IR 05000458/2020050

Special Inspection Report 05000458/2020050

ML20240A258
Person / Time
Site:	River Bend
Issue date:	09/03/2020
From:	Hay M NRC/RGN-IV/DRP
To:	Vercelli S Entergy Operations
Proulx D
References
EA-20-088 IR 2020050
Download: ML20240A258 (51)

Text

September 3, 2020

SUBJECT:

RIVER BEND STATION - SPECIAL INSPECTION REPORT 05000458/2020050

Dear Mr. Vercelli:

On April 30, 2020, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of the Diverse and Flexible Coping Strategies (FLEX) diesel generator failure to run, which occurred on April 16, 2020, at the River Bend Station. Based on our initial assessment, an inspection team performed an inspection from May 18, through May 22, 2020.

The NRCs initial evaluation satisfied the criteria in the NRC Management Directive 8.3, NRC Incident Investigation Program, for conducting a special inspection. The basis for initiating this special inspection is further discussed in the Charter, which is included as an attachment to the enclosed report.

On July 21, 2020, the NRC discussed the results of this inspection with you and other members of your staff. On August 27, 2020, the inspectors re-exited with you and other members of your staff with the results of the final detailed risk assessment. The results of this inspection are documented in the enclosed report.

One finding of very low safety significance (Green) is documented in this report. This finding involved a violation of NRC requirements. We are treating this violation as a non-cited violation (NCV) consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the violation or the significance of the violation documented in this inspection report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC Resident Inspector at River Bend Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC Resident Inspector at River Bend Station. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

If you have any questions concerning this matter, please contact David Proulx of my staff at 817-200-1561.

Sincerely, Michael C. Hay, Acting Director Division of Reactor Projects

Docket No. 05000458 License No. NPF-47

Enclosure:

Inspection Report 05000458/2020050 w/Attachment: Special Inspection Charter, dated May 4, 2020

Inspection Report

Docket Numbers:

05000458

License Numbers:

NPF-47

Report Numbers:

05000458/2020050

Enterprise Identifier: I-2020

Licensee:

Entergy Operations, Inc.

Facility:

River Bend Station

Location:

St. Francisville, Louisiana

Inspection Dates:

May 18, 2020 to May 22, 2020

Inspectors:

C. Henderson, Senior Resident Inspector, Region IV, Team Lead

S. Makor, Reactor Inspector, Region IV

M. McConnell, Senior Electrical Engineer, NRR

R. Deese, Senior Reactor Analyst, Region IV

Approved By:

David L. Proulx, Acting Chief

Reactor Projects Branch C

Division of Reactor Projects

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a special inspection at the River Bend Station, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

Failure to Establish and Translate Design Bases to Ensure Capability to Perform Flex Strategy Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000458/2020050-01 Open/Closed

[H.13] -

Consistent Process 93812 The inspectors reviewed a self-revealed, Green finding and associated non-cited violation of NRC Order EA-12-049, for the licensees failure to maintain strategies to maintain and restore core cooling and containment cooling capabilities following a beyond-design-basis external event. Specifically, the licensee failed to develop design requirements and perform adequate testing for Diverse and Flexible Coping Strategies (FLEX) program elements resulting in both the FLEX diesel generators required to restore reactor core cooling and containment cooling for the primary FLEX strategy (designated FLX-EG3 and FLX-EG4) and the N FLEX diesel generator required to provide cooling water to the suppression pool cooling heat exchanger (designated FLX-EG5) for the extended loss of AC power response strategy being nonfunctional for an extended period of time.

Additional Tracking Items

None.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

Starting on March 20, 2020, in response to the National Emergency declared by the President of the United States on the public health risks of the coronavirus (COVID-19), inspections were evaluated to determine if all or portion of the objectives and requirements stated in the IP could be performed remotely. If the inspections could be performed remotely, they were conducted per the applicable IP. In some cases, portions of an IP were completed remotely and on site.

The inspections documented below met the objectives and requirements for completion of the IP.

OTHER ACTIVITIES

- TEMPORARY INSTRUCTIONS, INFREQUENT AND ABNORMAL

93812 - Special Inspection

In accordance with the attached Special Inspection Team Charter, the inspection team conducted inspection activities associated with the April 2020 Diverse and Flexible Coping Strategies (FLEX) diesel generator (FLX-EG) failure to run.

.1 Description of Event and Reactive Inspection Basis

In September 2019, the licensee attempted to perform a 2-year test of the electric motor-driven FLEX pump FLX-P1, powered by a FLEX diesel generator designated FLX-EG5. This test verifies that FLX-EG5 can power FLX-P1 motor when uncoupled from the pump. During the September 2019 test, FLX-EG5 failed to start. FLX-EG5 was tested again and shut down on overvoltage on October 31, 2019. This was the subject of follow-on NRC inspection activities, documented in NRC Inspection Report 05000458/2019015, and the licensee put corrective actions in place to resolve this condition.

On April 1, 2020, the licensee again attempted to perform the 2-year test of FLX-P1 powered by FLX-EG5. The test failed due to a generator undervoltage trip following closure of the pump motor disconnect switch. The licensee sent FLX-EG5 to the vendor for repair. On April 16, 2020, the licensee attempted to re-perform the uncoupled pump test. During the test, the pump disconnect switch shut and the uncoupled pump motor ran for a few seconds. FLX-EG5 again tripped on the generator undervoltage trip.

Subsequent to the April 16, 2020, test, the licensee and vendor determined that FLX-EG5 was unable to handle the starting load (current) of the uncoupled pump motor.

After considering whether the diesel generators were appropriately sized for the FLEX program, the licensee determined that the generator output breaker undervoltage time delay setpoints could be adjusted to enable the generator to remain online during the initial uncoupled pump motor start. Based on this initial information, NRC staff determined that it was possible that multiple generator settings were never properly configured during the initial setup of the generators, prior to the equipment being considered available to perform their designed FLEX functions.

After the failure of FLX-EG5 on April 16, 2020, the licensee assessed the condition of four other FLEX diesel generators The licensee determined that all generators were subject to the same condition, whereby one or more generator settings were configured such that the associated FLEX loads would potentially not have been able to perform intended functions. The licensee subsequently adjusted setpoints to restore the functionality of all FLEX diesel generators.

On April 19, 2020, an additional issue was identified involving FLEX diesel generator FLX-EG1, which is designated to power in-plant battery chargers during a beyond-design-basis event involving the use of FLEX equipment. Specifically, during a load test using the newly derived generator settings, the generator exhibited high exhaust temperature. The licensee reduced the load on the generator due to concerns about damage to the exhaust manifold (reported to be extremely hot) and began troubleshooting the issue.

Management Directive (MD) 8.3, NRC Incident Investigation Program, was used to evaluate the level of NRC response to this event. The NRC staff determined that the condition met four of the deterministic criteria in MD 8.3. The condition involved 1) a major deficiency in design or operation having potential generic safety implications, 2) potential adverse generic implications, 3) significant unexpected system interactions, and 4) questions or concerns pertaining to licensee operational performance. The risk assessment required by MD 8.3 estimated the incremental conditional core damage probability to be approximately 3.3x10-6.

Based on the deterministic criteria and risk insights related to this event, NRC Region IV management determined that the appropriate level of NRC response was to conduct a special inspection. This special inspection was chartered to identify the circumstances surrounding this event and review the licensees actions to address the causes of the event.

.2 Develop a complete sequence of events related to testing failures and associated

adverse conditions involving FLEX generators that were identified as a result of recent testing activities.

The inspectors conducted a detailed review of the events related to the April 2020 FLEX diesel generator failures. The inspectors gathered information from the licensees cause evaluation, condition reports, licensee-provided timeline of events, and interviews with licensee personnel to develop the following timeline of the event.

Sequence of Events:

Time Equipment Condition Correction Condition Report (CR-RBS-)

March 12, 2012 ALL The NRC issued Order EA-12-049 Order Modifying Licenses with N/A N/A Time Equipment Condition Correction Condition Report (CR-RBS-)

Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, which required a phased approach including use of installed equipment and resources, use of portable onsite equipment, and use of offsite resources. This inspection is associated with portable onsite equipment.

February 28, 2013 ALL River Bend Station (RBS)responded to NRC Order EA-12-049 with the submittal of the overall integration plan (OIP) and committed to following the guidance provided in Nuclear Energy Institute (NEI) 12-06, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, Revision 0. The OIP defined the strategies, equipment, and necessary plant modifications to ensure that core cooling, spent fuel cooling and containment integrity are maintained or restored during and after a beyond-design-basis external event.

N/A N/A September 29, 2015

ALL

RBS installed the procured diesels.

N/A N/A August 11, 2016 ALL NRC issued its Safety Evaluation Report for FLEX, which concluded RBS developed guidance to maintain or restore core cooling, spent fuel pool (SFP) cooling, and containment cooling N/A N/A Time Equipment Condition Correction Condition Report (CR-RBS-)

following a beyond-design-basis external event which, if implemented appropriately, should adequately address the requirements of Order EA-12-049.

June 12, 2018 FLX-EG4 The FLX-EG4 display was found blank. The display did not respond to push button inputs.

The vendor replaced the digital controller per the original design.

2018-03359 July 10, 2018 FLX-EG5 During the FLEX monthly standby walkdown under Work Order 52825612, the licensee found that the control panel display was deenergized.

The vendor replaced the digital controller per the original design, since this was the same panel as FLX-EG4, a trend validation was performed by the licensee.

2018-03879 July 17, 2018 FLX-EG4 During the performance of required maintenance, the licensee found the digital control with a blank screen The vendor replaced the digital controller per the original design.

2018-03981 July 24, 2018 N/A The licensee validated an adverse trend associated with FLEX equipment which was approved by the licensees Program Review Group Site Integrated Planning Database 3352 was created to install an upgraded digital control panel.

2019-03879 January 2019 FLX-EG1-The original Intelilite controllers were replaced with Deep Sea 7310 controllers. The licensee did not use the engineering change process for the controller replacement. The licensee determined that the controller replacement did not impact FLEX diesel generator design characteristics and the engineering change process was therefore not performed.

N/A N/A Time Equipment Condition Correction Condition Report (CR-RBS-)

September 26, 2019 FLX-EG5 During the performance testing of the service water FLEX pump, FLX-P1, under Work Order 519028, FLX-EG5 started and tripped on overvoltage. The licensee did not perform official troubleshooting, implement the failure mode analysis (FMA)process, or establish an emergent issue team (EIT).

The vendor started FLX-EG5, and it tripped on over voltage. The vendor connected a laptop to monitor parameters and started FLX-EG5. FLX-EG5 did not trip on overvoltage with multiple starts and stops. The vendor stated the problem was due to prolonged time without running. The vendor recommended to operate them every 2 weeks instead of every 6 months.

2019-06262 Closed to the work management system.

October 31, 2019 FLX-EG1 and -EG2 FLX-EG1 and 2 started and tripped on high coolant temperature.

The vendor determined the high coolant alarm was a false reading and the trip function was bypassed. After running FLX-EG1 and -EG2 for approximately 30 seconds, the alarm cleared. The vendor determined a contact in the temperature switch was stuck.

2019-07016, 2019-07032.

Closed based on actions taken.

October 31, 2019 FLX-EG3 and -EG4 FLX-EG3 and -EG4 were started and tripped on overfrequency/runaway.

The licensee did not perform official troubleshooting, implement the FMA process, or establish an EIT.

The vendor started each diesel generator, and they both tripped on over frequency. The vendor started each diesel generator multiple times to allow them to warm up. The vendor stated the problem was due to prolonged time without running. The vendor recommended to operate them every 2 weeks instead of every 6 months.

2019-07016, 2019-07032.

Closed based on actions taken.

Time Equipment Condition Correction Condition Report (CR-RBS-)

October 31, 2019 FLX-EG5 The diesel generator was started and tripped on overvoltage. The licensee did not perform official troubleshooting, implement the FMA process, or establish an EIT.

The vendor performed troubleshooting using a computer connected to the diesel engine.

FLX-EG5 was started, and voltage increased to 507 volts, which caused an alert alarm (does not trip the unit).

The vendor secured FLX-EG5 and changed the overvoltage setpoint to increase the tolerance within manufacturers guidelines. FLX-EG5 was run with no further issues identified.

N/A November 14, 2019 FLX-EG1-The licensee performed a trend analysis on FLEX system components which identified an adverse condition trend.

The licensee classified the trend analysis as a condition adverse to quality. The condition was classified as a B level condition report and an adverse condition analysis (ACA) was performed.

2019-07343 April 1, 2020 FLX-EG5 FLX-EG5 tripped on undervoltage when the FLX-P1 disconnect, FLX-SW1, was closed.

Two additional attempts were performed with the same result.

Maintenance personnel Megger tested FLX-P1 and associated wiring with no issues identified.

2020-01434 April 2, 2020 FLX-EG5 FLX-EG5 was sent to the vendor.

The vendor performed load testing: on one test, FLX-EG5 tripped on undervoltage when load was increased to 300 kW; on a second test, FLX-EG5 tripped on undervoltage when an instant load of 400 kW was applied.

The vendor suspected a faulty voltage regulator.

N/A Time Equipment Condition Correction Condition Report (CR-RBS-)

April 3, 2020 FLX-EG5 FLX-EG5 vendor testing Voltage regulator replaced on FLX-EG5.

FLX-EG5 shut down on underspeed at 500 kW and had a poor engine response when loaded between 100 kW and 400 kW. Fuel delivery system suspected (i.e.,

fuel pump, injectors, etc.).

N/A April 6, 2020 FLX-EG5 FLX-EG5 vendor testing (continued)

Engine Control Module issue ruled out. Vendor suspected that the fuel pump was causing sluggish engine performance.

N/A April 8, 2020 FLX-EG5 FLX-EG5 vendor testing (continued)

Vendor replaced the fuel pump. FLX-EG5 then shut down on underspeed when fully loaded. FLX-EG5 functioned at 30 percent of full load. Vendor removed fuel injectors for testing.

N/A April 13, 2020 FLX-EG5 FLX-EG5 vendor testing (continued)

Vendor testing revealed that 4 of 8 fuel injectors failed.

N/A April 14, 2020 FLX-EG5 FLX-EG5 vendor testing (continued)

Vendor replaced all 8 fuel injectors.

N/A April 15, 2020 FLX-EG5 FLX-EG5 vendor testing (continued)

Vendor tested at instantaneous loads of 300 kW and 400 kW with no alarms.

FLX-EG5 back on site.

N/A April 16, 2020 FLX-EG5 FLX-P1 preventative maintenance Generator output breaker tripped when FLX-SW1 was closed.

FLX-EG5 continued to run but had overvoltage and overcurrent alarms on control panel.

CR-RBS-2020-1676 FLX-EG3 FLX-EG3 sent to vendor for testing FLX-EG3 passed 100 percent full load test but shut down on CR-RBS-2020-1685 Time Equipment Condition Correction Condition Report (CR-RBS-)

underspeed when drop tested at 250 kW.

April 18, 2020 FLX-EG5 Time delay adjustment Licensee adjusted the time delays for undervoltage (from 0 to 3.1 seconds) and output breaker instantaneous overcurrent

(x5) on FLX-EG5.

N/A April 19, 2020 FLX-EG5 FLX-P1 preventive maintenance FLX-EG5 shut down on underfrequency.

Licensee changed underfrequency time delay to 3.1 seconds.

FLX-EG5 was restarted and successfully completed the preventive maintenance.

CR-RBS-2020-1705 FLX-EG4 FLX-P1 preventive maintenance FLX-EG4 shut down on undervoltage. Adjusted undervoltage and overvoltage (from 0 to 3.1 seconds) and output breaker instantaneous overcurrent

(x5) then retested. FLX-EG4 shut down on overvoltage. Adjusted time delays in controller (from 0 to 2 seconds)then retested. Ten-minute functional run satisfactorily completed.

CR-RBS - 2020-1714 FLX-EG1 Extent of condition testing FLX-EG1 did not shut down when loading stepped up to 155 kW.

Shutdown on undervoltage occurred when taken from 45 kW to 195 kW with original settings. Adjusted time delays (from 0 to 2 seconds). Twenty-five minutes into the 2-hour full-load test, exhaust manifold observed CR-RBS-2020-1706 Time Equipment Condition Correction Condition Report (CR-RBS-)

glowing red, so load was reduced from 195 kW to 155 kW.

FLX-EG2 Extent of condition testing FLX-EG2 did not shut down when loading stepped up to 155 kW.

Shutdown on undervoltage occurred when taken from 45 kW to 195 kW with original settings. Adjusted time delays (from 0 to 2 seconds). Satisfactorily passed 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> full-load test.

CR-RBS-2020-1707 April 20, 2020 FLX-EG3 Testing after fuel injectors replaced Vendor replaced all eight fuel injectors.

Vendor tested to instantaneous load of 350 kW with no alarms then at 450 kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> with no alarms.

FLX-EG3 returned to site.

N/A FLX-P1 PM FLX-EG3 shut down the same as FLX-EG5 with initial settings.

Licensee adjusted time delay and output breaker settings then retested. FLX-P1 performed satisfactorily.

FLX-EG1 FLX-EG1 sent to vendor for trouble shooting (glowing red manifold)

N/A N/A April 21, 2020 FLX-EG3 Coolant leak Small crack identified on the brass extending down from the coolant pump. No leaks evident prior to vendor maintenance.

RBS-CR-2020-1759 FLX-EG1 Trouble shooting testing Vendor satisfactorily ran FLX-EG1 at 95 percent load (185 kW).

N/A FLX-EG3 Coolant leak repair Leak repaired followed by a functional run, N/A Time Equipment Condition Correction Condition Report (CR-RBS-)

April 22, 2020 which confirmed no leaks.

FLX-EG4 FLX-EG4 sent to vendor for fuel injector replacement and testing N/A N/A FLX-EG1 Vendor testing Vendor set time delays to original setting and tested. FLX-EG1 passed when loaded to 75 kW (no alarms) and failed twice when loaded to 100 kW.

FLX-EG1 passed twice when tested at 99 kW.

Vendor returned time delays to 2 seconds and satisfactorily full-load tested (195 kW) for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. FLX-EG1 returned to the site.

N/A FLX-EG2 Onsite testing FLX-EG2 tested three times to a loading of 90 kW, and failed on two of these tests.

Satisfactorily retested three times to a loading of 88 kW. FLX-EG2 full-load tested to 195 kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> with no issues.

N/A April 23, 2020 FLX-EG4 Vendor testing and fuel injector replacement FLX-EG4 passed testing with original settings for a 223-kW load drop test, but failed test at 224 kW (shutdown on undervoltage). Vendor adjusted time delay settings for undervoltage and underfrequency (from 0 to 3.1 seconds).

Vendor replaced all eight fuel injectors.

N/A April 24, 2020 FLX-EG4 Vendor testing and fuel injector replacement (continued)

Vendor tested FLX-EG4 after replacing the fuel injectors. Tested to N/A Time Equipment Condition Correction Condition Report (CR-RBS-)

instantaneous load of 350 kW and at 450 kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> with no issues. FLX-P1 preventive maintenance satisfactorily.

April 28, 2020 FLX-EG2 Onsite testing FLX-EG2 satisfactorily tested by licensee using a spare battery charger (BYS-CHG1D) to simulate expected loading conditions.

N/A

.3 Review the licensees causal evaluation(s) associated with the recently discovered

conditions and determine if they are being conducted at a level commensurate with the significance of the issues that were encountered for the degraded condition.

The inspectors reviewed the issues associated with FLEX diesel generator test failures, including those that the licensee entered in the corrective action program and were identified as subjects for causal evaluations. The licensee initiated Condition Report CR-RBS-2020-01723 to perform a historical review of River Bend Station compliance with NRC Order EA-12-049, based on the learnings and initial extent of condition for the FLEX diesel generator testing failures. NRC Order EA-12-049 required the licensee to implement mitigation strategies for beyond-design-basis external events.

The inspectors determined that the licensees causal evaluation was conducted at the appropriate level, commensurate with the safety significance of the associated issues.

The licensee categorized Condition Report CR-RBS-2020-01723 as B level, which was a condition adverse to quality level which warranted additional analysis. The condition required an adverse condition analysis (ACA) and corrective actions to correct the condition and other causal factors; thereby mitigating future risk. The ACA was assigned an extent of condition and extent of cause analysis. The analysis techniques used by the licensee included event and causal factor charting, barrier analysis, failure modes analysis, equipment failure evaluation, and organizational and programmatic screening.

The inspectors determined the licensees causal evaluation performed under Condition Report CR-RBS-2020-01723 was being performed at a level commensurate with the safety significance associated with the FLEX diesel generator test failures, but was not completed as of the end of the inspection.

.4 Following the discovery of adverse conditions, determine whether the licensee took

appropriate actions to ensure the functionality of the affected FLEX equipment to be able to perform the designated functions.

The inspectors reviewed the licensees past functionality assessment associated with FLX-EG1 and FLX-EG2 and the licensees immediate corrective actions to restore FLX-EG3, -EG4, and -EG5 to a functional status. The remaining FLEX diesel generators (hydrogen ignitor diesel generators, lighting diesel generators, communication diesel generators, and the direct diesel driven pumps) were not impacted by the incorrect digital controller setpoints, because these FLEX diesel generators are not designed to support large inductive loads as are FLX-EG3, -EG4, and -EG5.

• FLX-EG1 and EG2 Past Functionality Review and Immediate Corrective Actions

The inspectors reviewed Condition Reports CR-RBS-2020-1706 and CR-RBS-2020-1707 and noted that FLX-EG1 and FLX-EG2 were unable to supply the calculated load provided in the FLEX diesel generator sizing Calculation G13.18.6-023, FLEX Strategy - Portable Diesel Generator System Sizing, Revision 0, during testing. The sizing calculation for FLX-EG1 and FLX-EG2 showed a required total load of 193.66 kW, including line losses from the diesel generator to the battery charger as well as control room emergency lighting, fans, and miscellaneous accessories. The total load for FLX-EG1 and FLX-EG2 included a factor of 1.2 to account for line losses, and a factor of 2.1 was added to the running kilovolt-amperes (kVA) to account for harmonic distortion from the battery chargers.

FLX-EG1 and FLX-EG2 beyond-design-basis external event load conditions need to account for a depleted battery, causing the battery charger to operate at or near its current limit. This would result in a step change in loading of FLX-EG1 or FLX-EG2 at its limiting condition. Loading in this manner has the potential to challenge the undervoltage, underfrequency, and overvoltage trip time delays, which were originally set at the factory default settings of 0 seconds. These settings resulted in a trip of the generator prior to reaching its design loading condition of 195 kW.

The licensee performed testing to establish the step change load limit capability of FLX-EG1 and FLX-EG2 at the as-found trip time delay settings of 0 seconds and performed a past operability review documented in Condition Reports CR-RBS-2020-1706 and CR-RBS-2020-1707. The licensee performed testing on-site for FLX-EG2 and testing at the vendors facility for FLX-EG1. The testing demonstrated that FLX-EG1 and FLX-EG2 could accept a step change load of 99 kW and 90 kW, respectively. From the past functionality review, the licensee determined that the calculated load Calculation G13.18.6-023 included conservatism associated with the factor applied to address harmonic distortion.

Thus, the licensee prepared a test to simulate the maximum load condition during a beyond-design-basis external event for FLX-EG1 and FLX-EG2. As a result of this testing, the licensee determined that FLX-EG2 supplied actual loads of 84.625 kVA (or kW, at a unity power factor) with a maximum step load change of 62.224 kVA (or kW, at a unity power factor). The licensees subsequent review of the test results identified that the charger could be set at a current limit higher than the tested value and that using this higher current limit that the actual demand would still be lower than the minimum capability established by the test, 90 kW.

The inspectors verified the licensee implemented the corrective action of adjusting the FLX-EG1 and FLX-EG2 main breaker instantaneous overcurrent setpoint and the digital controller time delay setpoints for over/underfrequency and over/undervoltage.

• FLX-EG3, -EG4, and -EG5 Immediate Corrective Actions to Restore Functionality

Following the discovery that FLX-EG3, -EG4, and -EG5 could not supply the required beyond-design-basis external event loads, the inspectors determined that the licensee took appropriate corrective actions to resolve the condition that resulted in their failures. The licensee developed a troubleshooting plan and performed a failure modes analysis to determine the cause of the failures of FLX-EG3, -EG4, and -EG5. The licensee determined that fuel injectors required replacement due to fouling and that the FLEX diesel generator main breaker instantaneous overcurrent setpoint and voltage controller time delay setpoints for over/under frequency and over/under voltage were not set appropriately. The licensee replaced the fuel injectors, adjusted the main breaker and digital controller setpoints, and successfully tested the FLEX diesel generators. These actions were adequate to restore FLX-EG3, -EG4, and -EG5 to a condition of being available to perform their designated functions for a beyond-design-basis external event.

Based on the above, the inspectors determined that FLX-EG1 and FLX-EG2 were functional for the as-found condition of the digital controller setpoints, and the licensees immediate corrective actions restored FLX-EG3, -EG4, and -EG5 to functional conditions.

.5 Based on design requirements, test results, and conditions identified during testing,

determine whether FLEX generators were capable of performing the designated functions in an actual beyond-design-basis scenario with the equipment settings that existed prior to April 2020. Evaluate results of functional testing performed by the licensee on April 28, 2020 and determine its applicability to the design basis of the related FLEX equipment.

The inspectors reviewed design requirements, test results, and conditions identified during testing for the FLEX diesel generators. The inspectors determined that prior to April 2020, the licensee did not establish critical design characteristics for the diesel generators in their design basis, purchase orders, and testing. Specifically, the licensee did not establish required setpoints for breakers, time delay relays, and diesel generator support components, all of which were left at factory default settings. Additionally, the inspectors noted the following:

• Post-modification and initial acceptance testing did not ensure the FLEX diesel generators ability to support the designated beyond-design-basis external event functions. The licensee relied on vendor testing and did not perform a functional test following equipment modifications of FLX-EG1 through -EG5. This resulted in the FLEX diesel generators being tested with step/resistive loading instead of at the actual instantaneous loading that would be experienced during a beyond-design-basis external event (especially for FLX-EG3, -EG4, and -EG5).

• The breaker trip and time delay settings were not defined analytically or determined through testing prior to April 2020, and the vendor testing performed was not sufficient to demonstrate that the FLEX diesel generators would function during beyond-design-basis external event conditions.

Based on the above, the inspectors determined that FLX-EG1 and -EG2 were functional; however, FLX-EG3, -EG4, and -EG5 were not capable of performing their designated functions during a beyond-design-basis external event for the as-found equipment settings. Specifically, main breaker instantaneous overcurrent setpoint and voltage controller time delay setpoints for over/under frequency and over/undervoltage were at the factory default values of 1.5 (main breaker instantaneous overcurrent) and 0 seconds (over/under frequency/voltage) from September 18, 2015, to April 28, 2020.

.6 Review the licensees extent of condition evaluation to determine if the licensee has

adequately considered the potential for similar adverse conditions to exist in other beyond-design-basis mitigation equipment, including the eight other FLEX generators included in the licensees mitigating strategies.

The inspectors reviewed the extent of condition evaluation performed by the licensee as part of the FLEX diesel generator testing failures. The licensees emergent issue extent of condition approach used the following criteria to bound the extent of condition:

1. Technical Requirements 3.13.2, Diverse and Flexible Coping Strategies (FLEX)

Equipment, Table 3.13.2.1-1; and

2. FLEX diesel generators that start large motors which would incur a large inrush of

current that could cause them to trip with the time delay relay setpoints set to zero.

The above extent of condition criteria would only include the 500-kW and 200-kW FLEX diesel generators FLX-EG1, -EG2, -EG3, -EG4, -EG5, and -EG7. However, during the licensees initial troubleshooting of FLX-EG4 and FLX-EG5, it was identified that multiple fuel injectors were fouled due to preventive maintenance practices of not loading diesel generators greater than 30 percent of full load. Running diesel generators at less than 30 percent of full load causes unburned fuel to accumulate, leading to fouling of the fuel injectors and buildup on engine valves. The inspectors noted that the licensee did not consider this condition as part of the initial extent of condition scope, which excluded the hydrogen igniter diesel generator (HCS-ENG1), the communication diesel generators (FLX--EG8, -EG9, -EG10, -EG11, -EG12, and -EG13), and the lighting diesel generators (FLX-LT5, -LT6, -LT7, -LT8, -LT9, -LT10, -LT11, and -LT12).

In response to this observation regarding the limited initial extent of condition scope, the licensee initiated Condition Report CR-RBS-2020-02020 to further assess the extent of condition associated with injector fouling identified in FLX-EG4 and FLX-EG5. From the resulting expanded extent of condition review, the licensee determined the following:

1. The FLEX lighting diesel generators were operated yearly at a full load, which was

adequate to minimize the susceptibility to fuel injector fouling.

2. The hydrogen ignitor diesel generator (HCS-ENG1) was operated at equal to or

greater than 30 percent load during preventive maintenance testing, which is also adequate to minimize the susceptibility to fuel injector fouling.

3. The preventive maintenance testing for the FLEX communications diesel generators

was found to include operation of the diesel engines in an unloaded condition. In response, the licensee operated the FLEX communications diesel generators at a full load to verify proper operation, and no fuel injector fouling was identified.

Additionally, the inspectors reviewed the preventive maintenance testing of the direct diesel driven FLEX pumps FLX-P2, FLX-P3, and FWP-P4 to verify they were operated in a manner that prevented fuel injector fouling. From this review, the inspectors determined FLX-P2, FLX-P3, and FWP-P4 were operated at a diesel loading of greater than 30 percent, thus preventing fuel injector fouling.

.7 Review completed and proposed immediate corrective actions to determine if the

licensee has/is taking appropriate actions to address this condition.

The inspectors reviewed the licensees completed and proposed immediate corrective actions documented in Condition Reports CR-RBS-2020-1676, CR-RBS-2020-1685, CR-RBS-2020-1689, CR-RBS-2020-1705, CR-RBS-2020-1714, CR-RBS-2020-1723, CR-RBS-2020-2126, and the inspectors evaluation performed in Charter Item No. 4 to determine if the licensees corrective actions were appropriate to address FLEX diesel generator failures.

Based on the review of the licensees completed and proposed immediate corrective actions, the inspectors determined that the licensees corrective actions were appropriate.

.8 Evaluate completed and proposed corrective actions for past similar events at River

Bend Station and/or industry operating experience, if any, and determine whether the licensee implemented appropriate corrective actions.

The inspectors reviewed the licensees completed and proposed actions for corrective actions for past similar events associated with FLEX diesel generators documented in Condition Reports CR-RBS-2019-07343 and CR-RBS-2020-01311.

The licensee initiated Condition Report CR-RBS-2019-07343 in 2019 for an adverse trend associated with FLEX diesel generators being declared nonfunctional 12 different times from 2018 to 2019. The licensee categorized Condition Report CR-RBS-2019-07343 as B level, which was a condition adverse to quality level that warranted additional analysis. The condition required an ACA and corrective actions to correct the condition and other causal factors, thereby mitigating future risk. The casual factors and corrective actions are as follows:

• Causal Factor 1: The digital control panels that came installed on FLEX diesel generators FLX-EG1, -EG2, -EG3, -EG4, and -EG5, when purchased were not appropriate for the requirements of the FLEX program. The corrective action was to replace digital control panels with an upgraded model as directed by the vendor. This corrective action was completed in January 2019 and was performed without implementing the licensees engineering change process.

• Causal Factor 2: The failure to install equipment to maintain engine block temperatures warm enough to start properly on the first attempt led to FLX-EG1,

-EG2, -EG3, -EG4, and -EG5 tripping after their initial start, requiring additional restarts. The possible contributor to these failures to remain running after the initial starts was the preventive maintenance frequency being based on Electric Power Research Institute (EPRI) guidelines (every 6 months) instead of the vendor recommendation of 30 percent to 100 percent loading every 2 weeks for FLX-EG1 and FLX-EG2 and monthly for FLX-EG3, -EG4, and -EG5. This casual factor was assigned four corrective actions:

1. Validate that the preventive maintenance frequency ensures the FLEX diesel

generator functionality and adjust as needed.

2. Communicate to operations personnel via email and add a note to the FLEX

diesel generator hard cards that they may require multiple starts under various circumstances.

3. Determine and implement a method to ensure block heaters are energized

when needed while maximizing their reliability and life.

4. Eliminate GFCI receptable circuits to ensure the trip of a single GFCI will not

de-energize multiple receptacles in the FLEX buildings.

• Causal Factor 3: FLEX diesel generators are commercial grade equipment that come equipped with components intended to protect the engine that can fail causing false trip signals. The original engine coolant temperature switch in FLX-EG1 and FLX-EG2 experienced a stuck contact, which supplied a false high temperature trip to the control panel, shutting down the generators soon after start. The corrective action was to disable the temperature switch that stuck on FLX-EG1 and FLX-EG2, and identical switches on FLX-EG3, -EG4, and -EG5.

From the inspectors review of Condition Report CR-RBS-2019-07343 the licensee noted that FLX-EG5 tripped on overvoltage upon initial startup on September 26, 2019.

The licensees vendor attributed the overvoltage trip to the infrequent operation of FLX-EG5. Specifically, the infrequent operation resulted in a sluggish mechanical response of FLX-EG5. This sluggish mechanical response resulted in an increase in field excitation from the voltage regulator, thereby increasing the voltage. However, the licensee did not implement their formal troubleshooting process to confirm the vendor information and to determine if there were other potential causes that could result in a potential overvoltage trip (i.e., voltage regulator, fuel injection, or time delay relay setpoints issues). The inspectors noted that use of the licensees formal troubleshooting process, as used in April 2020, could have potentially identified the electrical setpoint issues sooner than April 2020.

A previous NRC inspection, documented in NRC Inspection Report 05000458/2019015, reviewed the issues discussed above as identified in the evaluation conducted under CR-RBS-2019-07343. The NRC issued non-cited violation (NCV)05000458/2019015-01 associated with the licensees failure to maintain the affected FLEX diesel generators in a functional condition as a result of these issues. The licensee initiated Condition Report CR-RBS-2020-01311 in response to this violation. The licensees corrective action for this issue was to develop action requests to perform load testing quarterly.

However, the inspectors noted that the corrective action did not include the FLEX hydrogen ignitor diesel generators (FLX-EG7 and HCS-ENG1) and FLEX communication diesel generators (FLX-EG8 through -EG12).

In response, the licensee entered the inspectors observations associated with corrective actions documented in Condition Reports CR-RBS-2019-07343 and CR-RBS-2020-01311 into the corrective action program as Condition Report CR-RBS-2020-02151.

The inspectors concluded that the licensee took appropriate corrective actions associated with previous similar events involving FLEX equipment. However, the licensee did not implement their formal troubleshooting process to confirm the vendor information and to determine if there were other potential causes that could result in an overvoltage trip (i.e., voltage regulator, fuel injection, or time delay relay setpoints issues). The inspectors noted that use of the licensees formal troubleshooting process, as used in April 2020, could have led to identification of the electrical setpoint issues sooner than April 2020.

.9 Determine whether the licensee included appropriate design parameters in FLEX

generator loading calculations, and correctly translated the results into equipment specifications and procedures for operation.

The inspectors reviewed the design basis documents, specifically the engineering changes (ECs) associated with the FLEX diesel generators EC 45118, Flex Design Details, Revision 0, EC 44959, Flex Basis, Revision 0, and EC 53852/G13.18.3.6-023, Flex Strategy - Portable Diesel Generator System Sizing, Revision 0. These ECs were used by the licensee to develop the critical performance characteristics for the FLEX diesel generators. The inspectors reviewed the engineering changes to determine whether the licensee included appropriate design parameters in FLEX diesel generator loading calculations and correctly translated the results into equipment specifications, procedures for operation, and the FLEX diesel generator purchase order.

The inspectors determined that EC 45118 and EC 44959 did not address the time delay setpoints for underfrequency, undervoltage, overfrequency, and overvoltage, and the output breakers instantaneous trip setpoint. Some FLEX diesel generator design characteristics were also not translated into the FLEX diesel generator installation parameters and not included in the purchase order specifications. The failure to translate the FLEX diesel generator design characteristics into the purchase order resulted in the time delay and breaker instantaneous trip setpoints being unanalyzed and remaining at the factory default settings of 0 seconds (over/under frequency/voltage) and 1.5 (main breaker instantaneous overcurrent).

The inspectors then reviewed the licensees procurement process and determined that the licensee provided a generic scope to the vendor. The design basis and requirements were incomplete because the licensee did not identify and include details on all the parts/components such as the circuit breaker. As a result, the purchase order provided to the vendor lacked specificity and did not require testing the diesel generators to the actual load conditions the site would expect to experience during a beyond-design-basis external event.

Due to these gaps, the inspectors determined that the licensee did not establish, document, and maintain a complete and accurate set of design requirements for the FLEX diesel generators. Specifically, the licensee did not include appropriate design parameters in the FLEX generator loading calculations and did not translate the results into equipment specifications and procedures for operations.

.10 Determine whether the licensee implemented adequate measures for ensuring that

FLEX generator characteristics, settings, and configurations were appropriately controlled to achieve compliance with NRC Order EA-12-049. Include in this review any documentation of critical characteristics to the vendor, and a review of vendor-provided installation, testing, and maintenance instructions. This review should include an understanding of whether the licensee correctly implemented processes for commercial-grade procurement of the diesel generators, as well as review of NRCs Safety Evaluation Report (ADAMS Accession No. ML15292A508) and FLEX Audit Report (ADAMS Accession No. ML15026A645).

The inspectors reviewed the licensees FLEX basis document, FLEX diesel generator sizing calculation, direct current load shedding analyses, and the FLEX diesel generator procurement specifications to assess whether the licensee implemented adequate measures for ensuring that FLEX generator characteristics, settings, and configurations were appropriately controlled to achieve compliance with NRC Order EA-12-049.

The inspectors identified that the licensee did not establish, document, and maintain a complete and accurate set of design requirements. EC 48511 and EC 44969 did not address the time delay setpoints for underfrequency, undervoltage, overfrequency, and overvoltage, and the output breakers instantaneous trip setpoint, which would be needed in order for the equipment to be able to support the designated functions. The time delay and output breaker instantaneous trip setpoints were all set to the factory default setpoints of 0 seconds (over/under frequency/voltage) and 1.5 (main breaker instantaneous overcurrent). The inspectors noted that considerable effort went into the FLEX bases and the sizing calculations, but the design characteristics were not translated into the FLEX diesel generator installation parameters and were not included in the purchase order specifications. The licensee did not establish required setpoints for breakers, time delay relays, and diesel generator support components, all of which were left at factory default settings.

The purchase order specifications included only a load bank test and did not test the actual load conditions that would exist when the equipment would be used to perform the designated FLEX functions. Specifically, the licensee did not perform testing using a 200-HP motor to validate that the FLEX diesel generators would support starting of the motor. The inspectors found that the FLEX diesel generator purchase order lacked specificity, and that the licensee did not identify the design characteristics for the output breaker and diesel generators for instantaneous voltage and the relay time delay until April 18, 2020. Through interviews and document reviews, the inspectors identified that the licensee submitted a purchase order for the generators that didnt include specific requirements because the site didnt have all the parts/components (breakers, etc.)

necessary to complete the supporting analyses that would feed into their bases. The licensees purchase order failed to include specifications for loading conditions and setpoints because their FLEX diesel generator strategy was not complete when they submitted the purchase order. Additionally, the licensee did not formally incorporate the necessary design characteristics once they were established.

The inspectors noted that the NRCs safety evaluation that documented the NRC staffs review of the licensees final integrated plan for complying with NRC Orders EA-12-049 and EA-12-051 did not address specific FLEX diesel generator design characteristics such as main breaker and time delay settings. The licensees final integrated plan also did not include this level of detail for the FLEX diesel generators.

.11 Determine whether the licensees procedures for testing and maintenance of FLEX

equipment are consistent with regulatory requirements, including commitments made during NRC staff review of the licensees final integrated plan for satisfying NRC Order EA-12-049. Evaluate the adequacy of the licensees FLEX equipment testing to provide assurance the equipment is available and capable of performing its intended function.

Determine whether any weaknesses identified are common to templates provided by industry sources, including Entergy Operations Inc. (Entergy), EPRI and/or NEI.

NRC Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, requires licensees or construction permit holders to develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and SFP cooling capabilities following a beyond-design-basis external event. NRC document JLD-ISG-2012-01, Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, Revision 0, contained interim staff guidance (ISG) to assist nuclear power reactor applicants and licensees with the identification of measures needed to comply with requirements to mitigate challenges to key safety functions. This ISG endorses, with clarifications, the methodologies described in the industry guidance document, NEI 12-06, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, Revision 0.

NEI 12-06 notes that FLEX includes programmatic controls that assure the continued viability and reliability of the FLEX strategies. These controls would establish standards for quality, maintenance, testing of FLEX equipment, configuration management and periodic training of personnel. Equipment associated with these strategies will be procured as commercial equipment with design, storage, maintenance, testing, and configuration control as outlined in this section. If the equipment is credited for other functions (e.g., fire protection), then the quality attributes of the other functions apply.

Item 7 of Section 11.3, Equipment Storage, of NEI 12-06, states that FLEX equipment should be stored and maintained in a manner that is consistent with assuring that it does not degrade over long periods of storage and that it is accessible for periodic maintenance and testing. Item 1 of Section 11.5, Maintenance and Testing, of NEI 12-06 states that FLEX mitigation equipment should be initially tested, or other reasonable means used to verify performance conforms to the limiting FLEX requirements. Validation of source manufacturer quality is not required. Item 2 of Section 11.5 states that portable equipment that directly performs a FLEX mitigation strategy for the core, containment, or SFP should be subject to maintenance and testing guidance provided in INPO AP 913, Equipment Reliability Process, to verify proper function. The maintenance program should ensure that the FLEX equipment reliability is being achieved. Standard industry templates (e.g., EPRI) and associated bases will be developed to define specific maintenance and testing, including the following:

a.

Periodic testing and test frequency should be determined based on equipment type and expected use. Testing should be done to verify design requirements and/or basis. The basis should be documented, and deviations from vendor recommendations and applicable standards should be justified.

b.

Preventive maintenance should be determined based on equipment type and expected use. The basis should be documented, and deviations from vendor recommendations and applicable standards should be justified.

c.

Existing work control processes may be used to control maintenance and testing (e.g., PM Program, Surveillance Program, vendor contracts, and work orders).

Electric Power Research Institute (EPRI) developed a program for maintenance of the equipment, which is documented in the EPRI Technical Report 3002000623, Applications Center: Preventive Maintenance Basis for FLEX Equipment - Project Overview Report. This program was endorsed by the NRC in the Letter from Jack R.

Davis (NRC) to Joseph E. Pollock (NEI), no subject line, dated October 7, 2013, Washington, DC (ADAMS Accession No. ML13276A224).

There are three objectives of the EPRI preventive maintenance basis document (also referred as the EPRI preventive maintenance templates). The first objective is to summarize industry experience on the tasks and task intervals that make up a sound, cost-effective PM program for a large number of major component types. The second objective is to make the technical basis for the recommendations sufficiently dynamic so that utility users could easily modify them but still preserve a valid technical basis for the changes. The third objective is to provide easy-to-use diagnostic software that can help the preventive maintenance analyst to recognize where the gaps in preventive maintenance exist and to find a better solution that is well adapted to an individual plant.

The inspectors reviewed the licensees model work orders for the FLEX diesel generators and determined that the prescribed preventive maintenance activities were consistent with the recommendations and guidance in the EPRI preventive maintenance basis document. The model work orders reviewed by the inspectors included 6-month functional and megger testing, annual performance testing and fluid analysis, and 3-year full load and megger testing. The inspectors noted that the licensees 3-year full load test model work order deviated from vendor recommendations for performing diesel generator load testing. Specifically, the vendor recommendation was as follows:

1. For FLX-EG1 and FLX-EG2, the vendor recommended starting the engine and

running at rated speed with 50 percent 70 percent load for 30 minutes every 2 weeks.

2. For FLX-EG3, -EG4, and -EG5, the vendor recommended performing monthly load

testing.

The inspectors identified that the licensee has a corrective action, documented in Condition Report CR-RBS-2020-01311, to review and revise the preventive maintenance frequency for testing the FLEX diesel generators under loaded conditions to minimize the potential for fuel injector fouling.

Based on the above, the inspectors found that the licensees procedures for testing and maintenance of the FLEX diesel generators are consistent with regulatory requirements, including commitments made during NRC staff review of the licensees final integrated plan for satisfying NRC Order EA-12-049. The inspectors confirmed that the licensees testing procedures provide assurance that the FLEX diesel generators are available and capable of performing their designated functions. Additional observations regarding industry guidance are noted under Item 15 below.

.12 Evaluate the licensees implementation of modification activities that involved

replacement of FLEX generator controllers in January 2019. Specifically, determine whether all applicable operational aspects of the replacement devices were appropriately evaluated and controlled, and whether vendor-recommended post-installation testing was completed.

The inspectors reviewed the modification activities associated with the FLEX generator controllers. Based on their review, the inspectors determined that the vendor-recommended post-installation testing was completed, but was inadequate because the licensee failed to identify and document some critical FLEX diesel generator characteristics and ensure that changes were properly implemented, verified, and incorporated into site documentation. The associated ECs did not establish the controller setpoints, and when questioned by inspectors, the licensee could not identify any evidence that the installation and replacement of the digital controllers included establishment of setpoints outside of their factory settings.

Based on their review of the licensees implementation of modification activities that involved the FLEX generator controller, the inspectors found that applicable operational aspects of the replacement devices were not appropriately evaluated and controlled.

.13 Determine the extent to which the licensees FLEX program implementation is reliant on

vendor or contractor assistance to achieve credited equipment operation and to maintain/troubleshoot FLEX equipment consistent with regulatory requirements.

The inspectors reviewed the licensees reliance on the vendor for the licensees FLEX program implementation to achieve credited equipment operation and to maintain/troubleshoot FLEX equipment consistent with regulatory requirements, and noted the following:

• The licensee relied on the vendor to perform testing following installation and after repairs, and licensee oversight of these functions by the vendor was not appropriately controlled. In accordance with the Entergy classification process, the FLEX diesel generators are classified as nonsafety-related, which does not require the same vendor oversight as the installed plant FLEX equipment. The installed FLEX equipment would be either classified as safety-related (direct connection to safety-related equipment) or augmented quality (such as FLX-P1)that could impact safety-related equipment during seismic events, which includes requirements for additional vendor oversight for maintenance and repair activities. The limited vendor oversight was evident during the digital controller change of FLX-EG1 through -EG5. The licensee treated the digital controller change as a repair by the vendor similar to changing out a fuel filter or an air filter.

• The inspectors noted, from the review of Condition Report CR-RBS-2019-07343 timeline of events, that FLX-EG5 tripped on over voltage on initial startups on September 26, 2019, as documented in Condition Report CR-RBS-2019-06262.

The licensees vendor attributed the over voltage trip to the infrequent operation of the FLX-EG5. Specifically, the infrequent operation resulted in a sluggish mechanical response of FLX-EG5. This sluggish mechanical response resulted in an increase in field excitation from the voltage regulator, thereby increasing the voltage. However, the licensee did not implement their formal troubleshooting process to confirm the vendor information and to determine if there were other potential causes that could result in a potential over voltage trip (i.e., voltage regulator, fuel injection, or time delay relay setpoints issues). The use of the licensees formal troubleshooting process, as used in April 2020, could have potentially identified the electrical setpoint issues sooner than April 2020.

• Post-modification and initial acceptance testing did not ensure the FLEX diesel generators ability to support the designated beyond-design-basis external event functions. The licensee relied on vendor testing and did not perform a functional test following equipment modifications of FLX-EG1 through -EG5. This resulted in the FLEX diesel generators being tested with step/resistive loading instead of at the actual instantaneous loading that would have been experienced during a beyond-design-basis external event (especially for FLX--EG3, -EG4, and -EG5).

• The inspectors identified that the licensee failed to maintain control of FLEX diesel generator settings following vendor off-site maintenance. The licensee initiated Condition Report CR-RBS-2020-02126 to capture this concern in the corrective action program.

Based on their review, the inspectors determined that the licensees reliance on the vendor contributed to the issues experienced while implementing their FLEX program.

.14 Evaluate the licensees use of credited FLEX functions for risk mitigation.

Specifically, evaluate the licensees implementation of requirements for assessing and managing risk.

The inspectors reviewed the licensees risk management process for performing online maintenance and shutdown conditions (refueling outages) and Procedure EN-OP-202, Diverse and Flexible Coping Strategies (FLEX) Program Document Basis, Revision 4.

The inspectors noted the following contained in Procedure EN-OP-202:

River Bend Station will abide by the NEI position paper entitled, Shutdown/Refueling Modes, addressing mitigating strategies in shutdown and refueling modes. This paper was endorsed by the NRC. Therefore, Entergy will incorporate the supplemental guidance provided in the NEI position paper to enhance the shutdown risk process and procedures.

In order to further reduce shutdown risk, the shutdown risk process and procedures will be enhanced through incorporation of the FLEX equipment. Consideration will be given in the shutdown risk process to:

• Maintaining FLEX equipment necessary to support shutdown risk processes and procedures readily available; and

• How FLEX equipment could be deployed or pre-deployed/pre-staged to support maintaining or restoring the key safety functions in the event of a loss of shutdown cooling.

In cases where FLEX equipment would need to be deployed in locations that would quickly become inaccessible as a result of a loss of decay heat removal from an extended loss of power (ELAP) event, pre-staging of the equipment is required.

Based on the above, the inspectors reviewed Procedure OPS-0037, Shutdown Operations Protection Plan (SOPP), Revision 39, and the Refueling Outage 20 Outage Risk Assessment Team Report. From this review, the inspectors did not identify where the shutdown PRA model, defense-in-depth analysis, or risk management actions during the refueling outage credited FLEX equipment to mitigate risk. Additionally, FLEX equipment would only be deployed during shutdown conditions if an ELAP was declared in accordance with Procedure AOP-0050, Station Blackout, Revision 62. The licensee would then transition to Procedure AOP-0065, Extended Loss of AC Power (ELAP),

Revision 6, and then implement FLEX Procedure RBS-FSG-003, Alternate Reactor Vessel Cooling, Revision 3. RBS-FSG-003 provides procedural guidance for shutdown conditions with the reactor core isolation cooling system isolated and the reactor pressure vessel depressurized.

From the discussion above, the inspectors concluded that the licensees inclusion of FLEX equipment in the PRA model impacts their risk profile for online maintenance, but the licensee did not use FLEX equipment for risk management actions to mitigate online risk or outage risk.

.15 Evaluate the potential for generic implications associated with issues identified during

the inspection, and work with the Office of Nuclear Reactor Regulation to gather information to inform any potential generic issues.

The inspectors identified four observations that have potential generic implications regarding the treatment of FLEX equipment. These observations included areas where the NRC could consider providing clarification to industry regarding use of the EPRI preventive maintenance basis document, reliance on and expectations of vendor-performed maintenance and modifications, utilization of change/work control processes with FLEX equipment (e.g., to govern modifications and design changes), and apparent exclusion of certain FLEX equipment from maintenance and testing requirements.

• EPRI Preventive Maintenance Basis Document

The inspectors identified that the licensee primarily used the EPRI preventive maintenance basis document to establish the preventive maintenance activities for FLEX equipment. NEI 12-06, Section 11.5 states periodic testing and frequency should be determined based on equipment type and expected use.

Testing should be done to verify design requirements and/or basis. The basis should be documented, and deviations from vendor recommendations and applicable standards should be justified, and preventive maintenance should be determined based on equipment type and expected use.

The inspectors noted that the EPRI preventive maintenance basis document only listed an example preventive maintenance template for diesel engine driven pumps and not electric diesel generators. Additionally, the EPRI preventive maintenance basis document identified the following common failure causes for diesel engines:

2. Buildup of carbon deposits in the engine because of low-load operation and

use of fuel with too high a sulfur content

6. Issues with normal oxidation and aging of the fuel from long-term standby

occurred after 1 to 3 years, while the buildup of biological contaminants from exposure to the environment is slightly longer2 to 3 yearsbut will be shorter if maintained in dirty and/or moisture-laden conditions. Age-related degradation of all oil and fuel filters should not be expected to occur before 2 to 3 years.

The EPRI preventive maintenance basis document lists a number of tests and inspections for diesel driven pumps. In addition to fluid analyses and visual checks, the EPRI preventive maintenance basis document recommended testing including functional testing, performance testing, and component operational inspection testing. The objective of the functional test and inspection task is to demonstrate the availability of the equipment, that is, that the diesel will start and run. The objective of the performance test is to ensure that the engine can run at full load for a sustained period of time and that the pump is able to provide its full capacity and pressure requirements. The objective of the component operational inspection and performance test is to ensure that the engine will start and run at a sustained load of greater than 30 percent and that the pump can meet its expected capacity and pressure. Outside of this task acknowledging that seized nozzles of the injectors could be identified during this test, there is no emphasis on the need to test the diesel generators under loaded conditions more frequently to avoid fuel injector fouling. The inspectors identified the EPRI recommended test frequencies also deviated from those recommended by the vendor. Specifically, the vendor recommendations for load testing FLX-EG1 and FLX-EG2 were starting the engine and running at rated speed with 50 percent - 70 percent load for 30 minutes every 2 weeks; for FLX-EG3, -EG4, and -EG5, the vendor recommended performing monthly load testing.

Furthermore, the EPRI preventive maintenance basis document also does not specify that testing needs to consider design characteristics such as breaker and relay setpoint adjustments, actual loading conditions (step, gradual, instantaneous, etc.), and type of loads (i.e., resistive and/or inductive) to demonstrate that the diesel generator can perform its design function.

From the above, the inspectors observed there was an opportunity to provide clarification to the industry that the EPRI preventive maintenance basis document should not be solely relied upon when establishing preventive maintenance of FLEX equipment. Specifically, licensees should also consider design characteristics, vendor recommendations, consensus standards, and operating experience when developing their preventive maintenance program for FLEX equipment while justifying and documenting deviations as noted in NEI 12-06.

• Vendor-performed Maintenance and Modifications

While most FLEX equipment is considered nonsafety-related or commercial grade, there is a lack of guidance on expectations for licensee oversight when solely relying on commercial-grade vendors to perform maintenance or modifications on FLEX equipment. Given the importance of FLEX equipment, the inspectors observation is that further clarification in this area may be warranted to ensure that licensees are providing adequate oversight of vendor-performed maintenance and modifications on FLEX equipment to ensure that this equipment remains reliable and capable of performing its designated functions.

• Utilization of Change/Work Control Processes with FLEX Equipment

NEI 12-06 states, in part, that programmatic control is one of the elements to assure the continued viability and reliability of the FLEX strategies. These controls would establish standards for quality, maintenance, testing of FLEX equipment, configuration management and periodic training of personnel.

NEI 12-06, Section 2.4, further states that the programmatic controls for implementation of FLEX include: quality attributes, equipment design, equipment storage, procedure guidance, maintenance and testing, training, staffing, and configuration control. Additionally, NEI 12-06, Section 11.4, Item 2.c, states that existing work control processes may be used to control maintenance and testing.

The inspectors noted NEI 12-06 provides appropriate expectations for maintaining the quality and reliability of FLEX equipment. The inspectors observed that further clarification in this area may be warranted to ensure that licensees are utilizing existing work control processes (e.g., Preventive Maintenance Program, Surveillance Program, procurement/vendor contracts, change management, work orders, etc.) to control maintenance of and modifications to FLEX equipment.

• Exclusion of Certain FLEX Equipment from Maintenance and Testing Requirements

NEI 12-06, Section 11.2, Item 1, states that Design requirements and supporting analysis should be developed for portable equipment that directly performs a FLEX mitigation strategy for the core, containment, and SFP that provides the inputs, assumptions, and documented analysis that the mitigation strategy and support equipment will perform as intended. When specifying portable equipment, the capacities should ensure that the strategy can be effective over a range of plant and environmental conditions. This documentation should be auditable, consistent with generally accepted engineering principles and practices, and controlled within the configuration document control system.

NEI 12-06, Section 11.5, Item 2, states, in part, that portable equipment that directly performs a FLEX mitigation strategy for the core, containment, or SFP should be subject to maintenance and testing guidance provided in INPO AP 913, Equipment Reliability Process, to verify proper function. The maintenance program should ensure that the FLEX equipment reliability is being achieved.

The inspectors observed that the guidance noted above may have unintentionally excluded (by citing that design requirements, supporting analyses, and maintenance and testing is limited to portable equipment that directly performs a FLEX mitigation strategy) the need to establish design requirements, supporting analyses, and maintenance and testing of all FLEX equipment that is necessary to ensure the overall success of the mitigation strategies required by NRC Orders EA-12-049 and EA-12-051 (e.g., equipment that supports/supplies communications, lighting, hydrogen ignitor generators, etc.). Therefore, the inspectors observed that further clarification in this area may be warranted to ensure that all FLEX equipment credited for the successful implementation of the mitigating strategies has established design requirements, supporting analyses, and maintenance and testing.

INSPECTION RESULTS

Failure to Establish and Translate Design Bases to Ensure Capability to Perform Flex Strategy Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000458/2020050-01 Open/Closed

[H.13] -

Consistent Process 93812 The inspectors reviewed a self-revealed, Green finding and associated non-cited violation of NRC Order EA-12-049, for the licensees failure to maintain strategies to maintain and restore core cooling and containment cooling capabilities following a beyond-design-basis external event. Specifically, the licensee failed to develop design requirements and perform adequate testing for Diverse and Flexible Coping Strategies (FLEX) program elements, resulting in both the FLEX diesel generators required to restore reactor core cooling and containment cooling for the primary FLEX strategy (designated FLX-EG3 and FLX-EG4) and the N FLEX diesel generator required to provide cooling water to the suppression pool cooling heat exchanger (designated FLX-EG5) for the Extended Loss of AC Power (ELAP) response strategy being nonfunctional for an extended period of time.

Description:

In September 2019, the licensee performed a 2-year test of the electric motor driven FLEX pump FLX-P1, powered by a FLEX diesel generator (FLX-EG5). During this test, which tested the diesel generators ability to run the pump motor uncoupled from the pump, the diesel failed to start. The generator was tested again and shut down on overvoltage on October 31, 2019. This was the subject of follow-on NRC inspection activities, and the licensee put corrective actions in place to resolve this condition.

On April 1, 2020, the licensee once again attempted to perform the 2-year test of FLX-P1 powered by FLX-EG5. The test failed due to a generator undervoltage trip following closure of the pump motor disconnect switch. The licensee sent the generator to the vendor for repair. On April 16, 2020, the licensee attempted to re-perform the uncoupled pump test.

During the test, the pump disconnect switch shut, and the uncoupled pump motor briefly ran for a few seconds and again tripped on the generator undervoltage trip. Subsequent to the April 16, 2020, test, the licensee and vendor determined that the generator was unable to handle the starting load (current) of the uncoupled pump motor.

After considering whether the diesel generators were appropriately sized for the FLEX program, the licensee determined that the generator undervoltage time delay setpoints could be adjusted to enable the generator to remain online during the initial uncoupled pump motor start. The inspectors determined that multiple generator settings were never properly configured during the initial setup of the generators, prior to the equipment being credited as being available to perform the designed FLEX functions.

After the failure of FLX-EG5 on April 16, 2020, the licensee assessed the condition of four other FLEX diesel generators (FLX-EG3, FLX-EG4, and FLX-EG7). The licensee determined that generators FLX-EG3 and FLX-EG4 were subject to the same condition, whereby one or more generator settings were configured such that the associated FLEX loads would potentially not have been able to perform their intended functions. The licensee subsequently adjusted setpoints to restore the functionality of all FLEX diesel generators.

From the inspectors review of the recent FLEX diesel generator test failures, they noted multiple gaps in the licensees implementation of their FLEX Diesel Generator Strategy. The licensee did not ensure that design characteristics, maintenance, and modifications that could impact the ability of the FLEX diesels to perform when needed were maintained in a consistent and up-to-date manner. The following are examples of the licensees failure to maintain adequate configuration control of the FLEX diesel generators:

1. Design Bases/Requirements (NEI 12-06, 11.2, Equipment Design) - The licensee did

not establish, document, and maintain a complete and accurate set of design requirements. Engineering Change (EC) 48511, Flex 1 Design Details, and EC 44969, Flex Basis, did not address the time delay setpoints for underfrequency, undervoltage, overfrequency, and overvoltage, which were all set to 0, and the output breakers instantaneous trip setpoint, which was set to 1.5. These were the factory default settings. The inspectors noted that considerable effort went into the FLEX Bases and the Sizing calculations, but the design characteristics were not translated into the FLEX diesel generator installation parameters and were not included in the purchase order specifications. The licensee did not establish required setpoints for breakers, time delay relays, and diesel generator support components, all of which were inappropriately left at factory default settings.

2. Purchasing Order -The purchase order specifications did not include testing at the

actual load conditions that would exist when the equipment would be used to perform the designated FLEX functions. The inspectors found that the diesel purchase order lacked specificity, and that the licensee did not identify the necessary design characteristics for the diesel generator main breaker instantaneous overcurrent and relay time delay setpoints until April 18, 2020. Through interviews and document reviews, the inspectors identified that the licensees purchase order for the generators did not include specific requirements because the licensee did not have all the parts/components (breakers, etc.) necessary to complete the supporting analyses. In their purchase order, the licensee failed to include specifications for loading conditions and setpoints because their FLEX diesel strategy was not complete when they submitted the purchase order, and it was not formally established that the design characteristics needed to be included once they were established. As a result, the purchase order failed to address testing of the diesel generators to actual load conditions. Specifically, the licensee did not perform testing using a 200-HP motor to validate that the FLEX diesel generators would support starting of the motor.

3. Testing (NEI 12-06, 11.5. Maintenance and Testing) (Functional, In-Field, Post-

Modification (permanent and temporary)) - The licensee failed to verify the adequacy of the design to ensure that components would perform satisfactorily. Specifically, the licensee did not perform functional testing for the FLEX modification of FLX-EG1 through -EG5 powering FLX-P1 or FLX-P2 (EC 48511, Flex 1 Design Details and EC 44969, Flex Basis). The licensee intended to perform field testing to validate settings when the generators were delivered, but the licensee failed to document the need to establish the setpoints and perform field testing under loading conditions that were representative of the conditions under which the equipment would be expected to function.

The inspectors noted that the licensees post-modification testing did not ensure the FLEX diesel generators ability to support the designated FLEX functions. Testing was instead performed according to the generic testing specified in the purchase order. The licensee tested the FLEX diesel generators upon receipt at step load/resistive loading versus actual conditions that would be expected in support of the designated FLEX functions (especially for FLX-EG3, -EG4, and -EG5) (i.e., the starting of large inductive loads).

4. Repairs/Replacements - The licensee failed to identify and document FLEX diesel

generator characteristics and ensure that changes were properly implemented, verified, and incorporated into site documentation. There was no evidence that the licensee ever adjusted setpoints on the digital controller. The licensee failed to identify and document FLEX diesel generator characteristics and ensure that changes were properly implemented, verified, and incorporated into site documentation for repairs and replacements. When the licensee sent the equipment to the vendor, it failed to verify that the changes made did not affect the FLEX diesel generators ability to perform the applicable FLEX function. Specifically, regarding the replacement of the digital controller in January 2019, the inspectors noted that the licensee did not use the stations engineering change process for the controller replacement from the original Intellite controllers to the new Deep Sea 7310 controllers on all five FLEX diesel generators. The licensee did not recognize that the settings needed to be adjusted from factory settings and was unable to find any evidence that the digital controller (old and new) ever had established setpoints outside of their factory settings.

The licensee also replaced the voltage regulator (April 2020), which provides controls for the engine and the fuel injectors (that were damaged from running at no-load).

The licensee failed to include critical design characteristics and did not establish them until April 18, 2020, for the FLEX diesel generators.

5. Procedures EN-DC-115, Engineering Change Process, and EN-DC-117, Post-

Modification Testing and Special Instructions, establish requirements for completing formal engineering changes (including commercial grade equipment) and the process for conducting post-modification tests on equipment. The inspectors determined that the licensees lack of implementation of these site procedures resulted in missed opportunities to identify that the generators would not perform as intended.

6. The licensee describes its strategies to meet NRC Order EA-12-049 in Procedure

EN-OP-201-07, River Bend Station FLEX Program Document, Revision 2.

Section 1.0, Purpose and Scope, step 3, states, This program document in conjunction with the fleet program document (EN-OP-201) satisfies these requirements that support or are affected by the FLEX strategies. Procedure EN-OP-201, Diverse and Flexible Coping Strategies Fleet Program Document, Revision 3, steps 6.1.2.1.a and 6.1.2.3.a, states, in part, that NEI 12-06 provides requirements for an overall program that:

(1) maintains the FLEX strategies and associated basis;

(2) contains a historical record of previous strategies and basis for changes; and

(3) contains the basis for ongoing maintenance and testing programs chose for the FLEX equipment. Procedure EN-DC-115, Engineering Change Process, contains screening criteria to ensure that any proposed activity involving a change to the plant design, physical plant layout, roads, buildings, or miscellaneous structures that has a potential to adversely impact the approved Fukushima Response strategies receives the appropriate evaluation. The inspectors identified that the licensees FLEX strategy basis documents failed to identify portable FLEX equipment as having a potential to adversely impact the approved Fukushima Response strategies, which represents the potential for portable FLEX equipment to not receive appropriate engineering change evaluation in accordance with Procedure EN-DC-115 and EN-DC-117.

7. Section 11.5.3 of NEI 12-06, Revision 0, notes that the unavailability of equipment and

applicable connections that directly performs a FLEX mitigation strategy for core, containment, and the SFP should be managed such that risk to mitigating strategy capability is minimized. Item 11.5.3(b) of NEI 12-06 specifies that portable equipment may be unavailable for 90 days provided that the site FLEX capability (N)is available. Item 11.5.3(c) of NEI 12-06 specifies that connections to permanent equipment required for FLEX strategies can be unavailable for 90 days provided alternate capabilities remain functional. The licensees primary strategy for maintaining core cooling relies on FLEX diesel generators FLX-EG3 and FLX-EG4 as the n set of equipment. The licensees alternate strategy for maintaining core cooling relies on diesel-driven pumps FLX-P3 and FWP-P4 as the n+1 set of equipment. Given that the licensees primary strategy using either FLX-EG3 and FLX-EG4 was unavailable for greater than 90 days, the licensees FLEX strategy failed to limit the unavailability of portable FLEX equipment in accordance with NEI 12-06, Revision 0.

In summary, the licensee failed to control the design requirements and did not maintain the FLEX diesel generators to the level appropriate to their safety significance. The inspectors determined that the licensee did not use a formal process to update FLEX diesel generator design basis and operational documentation as a result of FLEX diesel generator modifications.

The inspectors also noted that even though the FLEX diesel generators are commercial grade equipment, the licensee committed to using their work control processes to maintain the design of the FLEX diesel generators. The appropriate application of configuration control measures would have ensured that the implementation/installation, maintenance, and testing were all in accordance with design requirements. However, the licensee failed to adequately implement their work control processes for the FLEX diesel generators, resulting in the FLEX diesel generator design requirements not being fully established and maintained.

Corrective Actions: On April 18, 2020, River Bend Station completed the setpoint calculations to appropriately determine and adjust the time delay and trip setpoints with vendor input. The licensee also planned to update the vendor documents to capture the settings.

On April 28, 2020, River Bend Station completed an onsite test to demonstrate that some of the required FLEX functions were met and maintained in light of the identified degraded conditions. FLX-EG2 was satisfactorily tested using a spare battery charger (BYS-CHG1D).

Corrective Action References: Condition Report CR-RBS-2020-01723

Performance Assessment:

Performance Deficiency: The licensees failure to implement and maintain strategies to maintain and restore core cooling and containment cooling capabilities following a beyond-design-basis external event was a performance deficiency. Specifically, the licensee failed to maintain FLEX program elements such that both the FLEX diesel generators required to restore reactor core cooling and containment cooling for the primary FLEX strategy (designated FLX-EG3 and FLX-EG4), and the N Flex diesel generator required to provide cooling water to the suppression pool cooling heat exchanger (designated FLX-EG5) for the ELAP response strategy, were nonfunctional for an extended period of time.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to establish, document, maintain, and test portable FLEX diesel generator design characteristics resulted in FLEX diesel generators FLX-EG3, -EG4, and -EG5 being unavailable to support operation of the associated FLEX pump motors to accomplish the designated FLEX functions.

Significance: The inspectors assessed the significance of the finding using Appendix A, The Significance Determination Process (SDP) for Findings At-Power. A Detailed Risk Evaluation was required for this finding because it involved a failure, unavailability, and degradation of equipment credited for use in satisfying the requirements of Order EA-12-049 (FLEX) that would result in a complete loss of the ability to maintain or restore core cooling, containment, or spent fuel pool cooling capabilities for an exposure period greater than the out-of-service time allowed by the licensees FLEX final integrated plan. Specifically, the portable FLEX diesel generators, FLX-EG3 and FLX-EG4, were unavailable for an extended period of time to implement the licensees primary FLEX strategy to restore or maintain reactor core and containment cooling capabilities.

FLEX Special Inspection Detailed Risk Evaluation Conclusion: The estimated increase in core damage frequency (CDF) from the documented performance deficiency involving the Diverse and Flexible Coping Strategies (FLEX) diesel generators being non-functional at the River Bend Station was 8.5E-7/year. This result was peer reviewed by a risk and reliability analyst from the Division of Risk Assessment in the Office of Nuclear Reactor Regulation.

The increase in CDF included estimates of 6.4E-7/year from internal events and 2.1E-7/year from external events. The dominant sequences comprising approximately 85 percent of the increase in CDF were from losses of offsite power initiated from internal events, which progressed to station blackout events where FLEX equipment failed.

A. Internal Events Analysis Influential Assumptions: The following are assumptions which were discovered during conduct of the detailed risk evaluation, were raised by the licensee, or were assumptions which the final risk estimate was sensitive to:

1. Exposure time: A one-year exposure time was used and broken down as follows:

The analyst assumed that FLEX diesel generators FLX-EG3, -EG4, and -EG5 had always been non-functional. Using the guidance in Section 2, Exposure Time Modeling, of the Risk Assessment of Operational Events (RASP) Handbook, Volume 1, Internal Events, Revision 2, the analyst limited the exposure time to one year even though the condition existed for longer than one year.

2. Equipment failures and recovery: FLEX diesel generators FLX--EG3, -EG4, and -

EG5 were all assumed to suffer non-recoverable failures.

FLX--EG3, -EG4, and -EG5 were assumed to be failures to load and run that were unrecoverable. The analyst assumed the nominal level of station knowledge of the FLEX diesel generators along with the experience and procedures for recognizing and overcoming the degradation made success unlikely in the time needed.

3. Use of the station blackout (SBO) diesel generator (DG): The analyst assumed that

the licensees SBO DG was available as the first alternate diesel generator upon failure of the first deployed FLEX battery charging diesel generator, either FLX-EG1 or FLX-EG2.

For extended loss of AC power (ELAP) scenarios, operators would declare an ELAP, and one of the FLEX diesel generators FLX-EG1 or FLX-EG2 would be used. If that FLEX diesel generator were to fail, plant operators informed the analyst that they would next employ the SBO DG to attempt to perform the battery charging function because of familiarity with the component and its closer proximity to the plant. Finally, the unused FLEX battery charging diesel generator would then be used. The failure probability for failing to align the second FLEX battery charging diesel generator from the existing River Bend SPAR model was substituted into the fault tree EPS-DGN-SBO, Station Blackout Generator is Unavailable, to reflect better success due to the higher priority of using the SBO DG.

Next, because of the time required to deploy FLX-EG1 or FLX-EG2 and discover its failure, then deploy the SBO DG and discover its failure, the analyst created a new human failure event using SPAR-H for use of the second FLEX battery charging diesel generator. In this analysis, the analyst assumed high stress and moderate complexity in diagnosis and extreme stress and moderate complexity in action. This resulted in a human error probability of 5.25E-1 for aligning the second FLEX diesel generator.

For hurricane, seismic, tornado, and high wind events, the analyst assumed the SBO DG would be unavailable. The SBO DG sits exposed to the elements out in the licensees protected area and was assumed to be damaged during these external events.

The analyst consulted with personnel from the Idaho National Laboratory to make these model changes. These changes were reflected in the model used for the estimate in this detailed risk evaluation.

4. Common cause grouping of FLEX and SBO diesel generators: FLX-EG1, -EG2, -

EG3, -EG4, and -EG5 were grouped together as common equipment. When one or more of these diesel generators failed, the probability of any other diesel generators failing for common reasons would be increased.

The analyst used the existing common cause component group (CCCG) from the existing NRC SPAR model, which used a group of 5 diesel generators (FLEX diesel generators FLX--EG1, -EG2, -EG3, -EG4, and -EG5) in the same common cause group. Use of this group was assumed to be most reasonable given that the diesel generators had the same manufacturer (Generac), were subject to the maintenance practices, had similar missions to provide 480-volt AC power during events, and were stored and would be used in the same environment.

The analyst noted that the FLEX diesel generators were surveilled at the same time and assumed non-staggered testing in the construction of the CCCG. This assumption was applied in modification by personnel at Idaho National Laboratory for use in this detailed risk evaluation.

Sensitivity analyses were conducted for inclusion of the SBO DG into the CCCG and for eliminating common cause failures of the FLEX diesel generators. These sensitivity analyses are documented in Section E of this evaluation.

5. Use of the upper containment pool for the reactor core isolation cooling (RCIC) pump

suction source: The analyst ensured that the licensees modification to supply water from the upper containment pool to extend RCIC operation was adequately represented in the SPAR model. During the preparations to implement their FLEX strategies, the licensee performed a plant modification to be able to use the upper containment pool as a water source for RCIC during events. The modification would supply RCIC with approximately 400,000 gallons of water at around 90-100 degrees Fahrenheit to last for around 27 additional hours. RCIC reliability was improved, and dependence on suppression pool cooling was lowered upon successful alignment of this RCIC inventory source.

The analyst reviewed the River Bend SPAR model, specifically event tree SBO-ELAP, Station Blackout - Power not Recovered - ELAP Declared, to assess credit for the operational practice. Under event tree top event FLEX-TDP, fault trees FLEX-TDP, FLEX-TDP2, and FLEX-TDP3 are used. The analyst added a new fault tree, FLEX-TDP4, to reflect the sequence-specific failures relative to Sequences 12, 13 and 14 in event tree SBO-ELAP. Fault tree FLEX-TDP4 was modeled to reflect failure of RCIC without DC power after battery depletion with a successful deep load shed where EG-1, EG-2, and the SBO diesel generators had failed.

The analyst reviewed the fault trees and discovered that only a basic event capturing RCIC hardening, operator actions, and other similar actions was present under each FLEX-TDP fault tree. Since failure of the upper containment pool modification would lead to RCIC failure as events unfolded, the analyst created a human reliability basic event for the failure of operators to align the upper containment pool to the RCIC suction and added that event to fault trees FLEX-TDP, FLEX-TDP2, FLEX-TDP3, and FLEX-TDP4. In estimating the human error probability using the SPAR-H methodology for the event, the analyst assumed high stress for diagnosis, extreme stress for action, moderate complexity for action, and low experience/training for action. These assumptions combined to estimate the failure probability of 3.2E-1 for the event.

6. Alternate injection sources. The licensee had procedures for injection into the reactor

pressure vessel for decay heat removal and inventory control using FLEX diesel driven pumps and the diesel driven fire water pumps. Implementation of these procedures would require many operator actions. The analyst conducted a SPAR-H analysis of the tasks. Licensee operators stated that upon failure of FLX-EG3 and FLX-EG4 to power reactor pressure vessel injection, they would first align their diesel driven fire pumps for injection, and if that failed, they would employ the FLEX diesel driven firewater pumps (FLX-P3 and FPW-P4) with suction from the standby service water basin.

The human error probability for aligning the installed diesel fire pumps for injection was estimated for this analysis to be 2.05E-1 (79% success). In estimating the human error probability using the SPAR-H methodology for the event, the analyst assumed high stress and low experience for diagnosis and extreme stress for action.

The human error probability of aligning the first available diesel driven FLEX pump, FLX-P3, was estimated to be 3.4E-1 (66% success rate). In estimating the human error probability using the SPAR-H methodology for the event, the analyst assumed high stress and low experience for diagnosis and extreme stress, moderate complexity, and low experience for action. Moderate dependency was also assumed due to the actions assumed to be done by the different crew members and close in time.

The human error probability of aligning the second available diesel driven FLEX pump, FPW-P4, was estimated to be 6.2E-1 (38% success rate). In estimating the human error probability using the SPAR-H methodology for the event, the analyst assumed high stress and low experience for diagnosis and extreme stress, moderate complexity, and low experience for action. High dependency was also assumed due to the actions assumed to be done by the same crew and close in time.

Increase in CDF from Internal Events Estimate: Using SPAR model RIVER-BEND-RICK-UPDATE5, a limited use model modified from Version 8.56, run on SAPHIRE Version 8.2.1, the increase in CDF from internal events was estimated to be 6.4E-7/year. This modified model reflected that FLEX equipment was part of the as-operated plant and that emergency diesel generators were unable to be recovered after one hour. The model also incorporated modifications described in this evaluation. In using this model, the analyst applied Change Set FLEX-CREDIT, ELAP Declared and FLEX Equipment Credited.

B. External Events Analysis Using the modified SPAR model RIVER-BEND-RICK-UPDATE5, run on SAPHIRE Version 8.2.1, the increase in CDF was estimated for high winds (4.0E-8/year),hurricanes (1.3E-8/year), and seismic events (4.4E-8/year). Risk from tornado events from the SPAR was determined to be negligible when compared to the risk from other external events.

From previous interactions with the licensee, the analyst judged the licensee had a fire PRA capable of adequately evaluating the fire risk associated with the finding.

The performance deficiency considered FLX--EG3, -EG4, and -EG5 all to be out of service for the condition of interest. In engineering report PSA-RBS-06-06, PRA Risk evaluation of FLEX Diesel Failures, Revision 0, dated May 5, 2020, the licensee stated there would be only a negligible increase in CDF due to fire events due to FLX--EG3, -EG4, and -EG5 being out of service. Also, in PSA-RBS-06-06, the licensee stated that the increase in CDF from fire events with FLX--EG1, -EG2, -EG3,

-EG4, and -EG5 non-functional would be 2.96E-7/year. In reviewing the cutset results, the analyst noted that due to common cause methodology, when FLX-EG3, -

EG4, and -EG5 fail, the failure probability of FLX-EG1 and FLX-EG2 failing also was 3.71E-1. The analyst applied this fraction to the licensees fire risk estimate to obtain an estimate of the increase in CDF from fire events of 1.1E-7/year.

The analyst assumed the increase in CDF from internal and external flooding events was not risk-significant because the likelihood of internal and external flooding events that would lead to an ELAP scenario (and thereby rely on operation of FLEX diesel generators) was extremely low.

The following table summarizes the total estimate of 2.1E-7/year of the increase in CDF from external events:

External Event Contributor Increase in Core Damage Frequency Hurricanes 1.3E-8/year Tornados Not significant High Winds 4.0E-8/year Seismic events 4.4E-8/year Fire events (approximated)1.1E-7/year Flooding Not significant Total 2.1E-7/year

C. Large Early Release Frequency (LERF) Estimate

Using Table 6.1, Phase 1 Screening - Type A Findings at Full Power, from Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, the analyst noted that the table instructs further Phase 2 analysis for BWR reactor types with Mark III containment types for station blackout sequences. From that point, Table 6.2, Phase 2 Assessment Factors - Type A Findings at Power, prescribes an assessment factor of 0.2 for BWR reactor types with Mark III containment types for station blackout sequences.

The analyst noted that the Appendix H guidance states that, in general, sequences with late core damage (i.e., sequences that proceed to core damage due to loss of containment heat removal) will not contribute to LERF. The analyst reviewed the sequences in the results of the analyses for those that led to late core damage and did not consider those sequences for estimating the increase in LERF. The CDF of the remaining sequences was 1.9E-7/year. After application of the assessment factor of 0.2, the analyst estimated the increase in LERF to be 3.8E-8/year. The analyst considered the results of the CDF estimate to be better representative in determination of the significance of this issue than the derived LERF estimate.

D. Uncertainties The analyst performed an uncertainties analysis on the results of the SPAR model by running 5000 cases in a Monte Carlo analysis as allowed by SAPHIRE. The results of the internal events, seismic, high winds, and hurricane events produced a distribution of outcomes with a point estimate of 7.7E-7/year. The median case had an estimate of 7.1E-7/year, and 84.4 percent of the results were less than 1.0E-6/year. In considering this uncertainty analysis, the analyst assumed that the results continued to be representative of the result of very low safety significance.

E. Sensitivities The analyst performed the sensitivity runs in the table below to evaluate potentially influential factors of the evaluation and their resultant increase in CDF.

Sensitivity Result

(/year)1 Inclusion of the SBO DG into the CCCG (CCCG = 6 DGs)1.0E-6 2 Elimination of common cause failures of the FLEX diesel generators 8.5E-7 3 Using licensees PRA value for failing to align RCIC to the upper containment pool of 2.4E-4 (This analysis used 3.2E-1)4.8E-7 4 Using licensees value for failing to vent containment through the personnel airlock of 1.1E-3 (This analysis used 2.1E-1)3.0E-7 5 Using licensees PRA value for failing to align SBO DG after first FLEX DG failure of 3.5E-3 (This analysis used 5.0E-2)8.5E-7 6 Sensitivities 2, 3, 4, and 5 from above combined 2.3E-8 7 Assuming the plant would be safe and stable without restoration of power 3.1E-7

F. Qualitative Considerations Any consideration of common cause failure of the SBO DG would increase risk. The base PRA model used contained a CCCG consisting of FLX--EG1, -EG2, -EG3, -

EG4, and -EG5. Since the SBO DG has the same mission to provide AC power in ELAP scenarios and has the same manufacturer (Generac), it shares some common cause coupling factors. The SBO DG also does not share some of the other common cause coupling factors. Sharing of some factors with the CCCG of the FLEX diesel generators could lead to considering creation of a common cause failure mode for the SBO DG, as it currently is not modeled with any common cause consideration. The use of this common cause failure mode would not yield the magnitude of the increase in CDF seen in the results from the pertinent sensitivity listed in Section E in this evaluation where the SBO DG was included in the FLEX diesel generator CCCG, but would represent a small increase nonetheless for qualitative consideration.

Outage risk could increase the overall risk. Outage time was treated as at-power time for risk assessment purposes. Less than 2 percent of the chosen exposure year was in conditions which would be analyzed by use of the shutdown significance determination process. Expertise form the Office of Nuclear Reactor Regulation would be needed to construct a shutdown FLEX model. In the interest of timely significance determination, the analyst chose to treat the entire outage time the same as at-power time. Qualitatively, outage risk could be higher for reasons such as the initiating event frequency for losses of offsite power being approximately ten times higher than for losses of offsite power during at-power operations. While the increase in CDF could be significantly higher for this reason, the shorter period of outage time would represent only a relatively small increase in the CDF estimate.

Fire risk would be higher when applying NRC assumptions to the licensees fire model. Fire risk was estimated using the licensees fire PRA model. This fire PRA model is based on the licensees internal events PRA model. The licensees internal events model uses licensee-assumed failure probabilities and estimates increase in CDF an order of magnitude lower than the NRC SPAR model. If NRC-assumed failure probabilities were used in a similar fire PRA model, the estimated increased in CDF would be slightly higher.

Arrival of a diesel generator from the SAFER center within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> could lower risk.

The licensees agreement with the National SAFER Response Center calls for arrival of a 4160V diesel generator, which would be capable of powering a large pump motor, at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after notification. Considering the one-hour time to declare ELAP and additional time to move the large diesel generator from the staging area and electrically align it for use, practical use of this diesel generator could be hours after the 24-hour point after the start of the event. Nonetheless, any credit for successfully using this diesel generator would lower the increase in CDF.

The need to not enter containment to align the upper containment pool for RCIC suction could lower risk. The licensees procedure for aligning the upper containment pool to RCIC suction contains steps to enter containment during the ELAP event to manually operate a motor-operated valve. In cases where Division II electrical power is immediately lost, the valve will not need to be operated, negating the need to enter containment. If containment entry is not required, the increase in CDF will be lower.

A sensitivity is presented in Section E using the licensees human error probability, which would approximate the best case of never having to enter containment to perform this action.

Assuming long-term RCIC operations without AC power restoration leads to a safe and stable end state would lower risk. The NRC SPAR model assumes that RCIC will be sufficient for decay heat removal for a period of time (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), provided AC power is recovered by that time. The licensees model does not have this specification. A sensitivity is presented in Section E assuming AC power recovery is not necessary for the plant to be safe and stable.

G. Licensees Evaluation: The licensee documented a risk evaluation they performed in engineering report PSA-RBS-06-06, PRA Risk evaluation of FLEX Diesel Failures, Revision 0, dated May 5, 2020. For this evaluation, the licensee modified their model to reflect actual operation of the plant, where they felt the base model did not accurately reflect it previously. For this evaluation, the licensee PRA staff:

• Credited the use of the SBO DG as a contingency action if the first deployed FLEX battery charging diesel generator failed,

• Refined a scenario to allow credit for venting the containment through the personnel airlock, and

• Split their U2-ELAP treetop in 2 trees - one which reflects RCIC dependence on DC power and one which models RCIC suction from the upper containment pool.

This evaluation estimated that with FLX-EG1, -EG2, -EG3, -EG4, and -EG5 non-functional, the increase in CDF from internal and external events would be 5.8E-7/year. In this estimate, internal events only accounted for 5.3E-8/year, or 9 percent of the total. Prior to making these changes, the analyst extrapolated from the detailed risk evaluation performed for River Bend NRC Inspection Report 05000458/2019015 that the licensees model would have predicted an increase in CDF of 2.2E-6/year from internal and external events. These values and changes in the estimate of the increase in CDF from the NRC SPAR models are contained in the table below.

Increase in Core Damage Frequency In Different PRA Models

From River Bend Models From NRC SPAR Models Prior to May 2020 model changes 2.2E-6/year (extrapolated from licensee report)3.3E-6/year (extrapolated)

After May 2020 model changes 5.8E-7/year (from licensee report)8.5E-7/year (from this evaluation)

The licensees estimate of the increase in CDF from internal events is lower than the estimate from the SPAR model, as each model contains different embedded assumptions. The analyst reviewed the SPAR model results and discussed them with the licensee PRA staff and concluded that the major differences came from differences in

(1) common cause failure methodology,

(2) definition of safe and stable with regard to long-term RCIC operation, and

(3) human error probabilities for key operator actions. Some of these assumptions are discussed in the body of this evaluation. Sensitivities were done for all and are presented in Section E. Other differences are discussed as qualitative considerations in Section F.

Based on the above risk evaluation, the finding was determined to be of very low (Green)safety significance.

Cross-Cutting Aspect: H.13 Consistent Process: Individuals use a consistent, systematic approach to make decisions. Risk insights are incorporated as appropriate. Specifically, the licensee did not establish a well-defined decision-making process associated with FLEX equipment design characteristic control, with variations allowed for the complexity of the issue being decided.

Enforcement:

Violation: Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigating Strategies for Beyond-Design-Basis External Events, dated March 12, 2012,Section IV.A.2, requires, in part, that all licensees identified in Attachment 1 to this Order comply with the requirements described in Attachment 2 of this Order except to the extent that a more stringent requirement is set forth in the license.

Order EA-12-049, Attachment 1, identified Entergy Operations, Inc., River Bend Station as a power reactor licensee subject to Section IV of the Order.

Order EA-12-049, Attachment 2, requires, in part, that licensees develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and spent fuel pool cooling capabilities following a beyond-design-basis external event.

Procedure EN-OP-201-07, River Bend Station [Diverse and Flexible Coping Strategies]

FLEX Program Document, Revisions 1 and 2, Section 5.2 provides a summary of the strategies implemented by the licensee to satisfy the capabilities required by Order EA--12--049. Section 5.3.1.1 states, in part, that Table 2, FLEX Equipment List, provides a list of portable equipment required to support the strategies outlined in Section 5.2.

Table 2 includes FLEX diesel generators FLX--EG3, FLX-EG4, and FLX-EG5.

Contrary to the above, from September 19, 2015, to April 28, 2020, the licensee failed to develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and spent fuel pool cooling capabilities following a beyond-design-basis external event. Specifically, the licensee failed provide sufficient, portable, on-site equipment to maintain or restore core cooling, containment and spent fuel pool cooling capabilities following a beyond-design-basis external event until the capabilities could be accomplished with resources brought from off site. The FLEX diesel generators (FLX-EG3 and FLX-EG4)required to restore reactor core cooling and containment cooling and FLEX diesel generator (FLX-EG5) required to provide cooling water to the suppression pool cooling heat exchanger for the extended loss of AC power response strategy were nonfunctional as a result of an incorrect setting of the diesel generators output breaker undervoltage time delay setpoint.

Enforcement Action:

This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified that no proprietary information was retained or documented in this report.

• On July 21, 2020, the inspectors presented the inspection results to Mr. S. Vercelli, Site Vice President, and other members of the licensee staff.

• On August 27, 2020, the inspectors re-exited with the final results of the detailed risk evaluation to Mr. S. Vercelli, Site Vice President, and other members of the licensee staff.

.

DOCUMENTS REVIEWED

Inspection

Procedure

Type

Designation

Description or Title

Revision or

Date

93812

Action Reports

00183654

Corrective Action

Documents

CR-RBS-

2019-07343, 2019-07829, 2020-00100, 2020-00841, 2020-

01311, 2020-01434, 2020-01436, 2020-01676, 2020-01689,

20-01714, 2020-01723, 2019-06262, 2019-07032, 2020-

01705, 2020-01706, 2020-01685, 2020-01759, 2020-02016,

20-02017, 2020-02019, 2020-02020, 2020-02039

Corrective Action

Documents

Resulting from

Inspection

CR-RBS-

20-01706, 2020-01707, 2020-02125, 2020-02126, 2020-

2127, 2020-02151

Engineering

Changes

EC 3786

Use of Temporary Generator For Hydrogen Igniters for B5B

Compliance

EC 18153

Replace Old Station Blackout Diesel, BYS-EG1, with New

Generac Diesel Generator

EC 35929

Administrative Change for LO-WRTBS-2012-00109 CA-1,

25, 29, and 36

EC 44959

Flex Basis

EC 44963

FLEX Electrical - AC Bus

EC 45491

FLEX AC Bus Changes - 480 DIV 1 and NON-DIV

EC 45492

FLEX AC Bus Changes - 480V DIV 2 and NON-DIV

EC 48821

FLEX AC Bus Changes - 480V DIV 2

EC 53852

Supplemental EC to Flex Basis EC 44959

EC 69463

Operator Guide Intelilite NT

EC 86680

Acceptability of Using FLX-EG5 to Power FLX-EG3 or

FLX-EG4 Loads

Procedures

EN-OP-201-07

River Bend Station FLEX Program Document

EN-OP-201

Diverse and Flexible Coping Strategies (FLEX) Fleet

Program Document

EN-OP-202

Divers and Flexible Coping Strategies (FLEX) Program

Document Bases

EN-WM-104

On Line Risk Assessment

EN-OU-108

Shutdown Safety Management Program (SSMP)

Inspection

Procedure

Type

Designation

Description or Title

Revision or

Date

EN-OP-119

Protected Equipment Postings

AOP-0050

Station Blackout

AOP-0065

Extended Loss of AC Power (ELAP)

AOP-0051

Loss of Decay Heat Removal

319

EN-LI-102

Corrective Action Program

EN-LI-118

Causal Analysis Process

EN-FAP-LI-001

Performance Improvement Review Group Process

RBS-FG-003

Alternative Reactor Vessel Cooling

OPS-0037

Shutdown Operations Protection Plan (SOPP)

RBS-FSG-003

Alternate Reactor Vessel Cooling

EN-WM-107

Post-Maintenance Testing

EN-MA-125

Troubleshooting Control and Maintenance Activities

RBS-FSG-005

Initial Assessment and Flex Equipment Staging

RBS-FSG-005-01

ALLM MAXI-LITE ML 15 Light Tower HCS-ENG1

SOP-0054

Contingency Equipment Operations

24

EN-MP-117

Standardized Purchasing Process

EN-DC-117

Post Modification Testing and Special Instructions

EN-DC-126

Engineering Calculation Process

EN-DC-132

Control of Engineering Documents

EN-DC-146

Development and Control of Engineering Standards

EN-DC-148

Vendor Manuals and the Vendor Re-Contact Process

EN-DC-153

Preventive Maintenance Component Classification

EN-DC-324

Preventative Maintenance Program

EN-DC-115

Engineering Change Process

EN-PL-161

Zero Tolerance for Unanticipated Equipment Failures

EN-OM-126

Management and Oversight of Supplemental Personnel

EN-MP-106

Contract Management

EN-DC-156

Technical and Quality Requirements for Engineering

Contract Services

FFP-0115

Contingency/Mitigating Strategy Pump Annual Flow Test

RBS-FSG-005-07

SSW FLEX Pump FLX-P2

RBS-FSG-005-08

SFP Makeup FLEX Pump FLX-P3

RBS-FSG-005-05

Generac IDLC 200kW Generators FLX-EG1 and FLX-EG2

1, 1CNA

Inspection

Procedure

Type

Designation

Description or Title

Revision or

Date

RBS-FSG-005-06

Generac IDLC 500kW Generators FLX-EG3, EG4, EG5

1, 1CNA

RBS-FSG-12

Alternate Containment Cooling and Hydrogen Control

EN-DC-153

Preventive Maintenance Component Classification

EN-DC-167

Classification of Structures, Systems, and Components

EN-MA-106

Planning

EN-WM-102

Work Implementation and Closeout

Work Orders

WO 519028, 543554, 543562, 543371, 52889637, 544585,

544584, 543308, 544581, 544582, 544580, 505270, 544583,

544584, 544585

MWO

400444, 400538, 400519, 403913, 400438, 400518, 400532,

400438, 400525, 400601, 400526, 400603, 400424

Calculations

E-132

Voltage Profile

E-200

Overcurrent Device Setpoints

G13.18.1.3-039

FLEX AC Electrical Equipment Support Qualification

G13.18.3.6*016

Degraded Voltage Calculation for Class 1E Buses and 480V

Motor Operated Valves

G13.18.3.6-023

Flex Strategy - Portable Diesel Generator System Sizing

G13.18.12.3*171

Shutdown Safety Function Defense-in-Depth Color Codes

Misc

Outage Risk Assessment Team RF-20 Outage Report

Quality Assurance Program Manual

AO43Y699

MX341 Automatic Voltage Regulator (AVR) Specification,

Controls and Accessories

RBG-47329

River Bend Station Overall Integrated Plan in Response to

March 12, 2012 Commission Order to Modify Licenses With

Regard to Requirements for Mitigation Strategies for

Beyond-Design-Basis External Events (Order Number

2/28/2013

Drawings

EE-001AC

Start Up Electrical Distribution Chart

May 4, 2020

MEMORANDUM TO:

Chris Henderson, Senior Resident Inspector

Project Branch D

Division of Reactor Projects

FROM:

Anton Vegel, Director /RA/

Division of Reactor Projects

SUBJECT:

SPECIAL INSPECTION CHARTER TO EVALUATE FAILURE OF

FLEX DIESEL GENERATORS AT RIVER BEND STATION

In response to conditions that resulted in multiple FLEX credited diesel generators failing to

function successfully during recent operational testing at River Bend Station, a Special

Inspection will be performed. You are hereby designated as the Special Inspection team leader.

The following members are assigned to your team:

Matt McConnell, Senior Electrical Engineer, Division of Engineering and External

Hazards, Office of Nuclear Reactor Regulation

Shiattin Makor, Reactor Inspector, Division of Reactor Safety

A.

Basis

In September 2019, the licensee performed a 2-year test of the electric motor driven FLEX

pump P-1, powered by a FLEX diesel generator (EG5). During this test, which tested the

diesel generators ability to run the pump motor uncoupled from the pump, the diesel failed to

start. The generator was tested again and shut down on overvoltage on October 31, 2019.

This was the subject of follow-on NRC inspection activities, and the licensee put corrective

actions in place to resolve this condition.

On April 1, 2020 the licensee once again attempted to perform the 2-year test of FLEX pump

P-1 powered by EG5. The test failed due to a generator undervoltage trip following closure of

the pump motor disconnect switch. The licensee sent the generator to the vendor for repair.

The vendor identified and replaced a failed voltage regulator and also replaced the fuel pump.

On April 16, the licensee attempted to re-perform the uncoupled pump test. During the test, the

pump disconnect switch shut, and the uncoupled pump motor briefly ran for a few seconds and

again tripped on the generator undervoltage trip. Subsequent to the April 16 test, the licensee

and vendor determined that the generator was unable to handle the starting load (current) of the

uncoupled pump motor.

CONTACT:

Jason Kozal, DRP/C

817-200-1144

C. Henderson

After considering whether the diesel generators were appropriately sized for the FLEX program,

the licensee determined that the generator output breaker undervoltage time delay setpoints

could be adjusted to enable the generator to remain online during the initial uncoupled pump

motor start. Based on this initial information, the staff has determined that it is possible that

multiple generator settings were never properly configured during the initial setup of the

generators, prior to the equipment being credited as being available to perform the designed

FLEX functions. It is not known whether these settings were intended to be adjusted, but were

not actually configured in the field, or whether the licensee failed to consider them.

After the failure of EG-5 on April 16, the licensee assessed the condition of four other FLEX

diesel generators. The licensee determined that all generators were subject to the same

condition, whereby one or more generator settings were configured such that the associated

FLEX loads would potentially not have been able to perform intended functions. The licensee

subsequently adjusted setpoints to restore the functionality of all FLEX diesel generators.

On April 19, an additional issue involving generator EG1, which powers in-plant battery

chargers during a FLEX event, was identified. Specifically, during a load test using the newly

derived generator settings, the generator exhibited high exhaust temperature. The licensee

reduced the load on the generator due to concerns about damage to the exhaust manifold

(reported to be extremely hot) and began troubleshooting the issue.

Management Directive 8.3, NRC Incident Investigation Program, was used to evaluate the

level of NRC response for this event. In evaluating the deterministic criteria of MD 8.3, it was

determined that the degraded condition met four of the deterministic criteria. The condition

involved a major deficiency in design or operation having potential generic safety implications,

involved potential adverse generic implications, involved significant unexpected system

interactions, and involved questions or concerns pertaining to licensee operational performance.

In evaluating the risk assessment criteria of MD 8.3, the estimated incremental conditional core

damage probability was determined to be approximately 3.3 x 10-6.

Based on the deterministic criteria and risk insights related to this event, Region IV

management determined that the appropriate level of NRC response was to conduct a Special

Inspection. This Special Inspection is chartered to identify the circumstances surrounding this

event and review the licensees actions to address the causes of the event.

B.

Scope

The inspection is expected to perform data gathering and fact-finding to address the

following:

1.

Provide a recommendation to Region IV management as to whether the

inspection should be upgraded to an augmented inspection team response. This

recommendation should be made following the first day of inspection.

2.

Develop a complete sequence of events related to testing failures and associated

adverse conditions involving FLEX generators that were identified as a result of

recent testing activities. The chronology should include the status of the

equipment and licensee actions to address the conditions.

3.

Review the licensees causal evaluation(s) associated with the recently

discovered conditions and determine if they are being conducted at a level of

C. Henderson

detail commensurate with the significance of the issues that were encountered

for the degraded condition.

4.

Following the discovery of adverse conditions, determine whether the licensee

took appropriate actions to ensure the functionality of the affected FLEX

equipment to be able to perform the designated functions. Independently assess

the current functionality of the equipment.

5.

Based on design requirements, test results, and conditions identified during

testing, determine whether FLEX generators were capable of performing the

designated functions in an actual beyond-design-basis scenario with the

equipment settings that existed prior to April 2020. Evaluate results of functional

testing performed by the licensee on April 28, 2020, and determine its

applicability to the design basis of the related FLEX equipment.

6.

Review the licensees extent of condition evaluation to determine if the licensee

has adequately considered the potential for similar adverse conditions to exist in

other beyond-design-basis mitigation equipment, including the eight other flex

generators included in the licensees mitigating strategies.

7.

Review completed and proposed immediate corrective actions to determine if the

licensee has/is taking appropriate actions to address this condition.

8.

Evaluate completed and proposed corrective actions for past similar events at

River Bend and/or industry operating experience, if any, and determine whether

the licensee implemented appropriate corrective actions.

9.

Determine whether the licensee included appropriate design parameters in FLEX

generator loading calculations, and correctly translated the results into equipment

specifications and procedures for operation.

10.

Determine whether the licensee implemented adequate measures for ensuring

that FLEX generator characteristics, settings, and configurations were

appropriately controlled to achieve compliance with NRC Order EA-12-049.

Include in this review any documentation of critical characteristics to the vendor,

and a review of vendor-provided installation, testing, and maintenance

instructions. This review should include an understanding of whether the

licensee correctly implemented processes for commercial-grade procurement of

the diesel generators, as well as a review of the NRCs Safety Evaluation Report

(ML15292A508) and Flex Audit Report (ML15026A645).

11.

Determine whether the licensees procedures for testing and maintenance of

FLEX equipment are consistent with regulatory requirements, including

commitments made during NRC staff review of the licensees final integrated

plan for satisfying NRC Order EA-12-049. Evaluate the adequacy of the

licensees FLEX equipment testing to provide assurance the equipment is

available and capable of performing its intended function. Determine whether

any weaknesses identified are common to templates provided by industry

sources, including Entergy, EPRI and/or NEI.

C. Henderson

2.

Evaluate the licensees implementation of modification activities that involved

replacement of FLEX generator controllers in January 2019. Specifically,

determine whether all applicable operational aspects of the replacement devices

were appropriately evaluated and controlled, and whether vendor-recommended

post-installation testing was completed.

13.

Determine the extent to which the licensees FLEX program implementation is

reliant on vendor or contractor assistance to achieve credited equipment

operation and to maintain/troubleshoot FLEX equipment consistent with

regulatory requirements.

14.

Evaluate the licensees use of credited FLEX functions for risk mitigation.

Specifically, evaluate the licensees implementation of requirements for

assessing and managing risk.

15.

Evaluate the potential for generic implications associated with issues identified

during the inspection, and work with the Office of Nuclear Reactor Regulation to

gather information to inform any potential generic issues.

16.

Collect data necessary to support completion of the significance determination

process, if applicable.

C.

Guidance

Inspection Procedure 93812, Special Inspection, provides additional guidance to

be used by the Special Inspection Team. Your duties will be as described in

Inspection Procedure 93812. The inspection should emphasize fact-finding in its review

of the circumstances surrounding the event. It is not the responsibility of the team to

examine the regulatory process. Safety concerns identified that are not directly related

to the event should be reported to the Region IV office for appropriate action.

You will formally begin the Special Inspection with an entrance meeting to be conducted

no later than May 18, 2020. You should provide a daily briefing to Region IV

management during the course of your inspections and prior to your exit meeting. A

report documenting the results of the inspection should be issued within 45 days of the

completion of the inspection.

This Charter may be modified should you develop significant new information that

warrants review.

Docket No. 50-458

License No. NPF-47

ML20125A388

X SUNSI Review

By: CHY

ADAMS

X Yes No

Publicly Available

X Non-Publicly Available

X Non-Sensitive

Sensitive

Keyword:

NRC-002

MD 3.4, B.1

OFFICE

RIV/DRP:BC

DRO:D

RIV/DRS:D

RIV/DRP:D

NAME

JKozal

CMiller

RLantz

TVegel

SIGNATURE

/RA/

/RA/

/RA/

/RA/

DATE

05/01/20

05/04/20

05/04/20

05/04/20