IR 05000482/2011009

IR 05000482-11-009, 10/24/2011 - 01/17/2012, Wolf Creek Generating Station, Special Inspection, Maintenance Effectiveness, Surveillance Testing

ML120610793
Person / Time
Site:	Wolf Creek
Issue date:	03/01/2012
From:	O'Keefe N NRC/RGN-IV/DRP/RPB-B
To:	Matthew Sunseri Wolf Creek
References
IR-11-009
Download: ML120610793 (37)

Text

UNITED S TATE S NUC LEAR REGULATOR Y C OMMI S SI ON R E G IO N I V 1600 EAST LAMAR BLVD AR L I NGTON , TEXAS 760 1 1- 4511 March 1, 2012 Matthew W. Sunseri, President and Chief Executive Officer Wolf Creek Nuclear Operating Corporation P.O. Box 411 Burlington, KS 66839 Subject: WOLF CREEK GENERATING STATION - NRC SPECIAL INSPECTION REPORT 05000482/2011009 On January 17, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Wolf Creek Generating Station to evaluate the facts and circumstances surrounding Emergency Diesel Generator A load swings. The enclosed report documents the inspection findings that were discussed on January 17, 2012, with you and members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed plant personnel.

On September 1, 2011, while performing a surveillance run on Emergency Diesel Generator A, operators noted load swings of 400 to 500 kW. The amplitude of these oscillations was greater than the acceptance criterion and caused the emergency diesel generator to be declared inoperable. Your staff was aware that as load on the Emergency Diesel Generators increased, the load swings increased, but they still attempted to test the unit at the new, higher design basis accident loads. As a result, the load swings on Emergency Diesel Generator A increased to the point that caused the emergency diesel generator to become inoperable.

Based upon the risk and deterministic criteria specified in NRC Management Directive 8.3,

"NRC Incident Investigation Program," the NRC initiated a special inspection in accordance with Inspection Procedure 93812, Special Inspection. The basis for initiating the special inspection and the focus areas for review are detailed in the Special Inspection Charter (Attachment 2).

The determination that the inspection would be conducted was made by the NRC on October 13, 2011, and the onsite inspection started on October 24, 2011.

Based on the results of this inspection, the NRC has identified two issues that were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC has also determined that violations were associated with both of these issues. Because of the very low safety significance and because they were entered into your corrective action program, the NRC staff is treating these findings as noncited violations consistent with Section 2.3.2 of the NRC Enforcement Polic M. Sunseri -2-If you contest these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Wolf Creek Generating Station.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response, if you choose to provide one for cases where a response is not required, will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not include any personal privacy or proprietary, information so that it can be made available to the Public without redactio

Sincerely,

/RA/

Neil OKeefe, Chief Projects Branch B Division of Reactor Projects Docket: 50-482 License: NPF-42 Enclosure:

NRC Inspection Report 05000482/2011009 w/Attachments:

Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Email Request For Information Attachment 4: Emergency Diesel Generator Load Swing Event Timeline Distribution via Electronic Mail

M. Sunseri -3-Electronic distribution by RIV:

Regional Administrator (Elmo.Collins@nrc.gov)

Deputy Regional Administrator (Art.Howell@nrc.gov)

DRP Director (Kriss.Kennedy@nrc.gov)

DRP Deputy Director (Troy.Pruett@nrc.gov)

DRS Director (Anton.Vegel@nrc.gov)

DRS Deputy Director (Tom.Blount@nrc.gov)

Senior Resident Inspector (Chris.Long@nrc.gov)

Resident Inspector (Charles.Peabody@nrc.gov)

WC Administrative Assistant (Shirley.Allen@nrc.gov)

Branch Chief, DRP/B (Neil.OKeefe@nrc.gov)

Senior Project Engineer, DRP/B (Leonard.Willoughby@nrc.gov)

Project Engineer, DRP/B (Nestor.Makris@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Randy.Hall@nrc.gov)

Acting Branch Chief, DRS/TSB (Ryan.Alexander@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Congressional Affairs Officer (Jenny.Weil@nrc.gov)

OEMail Resource RIV/ETA: OEDO (Lydia.Chang@nrc.gov)

DRS/TSB STA (Dale.Powers@nrc.gov)

File located: R:\REACTORS\WC\2011\WC2011009-RPT-JFD.docx ML ADAMS: No Yes ; SUNSI Review Complete Reviewer Initials: JFD

Publicly Available ; Non-Sensitive Non-publicly Available Sensitive SRI/PSB2 BC

DRP/B J. Drake N. OKeefe

/RA/ /RA/

3/1/12 3/1/12 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000482 License: NPF-42 Report: 05000482/2011009 Licensee: Wolf Creek Nuclear Operating Corporation Facility: Wolf Creek Generating Station Location: 1550 Oxen Lane SE Dates: October 24, 2011, through January 17, 2012 Inspectors: J. Drake, Senior Reactor Inspector Approved By: Neil OKeefe, Chief Projects Branch B Division of Reactor Projects-1- Enclosure

SUMMARY OF FINDINGS

IR 05000482/2011009; 10/24/2011 - 01/17/2012; Wolf Creek Generating Station; Special

Inspection; Maintenance Effectiveness; Surveillance Testing The report covered one week of onsite inspection and in-office review. One regional inspector performed the special inspection for the Emergency Diesel Generator A excessive load swings.

Two Green noncited violations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG 1649, "Reactor Oversight Process," Revision 4, dated December 2006.

NRC Identified and Self-Revealing Findings

Green.

A self-revealing noncited violation of Technical Specification 5.4.1.a,

Procedures, was identified for the failure to include essential information needed to correctly adjust the emergency diesel generator governor actuator compensation potentiometer in Work Order 10-327976-000. Specifically, on May 23, 2011, maintenance personnel adjusted the actuator compensation potentiometer by following instructions from the system engineer per Work Order 10-327976-000.

Work Order 10-327976-000 did not contain the cautionary note from Procedure MPE NE-003, Governor Adjustments for Emergency Diesel Generator NE01, which stated, DO NOT set actuator compensation adjustor below 1.5.

The maintenance personnel set the potentiometer to 1.0. This improper adjustment resulted in Emergency Diesel Generator A being declared inoperable due to excessive load swings on September 1, 2011.

The finding is more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was a design or qualification issue that was confirmed not to represent an actual loss of safety function of the emergency diesel generator, because the unit was still able to operate properly in the isochronous mode. This finding was determined to have a crosscutting aspect in the Resources component of human performance because the licensee did not provide complete, accurate and up-to-date procedures/work orders to plant personnel because the licensee had not developed procedure guidance sufficiently detailed to ensure maintenance personnel properly adjusted the compensating actuator potentiometer for the electronic governor H.2(c).

(Section 3.1)

Green.

The inspector identified a noncited violation of 10 CFR 50, Appendix B,

Criterion XI, Test Control, with two examples, because the licensee failed to ensure that all testing required to demonstrate that the emergency diesel generators would perform satisfactorily in service was identified and performed. In the first example, the licensee failed to change the loading requirements in Surveillance Test Procedure STS KJ-005A, Manual/Auto Start, Sync & Loading Of EDG (emergency diesel generator) NE01, when the design basis accident loading of the emergency diesel generators was increased. In the second example, the licensee failed to perform testing required by Regulatory Guide 1.9 and IEEE Standard 387 to recertify the system following replacement of the mechanical governor.

The finding is more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the significance determination process, the inspectors determined that the finding was of very low safety significance (Green) because it was a design or qualification issue that was confirmed not to represent an actual loss of safety function of the emergency diesel generator, since the unit was still able to operate properly in the isochronous mode. This finding was determined to have a crosscutting aspect in the area of human performance associated with the decision making component because the licensee did not use conservative assumptions in decision making and adopt a requirement to demonstrate that the proposed action was safe in order to proceed rather than a requirement to demonstrate that it was unsafe in order to disapprove the action. Specifically, the licensee decided not to perform all required certification testing per Regulatory Guide 1.9 Revision 3 prior to declaring Emergency Diesel Generator A operable following replacement of the mechanical governor H.1(b). (Section 3.2)

Licensee Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness 1.0 Special Inspection Scope 1.1 Event Summary While performing the surveillance test on Emergency Diesel Generator A, the licensee noted load swings of +/- 400 to 500 kW while the emergency diesel generator was loaded at the new, higher design basis accident loads. The licensee knew that as Emergency Diesel Generator A loading was increased, the load swings increased, but operators still increased load to the point where the oscillations caused the emergency diesel generator became inoperable.

1.2 Inspection Scope The inspection charter (refer to Attachment 2) required the inspector to review the circumstances related to historical and present emergency diesel generator load swings issues, assess the effectiveness of actions taken to resolve and prevent recurrence of these problems, and assess the effectiveness of the immediate actions taken by the licensee in response to the Emergency Diesel Generator A load swings that occurred on September 1, 2011. In order to review each area of the charter, the inspector reviewed calculations, design documents, licensing documents, work orders, modification packages, and corrective action documents. The inspector evaluated licensee compliance with the applicable regulatory requirements and codes and standards.

The inspector interviewed key station personnel regarding the events. This included personnel from Operations, Performance Monitoring, Predictive Maintenance, Design and System Engineering, and Maintenance. Although the licensee had not completed their root cause/apparent cause analyses before the inspection was concluded, the inspector reviewed those sections that had been finalized.

The inspector assessed the licensees implementation of their corrective action program, design controls, and procedure implementation.

The inspector conducted reviews in accordance with NRC Inspection Procedure 93812,Special Inspection Procedure. The inspector reviewed procedures, corrective action documents, and design and maintenance records for the equipment of concern. , and assessed the adequacy of corrective actions. A list of specific documents reviewed is provided in Attachment 1. The charter for the special inspection is provided as Attachment 2.

2.0 Charter Items 2.1 Sequence of Events During a Component Design Bases Inspection in July 2007, the NRC identified that the licensee had not correctly calculated the worst case loading for the emergency diesel generators during a design basis accident. The licensee made corrections to Design Drawing E-11005, List of Loads Supplied by Emergency Diesel Generator to correct the discrepancy, but failed to identify that Procedure STS KJ-005A, Manual/Auto Start, Sync & Loading of EDG NE01 needed to be updated to the revised design basis accident loading value.

In May 2011, in an attempt to mitigate low amplitude, high frequency oscillations present in the fuel rack control system for the emergency diesel generators, the licensee made adjustments to the actuator compensating potentiometer. The actuator compensation setting was reduced from an original value of 2.0 to about 1.0.

Based on continued questioning by the resident inspectors, the licensee decided to test the emergency diesel generators at the new, higher design basis accident loading during a surveillance test. On September 1, 2011, operators started Emergency Diesel Generator A for a monthly surveillance test in accordance with Procedure STS KJ-005A.

When load on the unit was increased to approximately 5800 kW, the control room operator observed excessive load swings. Specifically while paralleled to the power grid in droop mode, Emergency Diesel Generator A experienced load swings of +/- 400 to 500 kW when operating above approximately 5800 kW; below 5800 kW the unit exhibited load variations of +/- 75 kW.

The licensee later determined that the actuator compensation setting on the Woodward 2301A governor control system was set too low. The actuator compensation setting had been decreased in May 2011, from an original value of 2.0 to about 1.0 to address excessive fuel rack movements during engine operation. The gain and reset were also tuned slightly at this same time. Returning the actuator compensation to a value of 2.0 in September 2011 corrected the load swings.

2.2 Evaluation of Industry Operating Experience

a. Inspection Scope

The inspector reviewed internal operating experience by obtaining a list of plant modifications related to the emergency diesel generators and selecting those modifications that would have affected the electronic governor. The inspector requested key word searches of the corrective action program related to load swings and unstable loads/frequency control on emergency diesel generators. Additionally, the inspector selected corrective maintenance activities that had affected the emergency diesel generator governors.

For external operating experience, the inspector selected operating experience information that was applicable to this inspection. Specific documents reviewed are listed in Attachment 1. This part of the inspection satisfied Charter Item 2.

b. Observations The licensee was able to provide only three examples of external operating experience related to emergency diesel generators being reviewed in their operating experience program. The inspector identified multiple applicable operating experience items and NRC Information Notices which were not in their program, for example:

Information Notice No. 83-58, TransAmerica DeLaval Diesel Generator Crankshaft Failure, dated August 30, 1983 Brunswick, Emergency Diesel Generators (EDG) Inoperable Due to Fuel Rack Limiter Problems, dated December 30, 2008 San Onofre, Emergency Diesel Generator Unrealized Inoperability Due to Load Swings, dated December 2007 Seabrook, B Emergency Diesel Generator Experienced a High KVAR Fluctuation, dated July 24, 2002 V.C. Summer, Failure of Electronic Governor, dated January 1998 Industry experience with emergency diesel generators and their governors is quite extensive, and although not specific to Fairbanks Morse equipment, it reflected similar challenges to operation for other diesel manufacturers. The licensee did not make use of operating experience until after performance problems occurred. The inspector performed a search of operating experience and identified reports that pertained to the malfunction of the Digital Reference Unit, setting of governor controls, frequency oscillation issues, and procedure adequacy and clarity. The licensee did not effectively utilize these reports.

2.3 Review of Preliminary Cause Determination

a. Inspection Scope

The inspector reviewed the license preliminary cause determination, associated records and documents and conducted interviews with the system engineers, operators, and maintenance personnel.

b. Observations September 1, 2011 Emergency Diesel Generator A Load Swings The Wolf Creek Generating Station is equipped with two emergency diesel generators, which consist of a Pielstick 2.5 14-cylinder engine and a Beloit Power Systems TGZDO

synchronous generator manufactured by Fairbanks-Morse Engine. The emergency diesel generators are controlled by a Woodward Governor Company 2301A speed governing system and a Westinghouse static excitation system.

The Woodward 2301A governing system can work in either of two modes of operation.

When the emergency diesel generator is the only source of power to the emergency bus, the unit runs in the isochronous mode, and maintains a stable frequency regardless of the load it is supplying. When both the emergency diesel generator and offsite power are supplying the emergency bus (the two sources are paralleled), as is done during monthly surveillance testing, the unit operates in the droop mode to allow proper load sharing between the two power sources. In the droop mode, the governor allows a linear decrease in frequency as load increases. At Wolf Creek, the emergency diesel generators were designed to have 3.5 percent droop, or a drop of 2.1 hertz from no load to full load (6201 kW).

On September 1, 2011, operators started Emergency Diesel Generator A for a monthly surveillance test in accordance with Procedure STS KJ-005A, Manual/Auto Start, Sync

& Loading of EDG NE01. When load on the unit was increased to approximately 5800 kW, the control room operator observed excessive load swings. Specifically while paralleled to the power grid in droop mode, Emergency Diesel Generator A experienced load swings of +/- 75 kW below 5800 kW. This equates to a 0.05 hertz frequency change. Above 5800 kW, the kW swing was observed as approximately +/- 500 kW, which equates to 0.339 hertz. This change in frequency is less than the technical specification allowed limit of +/- 1.2 hertz. Current design calculations show that safety-related equipment is capable of performing its design function within these frequency fluctuations.

The licensee later determined that the actuator compensation setting on the Woodward 2301A governor control system was set too low. The actuator compensation setting had been decreased in May 2011, from an original value of 2.0 to about 1.0 to address excessive fuel rack movements during engine operation. The gain and reset were also tuned slightly at this same time. Returning the actuator compensation to a value of 2.0 in September 2011 corrected the load swings.

The inspector observed that Nuclear Plant Information System computer setpoints NEP002 and NEU001 were unreliable and the condition was previously documented.

Condition Report 2011-34654 was initiated on 3/11/11 due to NEU0001 and NEP0002 either failing low or to unreasonable values during the performance of STS KJ-011A.

This system is used to provide accurate and precise indications and recordings of various plant parameters to allow monitoring of plant performance. Work Request 11-085841 (Work Order 11-339130-000) was generated as a result. The operators were unable to use the more precise Nuclear Plant Information System data points to perform trending of emergency diesel generator kW and amperage after initial resetting of actuator compensation adjustment. During interviews with the plant operators, they stated that because these indications were not available, they used wide range indications, which made it more difficult to detect the load swings. If these computer points had been available, it is likely the emergency diesel generator load oscillation would have been identified in a more timely manner.

2.4 Review the Current Status of the Licensee's Root Cause

Analysis.

(Apparent Cause Evaluation)

a. Inspection Scope

The inspector completed a review the licensees apparent cause evaluation, as well as several technical evaluations that had been prepared for the licensee by outside contractors and industry experts and discussed these results with licensee personnel.

b. Observations The licensee determined that the direct cause of this event was that the actuator compensator for the governor that had been improperly adjusted in May 2011. The as-found condition was that the potentiometer was set at 1.0, which was less than the procedural minimum value of 1.5 given in Section 7.2.8 of Procedure MPE NE-003, Governor Adjustments For Emergency Diesel Generator NE01.

The inspector agreed with this determination.

The licensee determined that the apparent cause for the event was that the organization did not use conservative actions in adjusting the emergency diesel generator governor.

Section 7.2.8 of Procedure MPE NE-003 contained a note that warned to not set actuator compensation adjustment below a value of 1.5 (it was set to a nonconservative 1.0 setting). The vendor manuals contained amplifying information that indicated settings below 1.5 for the actuator compensating potentiometer could result in an unstable feedback circuit at high load conditions. The inspector considered that the licensees nonconservative actions included the lack of sufficient monitoring by use of plant computer to assess the engine performance after making adjustment.

While this meets the procedural requirements for an apparent cause evaluation, the inspector determined that a more appropriate evaluation of the cause was inadequate work orders/procedures. Additionally, the inspector reviewed previous inspection reports to assess the extent of problems the licensee had experienced with inadequate maintenance procedures and practices. The inspector identified that during the previous 4 years, the NRC had issued 19 noncited violations related to inadequate procedures/work instructions or inadequate post maintenance testing. Some examples include:

Noncited Violation Number Issue 2007005-05 Inadequate work instructions resulted in a condensate pump trip.

Inadequate work instructions and poor work practices associated with trip circuit verification on the Central Chiller B resulted in the Condensate Pump B trip and a steam generator level transient.

Noncited Violation Number Issue 2007006-01 Inadequate procedure for restoration of the emergency diesel generator fuel oil transfer pump control circuit following a fire requiring control room evacuation.

2008003-07 Inadequate transformer procedure resulted in an unplanned reactor trip and forced outage. Inadequate maintenance procedure resulted in operators manually tripping the plant due a loss of all condensate pumps.

2009003-02 Inadequate fuse thermography procedure resulted in blown fuses and a reactor trip.

2009007-06 Water hammer on the essential service water system. Failure to provide adequate guidance to address the impact of a loss of offsite power event on the essential service water system delayed identification of leakage from the essential service water system piping.

2010005-08 Inadequate procedures for establishing feedwater preheat contributed to a reactor trip caused by steam generator level oscillations attributable to low feedwater temperature.

2010005-09 Inadequate procedures to ensure proper main feed pump speed during startup. Procedures failed to direct control room operators to establish a main feedwater pump speed that would allow the feed bypass regulating valves to control in the 60 to 80 percent open range, prior to raising power from 8 to 16 percent. This contributed to a reactor trip caused by steam generator level oscillations attributable to low feedwater temperature.

2011002-09 Inadequate clearance order disabled the power operated relief valve low temperature overpressure function. This resulted in an unplanned swap of the charging pump suction from the volume control tank to the reactor water storage tank and an unplanned entry into Technical Specification 3.4.12 2011003-07 Safety injection signal for a rapid steam line pressure decrease. The procedure was inadequate to open a main steam isolation valve without causing a safety injection signal.

Because of the licensees decision to limit the scope of the apparent cause evaluation, they failed to identify this continuing trend of inadequate work orders and procedures which impact plant performance.

2.5 Evaluation of Immediate Corrective Actions

a. Inspection Scope

The inspector reviewed the immediate corrective actions performed by the licensee.

b. Observations The immediate corrective actions included:

The 2301A governor actuator compensation adjustment was returned to the pre-May 2011 setting of 2.0 (as found setting was a value of 1.0). This reduced the load swings to an acceptable range. Emergency diesel generator A was successfully tested to 6,400 kW (overload test) without issue and was declared operable on September 4, 2011. A full load test of Emergency diesel generator B was completed, the unit did not exhibit abnormal load swings. The as found (i.e., after the May 2011 adjustment) of the actuator compensating potentiometer was 1.5.

The inspector determined that the immediate corrective actions for the load swings on emergency diesel generator A were adequate.

2.6 Review Maintenance and Surveillance Histories of the Emergency Diesel Generators

a. Inspection Scope

The inspector reviewed the maintenance and surveillance history, as well as Licensee Event Reports.

b. Observations The inspector determined that the monthly surveillance run data was not reviewed with sufficient thoroughness to identify the issue. The system engineer relied on the operators to evaluate the emergency diesel generator performance during the surveillance and did not normally review the computer data in detail. The system engineer felt the computer data had limited resolution and only a few parameters were logged, so it was not of value for analyzing system performance. Despite this, the inspector was able to discern critical data in the history plots of the emergency diesel surveillance runs and identify the increased load swings from May 2011 through September 2011.

The inspector noted that Wolf Creek issued six licensee event reports from October 2007 to November 2011, that involved maintenance or procedural issues related to the emergency diesel generators. Many of these failures resulted from maintenance or data review issues. The inspector concluded that the licensee had a history of events that challenged operation of their emergency diesel generators. The

inspector verified that the licensee had taken appropriate corrective actions to address each of the failures.

2.7 Review of Extent of Condition

a. Inspection Scope

The inspector reviewed the extent of condition review performed by the licensee as part of the apparent cause evaluation.

b. Findings and Observations

The licensee limited the extent of condition review to the A and B emergency diesel generators and the monitoring of performance during test/surveillance for safety related systems. This was based on the governor performance associated with emergency diesel generator A, which exhibited excessive load swings and abnormal fuel rack movement. The licensees basis for not considering the other governors onsite was:

• The other diesels on site are not as complex as the Fairbanks Morse emergency diesel generators and do not employ a Woodward 2301A control system.

• Although the Turbine Driven Auxiliary Feed Pump uses a Woodward governor system, it is an older system with a limited gain and stability control.

• The remaining diesels that could have a plant impact included the Security diesel generator, Technical Support Center diesel generator, and the Emergency Operations Facility diesel generator, none of which use a 2301A governor system.

The inspector determined that this limited scope evaluation met the procedural requirements for the apparent cause evaluation. During a recent 95002 inspection, the inspection team had noted that extent of condition evaluations were narrowly focused even for root cause evaluations. Because of this narrow focus, the licensee missed several opportunities to improve overall plant performance and material reliability.

The inspector found 2006 operating experience from Vermont Yankee related to improper tuning of the Terry turbine flow/speed controllers for both the high pressure core injection and reactor core isolation cooling systems that resulted in failure of the systems to operate in the automatic mode. This operating experience indicates that potential adverse consequences can result from improper adjusted governors that are less complex than the Woodard 2301A system, which the licensees review did not consider.

2.8 Potential for Generic Issues Related to the Discovery of the Load Swings

a. Inspection Scope

The inspector evaluated the Emergency Diesel Generator A load swing event and associated deficiencies to determine whether any potential generic issues should be

communicated to the industry (e.g., Information Notices, Generic Letters, and Bulletins).

This part of the inspection satisfied Charter Item 8.

b. Findings and Observations

The inspector determined that although there were a number of different issues related to the emergency diesel generator maintenance practices at this facility they were similar in nature to operating experience already available to the industry and may not warrant a generic communication to inform other licensees of the types of problems encountered.

The inspector determined that the problems with the emergency diesel generator load swings resulted from poor work practices, improper post maintenance testing, and less than adequate review of available data.

3.0 Inspection Findings 3.1 Inadequate Procedure to Adjust Compensating Potentiometer in Electronic Governor

Introduction.

A self-revealing noncited violation of Technical Specification 5.4.1.a, Procedures, was identified for the failure to include essential information needed to correctly adjust the emergency diesel generator governor actuator compensation potentiometer in Work Order 10-327976-000. The licensee entered this deficiency in their corrective action program as Condition Report 2011- 45223.

Description.

On May 23, 2011, maintenance personnel adjusted the actuator compensation potentiometer for emergency diesel generator A using Work Order 10-327976-000 in an attempt to reduce a high frequency, low amplitude oscillation that had been observed on the fuel racks and mechanical governors for the emergency diesel generators. Workers adjusted the potentiometer setting by following instructions from the system engineer, per instructions in Work Order 10-327976-000. The maintenance personnel lowered the setting from 2.0 to 1.0 based on engine response.

The inspector determined that Work Order 10-327976-000 did not contain pertinent technical guidance from Procedure MPE NE-003, Governor Adjustments for Emergency Diesel Generator NE01, Revision 10. Section 7.2.8 of MPE NE-003 stated, DO NOT set actuator compensation adjustor below 1.5. The system engineer was not aware of the limitation in the procedure. The inspector determined that the intent of this caution was to ensure that the governor feedback circuit did not become unstable at high loads.

On September 1, 2011, during performance of surveillance testing per STS KJ-005A, Emergency Diesel Generator A exhibited excessive load oscillations when load was increased above approximately 5800 kW. The load oscillations were of sufficient size that the requirements of STS KJ-005A could not be met, therefore, Emergency Diesel Generator A was declared inoperable.

During the troubleshooting to correct the load swing problem, the licensee performed the following actions:

• Adjusted the hydraulic actuator, model EGB-50P, high speed stop. No improvement was noted.

• Adjusted the 2301A load gain and droop settings. No improvement was noted.

• Cleaned and exercised the fuel racks. The racks were found to be reasonably free. While there was noticeable improvement in the fuel rack free resistance, there was negligible improvement to the load swings.

• Replaced EGB-50P hydraulic actuator. Negligible improvement to load swings was noted.

• Since a review of the data from previous diesel runs showed that the oscillation had existed since the maintenance in May 2011, the 2301A actuator compensation adjustment was returned to the pre-May 2011 setting of 2.0.

Emergency Diesel Generator A was successfully tested to 6,400 kW (overload test).

Additionally, a 2-hour test at a load range of 6350 kW to 6500 kW was performed on Emergency Diesel Generator A on September 4, 2011 and Emergency Diesel Generator B was successfully tested on September 14, 2011.

The Woodward 2301A governing system can work in either of two modes of operation.

When the emergency diesel generator is the only source of power to the emergency bus, the unit runs in the isochronous mode, and maintains a stable frequency regardless of the load it is supplying. while supplying power alone to the emergency bus, or as a drooped unit When both the emergency diesel generator and offsite power are supplying the emergency bus (the two sources are paralleled), as is done during monthly surveillance testing, the unit operates in the droop mode to allow proper load sharing between the two power sources. In the droop mode, the governor allows a linear decrease in frequency as load increases.

At Wolf Creek, the emergency diesel generator was designed to have 3.5 percent droop, or a drop of 2.1 hertz from no load to full load (6201 kW). Wolf Creek reported that the load swing when operating below 5800 kW was +/- 75 kW, which equates to only a 0.05 hertz frequency change. Above 5800 kW, the kW swing was observed as +/- 500 kW, which equates to 0.339 hertz. This change in frequency is less than the technical specification allowed limit of +/- 1.2 hertz. Current design calculations show that safety-related equipment is capable of performing its design function within these frequency fluctuations.

Analysis.

Failure to provide adequate procedures to adjust the compensating potentiometer in the electronic governor was a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was a design or qualification issue that was determined to not represent an actual loss of safety function of the emergency diesel generator. Specifically, the improper setting of the governor compensation would not have caused load oscillations when the emergency diesel

generator was supplying load during an accident because it affected only load sharing when paralleled with offsite power. This finding was determined to have impacted the Resources component of the human performance crosscutting area, because the licensee did not provide complete, accurate and up-to-date procedures/work orders to plant personnel because the licensee had not developed procedure guidance sufficiently detailed to ensure maintenance personnel properly adjusted the compensating actuator potentiometer for the electronic governor H.2(c).

Enforcement.

Technical Specification 5.4.1.a, Procedures, requires, in part, that written procedures be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A.

Regulatory Guide 1.33, Appendix A, Section 9, requires procedures for performing maintenance. Contrary to the above, on May 23, 2011, the licensee failed to establish and implement a procedure for performing maintenance on the emergency diesel generator governors. Specifically, instructions in Work Order 10-327976-000 directed workers to adjust the compensating potentiometer setting by following instructions from the system engineer. Work Order 10-327976-000 failed to include the cautionary note from Procedure MPE NE-003, which limited the minimum compensation setting in order to ensure stable load sharing at high load. Because the finding was of very low safety significance and has been entered into the licensees corrective action program as Condition Report 2011-45223, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000482/2011009-01, Inadequate Procedure To Adjust the Compensation In Emergency Diesel Generator Governor.

3.2 Inadequate Testing of Emergency Diesel Generator A

Introduction.

The inspector identified a noncited violation of 10 CFR 50, Appendix B, Criterion XI, Test Control, with two examples, because the licensee failed to ensure that all testing required to demonstrate that the emergency diesel generators would perform satisfactorily in service was identified and performed. The first example, the licensee failed to change the loading requirements in Surveillance Test Procedure STS KJ-005A, Manual/Auto Start, Sync & Loading Of EDG NE01, when the design basis accident loading of the emergency diesel generators was increased. In the second example two, the licensee failed to perform testing required by Regulatory Guide 1.9 and IEEE Standard 387 to recertify the system following replacement of the mechanical governor.

Description.

On September 1, 2011, while performing surveillance testing per STS KJ-005A, Emergency Diesel Generator A at loads based on changes made to design drawing E-11005, List of Loads Supplied by Emergency Diesel Generator, the system exhibited excessive load swings when load was increased above approximately 5800 kW. The load swings were of sufficient size that Emergency Diesel Generator A was declared inoperable.

The inspector identified two examples of inadequate test control associated with the emergency diesel generator.

Example One: In July 2007, the licensee identified that the emergency diesel generator loading during design basis accidents could be higher than previously estimated. The licensee made changes to design Drawing E-11005, List of Loads Supplied by Emergency Diesel Generator so that it would reflect the new loading.

The inspector identified that the licensee failed to recognize that the new accident loading must also be reflected in Surveillance Test Procedure STS KJ-005A, Manual/Auto Start, Sync & Loading Of EDG NE01. Appendix B of the licensees Updated Final Safety Analysis Report commits the licensee to meeting Regulatory Guide 1.9, Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants, Revision 3, for testing of the sites emergency diesel generators. Regulatory Position C.1.5 of Regulatory Guide 1.9 states that the design should include provisions so that testing of the units will simulate the parameters of operation that would be expected if actual demand were to be placed on the system. This position is further clarified in a July 11, 2007 Nuclear Regulatory Commission (NRC) memorandum, Staff Response to TIA 2005-009 Regarding Emergency Diesel Generator Testing, Revision 1 (TAC NO.

MD3715), that the test performed should most closely simulate the actual stresses on the machine to gain confidence in its readiness as stated in Regulatory Position C.1.5 of Revision 3 of Regulatory Guide 1.9. The licensee took actions to correct the nonconservative technical specification, implementing administrative controls and preparing a licensing amendment. This issue was entered into the licensees corrective action program as Condition Report 2011- 45218.

Example Two: As part of troubleshooting efforts to correct the load swing problem on Emergency Diesel Generator A, the licensee replaced the mechanical governor (EGB-50P hydraulic actuator) on September 3, 2012. While reviewing the document for the post maintenance testing following governor maintenance on Emergency Diesel Generator A, the inspector identified that the licensee had failed to re-establish proper emergency diesel generator certification per IEEE Standard 387-1984, IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power- Generating Stations.

The licensee had discussed that adjustments and replacement of the governor would require a retest per STS KJ-001(Integrated D/G And Safeguards Actuation Test - Train A) (This includes load sequencer and full load reject tests in accordance with the requirements of Regulatory Guide 1.9 Revision 3). The licensee considered required retests for the governor maintenance, but made a nonconservative decision relative to the performance of this testing by deciding to use retest guidance provided by the owners group.

As noted above, the licensee was committed to meeting Regulatory Guide 1.9.

Regulatory Guide 1.9 endorses IEEE Standard 387-1984. Section 7.6, Modifications, states that previously certified diesel generator units must be recertified if certain types of modifications are made to them, and one of the examples provided was repair or replacement of the governor.

Regulatory Guide 1.9 Revision 3 section 2.2 Table 1 indicates the following tests are require to be conducted for certification of the emergency diesel generator unit: Load-Run Test, Fast-Start Test, Loss-of-Offsite-Power (LOOP) Test, Safety Injection Actuation Signal (SIAS) Test, Combined SIAS and LOOP Tests, Single-Load Rejection Test, Full-Load Rejection Test, Endurance and Margin Test, Hot Restart Test, Synchronizing Test, Protective-Trip Bypass Test, Test Mode Change-Over Test, and the Redundant Unit test.

The licensee subsequently satisfactorily completed all required testing on the A emergency diesel generator.

Instead the licensee performed post maintenance testing per a Fairbanks-Morse owners group white paper, which stated that satisfactory performance of a fast start and a 50 percent load reject was sufficient to recertify the emergency diesel generator unit.

While this limited testing provided reasonable assurance that the emergency diesel generator was capable of performing its safety function, it did not satisfy all the testing requirements.

Analysis.

Failure to incorporate testing requirements, committed to in the Updated Final Safety Analysis Report, into the licensees surveillance and post maintenance testing was a performance deficiency. Specifically, the licensee failed to perform required testing as specified to in the update final safety analysis report and as called for in Regulatory Guide 1.9, Revision 3, on the emergency diesel generator for accident loading conditions and after replacing the Emergency Diesel Generator A governor. The finding was more than minor because if left uncorrected it could become a more significant safety concern because safety related equipment could be placed in service without proper verification of its ability to perform its safety function. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was a design or qualification issue determined to not represent an actual loss of safety function of the emergency diesel generator. This finding was determined to have impacted the Decision-making component of the human performance crosscutting area because the licensee did not use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action was safe in order to proceed rather than a requirement to demonstrate that it was unsafe in order to disapprove the action.

Specifically, the licensee decided not to perform all required certification testing per Regulatory Guide 1.9 Revision 3 prior to declaring Emergency Diesel Generator A operable following replacement of the mechanical governor H.1(b).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, requires, in part, that a test program be established to assure that all testing required to demonstrate that structures, systems and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in the applicable design documents.

Contrary to this requirement, the licensee failed to assure that all testing requirements needed to demonstrate that emergency diesel generators would perform satisfactorily in service was identified and performed in accordance with written test procedures.

Specifically:

• Between November 2009, and September 1, 2011, the licensee failed to incorporate the new accident loading in Surveillance Test Procedure STS KJ-005A, Manual/Auto Start, Sync & Loading Of EDG NE01, Revision 55, to assure that the emergency diesel generators would perform satisfactorily under the higher accident loading.

• On September 4, 2011, the licensee failed to perform all testing necessary to recertify Emergency Diesel Generator A following replacement of the hydraulic governor. The licensee failed to perform the load acceptance test and the load rejection test specified in Regulatory Guide 1.9, Revision 3, and IEEE 387-1984.

Because the finding was of very low safety significance and has been entered into the licensees corrective action program as Condition Report 2011-45304, this violation of 10 CFR 50, Appendix B, Criterion XI, was treated as a noncited violation, consistent with Section 2.3.2a of the NRC Enforcement Policy: NCV 05000482/2011009-02, Inadequate Testing of Emergency Diesel Generator A.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The inspector reviewed maintenance, corrective action, surveillance data, and modification history related to the emergency diesel generators in order to evaluate whether any longstanding issues continued to impact current performance. The inspector also reviewed the operating experience database and previous inspection reports. The inspector interviewed the team leader for the apparent cause evaluation, the system engineer, and other personnel

.1 Load Oscillation Impacts

The 2301A governing system can work in either of two modes of operation - as an isochronous unit when acting as the only source of power to the emergency bus, or as a drooped unit when paralleled with the offsite power system, as required for testing.

The droop mode is required for operating the unit on the grid (against the offsite power system). Droop is defined as the change (usually expressed in percent) in speed (decrease) with the application (increase) of load. One would not want droop in the governor system when the unit was supporting the emergency bus alone, as the speed would then fluctuate with the load. Therefore, the governor is normally in isochronous mode when operating alone. With 3.5 percent droop, the reference speed change

required to accept rated load would be 2.1 hertz (0.035 x 60). Wolf Creek reported that the load swing when operating below 5800 kW was +/- 75 kW, a total movement of 150 kW. This would have required only 0.051 hertz frequency change. Above 5800 kW, the kW swing was observed as high as +/- 500 kW, or 1000 kW total. If similar oscillations were to occur on the emergency diesel generator when it was operating in the isochronous mode, it would have resulted in a frequency perturbation of 0.339 hertz.

This is only a small fraction of the allowed technical specification variation in frequency of +/- 2 percent or 1.2 hertz.

.2 Procedure Guidance Not Commensurate with Work Complexity or Significance

As discussed earlier in this inspection report, the inspector determined that the licensee had not developed procedure guidance sufficiently detailed to ensure maintenance personnel properly adjusted the compensating actuator potentiometer for the electronic governor. From a review of plant procedures, work orders, and discussions with maintenance technicians, the inspector concluded that including more detail or quantitative criteria in work instructions could eliminate uncertainty and provide more consistency.

During troubleshooting on the mechanical governor while the system was out of service, maintenance personnel following instructions in Procedure SYS KJ-123, Post Maintenance Run of Emergency Diesel Generator A, Revision 45B, failed to fully zero the governor speed control knob on the new governor, resulting in an overspeed trip of the Emergency Diesel Generator A when the engine was started. The licensee entered this into their corrective action program as Condition Report 2011-43361. In addition, procedures SYS KJ-124, Post Maintenance Run of Emergency Diesel Generator B, Revision 44, and MPE NE-003, Governor Adjustments for Emergency Diesel Generator NE01, Revision 10 contained same procedural steps. The inspector determined that this issue was minor in accordance with Manual Chapter 0612, Appendix B, because the emergency diesel generator was already inoperable for maintenance and no impact to the unit occurred. The licensee entered this issue into their corrective action program as Condition Report 2011- 45127.

4OA6 Exit Meeting

Exit Meeting Summary

On October 28, 2011, the inspector presented the preliminary results of this inspection at the end of the onsite week, to Mr. M. Sunseri, President and CEO, and other members of his staff, who acknowledged the findings. The inspector returned all proprietary information reviewed during the inspection prior to exiting the site.

The inspector presented the inspection results to Mr. M. Sunseri, President and CEO, and other members of his staff who acknowledged the findings at an exit meeting on January 17, 2012.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Sunseri, President and CEO

S. Hedges, Site Vice President

L. Ratzlaff, Manager Maintenance

G. Sen, Manager Regulatory Affairs

D. Hooper, Supervisor, Licensing

L. Rockers, Licensing

W. Muilenburg, Licensing

NRC Personnel

C. Long, Senior Resident Inspector

C. Peabody, Resident Inspector

L. Willoughby, Senior Project Engineer

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000482/2011009-01 NCV Inadequate Procedure To Adjust the Compensation In Emergency Diesel Generator Governor (Section 3.1)

05000482/2011009-02 NCV Inadequate Testing of Emergency Diesel Generator A (Section 3.2)

Attachment 1