage, the operator training manual for the standby service water system, R-STM-0118_021-1, states that when the system is activated, an average value of the composite point is to be obtained. This is then to be used as the null or zero leakage reference value. If a leak were then to occur, the null value would shift upward to a new point, with the difference between the two null points being the amount of leakage.

Review of the procedures associated with operation of the standby service water system, found that Procedures SOP-042, AOP-0003, AOP-0009, and AOP-0016 did not include instructions for calculating a null value. Additionally, except for Abnormal Operating Procedure, AOP-0016, Loss of Standby Service Water, none of these procedures stated what degree of mismatch between the two recorder readings constitutes a concern. Abnormal Operating Procedure, AOP-0016 addressed potential leakage between an operating and non-operating division of standby service water which would require operator action to locate and isolate the leak if supply and return flows are not equal.

Given the known instrument uncertainty bias between flow recorders SWP-FR60A and 60B, completion of this step in the procedure was not possible without clarification of how the word equal was interpreted. As noted above this step appears to be one that was ignored, regardless of the difference in readings.

Several condition reports were written in 2004 regarding deficiencies in training on use of the new recorder point and the need to update the River Bend Station simulator, but were closed without any further actions. The closure was based on the expectation that further training, procedural, and/or simulator updates would be completed following implementation of Engineering Request ER-RB-2003-0120 to install modified circuit boards for damping in standby service water flow transmitters SWP-FT59A & FT60A, and following completion of an engineering evaluation on expected level of inaccuracies between the recorder readings. Engineering Request ER-RB-2003-0120 has been completed, but there was no record of the necessary evaluation on instrument inaccuracies having been received from engineering.

Without procedural steps for calculation and use of the null values derived from the composite point readings, and without an understanding of expected instrument inaccuracies and acceptable levels of leakage, the installed instrumentation was ineffective in meeting its functional objective described in the updated safety analysis report of being one of the primary means of detecting large scale leakage. During an actual loss-of-offsite-power with coincident loss-of-cooling accident event, periodic walkdowns of the system as a backup means of leak detection would be limited due to the potential for high levels of radiation in some areas of the auxiliary building. The ineffective flow recorders would not satisfy the requirement that operators would be able to quickly and continuously monitor for a sudden occurrence of leakage. Additionally, leakage through closed isolation valves with the nonsafety-related normal service water system may not be observable. Observation of changes in water level in the standby cooling tower basin would also be an inadequate alternate mean of leak detection.

During the inspection, the Division I and Division II standby cooling tower basin level

indicators were 20 inches apart in their readings. Given this level of uncertainty in water level readings and the large basin capacitance (approximately 11,500 gallons/inch), the basin level instrumentation could only yield a very gross indication of leakage that is far above what would be considered an acceptable amount of leakage.

Analysis.

The team determined that the failure to include appropriate acceptance criteria for leak detection in abnormal operating procedures for the standby service water system and ultimate heat sink was a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Specifically, the inadequate procedure guidance could lead to operators not recognizing conditions that would degrade the availability of the standby service water system. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green)because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, noncited violation of 10 CFR 50, Appendix B, Criterion V, Instruction, Procedures, and Drawings, which states, in part, Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Contrary to the above, the licensee failed to include appropriate quantitative or qualitative acceptance criteria for determining important activities have been satisfactorily accomplished. Specifically, prior to October 27, 2011, the licensee failed to provide appropriate quantitative or qualitative acceptance criteria in station and abnormal operating procedures to determine if actions for leak detection were satisfactorily accomplished to protect the standby service water system and ultimate heat sink during design basis events. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07555. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-05, Inadequate Procedures for Monitoring Standby Service Water System Leakage.

(2) Failure to Obtain NRC Approval for Change to Ultimate Heat Sink Inventory Requirements

Introduction.

The team identified a Severity Level IV, noncited violation of 10 CFR 50.59, Changes, Tests, and Experiments, because the licensee failed to obtain a license amendment, pursuant to 10 CFR 50.90, prior to implementing a change to the ultimate heat sink inventory requirements. Specifically, the licensee changed the design

basis of the ultimate heat sink inventory requirements from providing a 30-day cooling water supply without makeup capability to providing a less than 30-day cooling water supply with makeup capability without obtaining a license amendment.

Description.

River Bend Station updated safety analysis report Section 9.2.5, Ultimate Heat Sink, describes the standby cooling tower and water storage basin which functions as the ultimate heat sink for River Bend Station during accident conditions. Updated safety analysis report Section 9.2.5.1, Design Bases describes the criteria to which the ultimate heat sink is designed in accordance with General Design Criteria 44, Cooling Water. In particular updated safety analysis report Section 9.2.5.1, criterion 2 states:

The capacity of the [Ultimate Heat Sink] water storage basin is designed to provide necessary cooling for the period of time (30 days) needed to evaluate the situation, to take corrective action to mitigate the consequences of an accident, and if required to take any necessary measures to permit water replenishment. In addition, alternate methods are available for ensuring the continued capability of the sink beyond 30 days (Section 9.2.5.2).

The above design requirement is to ensure that the ultimate heat sink is designed and built to ensure that a 30-day inventory is available for cooling immediately following the design basis accident conditions. The design basis accident for ultimate heat sink calculations is postulated as a large main-steam-line-break coincident with a complete loss-of-offsite-power and failure of the Division II standby diesel generator. The accident is postulated to occur for 30 days. If the accident last longer than 30 days, procedures are in place to provide makeup water to the ultimate heat sink and standby service water system.

When the River Bend Station was originally licensed in November 1985, the licensee submitted the design of the ultimate heat sink that supplied a 30-day supply of water from the standby cooling tower basin for decay heat removal, without a makeup water source. The NRC reviewed and approved this design using Regulatory Guide 1.27, Ultimate Heat Sink for Nuclear Power Plants. The NRCs position was reflected in the River Bend Safety Evaluation Report, NUREG-0989, Section 9.2.5, which states:

The UHS contains more than a 30 day supply of water for decay heat removal without makeup, in accordance with GDC 44. Makeup water required after 30 days of UHS operation can be provided from the nonsafety related makeup water system if this system is available.

Additionally, the ultimate heat sink design of a standby cooling tower basin containing a 30-day supply without makeup is confirmed in the River Bend Technical Specification Bases, Section B 3.7.1, Standby Service Water System and Ultimate Heat Sink. Page B 3.7-1 states:

The basin is sized such that sufficient water inventory is available to provide heat removal capability to safely shut down the plant and to maintain it in a cold shutdown condition for a 30 day period with no external makeup water source available (Regulatory Guide 1.27, Ref. 1).

In December 2002, the licensee issued Engineering Request ER-RB-2002-0431. The basis of ER-RB-2002-0431 evaluated the effects of additional heat load on the standby cooling tower basin and standby service water system license basis when the Division II standby diesel generator does not fail. Additionally, the licensee evaluated the effects of post-accident system leakage on the standby cooling tower basin and standby service water system license basis. The engineering request determined to mitigate the consequences of system leakage that makeup water to the ultimate heat sink was necessary no later than 10 days into the design basis accident. Engineering Request ER-RB-2002-0431 also determined that the normal methods for makeup were unavailable during the 30-day design basis accident and procedures for alternate methods, such as use of nonsafety related diesel driven fire pumps, temporary diesel driven pumps, and tank trucks to transfer Mississippi River water to the standby cooling tower basin, should be revised.

Based on the above determination, the licensee revised procedures to provide makeup to the standby cooling tower basin during design basis accident conditions. Additionally, the licensee changed the updated safety analysis report Section 9.2.5 to include makeup to the standby cooling tower basin in less than 30 days. The original River Bend final safety analysis report, dated September 1985, stated:

The makeup water required after 30 days of operation is a maximum of approximately 164,000 gal/day. Primary makeup water is provided by the normal plant makeup wells which are described in Section 9.2.3. Makeup to the basin is manually controlled to maintain the water level above el 111 ft 10 in which is the minimum basin operating level. Should the primary makeup water source become unavailable, this makeup can supplied by any of the alternate methods:

1. Use of the tank trucks to carry Mississippi River water from the plant barge slip to

the standby cooling tower basin.

2. Use of a temporary pump and piping to pump Mississippi River water into the

storage basin

3. Use of a well - because of the presence of a large shallow water table

(approximately 80 ft below grade) and the favorable geology, a temporary well could be drilled and put into operation in a few days.

In December 2002, updated safety analysis report Section 9.2.5, page 9.2-29 was changed to (changes in italics):

The makeup water required after 30 days of operation is a maximum of approximately 164,000 gal/day. Additional makeup is required for system leakage under licensing basis condition and when operating two divisions with system leakage. Primary makeup water is provided by the normal plant makeup wells which are described in Section 9.2.3. Makeup to the basin is manually controlled to maintain the water level above el 111 ft 10 in which is the minimum basin operating level. Should the primary makeup water source become unavailable, this makeup can be supplied by any of the following alternate methods:

1. Use temporary power to power the plant deep/shallow well pumps and provide

makeup through the existing 4-diameter pipeline into the SCT basin. Also, Fire Protection System can be used to provide make-up water into the SCT basin.

2. Temporary diesel driven pump, hoses, and valves can be used to pump CWS

flume basin water into the SCT basin.

3. Temporary tank trucks, hoses and diesel driven pumps to transfer Mississippi

River water into the SCT basin.

Attached to Engineering Request ER-RB-2002-0431 was 10 CFR 50.59 safety evaluation 2002-026. The safety evaluation concluded that the change to the license basis to provide makeup during the design basis accident to replace system leakage could be made, without requiring prior NRC approval, because the change does not alter the license basis of the ultimate heat sink, based on 30-days operation without makeup and failure of one standby diesel generator, and meets Regulatory Guide 1.27 requirements.

Although the licensee determined NRC approval of the change was not necessary, the team determined the licensee incorrectly concluded that the change to updated safety analysis report Section 9.2.5 did not need NRC approval pursuant to 10 CFR 50.90.

The team determined that the new updated safety analysis report statement, Additional makeup is required for system leakage under licensing basis condition, changed the license basis requirement of the standby cooling tower basin to provide a 30-day cooling water supply without a makeup water source during the design basis accident to providing a less than 30-day cooling water supply with a makeup water source using nonsafety-related components. The team determined that the change needed NRC review and approval because the change resulted in a more than minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety. Particularly, the team determined that the licensee no longer meets the applicable regulatory requirements of Regulatory Guide 1.27 to which the licensee committed to in their original licensing documentation. The team also determined that a departure from the committed performance standard was not compatible with a no more than minimal increase.

The teams determination was based on Regulatory Guide 1.27, Ultimate Heat Sink for Nuclear Power Plants, Regulatory Position C.1, which states:

A cooling capacity of less than 30 days may be acceptable if it can be demonstrated that replenishment or use of an alternate water supply can be effected to assure the continuous capability of the sink to perform is safety functions, taking into account the availability of replenishment equipment and limitations that may be imposed on freedom of movement following an accident or the occurrence of severe natural phenomena.

Analysis.

The team determined that the failure to obtain a license amendment prior to implementing a proposed change, test or experiment to the ultimate heat sink requirements was a performance deficiency. The performance deficiency was evaluated using traditional enforcement because the finding has the ability to impact the regulatory process. The finding was more than minor because it involved a change to the updated final safety analysis report description where there was a reasonable likelihood that the

change would require NRC approval. In accordance with the NRC Enforcement Policy, the team used insights from MC 0609, Significance Determination Process, to determine the final significance of the finding. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding represented a loss of system safety function in that the ultimate heat sink could not meet its 30-day mission time to provide decay heat removal.

Therefore, a Phase 2 evaluation was necessary. The significance of the finding could not be assessed quantitatively through a Phase 2 or Phase 3 analysis. Consequently, an assessment was performed in accordance with IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. The finding was determined to have very low safety significance because the frequency of events that would require long term use of the ultimate heat sink is very low and the difference in the failure probability to replenish the ultimate heat sink in 10 days versus 30 days is very small. This was because an early depletion of the inventory would be easily detected and would become a priority. At the time that replenishment would be needed, plant conditions should be stable and local transportation arteries should be restored. Therefore, since the finding had very low safety significance, the finding was determined to be Severity Level IV, in accordance with the NRC Enforcement Policy. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Severity Level IV, noncited violation of 10 CFR 50.59, Changes, Tests and Experiments which states, in part, that a licensee shall obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if this activity would; result in more than a minimal increase in the likelihood of occurrence of a malfunction of a SSC important to safety previously evaluated in the final safety analysis report (as updated). Contrary to the above, the licensee failed to obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if this activity would; result in more than a minimal increase in the likelihood of occurrence of a malfunction of a SSC important to safety previously evaluated in the final safety analysis report (as updated).

Specifically, from December 16, 2002, to October 27, 2011, the licensee changed the design basis of the ultimate heat sink inventory requirements to provide a 30-day cooling water supply without makeup capability to providing a less than 30-day cooling water supply with makeup capability without obtaining a license amendment. This finding was entered into the licensees corrective action program as Condition Report CR 2011-07674. Because this finding was determined to be of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-06, Failure to Obtain NRC Approval for Change to Ultimate Heat Sink Inventory Requirements.

.4 Results of Reviews for Operator Actions:

The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6.

a. Inspection Scope

River Bend Station had a number of performance issues in the twelve months previous to this inspection report related to the operations department performance. Specifically, procedure quality and procedure adherence were of concern to the NRC based on several events that occurred at River Bend Station. Because of these performance issues, the NRC regional management team directed the inspection team to increase the number of risk significant operator action samples from an average of four samples on a typical inspection to eight samples for this inspection. Eight samples would provide more opportunities to evaluate these two attributes, procedure quality and adherence, at River Bend Station. Scenarios used for the inspection required crews while job performance measures required individual operators. The teams review of the following eight risk significant operator actions were either on two different crews or two different operators are as follows:

• Place the residual heat removal system in suppression pool cooling within thirty minutes during a design basis event as described on page 6.2-55 of the River Bend Station updated safety analysis report. The team observed a simulator scenario on two different crews which measured the ability of each crew to complete the required task within thirty minutes of the start of the event. The design basis event was a loss-of-coolant-accident concurrent with a loss-of-offsite-power and a loss of the division II standby diesel generator. This activity was satisfactorily performed within the required time.

• Secure the low pressure core spray pump at the sixty minute timeframe during the design basis event as described on page 6.2-55 of the River Bend Station updated safety analysis report. The team observed a simulator scenario on two different crews which measured the ability of each crew to recognize that adequate core cooling existed with only the high pressure core spray pump running and providing 5000 gallons per minute flowrate to the reactor core during the design basis event.

The design basis event was a loss-of-coolant accident concurrent with a loss-of-offsite-power and a loss of the Division II standby diesel generator. This determination was necessary in order for the crew to reduce electrical load on the division I standby diesel generator by securing the low pressure core spray pump.

This task was required at the 60-minute timeframe so that the standby cooling tower fans could be started on the corresponding diesel generator without overloading the division I standby diesel generator as stated in Section 6.2 of the updated safety analysis report. This activity was not performed correctly due to procedure and simulator issues as discussed in the findings section below for this section of the report.

• Make voltage adjustments to the Division II standby diesel generator during a station blackout in order to recover the Division II electrical bus and place the plant in a loss-of-offsite-power event only. The team observed a simulator scenario on two different crews where the plant experienced a loss-of-offsite -power with the Division I standby diesel generator unavailable because of maintenance. The Division II standby diesel generator starts and comes up just short of the required voltage set

point necessary for the synchronous circuit to auto-close the Division II standby diesel generator output breaker and energize the Division II electrical bus. This scenario would cause the plant to be in a station blackout condition based on similar blackout events that occurred in the northeastern United States at several nuclear power plants in 2003. The crew was expected to recognize that the Division II standby diesel generator was running, slightly adjust the voltage from the control room to close the standby diesel generator output breaker. These steps would power vital equipment needed for safe shutdown of the reactor. This activity was not performed correctly due to procedure issues as discussed in the findings section below for this section of the report.

• During a station blackout, align the Division III high pressure core spray diesel generator to the division I 4.16 kV emergency electrical bus. The team observed a simulator scenario on two different crews where the plant experienced a station blackout and required the crew to implement procedures from the control room (simulator) to connect to the Division III high pressure core spray diesel generator to the Division I 4.16 kV emergency electrical bus. This activity was satisfactorily performed and did not have a time associated with completing the task.

• During a station blackout, align power to Division I 125 Vdc switchgear ENB-SW01B from the station blackout generator within four hours of being dispatched by the control room staff. The team observed an in-plant job performance measure where one operator completes multiple sub tasks in order to align the station blackout generator to Division I 125 Vdc switchgear ENB-SW01B and return power to vital loads in the plant. This activity was satisfactorily performed within the required time.

• During a station blackout, shed dc loads from the control room within 15 minutes of being dispatched by the control room staff. The team observed an in-plant job performance measure on two different operators during a station blackout where loads were required to be shed from vital buses to minimize the effects on the station batteries. This activity was satisfactorily performed within the required time.

• During a station blackout, provide alternate power to the Division II safety relief valves. The team observed an in-plant job performance measure on two different operators during a station blackout where alternate power (portable batteries) was simulated to be connected to the Division II safety relief valves. This activity was satisfactorily performed and did not have a time associated with completing the task.

• During a station blackout, align the Division III high pressure core spray diesel generator to the Division I 4.16 kV electrical bus. The team observed an in-plant job performance measure on two different operators during a station blackout and required the operators to implement procedures in the plant that would be directed from the control room (simulator) to connect the Division III high pressure core spray standby diesel generator to the Division I emergency electrical bus. This activity was satisfactorily performed and did not have a time associated with completing the task.

b. Findings

(1) Inadequate Abnormal Procedure for Reducing Loads on Standby Diesel Generators

Introduction.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, because the licensee failed to include appropriate quantitative or qualitative acceptance criteria in abnormal operating procedures for control room operators to recognize the need to reduce loads on the standby diesel generators during design basis accidents.

Description.

During the inspection, a scenario was completed by two different operations crews in the simulator, one the week of October 17, 2011, and a second run during the week of October 24, 2011. During these scenarios both crews had considerable difficulty with the design basis event described in the River Bend Station updated safety analysis report, page 6.2-55. This scenario only included the design basis event that included a loss-of-offsite-power coincident with a loss-of-coolant accident with a loss of the Division II emergency electrical bus. At the one-hour point in the event, crews were expected to recognize the need to secure the low pressure core spray pump in order to reduce the electrical load on the standby diesel generator powering the division I emergency electrical bus. This action provides the necessary capacity to start the standby cooling tower fans, which are specifically required at this point in the event for proper cooling of plant equipment.

Each crew used the correct procedure for this event, Abnormal Operating Procedure AOP-004, Loss of Offsite Power, Rev. 037. However, both crews had considerable trouble during the scenario in understanding: 1) the need to secure the correct load to provide the capacity to start all the standby cooling tower fans on that division, 2) that they had adequate core cooling with only the high pressure core spray pump running and could secure the low pressure core spray pump, and 3) what the correct load on the diesel generator should be before and after the event at the one-hour point.

The first crew overloaded the diesel generator by starting the cooling tower fans with the low pressure core spray pump running and then later realized that they were running the diesel overloaded by several hundred kilowatts. The second crew struggled to find a way to reduce load and eventually throttled low pressure core spray to reduce load on the diesel generator, which worked but was not in the procedure or the updated safety analysis report. Additionally, the second crew had to be cued from the booth to start the cooling tower fans at the one-hour point as required by the procedure. Furthermore, both crews struggled to find a table or reference in the procedure that might list the appropriate loads to secure to reduce load on the diesel generator. The updated safety analysis report implicitly requires the low pressure core spray pump to be secured (which would be based on the correct assessment of adequate core cooling with only high pressure core spray injecting at 5000 gallons per minute).

Both crews were also confused on the amount of load on the diesel generator at the start of the event and thought that they should have had some capacity to start the cooling tower fans without securing other equipment. This is a separate performance deficiency for simulator fidelity and is covered in Section 1R21.4.b(3) below.

Therefore, Abnormal Operating Procedure AOP-004, Loss of Offsite Power, Rev. 037,

was inadequate for this scenario because it did not contain specific quantitative or qualitative criteria to directly address the following items:

1. The Division I standby (emergency) diesel generator is at maximum load at the one-

hour point in the event.

2. Adequate core cooling should be assessed and should be confirmed with only the

high pressure core spray pump running with 5000 gallons per minute flow into the core.

3. The low pressure core spray pump is the desired load to be secured in order to

provide adequate electrical capacity on the Division I standby diesel generator to start the standby cooling tower fans at the one hour point. Starting the cooling tower fans at the one-hour point is contained in the current procedure but one crew had to be cued to complete this action at the one-hour point.

Additionally, this procedure does not address the analogous event with the Division II standby diesel generator failure and subsequent securing of the C residual heat removal pump in order to have sufficient electrical capacity on the Division I standby diesel generator to start the standby cooling tower fans for that division. The licensee has entered this into their corrective action program as Condition Report CR-RBS-2011-07716.

Analysis.

The team determined that the failure to include appropriate quantitative or qualitative acceptance criteria in abnormal operating procedures for control room operators to recognize the need to reduce loads on the standby diesel generators during design basis accidents was a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating System Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesired consequences. Specifically, a control room operating crews failure to recognize the need to reduce loads to prevent the standby diesel generator failure during design basis accidents adversely affected the reliability of the standby diesel generators. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a crosscutting aspect in the area of human performance, resources component, because the licensee did not ensure that personnel, equipment, procedures, and other resources were available and adequate to assure nuclear safety for the correct training of licensed operator personnel

H.2(b).

Enforcement.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, which states, in part, Instructions, procedures, and drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been

satisfactorily accomplished. Contrary to the above, the licensee failed to include appropriate quantitative or qualitative acceptance criteria to determine if important activities are satisfactorily accomplished. Specifically, prior to October 27, 2011, the licensee failed to include appropriate qualitative and quantitative acceptance criteria in abnormal operating procedures for control room operators to recognize the need to reduce loads on the standby diesel generators during design basis accidents. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07716. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-07, Inadequate Abnormal Procedure for Reducing Loads on Standby Diesel Generators.

(2) Inadequate Emergency and Abnormal Procedures for Standby Diesel Generator Fail to Load Sequences

Introduction.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, because the licensee failed to include appropriate quantitative or qualitative acceptance criteria in procedures for control room operators to recognize and recover a standby diesel generator that starts but fails to load with the remaining standby diesel generator out of service during a loss-of-offsite-power event.

Description.

During the inspection, a scenario was completed by two different operations crews in the simulator, one the week of October 17, 2011, and a second run during the week of October 24, 2011. Both crews had considerable difficulty with a scenario that duplicated an event from the station blackout sequences for several nuclear power plants in the northeastern United States during the blackouts in the summer of 2003.

During the northeastern United States blackout events of 2003, a loss-of-offsite-power occurred at several nuclear power plants due to grid disturbances. Additionally, for a few nuclear plants, one standby diesel generator failed, or was in a maintenance condition.

At these plants, the remaining standby diesel generator started, but the output breaker failed to close due to an unidentified issue with voltage. The operators could have adjusted voltage (or speed, for frequency problems) to return the diesels parameters within normal limits and recover at least one bus for powering vital equipment needed for safe shutdown of the reactors.

However, one of the operating experience lessons learned that industry shared was that operators panicked and placed the remaining standby diesel generator in shutdown very early in the event because they were afraid the diesel engine might overheat without cooling water. The emergency diesel generators cooling water pump at most nuclear power plants, including River Bend Stations pump, is powered by the same emergency electrical bus that the standby diesel generator supplies power. Therefore, when no electricity powers the emergency bus, the cooling water pump is not running. The emergency diesel generators throughout the country usually have specified duration that the diesel generator can run unloaded in such a condition before it starts to overheat.

Usually, this duration is on the order of 10 to 20 minutes.

In River Bend Stations emergency and abnormal operating procedures for the standby diesel generators, there is a nonconservative value to secure the diesel generator within the first minute with no cooling water to prevent the standby diesel generator from overheating. This action to secure the standby diesel generator within the first minute has no calculation or design basis supporting this action. The system training manual for the standby diesel generators indicate that the diesel can run fully loaded for at least two minutes with no cooling water and not overheat, which is in alignment with industry emergency diesel generators.

The scenario tested on the crews was a loss-of-offsite-power with the Division I standby diesel generator out of service for several days and the Division II standby diesel generator starting during the event, but the output breaker fails to close due to an unidentified issue with voltage. When the voltage is outside of the normal limits at River Bend Station, the output breaker will not auto close and power the bus without manual adjustment of voltage (or speed, for frequency problems). The control room at this station has both controls for voltage and speed. Additionally, there are multiple indications to read and recognize a low voltage condition on the emergency electrical bus. Each crew was expected to recognize that voltage was slightly low from their control room voltage meter and adjust it up slightly until it was within specifications for the output breaker to automatically close to power the Division II emergency electrical bus. This action would mitigate a station blackout condition and put the plant in more safe conditions for a loss-of-offsite-power.

The operators had considerable difficulty with this scenario. The first crew allowed the standby diesel generator to run for approximately 15 minutes without cooling water because they could not determine the problem (this violated their current procedure for tripping it in one minute without cooling water) until they were cued from the booth that voltage was the only problem. After this cue, the first crew adjusted voltage until the output breaker closed. The second crew also allowed the standby diesel generator to run much longer than the 1 minute allowed under the current procedure and one operator tried to use the hard card Procedure OSP-0053 Emergency and Transient Support Procedure Attachment 2a/2b, Revision 14 to close the output breaker directly which tripped back open due to the voltage issue. This hard card is for the standby diesel generator panels in the control room and directs the operator to manually close the standby diesel generator output breaker to restore power to the bus, which will not work in this scenario at River Bend Station unless voltage is within specification.

The procedure inadequacies were as follows:

1. Procedure OSP-0053 Emergency and Transient Support Procedure, Attachment

2a/2b, Rev. 14

This procedure is the hard card for the emergency diesel generator panels in the control room, and it directs the operator to manually close the emergency diesel generator output breaker to restore power to the bus, which will not work in this scenario unless the operator adjusts voltage or frequency to meet the synchronous

conditions in the diesel generator output breaker circuitry. The direction to adjust voltage or frequency is not included in this procedure.

2. Procedure AOP-0004, Loss of Offsite Power, Rev. 037

This procedure states in a caution box on page 7, Do not allow a DG to run for more than one minute without cooling water. This implies that the diesel generator would overheat in the first minute of running when it is unloaded which is a non-conservative value and training materials state that the diesel generator can run for at least two minutes while fully loaded without cooling water and not overheat. This procedure caution during this scenario would cause operators to put the plant in a more serious condition with a station blackout when, with correct actions to restore the bus, the event could only be a loss-of-offsite-power. This one minute time limit has no basis in the design and is also not in alignment with industry standards for emergency diesel generators running unloaded.

3. Procedure AOP-0050, Station Blackout, Rev 040

This procedure does not address a running but not loaded emergency diesel generator for any reason and methods to recover or pointers to other procedures to help with this event.

The licensee has entered this into their corrective action program as Condition Reports CR-RBS-2011-07716, CR-RBS-2011-07717, and CR-RBS-2011-07718.

Analysis.

The team determined that the failure to include appropriate quantitative or qualitative acceptance criteria to determine that important activities are satisfactorily accomplished in emergency and abnormal operating procedures used during loss-of-offsite-power events was a performance deficiency. The finding was more than minor because it is associated with the procedure quality attribute of the Mitigating System Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesired consequences. Specifically, a control room operator crews failure to diagnose recoverable conditions adversely affected the availability of standby diesel generators during a loss-of-offsite-power event. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, the finding was determined to have very low safety significance (Green)because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality, loss of a system safety function, loss of a single train for greater than technical specification allowed outage time, loss of one or more non-technical specification risk significant equipment for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a crosscutting aspect in the area of problem identification and resolution, operating experience component, because the licensee did not implement and institutionalize operating experience through changes to station processes, procedures, equipment, and training programs P.2(b).

Enforcement.

The team identified a Green, noncited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, which states, in part, Instructions, procedures, and drawings shall include appropriate qualitative and quantitative criteria for determining that important activities have been satisfactorily accomplished. Contrary to the above, the licensee failed to include appropriate quantitative or qualitative acceptance criteria to determine that important activities are satisfactorily accomplished. Specifically, prior to October 27, 2011, the licensee failed to include appropriate quantitative or qualitative acceptance criteria in procedures for control room operators to recognize and recover a standby diesel generator that starts but fails to load with the remaining standby diesel generator out of service during a loss-of-offsite-power event. This finding was entered into the licensees corrective action program as Condition Reports CR-RBS-2011-07716, CR-RBS-2011-07717, and CR-RBS-2011-07718. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with the NRC Enforcement Policy: NCV 05000458/2011008-08, Inadequate Emergency and Abnormal Procedures for Standby Diesel Generator Fail to Load Sequences.

(3) Inadequate Simulator Fidelity for Standby Diesel Generator Loading

Introduction The team identified a Green, noncited violation of 10 CFR 55.46(c)(1),

Simulation Facilities, because the licensee failed to provide a plant-referenced simulator used for the administration of the operating test that demonstrated expected plant responses to operator input and to normal, transient, and accident conditions to which the simulator was designed to respond.

Description.

During this inspection, a scenario was completed by two different operations crews in the simulator, one the week of October 17, 2011, and a second run during the week of October 24 for a design basis event taken directly from the River Bend Station updated safety analysis report, page 6.2-55. In this scenario a loss-of-offsite-power occurs coincident with a loss-of-coolant accident and a loss of the division II emergency electrical bus. At the one-hour point in the event, the simulator was expected to be near full load as mentioned in the updated safety analysis report.

However, the simulator was approximately 800 kilowatts less than the expected full load for the standby diesel generator.

In order to establish that the scenario was setup correctly during the scenario validation week, the staff at River Bend Station performed a hand calculation on the expected loads that should be on the standby diesel generator at one-hour point in the scenario.

After confirming the results of the calculation, River Bend Station training staff agreed that the simulator was incorrectly modeling load for this event. In order to run the scenario as intended, the NRC senior operations engineer requested that a simulator override be placed on the load instrument, so that the team could evaluate the updated safety analysis report expected actions. This was easily accomplished by the training staff and the scenario results are included in Section 1R21.4.b(1) of this report.

The summary of the results from these two scenario completions as it pertains to the simulator fidelity issue were that both crews were confused on the amount of load on the

standby diesel generator at the start of the event. Both crews thought that they should have had some extra capacity on the standby diesel generator in order to start the cooling tower fans without securing other equipment. This was not the actual case.

Additionally, this inspection indicated that negative training of operators did occur based on the incorrect standby diesel generator loading presented in the simulator for this scenario. This was because operators thought they had electrical load margin on the standby diesel generators when the standby diesel generators were actually fully loaded with minimal margin without securing other equipment. This finding has been entered into the licensees corrective action program as Condition Report CR-RBS-2011-07682.

Analysis.

The team determined that the failure of the plant-referenced simulator to demonstrate expected plant response for standby diesel generator loading during accident conditions to which the simulator has been designed to respond was a performance deficiency. The finding was more than minor because it is associated with the human performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences.

Specifically, the incorrect simulator response adversely affected the control room operator crews capability to assess standby diesel generator loading conditions. In accordance with NRC Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets and the associated Appendix I, the finding was determined to be of very low safety significance (Green). Specifically, Manual Chapter 0609, Appendix I, Operator Requalification Human Performance Significance Determination Process, block 12, establishes a Green finding for failure to correctly replicate the plants response on the simulator that either has the potential to cause or actually causes negative training to operators. Negative training did occur for this finding because operators thought they had electrical load margin on the emergency diesel generators when the diesels were actually fully loaded with minimal margin without securing other equipment. This finding had a crosscutting aspect in the area of human performance, resources component, in that the licensee did not ensure that equipment (plant-referenced simulator) was adequate to assure nuclear safety for the correct training of licensed operator personnel H.2(b).

Enforcement.

The team identified a Green, noncited violation of 10 CFR 55.46(c)(1),

Simulation Facilities, which states, in part, that a plant-referenced simulator used for the administration of the operating test must demonstrate expected plant response to operator input and to normal, transient, and accident conditions to which the simulator has been designed to respond. Contrary to the above, the River Bend Station simulator failed to demonstrate expected plant response to operator input and to normal, transient, and accident conditions to which the simulator was designed to respond. Specifically, prior to October 27, 2011, the River Bend Station simulator did not demonstrate the expected plant response for standby diesel generator loading during accident conditions to which the simulator was designed to respond. The electrical loading on the emergency diesel generator in the simulator was approximately 800 kW less than the expected full load for the diesel generator. This finding was entered into the licensees corrective action program as Condition Report CR-RBS-2011-07682. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation

consistent with the NRC Enforcement Policy: NCV 05000458/2011008-09, Inadequate Simulator Fidelity for Standby Diesel Generator Loading.

4OA2 Identification and Resolution of Problems

The team reviewed 28 condition reports associated with the NRC inspection findings and observations that were identified during the previous component design basis inspection which was completed on August 26, 2008. The results of the previous inspection were reported in Inspection Report 05000458/2008006. No additional issues were identified.

4OA6 Meetings, Including Exit

On October 27, 2011, the team leader presented the inspection results to Mr. E. Olson, Site Vice President, and other members of the licensees staff. The licensee acknowledged the findings during each meeting. While some proprietary information was reviewed during this inspection, no proprietary information was included in this report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

E. Olson, Vice President, Operations

R. Gadbois, General Manager, Plant Operations

J. Roberts, Director, Nuclear Safety Assurance

H. Goodman, Director, Engineering

D. Burnett, Manager, Emergency Preparedness

F. Corley, Manager, Design Engineering

C. Forpahl, Manager, System Engineering

J. Clark, Manager, Licensing

M. Chase, Manager, Training

T. Evans, Manager, Operations

L. Woods, Manager, Quality Assurance

G. Pierce, Manager, Radiation Protection

K. Huffstatler, Sr. Licensing Specialist, Licensing

B. Davis, Corporate Engineering

M. McDaniel, Operations

N. Wood, Engineering

E. DeWeese, Supervisor, Engineering

J. Arms, Supervisor, Engineering

J. Meyer, Supervisor, Engineering

J. Antoine, Engineering

J. Schlesinger, Engineering

NRC personnel

G. Larkin, Senior Resident Inspector

A. Barrett, Resident Inspector

A. Wang, Senior Project Manager

J. Bettle, Nuclear Reactor Regulation

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000458/2011008-01 NCV Inadequate Testing of Division I and Division III Standby Diesel Generators (1R21.2.5)

05000458/2011008-02 NCV Failure to Use Conservative Design Assumptions in the Ultimate Heat Sink Inventory Calculation (1R21.2.7)

05000458/2011008-03 NCV Failure to Establish Residual Heat Removal Heat Exchanger Testing Frequency (1R21.2.9)

-A1-2-

05000458/2011008-05 NCV Inadequate Procedures for Monitoring Standby Service Water System Leakage (1R21.3.5)

05000458/2011008-06 NCV Failure to Obtain NRC Approval for Change to Ultimate Heat Sink Inventory Requirements (1R21.3.5)

05000458/2011008-07 NCV Inadequate Abnormal Procedure for Reducing Loads on Standby Diesel Generators (1R21.4)

05000458/2011008-08 NCV Inadequate Emergency and Abnormal Procedures for Standby Diesel Generator Fail to Load Sequences (1R21.4)

05000458/2011008-09 NCV Inadequate Simulator Fidelity for Emergency Diesel Generator Loading (1R21.4)

Opened

05000458/201108-04 URI Station Blackout-Containment Venting (1R21.2.13)