IR 05000482/2011009

IR 05000482-11-009, 10/24/2011 - 01/17/2012, Wolf Creek Generating Station, Special Inspection, Maintenance Effectiveness, Surveillance Testing

ML120610793
Person / Time
Site:	Wolf Creek
Issue date:	03/01/2012
From:	O'Keefe N F NRC/RGN-IV/DRP/RPB-B
To:	Sunseri M W Wolf Creek
References
IR-11-009
Download: ML120610793 (37)

Text

March 1, 2012

Matthew W. Sunseri, President and Chief Executive Officer Wolf Creek Nuclear Operating Corporation P.O. Box 411 Burlington, KS 66839 Subject: WOLF CREEK GENERATING STATION - NRC SPECIAL INSPECTION REPORT 05000482/2011009 On January 17, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Wolf Creek Generating Station to evaluate the facts and circumstances surrounding Emergency Diesel Generator A load swing The enclosed report documents the inspection findings that were discussed on January 17, 2012, with you and members of your staf The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your licens The inspectors reviewed selected procedures and records, observed activities, and interviewed plant personne On September 1, 2011, while performing a surveillance run on Emergency Diesel Generator A, operators noted load swings of 400 to 500 k The amplitude of these oscillations was greater than the acceptance criterion and caused the emergency diesel generator to be declared inoperabl Your staff was aware that as load on the Emergency Diesel Generators increased, the load swings increased, but they still attempted to test the unit at the new, higher design basis accident load As a result, the load swings on Emergency Diesel Generator A increased to the point that caused the emergency diesel generator to become inoperabl Based upon the risk and deterministic criteria specified in NRC Management Directive 8.3,

"NRC Incident Investigation Program," the NRC initiated a special inspection in accordance with Inspection Procedure 93812, "Special Inspection." The basis for initiating the special inspection and the focus areas for review are detailed in the Special Inspection Charter (Attachment 2). The determination that the inspection would be conducted was made by the NRC on October 13, 2011, and the onsite inspection started on October 24, 201 Based on the results of this inspection, the NRC has identified two issues that were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC has also determined that violations were associated with both of these issue Because of the very low safety significance and because they were entered into your corrective action program, the NRC staff is treating these findings as noncited violations consistent with Section 2.3.2 of the NRC Enforcement Polic M. Sunseri - 2 - If you contest these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Wolf Creek Generating Statio In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response, if you choose to provide one for cases where a response is not required, will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.htm To the extent possible, your response should not include any personal privacy or proprietary, information so that it can be made available to the Public without redactio

Sincerely,/RA/ Neil O'Keefe, Chief Projects Branch B Division of Reactor Projects Docket: 50-482 License: NPF-42

Enclosure:

NRC Inspection Report 05000482/2011009

w/Attachments:

Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Email Request For Information Attachment 4: Emergency Diesel Generator Load Swing Event Timeline Distribution via Electronic Mail M. Sunseri - 3 - Electronic distribution by RIV: Regional Administrator (Elmo.Collins@nrc.gov) Deputy Regional Administrator (Art.Howell@nrc.gov) DRP Director (Kriss.Kennedy@nrc.gov) DRP Deputy Director (Troy.Pruett@nrc.gov) DRS Director (Anton.Vegel@nrc.gov)

DRS Deputy Director (Tom.Blount@nrc.gov) Senior Resident Inspector (Chris.Long@nrc.gov) Resident Inspector (Charles.Peabody@nrc.gov) WC Administrative Assistant (Shirley.Allen@nrc.gov) Branch Chief, DRP/B (Neil.OKeefe@nrc.gov)

Senior Project Engineer, DRP/B (Leonard.Willoughby@nrc.gov) Project Engineer, DRP/B (Nestor.Makris@nrc.gov) Public Affairs Officer (Victor.Dricks@nrc.gov) Public Affairs Officer (Lara.Uselding@nrc.gov) Project Manager (Randy.Hall@nrc.gov) Acting Branch Chief, DRS/TSB (Ryan.Alexander@nrc.gov) RITS Coordinator (Marisa.Herrera@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov) Congressional Affairs Officer (Jenny.Weil@nrc.gov) OEMail Resource RIV/ETA: OEDO (Lydia.Chang@nrc.gov) DRS/TSB STA (Dale.Powers@nrc.gov)

File located: R:\REACTORS\WC\2011\WC2011009-RPT-JFD.docx ML ADAMS: No Yes SUNSI Review Complete Reviewer Initials: JFD Publicly Available Non-Sensitive Non-publicly Available Sensitive SRI/PSB2 BC:DRP/B J. Drake N. O'Keefe /RA/ /RA/ 3/1/12 3/1/12 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 05000482 License: NPF-42 Report: 05000482/2011009 Licensee: Wolf Creek Nuclear Operating Corporation Facility: Wolf Creek Generating Station Location: 1550 Oxen Lane SE Dates: October 24, 2011, through January 17, 2012 Inspectors: J. Drake, Senior Reactor Inspector Approved By: Neil O'Keefe, Chief Projects Branch B Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000482/2011009; 10/24/2011 - 01/17/2012; Wolf Creek Generating Station; Special Inspection; Maintenance Effectiveness; Surveillance Testing

The report covered one week of onsite inspection and in-office review. One regional inspector performed the special inspection for the Emergency Diesel Generator A excessive load swings. Two Green noncited violations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG 1649, "Reactor Oversight Process," Revision 4, dated December 2006.

A. NRC Identified and Self-Revealing Findings

Green.

A self-revealing noncited violation of Technical Specification 5.4.1.a, "Procedures," was identified for the failure to include essential information needed to correctly adjust the emergency diesel generator governor actuator compensation potentiometer in Work Order 10-327976-000. Specifically, on May 23, 2011, maintenance personnel adjusted the actuator compensation potentiometer by following instructions from the system engineer per Work Order 10-327976-000. Work Order 10-327976-000 did not contain the cautionary note from Procedure MPE NE-003, "Governor Adjustments for Emergency Diesel Generator NE01," which stated, "DO NOT set actuator compensation adjustor below 1.5." The maintenance personnel set the potentiometer to 1.0. This improper adjustment resulted in Emergency Diesel Generator A being declared inoperable due to excessive load swings on September 1, 2011. The finding is more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was a design or qualification issue that was confirmed not to represent an actual loss of safety function of the emergency diesel generator, because the unit was still able to operate properly in the isochronous mode. This finding was determined to have a crosscutting aspect in the Resources component of human performance because the licensee did not provide complete, accurate and up-to-date procedures/work orders to plant personnel because the licensee had not developed procedure guidance sufficiently detailed to ensure maintenance personnel properly adjusted the compensating actuator potentiometer for the electronic governor H.2(c). (Section 3.1)

Green.

The inspector identified a noncited violation of 10 CFR 50, Appendix B, Criterion XI, Test Control, with two examples, because the licensee failed to ensure that all testing required to demonstrate that the emergency diesel generators would perform satisfactorily in service was identified and performed. In the first example, the licensee failed to change the loading requirements in Surveillance Test Procedure STS KJ-005A, "Manual/Auto Start, Sync & Loading Of EDG (emergency diesel generator) NE01," when the design basis accident loading of the emergency diesel generators was increased. In the second example, the licensee failed to perform testing required by Regulatory Guide 1.9 and IEEE Standard 387 to recertify the system following replacement of the mechanical governor. The finding is more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the significance determination process, the inspectors determined that the finding was of very low safety significance (Green) because it was a design or qualification issue that was confirmed not to represent an actual loss of safety function of the emergency diesel generator, since the unit was still able to operate properly in the isochronous mode. This finding was determined to have a crosscutting aspect in the area of human performance associated with the decision making component because the licensee did not use conservative assumptions in decision making and adopt a requirement to demonstrate that the proposed action was safe in order to proceed rather than a requirement to demonstrate that it was unsafe in order to disapprove the action. Specifically, the licensee decided not to perform all required certification testing per Regulatory Guide 1.9 Revision 3 prior to declaring Emergency Diesel Generator A operable following replacement of the mechanical governor H.1(b). (Section 3.2)

B. Licensee Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness 1.0 Special Inspection Scope 1.1 Event Summary While performing the surveillance test on Emergency Diesel Generator A, the licensee noted load swings of +/- 400 to 500 kW while the emergency diesel generator was loaded at the new, higher design basis accident loads. The licensee knew that as Emergency Diesel Generator A loading was increased, the load swings increased, but operators still increased load to the point where the oscillations caused the emergency diesel generator became inoperable. 1.2 Inspection Scope The inspection charter (refer to Attachment 2) required the inspector to review the circumstances related to historical and present emergency diesel generator load swings issues, assess the effectiveness of actions taken to resolve and prevent recurrence of these problems, and assess the effectiveness of the immediate actions taken by the licensee in response to the Emergency Diesel Generator A load swings that occurred on September 1, 2011.

In order to review each area of the charter, the inspector reviewed calculations, design documents, licensing documents, work orders, modification packages, and corrective action documents. The inspector evaluated licensee compliance with the applicable regulatory requirements and codes and standards.

The inspector interviewed key station personnel regarding the events. This included personnel from Operations, Performance Monitoring, Predictive Maintenance, Design and System Engineering, and Maintenance. Although the licensee had not completed their root cause/apparent cause analyses before the inspection was concluded, the inspector reviewed those sections that had been finalized.

The inspector assessed the licensee's implementation of their corrective action program, design controls, and procedure implementation.

The inspector conducted reviews in accordance with NRC Inspection Procedure 93812,"Special Inspection Procedure." The inspector reviewed procedures, corrective action documents, and design and maintenance records for the equipment of concern. , and assessed the adequacy of corrective actions. A list of specific documents reviewed is provided in Attachment 1. The charter for the special inspection is provided as Attachment 2.

.0 Charter Items

2.1 Sequence of Events During a Component Design Bases Inspection in July 2007, the NRC identified that the licensee had not correctly calculated the worst case loading for the emergency diesel generators during a design basis accident. The licensee made corrections to Design Drawing E-11005, "List of Loads Supplied by Emergency Diesel Generator" to correct the discrepancy, but failed to identify that Procedure STS KJ-005A, "Manual/Auto Start, Sync & Loading of EDG NE01" needed to be updated to the revised design basis accident loading value.

In May 2011, in an attempt to mitigate low amplitude, high frequency oscillations present in the fuel rack control system for the emergency diesel generators, the licensee made adjustments to the actuator compensating potentiometer. The actuator compensation setting was reduced from an original value of 2.0 to about 1.0.

Based on continued questioning by the resident inspectors, the licensee decided to test the emergency diesel generators at the new, higher design basis accident loading during a surveillance test. On September 1, 2011, operators started Emergency Diesel Generator A for a monthly surveillance test in accordance with Procedure STS KJ-005A. When load on the unit was increased to approximately 5800 kW, the control room operator observed excessive load swings. Specifically while paralleled to the power grid in droop mode, Emergency Diesel Generator A experienced load swings of +/- 400 to 500 kW when operating above approximately 5800 kW; below 5800 kW the unit exhibited load variations of +/- 75 kW.

The licensee later determined that the actuator compensation setting on the Woodward 2301A governor control system was set too low. The actuator compensation setting had been decreased in May 2011, from an original value of 2.0 to about 1.0 to address excessive fuel rack movements during engine operation. The gain and reset were also tuned slightly at this same time. Returning the actuator compensation to a value of 2.0 in September 2011 corrected the load swings. 2.2 Evaluation of Industry Operating Experience

a. Inspection Scope

The inspector reviewed internal operating experience by obtaining a list of plant modifications related to the emergency diesel generators and selecting those modifications that would have affected the electronic governor. The inspector requested key word searches of the corrective action program related to load swings and unstable loads/frequency control on emergency diesel generators. Additionally, the inspector selected corrective maintenance activities that had affected the emergency diesel generator governors.

For external operating experience, the inspector selected operating experience information that was applicable to this inspection. Specific documents reviewed are listed in Attachment 1. This part of the inspection satisfied Charter Item 2.

b. Observations The licensee was able to provide only three examples of external operating experience related to emergency diesel generators being reviewed in their operating experience program. The inspector identified multiple applicable operating experience items and NRC Information Notices which were not in their program, for example:

Information Notice No. 83-58, TransAmerica DeLaval Diesel Generator Crankshaft Failure, dated August 30, 1983 Brunswick, Emergency Diesel Generators (EDG) Inoperable Due to Fuel Rack Limiter Problems, dated December 30, 2008 San Onofre, Emergency Diesel Generator Unrealized Inoperability Due to Load Swings, dated December 2007 Seabrook, B Emergency Diesel Generator Experienced a High KVAR Fluctuation, dated July 24, 2002 V.C. Summer, Failure of Electronic Governor, dated January 1998 Industry experience with emergency diesel generators and their governors is quite extensive, and although not specific to Fairbanks Morse equipment, it reflected similar challenges to operation for other diesel manufacturers. The licensee did not make use of operating experience until after performance problems occurred.

The inspector performed a search of operating experience and identified reports that pertained to the malfunction of the Digital Reference Unit, setting of governor controls, frequency oscillation issues, and procedure adequacy and clarity. The licensee did not effectively utilize these reports.

2.3 Review of Preliminary Cause Determination

a. Inspection Scope

The inspector reviewed the license preliminary cause determination, associated records and documents and conducted interviews with the system engineers, operators, and maintenance personnel.

b. Observations September 1, 2011 Emergency Diesel Generator A Load Swings The Wolf Creek Generating Station is equipped with two emergency diesel generators, which consist of a Pielstick 2.5 14-cylinder engine and a Beloit Power Systems TGZDO synchronous generator manufactured by Fairbanks-Morse Engine. The emergency diesel generators are controlled by a Woodward Governor Company 2301A speed governing system and a Westinghouse static excitation system. The Woodward 2301A governing system can work in either of two modes of operation.

When the emergency diesel generator is the only source of power to the emergency bus, the unit runs in the isochronous mode, and maintains a stable frequency regardless of the load it is supplying. When both the emergency diesel generator and offsite power are supplying the emergency bus (the two sources are "paralleled"), as is done during monthly surveillance testing, the unit operates in the "droop" mode to allow proper load sharing between the two power sources.

In the droop mode, the governor allows a linear decrease in frequency as load increases. At Wolf Creek, the emergency diesel generators were designed to have 3.5 percent droop, or a drop of 2.1 hertz from no load to full load (6201 kW).

On September 1, 2011, operators started Emergency Diesel Generator A for a monthly surveillance test in accordance with Procedure STS KJ-005A, "Manual/Auto Start, Sync

& Loading of EDG NE01." When load on the unit was increased to approximately 5800 kW, the control room operator observed excessive load swings. Specifically while paralleled to the power grid in droop mode, Emergency Diesel Generator A experienced load swings of +/- 75 kW below 5800 kW.

This equates to a 0.05 hertz frequency change. Above 5800 kW, the kW swing was observed as approximately +/- 500 kW, which equates to 0.339 hertz. This change in frequency is less than the technical specification allowed limit of +/- 1.2 hertz. Current design calculations show that safety-related equipment is capable of performing its design function within these frequency fluctuations.

The licensee later determined that the actuator compensation setting on the Woodward 2301A governor control system was set too low. The actuator compensation setting had been decreased in May 2011, from an original value of 2.0 to about 1.0 to address excessive fuel rack movements during engine operation. The gain and reset were also tuned slightly at this same time. Returning the actuator compensation to a value of 2.0 in September 2011 corrected the load swings. The inspector observed that Nuclear Plant Information System computer setpoints NEP002 and NEU001 were unreliable and the condition was previously documented. Condition Report 2011-34654 was initiated on 3/11/11 due to NEU0001 and NEP0002 either failing low or to unreasonable values during the performance of STS KJ-011A. This system is used to provide accurate and precise indications and recordings of various plant parameters to allow monitoring of plant performance. Work Request 11-085841 (Work Order 11-339130-000) was generated as a result. The operators were unable to use the more precise Nuclear Plant Information System data points to perform trending of emergency diesel generator kW and amperage after initial resetting of actuator compensation adjustment. During interviews with the plant operators, they stated that because these indications were not available, they used wide range indications, which made it more difficult to detect the load swings. If these computer points had been available, it is likely the emergency diesel generator load oscillation would have been identified in a more timely manner.

===.4 Review the Current Status of the Licensee's Root Cause

=

(Apparent Cause Evaluation)

a. Inspection Scope

The inspector completed a review the licensee's apparent cause evaluation, as well as several technical evaluations that had been prepared for the licensee by outside contractors and industry experts and discussed these results with licensee personnel.

b. Observations The licensee determined that the direct cause of this event was that the actuator compensator for the governor that had been improperly adjusted in May 2011. The as-found condition was that the potentiometer was set at 1.0, which was less than the procedural minimum value of 1.5 given in Section 7.2.8 of Procedure MPE NE-003, "Governor Adjustments For Emergency Diesel Generator NE01".

The inspector agreed with this determination. The licensee determined that the apparent cause for the event was that the organization did not use conservative actions in adjusting the emergency diesel generator governor. Section 7.2.8 of Procedure MPE NE-003 contained a note that warned to not set actuator compensation adjustment below a value of 1.5 (it was set to a nonconservative 1.0 setting). The vendor manuals contained amplifying information that indicated settings below 1.5 for the actuator compensating potentiometer could result in an unstable feedback circuit at high load conditions. The inspector considered that the licensee's nonconservative actions included the lack of sufficient monitoring by use of plant computer to assess the engine performance after making adjustment. While this meets the procedural requirements for an apparent cause evaluation, the inspector determined that a more appropriate evaluation of the cause was inadequate work orders/procedures. Additionally, the inspector reviewed previous inspection reports to assess the extent of problems the licensee had experienced with inadequate maintenance procedures and practices. The inspector identified that during the previous 4 years, the NRC had issued 19 noncited violations related to inadequate procedures/work instructions or inadequate post maintenance testing. Some examples include:

Noncited Violation Number Issue 2007005-05 Inadequate work instructions resulted in a condensate pump trip.

Inadequate work instructions and poor work practices associated with trip circuit verification on the Central Chiller B resulted in the Condensate Pump B trip and a steam generator level transient.

Noncited Violation Number Issue 2007006-01 Inadequate procedure for restoration of the emergency diesel generator fuel oil transfer pump control circuit following a fire requiring control room evacuation. 2008003-07 Inadequate transformer procedure resulted in an unplanned reactor trip and forced outage. Inadequate maintenance procedure resulted in operators manually tripping the plant due a loss of all condensate pumps. 2009003-02 Inadequate fuse thermography procedure resulted in blown fuses and a reactor trip. 2009007-06 Water hammer on the essential service water system. Failure to provide adequate guidance to address the impact of a loss of offsite power event on the essential service water system delayed identification of leakage from the essential service water system piping. 2010005-08 Inadequate procedures for establishing feedwater preheat contributed to a reactor trip caused by steam generator level oscillations attributable to low feedwater temperature. 2010005-09 Inadequate procedures to ensure proper main feed pump speed during startup. Procedures failed to direct control room operators to establish a main feedwater pump speed that would allow the feed bypass regulating valves to control in the 60 to 80 percent open range, prior to raising power from 8 to 16 percent. This contributed to a reactor trip caused by steam generator level oscillations attributable to low feedwater temperature. 2011002-09 Inadequate clearance order disabled the power operated relief valve low temperature overpressure function. This resulted in an unplanned swap of the charging pump suction from the volume control tank to the reactor water storage tank and an unplanned entry into Technical Specification 3.4.12 2011003-07 Safety injection signal for a rapid steam line pressure decrease.

The procedure was inadequate to open a main steam isolation valve without causing a safety injection signal. Because of the licensee's decision to limit the scope of the apparent cause evaluation, they failed to identify this continuing trend of inadequate work orders and procedures which impact plant performance.

.5 Evaluation of Immediate Corrective Actions

a. Inspection Scope

The inspector reviewed the immediate corrective actions performed by the licensee.

b. Observations The immediate corrective actions included: The 2301A governor actuator compensation adjustment was returned to the pre-May 2011 setting of 2.0 (as found setting was a value of 1.0). This reduced the load swings to an acceptable range. Emergency diesel generator A was successfully tested to 6,400 kW (overload test) without issue and was declared operable on September 4, 2011. A full load test of Emergency diesel generator B was completed, the unit did not exhibit abnormal load swings. The "as found" (i.e., after the May 2011 adjustment) of the actuator compensating potentiometer was 1.5. The inspector determined that the immediate corrective actions for the load swings on emergency diesel generator A were adequate. 2.6 Review Maintenance and Surveillance Histories of the Emergency Diesel Generators

a. Inspection Scope

The inspector reviewed the maintenance and surveillance history, as well as Licensee Event Reports.

b. Observations The inspector determined that the monthly surveillance run data was not reviewed with sufficient thoroughness to identify the issue. The system engineer relied on the operators to evaluate the emergency diesel generator performance during the surveillance and did not normally review the computer data in detail. The system engineer felt the computer data had limited resolution and only a few parameters were logged, so it was not of value for analyzing system performance. Despite this, the inspector was able to discern critical data in the history plots of the emergency diesel surveillance runs and identify the increased load swings from May 2011 through September 2011.

The inspector noted that Wolf Creek issued six licensee event reports from October 2007 to November 2011, that involved maintenance or procedural issues related to the emergency diesel generators. Many of these failures resulted from maintenance or data review issues. The inspector concluded that the licensee had a history of events that challenged operation of their emergency diesel generators. The inspector verified that the licensee had taken appropriate corrective actions to address each of the failures. 2.7 Review of Extent of Condition

a. Inspection Scope

The inspector reviewed the extent of condition review performed by the licensee as part of the apparent cause evaluation.

b. Findings and Observations

The licensee limited the extent of condition review to the A and B emergency diesel generators and the monitoring of performance during test/surveillance for safety related systems. This was based on the governor performance associated with emergency diesel generator A, which exhibited excessive load swings and abnormal fuel rack movement. The licensee's basis for not considering the other governors onsite was:

• The other diesels on site are not as complex as the Fairbanks Morse emergency diesel generators and do not employ a Woodward 2301A control system.

• Although the Turbine Driven Auxiliary Feed Pump uses a Woodward governor system, it is an older system with a limited gain and stability control.

• The remaining diesels that could have a plant impact included the Security diesel generator, Technical Support Center diesel generator, and the Emergency Operations Facility diesel generator, none of which use a 2301A governor system.

The inspector determined that this limited scope evaluation met the procedural requirements for the apparent cause evaluation. During a recent 95002 inspection, the inspection team had noted that extent of condition evaluations were narrowly focused even for root cause evaluations. Because of this narrow focus, the licensee missed several opportunities to improve overall plant performance and material reliability.

The inspector found 2006 operating experience from Vermont Yankee related to improper tuning of the Terry turbine flow/speed controllers for both the high pressure core injection and reactor core isolation cooling systems that resulted in failure of the systems to operate in the automatic mode. This operating experience indicates that potential adverse consequences can result from improper adjusted governors that are less complex than the Woodard 2301A system, which the licensee's review did not consider. 2.8 Potential for Generic Issues Related to the Discovery of the Load Swings

a. Inspection Scope

The inspector evaluated the Emergency Diesel Generator A load swing event and associated deficiencies to determine whether any potential generic issues should be communicated to the industry (e.g., Information Notices, Generic Letters, and Bulletins). This part of the inspection satisfied Charter Item 8.

b. Findings and Observations

The inspector determined that although there were a number of different issues related to the emergency diesel generator maintenance practices at this facility they were similar in nature to operating experience already available to the industry and may not warrant a generic communication to inform other licensees of the types of problems encountered. The inspector determined that the problems with the emergency diesel generator load swings resulted from poor work practices, improper post maintenance testing, and less than adequate review of available data.

3.0 Inspection Findings 3.1 Inadequate Procedure to Adjust Compensating Potentiometer in Electronic Governor

Introduction.

A self-revealing noncited violation of Technical Specification 5.4.1.a, "Procedures," was identified for the failure to include essential information needed to correctly adjust the emergency diesel generator governor actuator compensation potentiometer in Work Order 10-327976-000. The licensee entered this deficiency in their corrective action program as Condition Report 2011- 45223.

Description.

On May 23, 2011, maintenance personnel adjusted the actuator compensation potentiometer for emergency diesel generator A using Work Order 10-327976-000 in an attempt to reduce a high frequency, low amplitude oscillation that had been observed on the fuel racks and mechanical governors for the emergency diesel generators. Workers adjusted the potentiometer setting by following instructions from the system engineer, per instructions in Work Order 10-327976-000. The maintenance personnel lowered the setting from 2.0 to 1.0 based on engine response. The inspector determined that Work Order 10-327976-000 did not contain pertinent technical guidance from Procedure MPE NE-003, "Governor Adjustments for Emergency Diesel Generator NE01," Revision 10. Section 7.2.8 of MPE NE-003 stated, "DO NOT set actuator compensation adjustor below 1.5." The system engineer was not aware of the limitation in the procedure.

The inspector determined that the intent of this caution was to ensure that the governor feedback circuit did not become unstable at high loads.

On September 1, 2011, during performance of surveillance testing per STS KJ-005A, Emergency Diesel Generator A exhibited excessive load oscillations when load was increased above approximately 5800 kW. The load oscillations were of sufficient size that the requirements of STS KJ-005A could not be met, therefore, Emergency Diesel Generator A was declared inoperable.

During the troubleshooting to correct the load swing problem, the licensee performed the following actions:

• Adjusted the hydraulic actuator, model EGB-50P, high speed stop. No improvement was noted.

• Adjusted the 2301A load gain and droop settings. No improvement was noted.

• Cleaned and exercised the fuel racks. The racks were found to be reasonably free. While there was noticeable improvement in the fuel rack free resistance, there was negligible improvement to the load swings.

• Replaced EGB-50P hydraulic actuator. Negligible improvement to load swings was noted.

• Since a review of the data from previous diesel runs showed that the oscillation had existed since the maintenance in May 2011, the 2301A actuator compensation adjustment was returned to the pre-May 2011 setting of 2.0.

Emergency Diesel Generator A was successfully tested to 6,400 kW (overload test). Additionally, a 2-hour test at a load range of 6350 kW to 6500 kW was performed on Emergency Diesel Generator A on September 4, 2011 and Emergency Diesel Generator B was successfully tested on September 14, 2011. The Woodward 2301A governing system can work in either of two modes of operation. When the emergency diesel generator is the only source of power to the emergency bus, the unit runs in the isochronous mode, and maintains a stable frequency regardless of the load it is supplying. while supplying power alone to the emergency bus, or as a "drooped" unit When both the emergency diesel generator and offsite power are supplying the emergency bus (the two sources are "paralleled"), as is done during monthly surveillance testing, the unit operates in the "droop" mode to allow proper load sharing between the two power sources.

In the droop mode, the governor allows a linear decrease in frequency as load increases.

At Wolf Creek, the emergency diesel generator was designed to have 3.5 percent droop, or a drop of 2.1 hertz from no load to full load (6201 kW). Wolf Creek reported that the load swing when operating below 5800 kW was +/- 75 kW, which equates to only a 0.05 hertz frequency change. Above 5800 kW, the kW swing was observed as +/- 500 kW, which equates to 0.339 hertz. This change in frequency is less than the technical specification allowed limit of +/- 1.2 hertz. Current design calculations show that safety-related equipment is capable of performing its design function within these frequency fluctuations.

Analysis.

Failure to provide adequate procedures to adjust the compensating potentiometer in the electronic governor was a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was a design or qualification issue that was determined to not represent an actual loss of safety function of the emergency diesel generator.

Specifically, the improper setting of the governor compensation would not have caused load oscillations when the emergency diesel generator was supplying load during an accident because it affected only load sharing when paralleled with offsite power. This finding was determined to have impacted the Resources component of the human performance crosscutting area, because the licensee did not provide complete, accurate and up-to-date procedures/work orders to plant personnel because the licensee had not developed procedure guidance sufficiently detailed to ensure maintenance personnel properly adjusted the compensating actuator potentiometer for the electronic governor H.2(c).

Enforcement.

Technical Specification 5.4.1.a, "Procedures," requires, in part, that written procedures be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A. Regulatory Guide 1.33, Appendix A, Section 9, requires procedures for performing maintenance. Contrary to the above, on May 23, 2011, the licensee failed to establish and implement a procedure for performing maintenance on the emergency diesel generator governors. Specifically, instructions in Work Order 10-327976-000 directed workers to adjust the compensating potentiometer setting by following instructions from the system engineer. Work Order 10-327976-000 failed to include the cautionary note from Procedure MPE NE-003, which limited the minimum compensation setting in order to ensure stable load sharing at high load. Because the finding was of very low safety significance and has been entered into the licensee's corrective action program as Condition Report 2011-45223, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000482/2011009-01, "Inadequate Procedure To Adjust the Compensation In Emergency Diesel Generator Governor." 3.2 Inadequate Testing of Emergency Diesel Generator A

Introduction.

The inspector identified a noncited violation of 10 CFR 50, Appendix B, Criterion XI, Test Control, with two examples, because the licensee failed to ensure that all testing required to demonstrate that the emergency diesel generators would perform satisfactorily in service was identified and performed. The first example, the licensee failed to change the loading requirements in Surveillance Test Procedure STS KJ-005A, "Manual/Auto Start, Sync & Loading Of EDG NE01," when the design basis accident loading of the emergency diesel generators was increased. In the second example two, the licensee failed to perform testing required by Regulatory Guide 1.9 and IEEE Standard 387 to recertify the system following replacement of the mechanical governor.

Description.

On September 1, 2011, while performing surveillance testing per STS KJ-005A, Emergency Diesel Generator A at loads based on changes made to design drawing E-11005, "List of Loads Supplied by Emergency Diesel Generator," the system exhibited excessive load swings when load was increased above approximately 5800 kW. The load swings were of sufficient size that Emergency Diesel Generator A was declared inoperable.

The inspector identified two examples of inadequate test control associated with the emergency diesel generator.

Example One: In July 2007, the licensee identified that the emergency diesel generator loading during design basis accidents could be higher than previously estimated. The licensee made changes to design Drawing E-11005, "List of Loads Supplied by Emergency Diesel Generator" so that it would reflect the new loading.

The inspector identified that the licensee failed to recognize that the new accident loading must also be reflected in Surveillance Test Procedure STS KJ-005A, "Manual/Auto Start, Sync & Loading Of EDG NE01." Appendix B of the licensee's Updated Final Safety Analysis Report commits the licensee to meeting Regulatory Guide 1.9, "Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants", Revision 3, for testing of the site's emergency diesel generators. Regulatory Position C.1.5 of Regulatory Guide 1.9 states that the design should include provisions so that testing of the units will simulate the parameters of operation that would be expected if actual demand were to be placed on the system. This position is further clarified in a July 11, 2007 Nuclear Regulatory Commission (NRC) memorandum, "Staff Response to TIA 2005-009 Regarding Emergency Diesel Generator Testing, Revision 1 (TAC NO.

MD3715)," that the test performed should most closely simulate the actual stresses on the machine to gain confidence in its readiness as stated in Regulatory Position C.1.5 of Revision 3 of Regulatory Guide 1.9. The licensee took actions to correct the nonconservative technical specification, implementing administrative controls and preparing a licensing amendment. This issue was entered into the licensee's corrective action program as Condition Report 2011- 45218. Example Two: As part of troubleshooting efforts to correct the load swing problem on Emergency Diesel Generator A, the licensee replaced the mechanical governor (EGB-50P hydraulic actuator) on September 3, 2012. While reviewing the document for the post maintenance testing following governor maintenance on Emergency Diesel Generator A, the inspector identified that the licensee had failed to re-establish proper emergency diesel generator certification per IEEE Standard 387-1984, "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power- Generating Stations."

The licensee had discussed that adjustments and replacement of the governor would require a retest per STS KJ-001(Integrated D/G And Safeguards Actuation Test - Train A) (This includes load sequencer and full load reject tests in accordance with the requirements of Regulatory Guide 1.9 Revision 3). The licensee considered required retests for the governor maintenance, but made a nonconservative decision relative to the performance of this testing by deciding to use retest guidance provided by the owners' group. As noted above, the licensee was committed to meeting Regulatory Guide 1.9. Regulatory Guide 1.9 endorses IEEE Standard 387-1984. Section 7.6, "Modifications," states that previously certified diesel generator units must be recertified if certain types of modifications are made to them, and one of the examples provided was repair or replacement of the governor.

Regulatory Guide 1.9 Revision 3 section 2.2 Table 1 indicates the following tests are require to be conducted for certification of the emergency diesel generator unit: Load-Run Test, Fast-Start Test, Loss-of-Offsite-Power (LOOP) Test, Safety Injection Actuation Signal (SIAS) Test, Combined SIAS and LOOP Tests, Single-Load Rejection Test, Full-Load Rejection Test, Endurance and Margin Test, Hot Restart Test, Synchronizing Test, Protective-Trip Bypass Test, Test Mode Change-Over Test, and the Redundant Unit test. The licensee subsequently satisfactorily completed all required testing on the A emergency diesel generator.

Instead the licensee performed post maintenance testing per a Fairbanks-Morse owners' group white paper, which stated that satisfactory performance of a fast start and a 50 percent load reject was sufficient to recertify the emergency diesel generator unit. While this limited testing provided reasonable assurance that the emergency diesel generator was capable of performing its safety function, it did not satisfy all the testing requirements.

Analysis.

Failure to incorporate testing requirements, committed to in the Updated Final Safety Analysis Report, into the licensee's surveillance and post maintenance testing was a performance deficiency. Specifically, the licensee failed to perform required testing as specified to in the update final safety analysis report and as called for in Regulatory Guide 1.9, Revision 3, on the emergency diesel generator for accident loading conditions and after replacing the Emergency Diesel Generator A governor. The finding was more than minor because if left uncorrected it could become a more significant safety concern because safety related equipment could be placed in service without proper verification of its ability to perform its safety function. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the finding was determined to have very low safety significance (Green) because it was a design or qualification issue determined to not represent an actual loss of safety function of the emergency diesel generator. This finding was determined to have impacted the Decision-making component of the human performance crosscutting area because the licensee did not use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action was safe in order to proceed rather than a requirement to demonstrate that it was unsafe in order to disapprove the action. Specifically, the licensee decided not to perform all required certification testing per Regulatory Guide 1.9 Revision 3 prior to declaring Emergency Diesel Generator A operable following replacement of the mechanical governor H.1(b).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," requires, in part, that a test program be established to assure that all testing required to demonstrate that structures, systems and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in the applicable design documents.

Contrary to this requirement, the licensee failed to assure that all testing requirements needed to demonstrate that emergency diesel generators would perform satisfactorily in service was identified and performed in accordance with written test procedures.

Specifically:

• Between November 2009, and September 1, 2011, the licensee failed to incorporate the new accident loading in Surveillance Test Procedure STS KJ-005A, "Manual/Auto Start, Sync & Loading Of EDG NE01," Revision 55, to assure that the emergency diesel generators would perform satisfactorily under the higher accident loading.

• On September 4, 2011, the licensee failed to perform all testing necessary to recertify Emergency Diesel Generator A following replacement of the hydraulic governor. The licensee failed to perform the load acceptance test and the load rejection test specified in Regulatory Guide 1.9, Revision 3, and IEEE 387-1984.

Because the finding was of very low safety significance and has been entered into the licensee's corrective action program as Condition Report 2011-45304, this violation of 10 CFR 50, Appendix B, Criterion XI, was treated as a noncited violation, consistent with Section 2.3.2a of the NRC Enforcement Policy: NCV 05000482/2011009-02, "Inadequate Testing of Emergency Diesel Generator A."

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The inspector reviewed maintenance, corrective action, surveillance data, and modification history related to the emergency diesel generators in order to evaluate whether any longstanding issues continued to impact current performance. The inspector also reviewed the operating experience database and previous inspection reports. The inspector interviewed the team leader for the apparent cause evaluation, the system engineer, and other personnel

.1 Load Oscillation Impacts

The 2301A governing system can work in either of two modes of operation - as an isochronous unit when acting as the only source of power to the emergency bus, or as a "drooped" unit when paralleled with the offsite power system, as required for testing. The "droop" mode is required for operating the unit on the grid (against the offsite power system). "Droop" is defined as the change (usually expressed in percent) in speed (decrease) with the application (increase) of load. One would not want "droop" in the governor system when the unit was supporting the emergency bus alone, as the speed would then fluctuate with the load. Therefore, the governor is normally in isochronous mode when operating alone. With 3.5 percent droop, the reference speed change required to accept rated load would be 2.1 hertz (0.035 x 60). Wolf Creek reported that the load swing when operating below 5800 kW was +/- 75 kW, a total movement of 150 kW. This would have required only 0.051 hertz frequency change. Above 5800 kW, the kW swing was observed as high as +/- 500 kW, or 1000 kW total. If similar oscillations were to occur on the emergency diesel generator when it was operating in the isochronous mode, it would have resulted in a frequency perturbation of 0.339 hertz. This is only a small fraction of the allowed technical specification variation in frequency of +/- 2 percent or 1.2 hertz.

.2 Procedure Guidance Not Commensurate with Work Complexity or Significance

As discussed earlier in this inspection report, the inspector determined that the licensee had not developed procedure guidance sufficiently detailed to ensure maintenance personnel properly adjusted the compensating actuator potentiometer for the electronic governor. From a review of plant procedures, work orders, and discussions with maintenance technicians, the inspector concluded that including more detail or quantitative criteria in work instructions could eliminate uncertainty and provide more consistency.

During troubleshooting on the mechanical governor while the system was out of service, maintenance personnel following instructions in Procedure SYS KJ-123, "Post Maintenance Run of Emergency Diesel Generator A," Revision 45B, failed to fully zero the governor speed control knob on the new governor, resulting in an overspeed trip of the Emergency Diesel Generator A when the engine was started. The licensee entered this into their corrective action program as Condition Report 2011-43361. In addition, procedures SYS KJ-124, "Post Maintenance Run of Emergency Diesel Generator B," Revision 44, and MPE NE-003, "Governor Adjustments for Emergency Diesel Generator NE01," Revision 10 contained same procedural steps. The inspector determined that this issue was minor in accordance with Manual Chapter 0612, Appendix B, because the emergency diesel generator was already inoperable for maintenance and no impact to the unit occurred. The licensee entered this issue into their corrective action program as Condition Report 2011- 45127.

4OA6 Exit Meeting

Exit Meeting Summary

On October 28, 2011, the inspector presented the preliminary results of this inspection at the end of the onsite week, to Mr. M. Sunseri, President and CEO, and other members of his staff, who acknowledged the findings. The inspector returned all proprietary information reviewed during the inspection prior to exiting the site.

The inspector presented the inspection results to Mr. M. Sunseri, President and CEO, and other members of his staff who acknowledged the findings at an exit meeting on January 17, 2012.

A1-

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Sunseri, President and CEO

S. Hedges, Site Vice President

L. Ratzlaff, Manager Maintenance

G. Sen, Manager Regulatory Affairs

D. Hooper, Supervisor, Licensing

L. Rockers, Licensing

W. Muilenburg, Licensing

NRC Personnel

C. Long, Senior Resident Inspector

C. Peabody, Resident Inspector

L. Willoughby, Senior Project Engineer

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000482/2011009-01 NCV Inadequate Procedure To Adjust the Compensation In Emergency Diesel

Generator Governor (Section 3.1)

05000482/2011009-02 NCV Inadequate Testing of Emergency Diesel Generator A (Section 3.2)

Attachment 1

DOCUMENTS REVIEWED

CONDITION REPORTS

2000-03385 2001-01253 2003-00719 2006-02054 2007-03759 2008-00900 2008-01147 2008-04026 2008-04312 2008-05766 2008-5740 2008-05767

2008-09003 2009-00680 2011-40714 2011-45127 2011-45169 2011-45197

2011-45218 2011-45223 2011-45225 2011-45228 2011-45229 2011-45304

2011-43339

DRAWINGS

NUMBER

TITLE

REVISION E-11005 List of Loads Supplied By Emergency Diesel Generator 36

WIP-E-1100SA-001-A-1 Emergency Diesel Generator Loading Data 02

WIP-E-1100SA-001-A-1 Emergency Diesel Generator Loading Data 00

PLANT MODIFICATIONS

Design Change 73-019, Speed Sensing Gear Design Change 87-061, Diesel Generator Reliability Upgrade Design Change 93-024, Diesel Generator Upgrades

PROCEDURES

NUMBER TITLE REVISION

AP 23E-001

Emergency Diesel Generator Reliability Program

7A MPE

NE-003

Governor Adjustments for Emergency Diesel Generator NE01

10 STS

KJ-001A

Integrated D/G and Safeguards Actuation Test Train A

43 STS

KJ-001B

Integrated D/G and Safeguards Actuation Test Train B

42A STS

KJ-005A

Manual/Auto Start Synchronization and Loading of Emergency D/G NE01

55 STS

KJ-011A

EDG NE01 24 Hour Run

25 STS

KJ-011B

EDG NE02 24 Hour Run

25 STS

KJ-013A

Hot Restart of Emergency D/G NE01

12 STS

KJ-013B

Hot Restart of Emergency D/G NE02

13 STS

KJ-015A

Manual/Auto Fast Start Sync & Loading of EDG NE01

30 STS

KJ-015B

Manual/Auto Fast Start Sync & Loading of EDG NE02 31

Attachment 1 NUMBER TITLE REVISION

SYS

KJ-121

Diesel Generator NE01 and NE02 Lineup for Automatic

Operation

44A SYS

KJ-123

Post Maintenance Run of Emergency Diesel Generator A

45B SYS

KJ-124

Post Maintenance Run of Emergency Diesel Generator B

44 SYS

KJ-200

Inoperable Emergency Diesel

26

TECHNICAL REPORTS

NUMBER TITLE

Vendor Manual

VM-0245, KSV16T Emergency Diesel Generator, Volume 2

P12619626 Actuator Magnetic Pickup & BOM

P12619551 Assembly Magnetic Pickup & BOM

12998236 Digital Reference Unit (Nuclear)

P12619555 Enclosure Magnetic Pickup

12996949,

Governor 2301a Load-Sharing & Speed Control

P12619575,

Governor Woodward Egb50p S/U 062

M-018b-00001

Instruction Manual For Governor Modification

P12619630

Magnetic Pick-Up

2390E Product Specification Woodward 2301a Load Sharing And Speed Control

82005,

Product Specification Woodward Digital Reference Unit (3 Set Points)

2543D,

Product Specification Woodward Egb-10p 13p & 35p Governor/Actuator

82389J

Woodward 2301A Electronic Load Sharing And Speed Controls 9905/9907, Series Installation Operation & Calibration Manual

82006,

Woodward Digital Reference Unit With High Low & Intermediate Set Points

37712E

Woodward

EGB-35 & Egb-50 Hydraulic Actuators Operation Manual

82340C Woodward

EGB-Proportional Governor/Actuator With Hydraulic Amplifier Systems

2715H Woodward Guide For Handling And Protection Electronic Controls Printed Attachment 1 NUMBER TITLE

Circuit Boards Modules 55011F Woodward Portable Speed Loop Tester With Load Sensor Operation & Troubleshooting Manual

OPERATING EXPERIENCE

Generic Letter 84-15 Proposed Staff Actions To Improve and Maintain Diesel Generator Reliability

July 2,1984 Licensee Event Report 2000-008-01 Non-conservative Drywell Temperature Profile Places Plant in a Condition Outside of Design Basis

Generic Letter 84-15 Response to "Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability

October 1,1984

Seabrook Generating Station - NRC Special Inspection Report 05000443/2002010

September 13, 2002 Information Notice 1988-27 Deficient Electrical Terminations Identified in Safety-Related Components May 18,1988 Information Notice 1988-27 Deficient Electrical Terminations Identified in Safety-Related Components

May 18, 1988 Information Notice 1998-43 Leaks in The Emergency Diesel Generator Lubricating Oil and Jacket Cooling Water Piping

December 4, 1998 Information Notice 2007-27 Recurring Events Involving Emergency Diesel Generator Operability

August 6, 2007

LICENSEE EVENT REPORTS

05000482/2000-004-00 05000458/2005-003-00

05000362/2007-001-01 05000395/1998-002-00

Attachment 1

MISCELLANEOUS

NUMBER TITLE

REVISION / DATE

Diesel Generator Design Criteria Document and Appendices

Diesel Generator Technical Specifications and Bases Lesson Plan

COR002-08-02

OPS Diesel Generators 20

Operator logs from September 01, 2011 to September 04, 2011

IEEE Std 323-1974

IEEE Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations

December 13, 1973 IEEE Std 344-1975

IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations

December 20, 1974 IEEE Std 387-1977 IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power-Generating Stations September 9, 1976 IEEE Std 387-1984 IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations

March 11, 1982

Wolf Creek Generating Station Mitigating Systems Performance Index Basis Document

4 Nuclear Energy Institute 99-02 Regulatory Assessment Performance Indicator Guideline 5

Attachment 2

October 13, 2011

MEMORANDUM TO:

Jim Drake, Senior Reactor Inspector

FROM: Kriss Kennedy,

Director, Division of Reactor Projects

SUBJECT:

SPECIAL INSPECTION CHARTER TO EVALUATE THE WOLF CREEK GENERATING STATION EMERGENCY DIESEL GENERATOR LOAD OSCILLATIONS

A Special Inspection is being chartered in response to the discovery of excessive emergency diesel generator load oscillations at Wolf Creek Generating Station on September 1, 2011. You are hereby designated as the team leader. The Senior Reactor Analyst assigned to support the team is David Loveless.

On September 1, 2011 while performing a surveillance run on emergency diesel generator A, the licensee noted load swings of 500 kW while the emergency diesel generator was running at near accident loading. The amplitude of these oscillations was in excess of the licensee's acceptance criterion and led to the licensee declaring the emergency diesel generator inoperable. These oscillations during an event could have led to a trip of the emergency diesel generator and complicated response to the event or even potentially damaged the emergency diesel generator. The licensee was aware the oscillations were higher at higher loads prior to testing the emergency diesel generator at the higher accident loading. Instead of resolving this issue before it became a problem, the licensee allowed the oscillations to grow to the point where the emergency diesel generator became inoperable.

A regional Senior Reactor Analyst estimated the Maximum Conditional Core Damage Probability for this issue to be 2.0 x 10.6 per year, which is in the overlap region of baseline and special inspection. Based on available information, the NRC staff recommended performance of a special inspection. The purpose of the special inspection is to understand the causes of the load oscillations, determine the extent of condition and past operability, and to assess the adequacy of the licensee's corrective actions.

UNITED STATESNUCLEAR REGULATORY COMMISSIONREGION IV611 RYAN PLAZA DRIVE, SUITE 400ARLINGTON, TEXAS 76011-4005

Wolf Creek Sit Charter 2

A2-2 Attachment 2

B. Scope

The team is expected to address the following:

1.

Develop a complete sequence of events (time line) related to the discovery of the load oscillations and follow-up actions taken by the licensee.

2.

Evaluate pertinent industry operating experience related to emergency diesel generator load oscillations. This review should include the results of

TI-176, "Emergency Diesel Generator Technical Specification Surveillance Requirements Regarding Endurance and Margin Testing." Assess the effectiveness of any licensee actions taken in response to operating experience.

3.

Review any preliminary cause determination the licensee has completed and assess the adequacy of short term corrective actions.

4.

Review the current status of the licensee's root cause analysis and determine if it is being conducted at a level of detail commensurate with the significance of the problem.

5.

Determine if (a) the licensee's immediate corrective actions have corrected the issues, (b) the licensee has addressed the extent of condition and extent of cause for the load oscillations, and (c) whether these actions are adequate to prevent recurrence.

6.

Review the maintenance and surveillance histories of the emergency diesel generators. Evaluate previous runs to determine if previous oscillations occurred and assess licensee response to any abnormal parameters. Interviews with key personnel involved in the maintenance of the emergency diesel generator should be included in this effort.

7.

Conduct an independent review of extent of condition. Determine if any other safety related equipment is showing negative trends that could cause inoperability.

8.

Evaluate the potential for generic issues related to the discovery of the load oscillations. Promptly communicate any potential generic issues to Region IV management.

9.

Collect data as necessary to support a risk analysis. Work closely with the Senior Reactor Analyst during this inspection.

C.

Guidance

Inspection Procedure 93812, "Special Inspection," provides additional guidance to be used by the Special Inspection Team. Your duties will be as described in Inspection Procedure 93812. The inspection should emphasize fact-finding in its review of the circumstances surrounding this issue. It is not the responsibility of the team to examine the regulatory process. Safety concerns identified that are not directly related to this issue should be reported to the Region IV office for appropriate action.

The team will report to the site, conduct an entrance, and begin inspection no later than October 24, 2011. While on site, you will provide daily status briefings to Region IV

management, starting on October 25, 2011. Regional management will coordinate with Wolf Creek Sit Charter 3

A2-3 Attachment 2 the Office of Nuclear Reactor Regulation, to ensure that all other parties are kept informed. If information is discovered that shows a more significant risk was associated with this issue, immediately contact Region IV management for discussion of appropriate actions. The results of the inspection will be documented in Inspection Report 05000482/2011009. This report will be issued within 45 days of the completion of the inspection.

This charter may be modified should the team develop significant new information that warrants review. Should you have any questions concerning this charter, contact Geoffrey Miller at (817) 860-8141.

Wolf Creek Sit Charter 4

A2-4 Attachment 2

Wolf cc: Collins, RA A. Howell, DRA K. Kennedy, 0: DRP

T. Pruett, DO: DRP A. Vegel, 0: DRS T. Blount, DO: DRS M. Herrera, IRTS M. Markley, C:NRR/DORLlLPL4

G. Miller, C: DRP/B L. Willoughby, SPE: DRP/B

Attachment 3 E-MAIL

From: Drake, James [1]

Sent: Tuesday, October 11, 2011 7:03 AM

To: Muilenburg William T

Subject: Request information for Wolf Creek Special Inspection for EDGE oscillations

Bill, Request the following information be provided, electronically on Certrec will be acceptable.

1. Copy of technical manuals for the emergency diesel generator (EDG) governors

2. Copies of the last 4 load response surveillances with response traces for the EDG's

3. Copies of work requests on the EDG's involving fuel supply system, governors, or voltage regulators

4. Copies of all condition reports written on the EDG's for load, voltage, or frequency oscillations

5. Copies of design calculations for the EDG loading under worst case accident conditions

6. Copy of EDG technical specifications

7. Copies of SER and licensing documents for EDG's

8. List of which Regulatory Guidelines Wolf Creek has committed to follow?

9. PID and schematic diagrams for control systems for the EDG's (governors, voltage regulators, fuel supply, starting systems)

10. Sections of FSAR related to EDG's

11. Complete sequence of events (time line) related to the discovery of the load oscillations and follow-up actions taken

12. Contact information for the EDG system engineer(s)

13. Copies of log entry data related to the September 1 load oscillations

13. Copy of plant procedures and operating instructions including abnormal and emergency) for EDG and electrical systems

14. Copies of any operability determinations written on the EDG's related to the condition reports written on the EDG's for load, voltage, or frequency oscillations

Attachment 3 15. Copies of any operating experience (internal and external ) that Wolf Creek has

16. Evaluated pertaining to emergency diesel generator oscillations as an operational problem.

Also include any licensee actions taken in response to the operating experience

17. Copy of the root cause determination for the emergency diesel generator failure, the extent of condition review, the common cause evaluation and corrective measures that have been taken or are planned

18. List of names and contact information for key personnel involved in the maintenance of the emergency diesel generator.

I will want to schedule interviews with some of these personnel

19. Copy of the applicable version of: a)

ASME Section III, Class 3 b)

IEEE323

c)

IEEE344 d)

IEEE 387

Thank you, Jim Attachment 4 Emergency Diesel Generator A Load Oscillation Timeline

Timeline for Emergency Diesel Generator AExcessive Load Oscillations on September 1, 2011

Date/Time Description July 2007

CDBI team issues noncited violation for failure to account of r technical specification allowed frequency variation in emergency diesel generator load calculation.

November 2009 Design Calculation Drawing E-11005 updated to reflect maximum calculated load on emergency diesel generators based on technical specification maximum allowed frequency.

March 2010 The NRC SRI raised concern about SR 3.8.1.14 (DG endurance and margin test) and whether the surveillance test was conservative in relation to accident loading.

Based on drawing E-11005 the emergency diesel generators should be tested at 110 percent of the design basis accident loading.

See section 3.2 of report for additional information

May 2011 The electronic governors Emergency Diesel Generators A and B were tuned in an attempt to improve low magnitude high frequency fuel rack movement.

No full load run evaluation at the accident loading conditions was performed post adjustment.

Emergency diesel generator A data records indicate that large load swings were occurring at high load conditions after the adjustment.

This condition was not recognized by the licensee personnel during initial data review.

06/15/2011, 1146 Emergency Diesel Generator B declared inoperable for maintenance on ventilation damper in Mode 5

06/16/2011, 1210 Emergency Diesel Generator B restored to operable status

08/09/2011, 0400 Emergency Diesel Generator B declared inoperable for planned maintenance

08/10/2011, 1155 Emergency Diesel Generator B restored to operable status

08/02/2011 The procedure for performing emergency diesel load run, "STS

KJ-005A," was revised to specify a control band of 5800 kW to 6201 kW based on concerns brought to the licensee by the resident inspectors regarding potential non conservative technical specifications pertaining to load testing of the emergency diesels.

09/01/2011 1354 Emergency Diesel Generator A started for normal monthly surveillance.

09/01/2011 1405

Commenced loading of Emergency Diesel Generator A.

09/01/2011

1443 The Control Room Operator noted load oscillations and contacted Shift Attachment 4 Manager and System Engineer.

Emergency Diesel Generator A declared inoperable

09/01/2011 1443

Entered Tech. Spec. 3.8.1Condition B.1.

Emergency Diesel Generator A was declared INOPERABLE due to excessive load (kW), amps, and fuel rack oscillation.

During the performance of load testing the Emergency Diesel Generator A had excessive load swings (300 to 400 kW) and fuel rack movement.

The load swing is of sufficient size that the loading criteria of Procedure STS

KJ-005A could not be met.

09/01/2011 1520

NRC Senior Resident Inspector was notified of the Emergency Diesel Generator A being declared inoperable

09/01/2011 1732

Operators reduced load on Emergency Diesel Generator A after completion of engine analysis/troubleshooting.

When load decreased to approximately 5000 kW, the load, amps, and fuel rack oscillations reduced significantly.

09/01/2011 1742

Emergency Diesel Generator A load was increased to determine whether the load, amperage, and fuel rack oscillations would return.

At approximately 5500 kW the oscillations were apparent, though lower in magnitude than when load was approximately 6200 kW.

09/01/2011 1816

Operators increased Emergency Diesel Generator A load slightly to approximately 5850 kW and confirmed that the load swings increased. Load was then reduced to approximately 4700 kW, and the load swings were reduced in magnitude.

09/01/2011 2100

The licensee held an Update meeting for Emergency Diesel Generator A issues.

Troubleshooting plans were developed.

The licensee installed pressure gauges on the fuel rack control system to monitor hydraulic pressure during the load run.

Packages to disconnect the governor actuator linkage and return springs so the racks could be moved manually were developed based on input from the vender, Fairbanks, who suggested the racks might be "gummy" in the region that the load swings were occurring.

09/02/2011 0100

Operators started Emergency Diesel Generator A for troubleshooting.

09/02/2011 0103

Emergency Diesel Generator A tripped on overspeed while attempting to control the emergency diesel generator locally.

09/02/2011 0115

The cause of the engine overspeed was determined to be improper setting of mechanical governor speed control knob.

09/02/2011 0142

The Emergency Diesel Generator A started without incident indicating the governor speed control was properly set to zero.

09/02/2011 0832 During a review of previous surveillance run data, the licensee identified that the load oscillation condition has existed since before 5/23/2011 but not before 4/15/2011.

Attachment 4

09/02/2011 0920

Emergency Diesel Generator A aligned for automatic operation.

09/02/2011 0931 Discussions among emergency diesel generator System engineers regarding adjustments to 2301A load sharing and speed control unit.

Comments were made that no adjustment of the Gain, Actuator Compensation, and reset should be attempted because these would require a retest per STS

KJ-001(Integrated D/G And Safeguards Actuation Test - Train A) (This includes load sequencer and full load reject tests) See Section 3.1 of the inspection report for additional details.

The licensee considered required retests for the governor maintenance, but made a nonconservative decision relative to the performance of this testing.

09/02/2011 0947

Operators started Emergency Diesel Generator B to rule out common mode failure 09/02/2011 1018 Emergency Diesel Generator B was fully loaded; load swings were within acceptable limits.

09/02/2011 1105 Stopped Emergency Diesel Generator B.

09/02/2011 1339 Placed Emergency Diesel Generator A Master Transfer Switch in LOCAL/MANUAL per MPE

NE-003.

09/02/2011 1402 Started Emergency Diesel Generator A using MPE

NE-003, Governor Adjustments For Emergency Diesel Generator NE01.

Performing troubleshooting on the electronic governor.

09/02/2011 1634 Secured the Emergency Diesel Generator A using MPE

NE-003

09/02/2011 1924 Started Emergency Diesel Generator A using MPE

NE-003 per section 7.3, Digital Reference Unit (DRU) Setup and Testing.

09/02/2011 2006 Field Testing identified that Digital Reference Unit (DRU) high speed stops were low.

09/02/2011 2026 Stopped Emergency Diesel Generator A

09/02/2011 2114 Started Emergency Diesel Generator A per MPE

NE-003 to perform Load Gain and Droop Adjustments.

09/02/2011 2128 Emergency Diesel Generator A output breaker is closed.

09/02/2011 2200 Emergency Diesel Generator A at full load.

09/02/2011 2232 Licensee opened Emergency Diesel Generator A output breaker.

Emergency Diesel Generator A is still exhibiting excessive oscillations when load increased to 5800kw.

09/03/2011 0623 Mechanical governor (EGB-50P) removed from Emergency Diesel Generator A

Attachment 4

09/03/2011 1400 Started Emergency Diesel Generator A in accordance with MPE

NE-003.

09/03/2011 1443 Stopped Emergency Diesel Generator A in accordance with MPE

NE-003.

Vented mechanical governor and set HIGH and LOW speed stops.

09/03/2011 1459 Placed Emergency Diesel Generator A master transfer switch in AUTO.

09/03/2011 1500 Started Emergency Diesel Generator A in accordance with MPE

NE-003.

09/03/2011 1510 Closed Emergency Diesel Generator A output breaker in accordance with MPE

NE-003.

Increasing load to approximately 4000kW for governor adjustments.

09/03/2011

1611 After governor adjustments in accordance with MPE

NE-003 the load swings still existed when load was at or above 6000 kW.

Secured the diesel and continued troubleshooting efforts.

09/03/2011 1644 Emergency Diesel Generator A was restored for automatic operation in accordance with SYS KJ-121.

09/03/2011 1725 Removed Emergency Diesel Generator A from service for continued troubleshooting.

09/04/2011 0030 The Emergency Diesel Generator A fuel racks were lubricated and exercised.

This reduced the amount of force required to move the fuel racks by approximately 1/2 (this is an approximation since the force applied was that of the vender technician moving the fuel racks by hand).

A small misalignment issue on the # 2 Cylinder was also corrected.

The diagnostics testing of the electronic governor (2301A) did not identify anything unusual. The licensee planned to commence testing as follows 1. Perform a fast start test in accordance with MPE

NE-003 section 7.5.

2. Following completion of the fast start test commence loading the Emergency Diesel Generator A in accordance with MPE

NE-003 Section 7.6 in preparations for the load reject test.

3. At approximately 6,000 kW, monitor output for load oscillations. If the load swings are still present reduce output to approximately 5,500 kW. 4. Return the electronic governor (2301A) setting to their previous settings to dampen the fuel rack movement.

5. Following these adjustments return the Emergency Diesel Generator A to approximately 6,000 kW and again monitor for load swings.

If the load swings have returned to a more historic (normal value)

6. Reperform MPE

NE-003 sections 7.5 (fast start test) and 7.6 (load reject test).

7. Once completed perform load reject testing prior to declaring the Emergency Diesel Generator A operable.

09/04/2011 0305 Emergency Diesel Generator A was fast started per MPE NE-003.

Attachment 4 09/04/2011 0310 When the Emergency Diesel Generator A reached full load (5,800 to 6,200 kW) the load swings were still present.

While of a smaller magnitude than those identified on 9/1/1, they were still excessive.

Work performed on the fuel racks reduced but did not completely eliminate the oscillations.

09/04/2011 0445 The licensee adjusted the compensation actuator potentiometer for the electronic governor from 1.0 to 2.0 and loaded the Emergency Diesel Generator A to between 5,870 and 6,200 kW.

The load swings were now at their pre May 2011 adjustment values (WO 10-327976-000).

The local maintenance personnel performing the potentiometer adjustment reported that they found the potentiometer set at 1.0 versus the 1.5 identified in

WO 10-327976-000.

This adjustment was the cause of the oscillations

09/04/2011 0603: Loaded Emergency Diesel Generator A to 6,400 kW.

09/04/2011 0623 Commenced unloading A EDG

09/04/2011 0630 Licensee had several discussions to determine what post maintenance testing needed done following the replacement of the mechanical governor.

In accordance with MPE

NE-003 Governor Adjustments for NE01, the Emergency Diesel Generator A was fast loaded and responded within all surveillance requirements. Licensee made the following decisions: 1. Perform a 50 percent load rejection to prove the governor could respond to changing load conditions.

2. Perform STS

KJ-015A Fast Loading Start.

If these tests are successful the Emergency Diesel Generator A will be declared operable.

09/04/2011 0637 Performed partial load reject portion of MPE

NE-003

09/04/2011 0924 Emergency Diesel Generator A fully loaded

09/04/2011 1038 Emergency Diesel Generator A declared operable

09/04/2011 1128 Commenced Emergency Diesel Generator A Overload test

09/04/2011 1406 Emergency Diesel Generator A secured

09/04/2011 1612

Emergent work on Emergency Diesel Generator A secured