ML19325D866
| ML19325D866 | |
| Person / Time | |
|---|---|
| Issue date: | 10/12/1989 |
| From: | Serkiz A NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Kniel K NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| FRN-57FR14514, REF-GTECI-B-56, REF-GTECI-EL, RTR-REGGD-01.009, RTR-REGGD-1.009, TASK-B-56, TASK-OR AE06-1-077, AE6-1-77, NUDOCS 8910270083 | |
| Download: ML19325D866 (38) | |
Text
_.
3f p.3
,e NI 121989 I
~ MEMORANDUM FOR:-
Karl Kniel, Chief L-Reactor and Plant Safety Issues Branch Division.of Safety Issue Resolution FROM:
Aleck Serkiz, Senior Task Manager Reactor and Plant Safety Issues Branch Division of Safety Issue Resolution
SUBJECT:
RESOLUTION OF B-56, " DIESEL GENERATOR RELIABILITY" Meeting Dates:
September 29, 1989 and October 6, 1989 Location:
US NRC 5650 Nicholson Lane Rockville, Md.
Purpose:
Discussions Related to RG.1.9, Revision 3-(Proposed) l
Participants:
- 0. M. Chopra, NRC/NRR; A. Marion, NUMARC; M. McGarry, BCP&R; A. Serkiz, NRC/RES; A. Pietrangelo, NUMARC l
Sumary:
These meetings dealt with comparisons of Regulatory Guide 1.9, Revision 3 (Proposed ) and NUMARC 8700, Appendix D (Revised). As a result of prior meetings, attention was directed at: a)RevisedINPOPlantPerformanceIndicator i
definitions, b) dealing with the " problem" EDG as a separate regulatory position, c) implementation language and d) miscellaneous sections of the regulatory guide which had been discussed previously.
The 10-5-89 working draft of Regulatory Guide 1.9, Revision 3 l '
(enclosed) represents near culmination of these meetings l
with NUMARC's B-56 working group. The enclosed markups highlight the results of the October 6,1989 meeting.
In summary, the following situation exists:
1)
INP0's definitions dealing with start and load-run demands, and f ailures, are used in the regulatory guide except for two places.
L 2)
A separate regulatory position (C.3.5) has been written for dealitig with the " problem" EDG. The
" problem" EDG was previously imbedded in the EDG Reliability Program monitoring section (C.3.4).
3)
Implementation language has been clarified.
l M 'a 8910270083 891012 1
.- i
~
4)-
NUMARC and tne Staff still have several differences of opinion', these being:
a) endorsement of IEEE Std 387-1984 in the regulatory guide, b) the need for fast start and load tests (the 10 second load requirement associated with large LOCA))at six month intervals due to the DBA requirement, c declaring the " problem" EDG inoperable at a 5/25 failure count, d) the need for 14 consecutive failure free tests 1
following a major overhaul of the diesel engine and e) the need for separate loss-of-oTTsire power Loop),
Safety Injection Auto-Start (SIAS) and combined SIAS 4 Loop tests at the preoperational and refueling outage stages.
At this time point, 1 feel that RG 1.9 Revision 3 and NUMARC's Appendix D (8-28-89) are complementary except for the differences noted above.
It tha'. ld siso be recognized that HUMARC's Appendix.D deals only with guidance for an EDG reliability program and monitoring; the regulatory guide deals also with other items such as design, testing, recordkeeping and reporting guidance.
NUMARC is expected to forward their specific consnents in near future, along with 1
a further revised Appendix D.
grignant aiene Dr6 Aleck Serkiz, Senior Task Manager Reactor and Plant Safety Issues Branch Division of Safety Issue Resolution Office of Nuclear Regulatory Research
Enclosures:
1.
NUMARC 8700 Appendix D (Markup Copy) 2.
Regulatory Guide 1.9 (Revision 3)
DISTRIBUTION:
PDR RWHouston RES Circ /Chron WMinners OF Of 681000CS'$
AThancani DSIR C/F F. Rosa RPSIB R/F KKniel I
l PNor1an MVagins L
Meeting Attendees M. El Zeftawy, ACRS l
[ RESOLUTION OF B56, DGE]
/A, 0FFC:RP51B/D51R :RPSIB/DSIR:RP51B/D51R:
NAME:A5erkiz/bgp:PNorian
- KKniel UATEIT0/sk/89
- 10/12/89 :10//A/89
_Q g
0FFICIAL RECORD COPY
l o--6 --h
.p w.ug,
.i 8700, Appendix D, "EDG Reliability Program," to provide guidance on a reliability program to ensure that EDG reliability target levels selected for station blackout are maintained, and on
-actions to be taken if EDG reliability targets are not being met.
The NRC staff has reviewed this revised guidance and concludes that NUMARC 8700, Appendix D, provides guidance for an EDG reliabilty program in large part identical to those portions of this gaide which deal with an EDG reliability ~ program and the monitoring of EDG reliability. Table 1 of this regulatory guide
.provides a section-by-section comparision between Regulatory Guide 1.9, Revision 3 and NUMARC - 8700, Appendix D (Revised).
ic C.
REGULATORY POSITION l6-GQ Conformance with the guidelines in IEEE Std 387-1984 "IEEE
. Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," provides a
~
method acceptable to the NRC staff.for satisfying the Commission's regulations with respect to design, qualification, and periodic testing of diesel generator units used as onsite electric power systems for nuclear power plants subject to the
~
i following:
1.
DESIGN CONSIDERATIONS The guidelines of IEEE Std 387-1984 should be supplemented as follows:
1.1 Section 1.2, " Inclusions," of IEEE Std 387-1984 should be supplemented to include diesel generator auto controls, acnual controls, and diesel generator output breaker.
1.2.101en the characteristics of the required diesel generator loads are not accurately known, such as during the construction permit stege of design, each diesel generator unit of an onsite power supply system should be selected to have a continuous load rating (as defined in Section 3.7.1 of IEEE Std 387-1984) equal to or greater than the sum of the conservatively estimated loads (nameplate) needed to be powered by that unit at any one time.
In the absence of fully substantiated performance characteristics for mechanical equipment such as pumps, the electric motor drive ratings should be calculated using conservative estimates of these characteristice, e.g., pump runout conditions and motor efficiencies of 90 percent or less and power factors of 85 percent or high r.
Sesott.
1.3. At the operating license stage of review, the predicted loads should not exceed the short-time rating (as defined in Section 3.7.2 of IEEE Std 387-1984) of the diesel generator unit.
6 1
k 00$&
bW
}tL USO M
p*4k tr +RJ us) b th. % 1.t% p% p4 codo Jtca 1 5-
' [ 6-G.-h g
.f.,
g4 6:
A load-run of any duration that results from a real o
(e.g. not a test) automatic or manual signal.
A load-run test to satisfy the plant's load and duration o
test specifications.
o -other Soerations (e.g.,
special tests) of the emergancy diesei generator in which the emergency diesel generator is-planned to run for at least one hour with at least 50 percent of design load.
Load-run Failures: A load-run failure should be counted when the emergency diesel generator starts but does not pick up load and run successfully. Any f ailure during a valid load-run demand should be counted. See " Exceptions" below. For monthly surveillance tests, the diesel generator can'be loaded at a rate that is. recommended by the manufacturer to minimize stress and wear. Any condition identified in the course of maintenance inspections (with the EDG in the standby mode) that would have resulted in a load-run failure if a demand had occurred should be counted as a valid load-run demand and failure.
1 Exceptions: Unsuccessful attempts to start or to load-run should not be counted as valid demands or failures when they can be definitely attributed to any of the following:
o ' Spurious operation of a trip that wauld be bypassed in the emergency operation mode (e.g. hi'gh cooling water temperature trip)
I o
Malfunction of equipment that is not required to operate during the emergency operating mode (e.g.,
j synchronizing circuitry).
component malfunctions or operating errors that did not o
prevent the emergency diesel from being restarted and brought to load withing a few minutes (i.e., without corroctive maintenancs or significant problem diagnosis) o Intentional termination of the test because of alarmed or observed abnormal conditions (e.g., small water or oil leaks) that would not have ultimately resulted in significant emergency generator damage or failure.
l o
A failure to start following an actual (manual or automatic) or inadvertent start demand (if actuated only on a loss of offsite power), if restarted manually within five minutes from the first start attempt.
s-1 M
- bk
)t* d" 10 ~ b M
(
5 l
l l
l t
,..., - - -., - -..,. -. ~ _ -
..,,...,.n.,.,,_
~
~
to A WA m
o If the EDG fails to reach rated speed and voltage in the precise time required by Technical Specifications, the start attempt and load-run attempt should not be considered a failure if the test demonstrated that the EDG would have started in an emergency and should therefore be retained in the EDG availability data base.
i Each emergency diesel generator failure that results in the emergency diesel generator being declared inoperable should be counted as one demand and one failure. Exploratory tests during corrective maintenance and the successful test that is run following repair to verify operability (g i n t: if
!=
M
"'O-should not be counted as de ds or failures M N WDGr.A no~ ~ rwet w A y _W 2.2 Test Descriotipng The following test descriptions are applicable to Regulatory Positions 3 and 4.
Table 2 describes the sequence of qualifica-tion and surveillance testing. Detailed procedures should be provided for each test defined in Regulatory Position 2. The procedures should identify special arrangements or changes in normal system configuration that must be made to put the EDG under test. Jumpers and other non-standard configurations or arrangements should not be used subsequent to initial equipment startup testing.
2.2.1 Start-Test
Demonstrate proper startup from ambient conditions and verify that the required design voltage and frequency is attained.
For these tests, tha.. diesel gencrator can be slow-started, be prelubricated, have prewarmed oil $nd water t'-
circulating, and should reach rated speed en a prespecilied schedule that is celected to minimize stress and wear.
2.2.2 Lgad-Run_ Test:
Demonstrate full-plant emergency load l
carrying capability, or 90 to 95 percent of the continuous ra ting l.
of the EDG, for an interval of not less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and until temperature equilibrium has been attained.
This test may be r
l accomplished by synchronizing the generator with offsite power.
l The loading and unloading of a diesel generator during this test should be gradual and based on a prescribed schedule that is selected to minimize stress and wear on the diesel generator.
2.2.3 fast-Start Test:
Demonstrate that each diesel generator unit starts from ambient conditions (if a plant has f
normally operating prelube and prewarm systems, this would constitute its ambient conditions) and verify that the diesel I
generator reaches stable required voltage and frequency within p
acceptable limits and time, as defined in the plant technical i
specifications.
\\ b-G-M b 11 k
Mb 1(. M (AN N N 7tt-N-(t)M aum 6 -J A ' 4=*J D L
i 4"' ""b, '
1 i
ebo ee4 A% e-> M3%y* F0 #h '
g e J te M (q tc4 waxGod 4 nc4~m g
C, s
t o-G -69
".[
7'.
}d &-uS l
When the EDG is declared operational in accordance with plant technical specifications, the following periodic test program p'7
/
should be implemented.
2.3.2.1 Monthly Testina:
After completion of the 3, K diesel generator unit reliability demonstration during je
(
preoperational testing, periodic testing of diesel generator o
units during normal plant operation should be performed.
Each diesel generator should be started and loaded as defined in
%J
. (
Regulatory Positions 2.2.1 and 2.2.2 at least once in 31 days (with maximum allowable extension not to exceed 25 percent of the h2 survaillance interval) on a staggered basis.
2.3.2.2 Six-Month for 184 days) Testina:
The design pf basis for nuclear power plants requires a capability for the
) S,
,j diesel generators to make fast starts (as defined in the plant Technical Specifications) from standby conditions to provide the necessary power to mitigate the large-break loss-of-coolant
. accident coincident with loss of offsite power.
It has been m
determined (based on a probabilistic risk analysis performed to gj f
.d examine the change in core melt frequency associated with p
lengthening the fast-start test interval) that relaxation of 6t3 C
fast-start test frequency from once per month to once per 6 months would not appreciably increase risk.
Therefore, once d<
every 6 months each diesel generator should be started from (g
standby conditions (if a plant has normally operating prelube and (3
prewarm systems this should constitute its standby conditions) to 2'
verify )that the diesel generator reaches stable cated voltage and frequency within acceptable limits and time end operates for 5 minutes.
2.3.2.3.
Refuelina Outaae Testina:
Overall diesel generator unit design ' capability c'ould be demonstrated at every refueling outage by performing the tests identified in Table 2.
2.3.2.4.
Ten-Year Testina:
Demonstrate that the trains of standby electric power are independent once per 10 l
E years (during a plant shutdown) or after any modifications that could affect diesel generator independence, whichever is the shorter, by starting all redundant units simultaneously to help identify certain common failure modes undetected in single diesel generator unit tests.
2.3.3 Corrective Action Testina:
Following the occurrence I
of a degrading situation as defined in Regulatory Position 3.5 l
for a problem EDG, the surveillance testing interval for that EDG should be reduced to no more that 7 days, but no less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This test frequency should be maintained until seven consecutive failure-free start and load-run tests have been i
performed to demonstrate the ef fectiveness of corrective actions y
taken and recovery of reliability 1cvels. At that time, monthly 1
14 l
l s -a.
tsNw -WP surveillance testing can be resumed. However, if subsequent to 3
-the seven failure-free tests, one or more additional failures occur such that'there are again four or more failures in the last
)
25 tests, the testing interval should again be reduced as noted i
above and' maintained until seven consecutive failure-free tests i
have been performed. The EDr vndergoing corrective action testing should be consider %? " opera
" unless other license requirements necessitate declaring the E.9 operable.
i 1
3.
EDG RELIABILITY GOALS AND CALCULATIONS Reliability goals for emergency diesel generators (EDGs) j(
and related calculational methodology are as follows:
g J
3.1 Reliability Goals for Station Blackout O
In order to comply with 10 CFR 50.63, " Loss of All Alternating Current Power," and the guidance in Regulatory Guide 1.155, " Station Blackout," the minimum EDG reliability should be targeted at 0.95 or O.975 per demand for each EDG for plants in 3
emergency ac (EAC) Groups A, B, and C and at 0.975 per demand for i
each EDG for plants in EAC Group D.(see Table 2 of Regulatory 1
Guide 1.155)..
3.2 Desian Basis Accidents Assessment A quantitative EDG reliability target for design basis f
accidents has not been established. If an EDG reliability estimate is needed for plant-specific PRAs, it should be L
calculated using only the successful "immediata" starts, where
~
l immediate is defined as the time required for the EDG to be
[
j j
available for design basis loss-of-coolant accidents and other I
L limiting plant transient emergency electrical loads.
Therefore, Pp L
delayed starts (i.e., starts that are restarted manually within fC 5 minutes from the first start attempt) deemed successful for' station blackout assessments p:r eMeeptirn noted in n:;uletery gr-)
r :itirn 2.1 should not be considered for design basis accident l
assessment.
l 3.3 piesel Generator Reliability Calculations calculation of EDG reliabilities should be based on the definitions consistent with the reporting rules for the Industry-wide Plant Performance Indicator Program or equivalent and the definitions in Regulatory Position 2.1.
The evaluation of a nuclear unit's EDG reliability should take into account the demand and failure experience of all EDGs l
that provide emergency AC power for the unit. Calculation of EDG reliability levels should be based on the last 50 and 100 demands in the following manner:
15
,i sample that falls below 96 percent, is an indication that the true underlying reliability may have fallen below 97.5 percent.
Actions to be taken are discussed below.
3.4 EDG Reliability Procram Monitorina Data from surveillance tests and unplanned' starts can be used to estimate achievement of a nuclear unit's EDG reliability targets and also to detect a deteriorating situation for both the reliablity program and individual EDGs. Failures encountered in the last 20, 50, and 100 demands can be related to nuclear unit target reliabilities as in Table 4 Table 4 Action Levels and Remedial Actions Target Action Demand Failure Remedial
^
Reliability Level Combinations ( All EDGs)
Actions
.95 Mild 3/20 2r 5/50 2r 8/100 (1)
Strong 5/50 And 8/100 (2)
.975 Mild 3/20 nr 4/50 2r 5/100 (1)
Strong 4/50 And 5/100 (2)
(1) Take action per Figure 1 for a Mild Action Level.
(2) Take action per Figure 1 for a Strong Action Level.
t 3.5 Problem EDG
.A problem diesel is defined as an individual EDG eperiancing 3 or more failures in the last 20 demands. Should this case arise, a Mild Action Level would be declared and the actions defined in Figure 1 would be undertaken. If the problem EDG experiances an additional failure, such that there have been 4 failures in the last 25 demands, then a Strong Action Level would be declared.
Following completion of corrective programmatic actions as I
defined in Steps 1 - 4 of column 3 (Strong Action Level) of Figure 1, restored performance of the problem EDG should be demonstrated by conductiong seven consecutive failure free starts I
and load-run tests as defined in Regulatory Position 2.3.3. The l
monthly surveillance schedule should not be resumed until 7 L
consecutive failure free start and run-load demand tests have L
been completed. All starts and load-runs performed during the L
corrective action testing shall be included in the nuclear unit L
EDG reliability data set so long as the EDG is declared operable.
i s
If following completion of the seven consecutive failure-l l
free tests (per Regulatory Position 2.3.3), the same EDG experiances another failure such that there have been 5 failures 17 hruwd om eQ raukJ m to-u-M I J
4 kP=% 4 A wt Att g.wu 3 5 -
J l o-4-M
- .?
r H40-. RS y
i r
l i
in the last 25 demands, consideration should be given to l
, declaring that problem EDG inoperable in accordance with plant
_ Technical Specificationsjana undertaking a overhaul of that EDG f
rbasea on the subsystems affected (see Figure 3) and the nature of re-occuring failures, j
l
(
If the overhaul necessitates the tear-down and overhaul of the diesel engine and/or the generator (see Figure 3), then prior to returning that EDG to service, 14 consecutive failure-free tests (per Regulatory Position 2.2.3) should be conducted.
i If the overhaul is of a lesser nature (i.e. subsytem er support system overhaul, see Figure 3), then the problem EDG should be considered in a Strong Action Level and 7 consecutive failure-free-tests (per Regulatory Position 2.2.3) should be conducted before returning that EDG to service per plant Technical Specification. requirements.
u 3.6 Recovery from a Strona Action Level (EDG Procram)
Recovery from a Strong Action Level should be based on continued monitoring of the nuclear unit EDG reliability level nad the demand-failure combinations shown in Table 4. The plant would not revert to a reduced action level until the number of demand-failures was adequately reduced, or two years from the last failure while in an exceedance, which ever occurs first.
However, prior to reverting to a no exceedance state, all identified improvement actions must be completed within the two year period.
Should a plant continue in an exceedance state because of new failures, these failures should be evaluated against improvement actions previously identified for implementation. The purpose of this evaluation would be to assess whether prior conclusions and attendant recommendations should be revised due to continued failures.
4.
RECORDKEEPING GUIDANCE Guidance from Section 7.5.2,
" Records and Analysis," of IEEE Std'387-1984 should be supplemented as follows:
All demands, as defined in Regulatory Position 2.1, should be logged and continually updated for each diesel generator base.d on surveillance testing and experianced failures.
The log should be' maintained in auditable form and should include sufficient detail to permit review and audit of reliability calculations in accordance with Regulatory Position 3.3. The log should also include a recalculated nuclear unit reliability estimate following occurrence of a load-run demand.
h U V M M.C. hM ud4 (vJLad D dL Acrph.ogo ed s he couJ.
Ebr
~
1, y
S UUkML6 6ets csh' M.L oMf t
4 W A p eJ m.
upM@ % N.
maa A 14 M " %
$ 4 " A81 kra. M%M wM
\\ 0~(o%
w,g.
}
l l
A management oversight function (or procedures) should also be available to review t.he effectiveness of the reliability program and' reliability levels being sustained, independent of the day-to-day EDG activities. Such a plant-wide function may 4
already exist; however, a routine evaluation of EDG performance should be incorporated into the plant performance review process.
D.
IMPLEMENTATION The purpose of this section is to provide information to applicants regarding the NRC staff's plans for using this regulatory guide.
Except in those cases in which an applicant proposes an acceptable alternative method for complying with the specified portions of the Commission's regulations, the methods described in this guide will be used'in the evaluation of selection, design, qualification, and testing of diesel generator units.used as onsite electric power systems for the following nuclear power plants:
1.
Plants for which the construction permit is issued after the issue date of the final guide,
- 2. Plants for which the operating-license, application is docketed 6 months or more after the issue date of the final guide,
- 3. Plants for which the licensee voluntarily 5
commits to the provisions of this guide.
j The NRC Staff also intends to apply this Regulatory Guide to monitor emergency diesel generator reliability levels and to review existing or proposed EDG reliability programs for meeting the station blackout rule, 10 CFR 50.63 in accordance with
~
Regulatory Positions 3 and 6 g b
Activities associated with Regulatory Positions 1, Design Considerations and 2.3.1, Preoperational Testing will not have to be repeated by licensees or applicants which have completed such activities. Previous submittals by applicants, licensees, or E
other parties such as by the TDI owners Group, can be used where I
appropiate.
This regulatory guide will become effective 270 days after issuance.
i fON CL, 0%8 J
e*2W d 7 b My %p & #2 %
@g.A aAEG% - s e g* M
- h i
o e
l w
N L
t@
e 1
Pigure 1 eredad tempanse to Segredific Ett tottability (10 + 09 Draft)
STRONG ACTION STAft RILB ACff00 STAft moenAL ACTION STAft
- 1. Notify the NRC of
~
1 i
o Continue survelttance the etert.
and conditfon monitoring according eeview feltures In test 20,
- 2. Ascerteln the nature to approved retlebit-508100 demande to determine
. of the rellebility If there are potterne in i
ty program plan.
the felture modes or causes prebtee. Assessment actione should f
eA-u vettures as PAffEtt l
no,AffERN include one or more of the foitowing t.., occur.
I e root cause enefyele Increses or leprove e anstyeis for Devloe corrective surveittence and/or potterne in felture actlen for ebeerved failure cenditten eenitoring modes and cessee for moet likely (teet 100 demands) pottern felture modes i
e Assessment of other l
l ptente felture informatten leptement a probles leptasent a program for the aeove_
close-out ye--: ^e e Exploretory close-out p.--_^
e for augmented survoittence corrective actlen survelltance/cenditlen monitoring e Eeploretory eendt-tion monitoring I
I
~
e Retlebiti dies-notic enet ;e (FEMA f t tree trackIngandtren[f-Notify the NRC en-elte ing, etc.)
l inspector of e Design /uperettenet edjustmente to the l
EDC rettability changes
- 3. Doctament and lepte-l ment corrective actione plan.
l 4.
Revloe rettability program.
il S. Demonstrate effect-ness of actions (*)
taken.
fE l
g wgec-.ctic,,e dice. seed i,.egui.to,y,ositi e C.3.s el C.2.3.3.
@ W ocis l
~
m.._.
s_.
a
___m.mm.._-4
- ~. _
H 3
?.
E Revision 3 10-5 Working Draft REGULATORY GUIDE 1.9 L
(TASK RS 802-5) i SELECTION, DESIGN, QUALIFICATION, TESTING, AND RELIABILITY OF DIESEL GENERATOR UNITS USED AS CLASS lE ONSITE ELECTRIC POWER SYSTEMS y
AT NUCLEAR POWER PIANTS A.
INTRODUCTION Criterion 17, " Electric Power Systems," of Appendix A,
" General Design-Criteria for Nuclear Power Plants," to 10 CFR Part 50, " Domestic Licensing of Production and Utilization Facilities," requires that onsite electric power systems have sufficient independence, capacity, capability, redundancy, and testability to ensure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences'and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents, assuming a single failure.
Criterion 18, " Inspection and Testing of Electric Power Systems," of Appendix A to 10 CFR 50 requires that electric power systems important to safety be designed to permit appropriate periodic inspection and testing to assess the continuity of the systems and the condition of their components.
Criterion XI, " Test Control," of Appendix B, " Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing i
Plants," to 10 CFR 50 requires that (1) measures be provided for verifying or checking the adequacy of design by design reviews, by the use of alternative or simplified calculational methods, or by the performance of a suitable testing program and (2) a test program be established to ensure that systems and components perform satisfactorily and that the test program include operational tests during nuclear powar plant operation.
1
10 CFR 50.63, " Loss of All Alternating Current Power,"
reguireo that each light-water cooled nuclear power plant be able to wi+,nstand and recover from a station blackout (i.e., loss of offsate and onsite emergency ac power system) for a specified duration.
Section 50.63 identifies the reliability of onsite emergency ac power sources as being one of the main factors contributing to risk of core melt resulting from station blackout.
Diesel generator units have been widely used as the power source for the onsite electric power systems.
This regulatory guide provides guidance acceptable to the NRC staff for complying with the Commission's requirements that diesel generator units intended for use as onsite power sources in nuclear power plants be selected with sufficient capacity, be qualified, and be maintained to ensure availability of the required emergency diesel generator performance capability for station blackout and design basis accidents.
This guide has been prepared for the resolution of Generic Safety Issue B-56, " Diesel Reliability," and is related to Unresolved Safety Issue (USI) A-44, " Station Blackout."
The resolution of USI A-44 established a need for an emergency diesel generator (EDG) reliability program that has the capability to achieve and maintain the emergency diesel generator reliability levels in the range of 0.95 per demand or better to cope with l
station blackout.
l This guide recognizes that unless diesel generators are i
properly maintained, their capabilities to perform on demand may i
degrade. The condition of the diesel units must be monitored during the test and maintenance programs, and appropriate parametric trendr must,be noted to detect potential failures; appropriate preventive maintenance should be performed.
[ Insert for ACRS approval will be added later)
Any information collection activities mentioned in this regulatory guide are contained as requirements in 10 CFR Part 50, which provides the regulatory basis for this guide.
The information collection requirements in 10 CFR Part 50 have been cleared under OMB Clearance No. 3150-0011.
l l
I 1
2
~..
8.
DISCUSSION A diesel generator unit selected for use in an onsite electric power system should have the capability to (1) start and accelerate a number of large motor loads in rapid succession j
while maintaining voltage and frequency within acceptable limits, 1
(2) provide power promptly to engineered safety features if a loss of offsite power and an accident occur during the same time j
period, and (3) supply power centinuously to the equipment needed to maintain the plant in a safe condition if an extended loss of offsite power occurs.
IEEE Std 387-1984,(U "IEEE Standard Criteria for Diesel-i Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," delineates principal design criteria and qualification and testing guidelines that, if followed, will help ensure that selected diesel generator units meet performance requirements.
(IEEE Std 387-1977 was endorsed by Revision 2 of
' Regulatory Guide 1.9, " Selection, Design, and Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants.")
IEEE Std 387-1984 was developed by Working Group 4.2C of the Nuclear Power Engineering
' Committee (NPEC) of the Institute of Electrical and Electronics Engineers, Inc. (IEEE), approved by NPEC, and subsequently approved by the IEEE Standards Board on March 11, 1982. Std 387-1984 is supplementary to IEEE Std 308-1974, "IEEE Standard
. Criteria fpr Class 1E Power Systems and Nuclear Power Generating Stations," and specifically amplifies paragraph 5.2.4, " Standby Power Supplies," of IEEE Std 308 with respect to the application of diesel generator units.
IEEE Std 308-1974 is endorsed, with certain exceptions, by Regulatory Guide 1.32',' " Criteria for l
Safety-Related Electric Power Systems for Nuclear Power Plants."
IEEE Std 387-1984 also references other standards that contain valuable information. Those referenced standards not endorsed by a regulatory guide or incorporated into the regulations, if used, are to used in a manner consistent with current regulations.
A knowledge of the characteristics of each load is essential in establishing the bases for the selection of a diesel generator unit that is able to accept large loads in rapid succession.
Tne l
majority of the emergency loads are large induction motors.
This l
type of motor draws, at full voltage, a starting current five to eight times its rated load current.
The sudden large increases in current drawn from the diesel generator resulting from the startup of induction motors can result in substantial voltage reductions. The lower voltage could prevent a motor from
- starting, i.e.,
accelerating its load to rated speed in the
. (O Coples any be obtelnad from the Institute of Electricet and Electronics Engineers, Inc.,
IEEE Service Center, 445 hoes Lane, P.O. Dos 1331, Piscatauey, NJ 08055 l
3 l
l
~...
l c
i required time, or could cause a running botor to coast down or J
stall.
Other loads, because of low voltage, might be lost if their contactors drop out.
Recovery from the transient caused by l
starting large motors or from the loss of a large load could c
cause diesel engine overspeed that, if excessive, might result in l
a trip of the engine, i.e.,
loss of the Class 1E power source.
These same consequences can also result from the cumulative effect of a sequence of more moderate transients if the system is L
not permitted to recover sufficiently between successive steps in a loading sequence.
l Generally it has been industry practice to specify a maximum voltage reduction of 10 to 15 percent when starting large motors l
L from large-capacity power systems and a voltage reduction of 20 l
to 30 percent when starting these motors from limited-capacity i
power sources such as '.iesel generator units. Large induction motors can achievr rated speed in less than 5 seconds when powered from adequately sized diesel generator units that are capable of restoring the bus voltage to 90 percent of nominal in about 1 second.
I protection of the diesel generator unit from excessive overspeed, which can result from an improperly adjusted control l
system or governor failure, is afforded by the immediate operation of a diesel generator unit trip, usually set at 115 percent of nominal speed.
similarly, in order to prevent sabstantial damage to the generator, the generator differential current trip must operate immediately upon occurence of an internal fault There are other protective trips provided to
+
protect the diesel generator units from possibis damage. However, l
these trips could interfere with the successful functioning of the unit when it is most needed, i.e.,
during accident l
conditions.
Experience has shown that there have been numerous occasions when these trips have needlessly shut down diesel generator units because of spurious operation of a trip circuit.
i consequently, it is important that measures be taken to ensure that spurious actuation of these other protective trips does not prevent the diesel generator unit from performing its function.
The uncertainties inherent in estimates of safety loads at L
the construction permit stage of design are sometimes of such l
magnitude that it is prudent to provide a substantial margin in l
selecting the load capabilities of the diesel generator unit.
This margin can be provided by estimating the loads l
l conservr.tively and selecting the continuous rating of the diesel generator unit so that it exceeds the sum of the loads needed at any one time.
A more accurate estimate of safety loads is t
po:sible during the operating license stage of review because detailed designs have been completed and component test and preoperational test date are usually available.
At this point the NRC permits the consideration of a somewhat less conservative 4
. ~
i l
l
~
o approach, such as operation with safety loads within the short-
]
time rating of the diesel generator unit.
i The reliability of dienel generators is one of the main I
factors affecting the risk of core damage from a station blackout event.
Thus, attaining and maintaining high reliability of diesel generators at nuclear power plants is necessary to reduce 3
the probability of station blackout.
In Regulatory Guide 1.155, j
- station Blackout," the reliability of the diesel generator is one of the factors to be used to determine the length of time a plant should be able to cope with a station blackout.
If all other factors (redundancy of emergency diesel generators, treguency of loss of offsite power, and probable time needed to restore offsite power) remain constant, a higher reliability of j
the diesel generators will result in a lower probability of a total loss of ac power (station blackout) with a corresponding coping duration for certain plants according to Regulatory Guide 1.155.
High reliability should be designed into the diesel generator units and maintained throughout their service lifetime.
l This can be achieved by appropriate testing, maintenance, operating programs, and institution of a reliability program l
designed to monitor, improve, and maintain reliability at selected levels.
This guide provides explicit guidance in the areas of preoperational testing, periodic testing, reporting requirements, and valid demands and failures.
The preoperational and periodic testing provisions set forth in this guide pYovide a basis for taking corrective actions needed to maintain high inservice reliability of installed diesel generator units.
The data r
developed will provide an ongoing demonstration of performance and reliability for all diesel generator units after installation i
and during service.
1 f
This revision of Regulatory Guide 1.9 integrates into a single regulatory guide pertinent guidance previously addressed in Revision 2 of Regulatory Guide 1.9, Regulatory Guide 1.108, and Generic Letter 84-15, and it endorses guidelines set forth in F
In addition, this guide describes a means for meeting the minimum diesel generator reliability goals in Regulatory Guide 1.155.
This guide also provides principal elements of a diesel generator reliability program designed to maintain and monitor the reliability level of each diesel generator unit over time for assurance that the selected t
reliability levels are being achieved.
Concurrent with the development of this regulatory guide, and consistent with discussions with NRC staff, the Nuclear Management and Resources Council (NUMARC) has revised WUMARC 5
o 8700, Appendix D, "EDG Reliability Prograa," to provide guidance on a reliability program to ensure that EDG reliability target levels selected for station blackout are maintained, and on actions to be taken if EDG reliability ta gets are not being met.
The NRC staff has reviewed this revised guidance and concludes that NUMARC 8700, Appendix D, provides guidance for an EDG reliabilty program in large part identical to those portions of this guide which deal with an EDG reliability program and the monitoring of EDG reliability. Table 1 of this regulatory guide provides r, noction-by-section comparision between Regulatory Guide 1.9, Revision 3 and NUMARC - 4700, Appendix D (Revised).
C.
REGULATORY POSITIOW j
Conformance with the guidelines in IEEE Std 387-1984 "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," provides a method acceptable to the NRC staff for satisfying the commission's regulations with respect to design, qualification, and periodic testing of diesel generator units used as onsite electric power systems for nuclear power plants subject to the following:
I 1.
DESIGN CONSIDERATIONS The guidelines of IEEE Std 387-1984 should be supplemented as follows:
j 1.1 Section 1.2, " Inclusions," of IEEE Utd 387-1984 should be supplemented to include diesel generator auto controls, manual controls, and diesel generator output breaker.
i l
1.2. When the characteristics of the required diesel
}
generator loads are not accurately known, such as during the l
(
construction permit stage of design, each diesel generator unit t
of an onsite power supply systen should be selected to have a l
continuous load rating (as defined in Section 3.7.1 of IEEE Std l
387-1984) equal to or greater than the sua of the conservatively estimated loads (nameplate) needed to be powered by that unit at l
any one time.
In the absence of fully substantiated performance characteristics for mechanical equipment such as pumps, the electric motor drive ratings should be calculated using canservative estimates of these characteristics, e.g.,
pump runout conditions and motor efficiencies of 90 percent or less
(
and power factors of 85 percent or ;'--
$py/44,
I l
1.3. At the operating license stage of review, the predicted i
loads should not exceed the short-time rating (as defined in Section 3.7.2 of IEEE Std 387-1984) of the diesel generator unit.
6 1
--_____.__~-_-m_,__
j i
1 4 Section 5.1.2,
" Mechanical and Electrical Capabilities,a of IEEE Std 387-1984 pertains, in part, to the starting and load-accepting capabilities of the diesel generator unit.
In conformance with Section 5.1.2, each diesel generator unit should be capable of starting and accelerating to rated speed, in the required sequence, all the needed engineered safety feature and i
emergency shutdown loads.
The diesel generator unit design should be such that at no time during the loading sequence should i
'the frequency decrease to less than 95 percent of nominal nor the voltage decrease to less than 75 percent of nominal (or a larger decrease in voltage and frequency may be justified for a diesel 4
generator unit that carries only one large connected load).
Frequency should be restored to within 2 percent of the nominal i
in less than 60 percent of each load-sequence interval for step-load increase and in less than 80 percent of each load-sequence l
interval for disconnection of the single largest load, and l
voltage should be restored to within 10 percent of nominal within 60 percent of each load-sequence time interval. (A greater i
percentage of the time interval may be used if it can be justified by analysis.
However, the load-sequence time interval l
should include sufficient margin to account for the accuracy and l'
repeatability of the load-sequence timer.) During recovery from transients caused by the disconnection of the largest single load, the speed of the diesel generator unit should not exceed i
i the nominal speed plus 75 percent of the difference between nominal speed and the overspeed trip setpoint or 115 parcent of l
nominal, whichever is lower.
Furthermore, the transient following the complete loss of load should not cause the speed of the unit to attain the overspeed trip setpoint.
+
l 1.5 Diesel generator units should be de igned to be testable as discussed in Regulatory Position 2.
The design should include i
provisions so that testing of the units will simulate the l
parameters of operation (manual start, automatic start, load sequencing, load shedding, operation time, etc.), normal standby l
conditions, and environments (temperature, humidity, etc.) that l
would be expected if actual demand were to be placed on the system. If prevara systems designed to maintain lube oil and j
jacket water cooling at certain temperatures or prelubrication systems or both are normally in operation, this would constitute l
normal standby conditions for that plant.
1.5.1 The units should be designed to automatically transfer from the test mode to an energency mode upon receipt of energency signals.
l 1.5.2 The units should be designed for a slower rate of starting and loading for test purposes and for faster starting and loading rates for response to plant emergency conditions. The starting and loading rates should be consistent with the manufacturer's reconnendations.
7
.,-my
,_-,__,_,___m.
.,_.-._,,,__.__.m.,,
w.,_o__,,,
}
l 1.6 Design provisions should include the capability to test each diesel generator unit independently of the redundant units.
Test equipment should not cause a loss of independence between redundant diesel generator units or between diesel generator load
]
groups.
1.6.1 Testability should be considered in the selection and location of instrumentation sensors and critical components (e.g., governor, starting system components). Instrumentation sensors should be readily accessible and designed so that their inspection and calibration can be verified in place. The overall i
design should include status indication and alarm features, i
1.7 Section 5.5.3.1,
" surveillance systems," of IEEE Std 387-1984 pertains to status indication of diesel generator unit i
conditions. The guidance in this section should be supplemented as follows:
l 1.7.1 A surveillance system should be previded with I
i remote indication in the control room for displaying diesel generator unit status, i.e., under test, ready-standby, lockout.
l A means of communication should also be provided between diesel generator unit testing locations and the main control room to ensure that the operators are cognizant of the status of the unit
(
under test.
1.7.2 In order to facilitate trouble diagnosis, the l
l surveillance systen should indicate which of the diesel generator l
l protective trips has been activated first.
l 1.8 Section 5.5.4, " Protection," of IEEE Std 387-1984 pertains to bypassing diesel generator protective trips.
This l
section should be revi' sed to read as follows.
The diesel generator unit should be automatically tripped on an engine overspeed, low oil pressure, and generator-differential overcurrent.
The diesel generator protective trips other than engine overspeed, low oil pressure and generator-differential overcurrent should be handled in one of two ways (1) a trip should be implemented with two or more measurements for each trip parameter with coincident logic provisions for trip actuation, or (2) a trip may be bypassed under accident conditions provided the operator has sufficient time to react appropriately to an abnormal diesel generator unit condition.
The design of the bypass circuitry should include the capability for (1) testing the status and operability of the bypass circuits, (2) alarming in the control room for abnormal values of all bypass parameters (common trouble alarms may be used),
and (3) manually resetting the trip bypass function.
8 i
~
Capability for automatic reset is net acceptable.
Section 5.5.4 (2) of IEEE Std 387-1984, on retaining all protective devices during diesel generator testing, does not apply to a periodic test that demonstrates diesel generator system response under simulated accident conditions per i
Regulatory Position 2.2.5 and 2.2.12.
2.
DIESEL GENERATOR TESTING (33 1
Testing, and Section Section 3, " Definitions, "Section 6 7,
Qualification Requirements," in IEEE Std 387-1984 should be j
supplemented as discussed below, i
i 2.1 Definitions
]
The following definitions (33 are applicable to the positions of this regulatory guide that address testing, reliability I
calculations, record-keeping, and reporting of performance.
l start deman33:
All valid and inadvertent start demands, including all start-only demands and all start demands that are followed by load-run demands, whether by automatic or mar.ual initiation.
A start-only demand is a demand in which the l
emergency generator is started, attains specified voltage and frequency, but no attempt is made to load the emergency diesel generator. See " Exceptions" below.
start failures Any failure within thenomergency generator system that prevents the generator from achieving specified I
frequency (or speed) and voltage is classified as a valid start i
i failure.
For the monthly surveillance tests, the emergency l
diesel generator can be brought to rated speed and voltage in a time that is recommended by the manufacturer to minimize stress i
and wear.
Any condition identified in the course of maintenance i
inspections (with the EDG in the standby mode) that would have resulted in a start failure if a demand had occurred should be l
counted as a valid start demand end failure. See " Exceptions" l
below.
~
i l
Load-run demands: To be valid, the load-run demand must follow a successful start and meet one of the following criteria (See " Exceptions" below.)
i (t) Additlenet neeful Inforestien en teettre oral test def t.Attens can he fewd in the InsJetry wide Plant Performente trWitator Progren (PPIP) and the ADIE 00m Port M,
- Inservice Testire and maintenance of Dlooel Drives et nucleet Power Plants.* Caples can be obtaired by centacting 1180 or the ASE.
(3) These definitlens are corsistent with the reporttre rules for trukstry wide Pient Perforsence Irdicator Program (PPIP).
9 l
l l
=
--c v.-,-i,~,,,----,,--,,.-,..~,.---.-e--,
.---..--,,w-------,.--m--,---,,---,--,,--,----...,-.-4-,,-----.--,
,--w
l t
i o
A load-run of any duration that results from a real (e.g. not a test) automatic or manual signal.
o A load-run test to satisfy the plant's load and duration test specifications.
o other operations (e.g., special tests) of the emergency diesel generator in which the emergency diesel generator is planned to run for at least one hour with at least 50 percent of design load.
Load-run Failures A load-run failure should be counted when the emergency diesel generator starts but does not pick up load and run successfully. Any failure during a valid load-run demand should be counted. See " Exceptions" below. For monthly surveillance tests, the diesel generator can be loaded at a rate that is recomment.ad by the manufacturer to minimize stress and wear.
Any condition identified in the course of maintenance inspections (wit.h the EDG in the standby mode) that would have resulted in a load-run failure if a demand had occurred should be counted as a valid load-run demand and failure.
Exceptionst Unsuccessful attempts to start or to load-run should not be counted as valid demands or failures when they can be definitely attributed to any of the following:
i o
Spurious operation of a trip that would be bypassed in the emergency operation mode (e.g. h4gh cooling water temperature trip)
[
l o
Malfunction of equipment that is not required to operate during the emergency operating mode (e.g.,
l synchronising circuitry).
f o
component malfunctions or operating errors that did not prevent the emergency diesel from being restarted and brought to load withing a few minutes (i.e., without corrective maintenance or significant problem diagnosis) o Intentional termination of the test because of alarmed cr i
observed abnormal conditions (e.g., small water or oil leaks) that would not have ultimately resulted in significant emergency gsnarator damage or failure.
o A failure to start following an actual (manual or automatic) or inadvertent start demand (if actuated only on a loss of offsite power), if restarted manually within five minutes from the first start attempt.
10 1
I I
i o If the EDG fails to reach rated speed and voltage in the precise time required by Technical specifications, the start attsapt and load-run attempt should not be considered a failure if the test demonstrated that the EDG would have started in an emeraency end should therefore be i
retained in the EDG availabi1Ity data base.
l 1
i Each emergency diesel generator failure that results in the emergency diesel generator being declared insperable should be i '
counted as one demand and one failure. Exploratory tests during corrective maintenance and the successful test that is run following repair to verify operability (prior to declaring operability) should not bs counted as demands or failures.
2.2 Test Descrintions i
The following test descriptions are applicable to Regulatory Positions 3 and 4.
Table 2 describes the sequence of qualifica-tion and surveillance testing. Detailed procedures should be provided for each test defined in Regulatory Position 2. The procedures should identify special arrangements or changes in j
normal system configuration that must be made to put the EDG under test. Jumpers and other non-standard confiprations or arrangements should not be used subsequent to initial equipment startup testing.
2.2.1 Start-Test
Demonstrate proper startup from ambient conditions and verify that the required design voltage and frequency is attained.
For thout tests, the.. diesel generator can be slow-started, be prelubricated, have prewarned oil and water circulating, and should reach rated speed on a prospecified schedule that is selected to minimize stress and wear.
i 2.2.2 Load-Run Test!
Demonstrate full-plant energency load carrying capability, or 90 to 95 percent of the continuous rating of the EDG, for an interval of not less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and until temperature equilibrium has been attained.
This test may be accomplished by synchronizing the generator with offsite power.
The loading and unloading of a diesel generator during this test should be gradual and based on a prescribed schedule that is selected to minimize stress and wear on the diesel generator.
2.2.3 Fast-Start Test:
Demonstrate that each diesel generator unit starts from ambient conditions (if a plant has norast'y operating prelube and prewarm systems, this would constt'.ute its ambient conditions) and verify that the diesel genert,or reaches stable required voltage and frequency within acceptable limits and time, as defined in the plant technical specifications.
l 11 i
____,s.
\\
.o I
2.2.4 Lons-of-offsite Power (LDOP) T231:
Demonstrate by simulating a loss of offsite power that (1) the emergency buses are doenergized and the loads are shed from the energency buses and (2) the diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, energizes the auto-connected shutdown loads through the load sequencer, and operates for a miniaua of 5 minutes.
2.2.5 SIAS Testt Demonstrate that on a safety injection auto-start (SIAS) signal, the diesel generator starts on the 4
auto-start signal from its ntandby conditions, attains the required voltage and frequency within acceptable limits and time, and operates on standby for greater than or equal to 5 minutes.
1 2.2.6 combined FIAS and LDOP Test:
Demonstrate by j
simulating a loss of offsite power in continction with SIIS that (1) the emergency buses are doenergized and loads are shes from the emergency buses and (2) the diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time,
)
l energizes auto-connected loads through the load sequencer, and i
operates while loaded with the auto-connected loads for greater than or equal to 5 minutes.
2.2.7 Sinale-Lead Reiection Test:
Demonstrate the emergency diesel generator's capability to reject a loss of the largest single load and verify that the voltage and frequency requirements are met and that the unit will,not trip on i
l 2.2.8 Pull-Lead Reiection Test:
Demonstrate the diesel generator's capability to reject a load equal to 100 percent of the automatically sequenced loads, and verify that the voltage requirements are met and that the unit will not trip on overspeed.
2.2.9 Endurance and Marain T331 Demonstrate full-load carrying capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, of which 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> should be at a load equivalent to 110 percent of the automatically sequenced loads of the diesel, and 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> at l
a load equivalent to the automatically sequenced loads, verify that voltage and frequency requirements are maintained.
2.2.10 Hot Restart Test!
Demonstrate hot restart functional capability at full-load temperature conditions by verifying that the diesel generator starts on a manual or auto-start signal, attains the required voltage and frequency within acceptable limits and time, and operates for longer than 5 minutes.
12
)
)
2.2.11 synchronizina Test:
Demonstrate the ability to (1) i synchronize the diesel generator unit with offsite power while the unit is connected to the emergency load, (2) transfer this load to the offsite power, (3) isolate the diesel generator unit, and (4) restore it to a standby status.
2.2.12 Erotective-Trio avomas Test:
Demonstrate that all l
automatic diesel generator trips (except engine overspeed, oil
)
prossure, and generator differential) are automatically bypassed upon a safet,v,,njection actuation signal.
l 2.2.13 Test Mode chanaa-Over Test:
Demonstrate that with the diesel generator operating in the automatic test mode while connected to its bus, a simulated safety injection overrides the i
test mode by (1) returning the diesel generator to standby operations and (2) automatically energizing the emergency loads from offsite power.
2.3.14 Redundant Unit Test:
Demonstrate that, by starting and running beth redundant units simultaneously, potential common failure modes that may be undetected in single diesel generator unit tests do not occur.
2.3 Pre-operationat and Surveillance Testina t
Table 2 relates pre-operational and surveillance tests to the anticipated schedule for performance (e.g., pre-operational, monthly surveillance, 6-month, scheduled sefyeling period, and 10-year testing).
All tests should be in general accordance with the manufacture's recomendations for reducing engine wear, including cool-down operation at reduced power, followed by postoperation lubricatia.
z I
2.3.1 Pre-operationgl Testina:
A pre-operational test program should be implemented for all diesel generator systems l
following assembly and installation at the site.
This prgram I
i should include the tests identified in Table 2 and be carried out per the test definitions in Regulatory Pesition 2.2.
In addition, demonstrate through a minimum of 25 valid start-and-load demands (or tests) without failure on each installed diesel generator unit that an acceptable level of reliability has been achieved to place the new EDG into an operational category.
2.3.2 surveillance Testina:
After the plants are licensed (after fuel load), periodic surveillance testing of each diesel generator must demenstrate continued capability and reliability of the diesel generator unit to perform its intended function.
13 i
I 5
c l
When the EDG is declared operational in accordance with plant i
technical specifications, the following periodic tort program j
should be implemented.
j 2.3.2.1 Rent.hiv Testina:
After completion of the i
diesel generator unit re11 ability demonstration during l
preoperational testing, periodic testing of diesel generator i
units during normal plant operation should be performed.
Each diesel generator should be started and ioaded as defined in
}
Regulaton Positions 2.2.1 and 2.2.2 at least once in 31 days (w;,th maximum allowable extension not to exceed 25 percent of the i
surveillance interval) on a staggered basis.
j 2.3.2.2 Ely-Month for 184 davn) Testinus The design basis for nuclear power plants requires a capability for the diesel generators to make fast starts (as defined in the plant i
Technical Specifications) from standby conditions to provide the necessary power to mitigate the large-break less-of-coolant accident coincident with loss of offsite power.
It has been J
determined (based on a probabilistic risk analysis performed to examine the change in core melt frequency associated with lengthening the fast-start test interval) that relaxation of l
fast-start test frequency from once par month to once per 6 months would not appreciably increase risk.
Therefore, once i
avery 6 months each diesel generator should be started fro' standby conditions (if a plant has normally operating pre.abe and
{
prewarm ayatens this should constitute its standby conditions) to verify i. sat the diesel generator reaches stable rated voltage and frequency within acceptable limits and time end operatea for 5 minutes.
2.3.2.3.
Refuelina Outaae Testina:
Overall diesel generator unit design ' capability should be demonstrated at every refueling outage by performing the tests identified in Table 2.
i l
2.3.2.4.
Ten-Year Testina:
Demonstrate that the trains of standby electric power are independent once per 10 years (during a plant shutiown) or after any modifications that I
could effect diesel generator independence, whichever is the shorter, by starting all redundant units simultaneously to help identify certain common failure modes undetect ad in single diesel generator unit tests.
2.3.3 corrective Action 'restinar Following the occurrence l
of a degrading situation cis defined in Regulatory Position 3.5 for a problem EDG, the surveillance testing interval for that EDG should be reduced to no more that 7 days, but no less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This test frequency should be maintained until seven consecutive failure-free start and load-run tests have been performed to demonstrate the effectiveness of corrective actions taken and recovery of reliability levels. At that time, monthly 14
- -- ~_.__ - -.- -...
6*
J L
surveillance testing can be resumed. However, if suksequent to the seven failure-free tests, one or more additional failures occur such that there are again four or mor9 failures in the last 25 tests, the testing interval should agair be reduced as noted above and maintained until seven consecutive failure-free tests have been performed. The EDG undergoing c.rrective action testing i
should be considered " operable" unless other license requirements l
necessitate declaring the EDG inoperable.
3.
EDG RELIABILITY GOALS AND CALCUIATIONS i
i Reliability goals for emergency diesel generators (EDGn) l and related calculational methodology are as follows:
3.1 Reliability Goals for Station Blackeyt In order to comply with 10 CFR 50.63, ' Loss of All Alternating Current Power," and the guidance in Regulatory Gulds 1.155, " Station Blackout," the minimum EDG reliability should be 1:argeted at 0.95 or 0.975 per demand for each EDG for plants in emergency ac (EAC) Groups A, B, and C and at 0.975 per demand for each EDG for plants in EAC Group D (see Table 2 of Regulatory Guide 1.155).
3.2 Desian Basis Accidents Assessment A quantitative EDG reliability target for deaign basis accidents has not been established. If an EDG reliability estimate is needed for plant-specific PRAs, 4t should be l
calculated using only the successful "immediate" starts, where immediate is defined as the time required for the EDG to be available for design basis loss-of-coolant accidents and other limiting plant transient emergency electrical loads.
Therefore, delayed starts (i.e., starts that are restarted manually within 5 minutes from the first start attempt) deemed successful for t
station blackout assessasnts per exceptions noted in Regulctory Position 2.1 should not be considered for design basis accident assessment.
i 3.3 Diesel Generator Reliability Calculations Calculation of EDG reliabilities should be based on the definitions consistent with the reporting rules for the Industry-wide Plant Performance Indicator Program or equivalent and the definitions in Regulatory Position 2.1.
The evaluation of a nuclear unit's EDG reliability should take into account the demand and failure experience of all EDGs that provide emergency AC power for the unit. Calculation of EDG reliability levels should be based on the last 50 and 100 demands in the following manner:
15
.___,_.__m-,.-___,,.
.,..._,,,_,m._,-.
_-__._..-....--_.,e..,
F
, EI 1
)
- 1).... ort RC), lability (SR) is defined ast l
S R = ____ Mn= hey, gfysuccessful starts f
Total Nr}1 bel of Valid Start Demands
- 2) Load-run Reliability (LR) is defined est j
LR =
Mn=her of Successful Load-runs Total Number of Valid Load-Run Demands t
- 3) EDG Reliability (SR) * (LR) l
=
Table 3 provides guidance for combining data from individual EDG I
performance to arrive at a nuclear unit reliability estimate.
TABL2 3.
COMBINING EDG FAIIURE EXPERIENCE EDG Configuration Methoj_fpr Combinina 2,3,4 EDGs dedicated to Usc, combined fkilure l
nuclear unit experience of all EDGs.
l l
l i
2,3,4 EDGs shared between Use combined failure l
t I
between units orperience of all EDGs for all units.
1 dedicated EDG at each Each unit uses the combined I
unit and 1 shared between failure experience of its units dedicated'*EDGs and the shared i
EDG.
2 dedicated EDGs at each unit Each unit uses the combined l
and 1 shared between units failure experience of its dedicated EDGs and the shared i
i EDG.
2 dedicated EDGs and 1 HPCS Use the combined failure EDG or diverse EDGs within the experience of similar EDGs and same unit separately consider the failure experience of different EDCs.
The calculations discussed above will be point estimates of reliability and will have inherent uncertainties because of the sample size available. A point estimate reliability calculation for a 59-demand sample that falls below 92 percent, or for a 100-demand sample that falls below 93 percent, is an indication that the true underlying reliability may have fallen below 05 4
percent. A point estinate reliability calculation for a 50-deu.snd sample that falls below 94 percent, or for a 100 demand 16
?
l sample that falls below 96 percent, is an indication that the true underlying reliability may have fallen below 97.5 percent.
Actions to be taken are discussed below.
3.4 EDG Reliability Proaram Monitorina f
Data from surveillance tests and unplanned starts can be used to estimate achievement of a nuclear unit's EDG reliability l
targets and also to detect a deteriorating situation for both the reliablity program and individual EDGs. Failures encountcred in the last 20, 50, and 100 demandn can be related to nuclear unit target reliabilities as in Table 4 l
t Table 4 Action Levels and Remedial Actions Target Action Demand Failure Remedial Reliability Level fonbinations (All EDGsi Actions
.95 Mild 3/20 p.I 5/50 gr 8/100 (1) i Strong 5/50 And 8/100 (2)
.975 Mild 3/20 gr 4/50 2r 5/100 (1)
Strong 4/50 And 5/100 (2)
(1) Take action per Figure 1 for a Mild Action Level.
(2) Take action per Figure 1 for a Strong Action Level.
3.5 Problem EDG A problem diesel is defined as an individual EDG eperiancing 3 or more failures in the last 20 demands. Should this case arise, a Mild Action Level would be declared and the actions defined in Figure 1 would be undertaken. If the problem EDG t
experiances an additional failure, such that there have been 4 i
failures in the last 25 demands, then a strong Action Level would be declared.
i Following completion of corrective programmatic actions as defined in Steps 1 - 4 of column 3 (Strong Action Level) of Figure 1, restored performance of the problem EDG should be demonstrated by conductiong seven consecutive failure free starts and load-run tests as defined in Regulatorj Position 2.3.3 The monthly surveillance schedule should not be resumed until consecutava failure freu start and run-load demand tests have been completed. All starts and load-runs performed during the corrective action testing shall be included in the nucidar unit EDG reliability data set so long as the EDG is declared operable.
If following completion of the seven consecutive failure-free tests (per Regulatory Position 2.3.3), the same EDG experiances another failure such that there have been 5 failuree 17
~, - - - -
-n
---,,e, n,.
,,v,---...---,.----,..-n.--
L l
in the last 25 demands, consideration should be given to declaring that problem EDG inoperable in accordance with plant l
Technical Specifications and undertaking a overhaul of that EDG L
baned on the subsystems affected (see Figure 3) and the neture of 1
l re-occuring failurow.
If the overhaul necessitate-the tear-down and overhaul of the diesel engine and/or the generator (see Figure 3), then j
l prior to returning that EDG to service, 14 consecutive failure-i i
free tests (per Regulatory Position 2.2.3) should be conducted.
{
If the overhaul is of a lesser nature (i.e. subsyten or support l
system overhaul, see Figure 3) then the problem EDG shculd be considered in a Strong Action Level and 7 consecutive failure-free tests (per Regulatory Position 2.2.3) should be conducted r
l before returning that EDG to service per plant Technical specificatiosi requirements.
l 3.6 Rapovery from a Strona Action Leve.1 (EDG Procram)
Recovery from a Strong Action Level should be based on continued monitoring of the nuclear unit EDG reliability level nad the demand-failure combinations shown in Table 4. The plant would not revert to a reduced action level until the number of l
demand-failures was adequately reduced, or two years from the last failure while in at exceedance, which ever occurs first.
i However, prior to reverting to a no exceedance state, all identified improvement actions must be completed within the two year period.
Should a plant continue in an exceedance state because of new failures, these failures should be evaluated against improvement actions previously identified for implementation. The purpose of this evaluation would be to assess wh' ether prior conclusions and attendant recommendations should be revised due to continued failures.
4.
RECORDKEEPING GUIDANCE Guidance fr?m Sectiv 7.5.2,
" Records and Analysis," of IEEE Std 387-1984 should ha supplemented as follows:
All demands, as defined in Regulatory Position 2.1, should be logged and continually updated for each diesel generator based on surveillance testing and experianced failures.
The log should be maintained in auditable form and should include sufficient detail to permit review and audit of reliability calculations in accordance with Regulatory Position 3.3. The log should also include a recalculated nuclear unit reliability estimate following occurrence of a load-run demand.
18
Meintenance, repair, and c'at-of-service time as well as
}
canulative maintenance and operating data (hours of operation) shvuld also be logged.
The out-of-service time should include the hours the diesel generator is removed from service (declared jnoperable) for preventive maintenance, corrective maintenance i
following a failure, modifications, or for support systems out of i
service.
l i
The out-of-service time for diesel generaters during i
refueling need not be logged if the diesel generator is electively removed from service (i.e., no failura has occurred).
After a failure experienced during refueling, the actual time j
i spent in corrective maintenance should be logged as out-of-service time.
5.
REPORTING CRITERIA When reporting EDG failures, all plants should conform with i
the provisions of 10 CFR 50.72, 10 CFR 50.73, 10 CFR 21, plant technical specifications, and other current NRC reporting regulations.
If a mild action level condition comes about, the NRC on-site inspector should be notified and a report prepared within 30 days that would be maintained at the site for NRC audit. This i
report should include the following informations j
1.
A summary of all tests within the time period over
+
which the last 20,50 and 100 valid tests were i
performed, with emphasis on those tests with failures.
2.
A des 9ription of the tailures, underlying causes, and l
corrective actions takan.
3.
The nuclear unit EDG reliability level per Regulatory Position 3 at the time a mild action level condition was entered, i
l 4.
An assessment of the corrective actions to be taken with l
respect to restoration of reliability level.
1 L
If a strong action level situation comes about, both the NRC Region and Headquarters should be notified within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and t
the activities outined in column 3 of Figure 1 should be undsrtaken.
A schedule for implementing corrective actions and a report containing the above four items should be submitted to the NRC within 30 days.
- 6. EMERGENCY DIESEL GENERATOR REI.IABILITY PROGRAM 19 l
l l
e Regulatory Guide 1.155 describes a means acceptable to the i
NRC staff for meeting the requirements of 10 CFR 50.63 and identifies the need for an 2DG reliability prograa designed to maintain and monitor EDG reliability levels to I
ensore that selected reliability levels are being achieved.
t This section provides guidance regarding the principal elements for such a reliability program. Although current industry practices may group activities discussed below somewhat differently, existing EDG reliability and maintenance programs i
should encompass the elements discussed below.
i The principal elements of an EDG reliability program (o*
i activities) should encompass the following:
1.
An EDc reliability taraat level corresponding to that selected for compliance with 10 CFR 50.63.
2.
A survalliance 21AD that identifies EDG subccuponents and subsystems, surveillance parameters, surveillance frequency, and incorporates manufacturer recommendations.
t This plan should define the monitoring i
requirements to be used by the other elements of the EDG reliability program.
Performance monit I1DE of iaPortant 3.
S parameters on an ongoing basis to obtain l
information on the state of the EDG and components so that precursor conditions are l
l identified prior to failure.
This information can also be used for maintenance-i related activities.
4.
A raintenance oroaram designed for both preventive and corrective actions based on operational history and past maintenance i
activities, vendor recommendations, spare parts considerations, and the results of surveillance monitoring.
5.
Tailure analyses, including root cause analyses, that have been developed for the onsite EDGs and that can be used to reduce failures and root causes to corrective actions for avoidance in the future.
6.
Problem closeout erocess that establishes i
criteria for closeout of reliability and operations-related problems, and that provide for follow-up surveillance to enecre that the 20 i
I c
i problem has been corrected and that latent long-term ef fects (i.e., excessive wear) will not recur.
j 7.
A data memulsition system (or equivalent weans) that provides for data capture, storage, and retrieval capability to all elements of the reliability program.
1 8.
Defined resnonsibilitigp and mannaement eversiaht to ensure that ths reliability i
program slements are functioning effectivsly and that target reliability levels are being
)
sustained.
The interaction of tha respective EDG reliability program elements is shown in Figure 2.
The principal elements of an EDG reliability program as defined above are provided as guidelines. Other reliability programs that include the same or similar activities may also be used, such gs the TDI Owner's Group maintenance and surveillance activities. 3 such programs should be reviewed for consistency with Regulatory Guide 1.150 ar.d this regulatory guide.
6.1 Diesel Generator Reliability Taraat Regulatory Guide 1.15S provides guidance on selecting an EDG j
reliability target. Regulatory Position 2 of. Regulatory Guide
)
1.9, Revision 3 provides guidance for periodic testing related i
to determining EDG reliability levels. Regulatory Position 3 of kegulatory Guide 1.9, Revision 3 provides guidance for estimating
)
reliability levels being achieved and corrective actions that should be taken to correct a deteriorating situation.
6.2 Diesel Generator Surveillance Plan A surveillar.ca plan should identify the ED3 components (or j
subsytems) and support systems. Figure 3 provides an exampic of t
typical components and support systems that should be considered defining an EDG boundary. Those components whose function is
{
solely to support the EDG are to be viewed as within the EDG boundary. The systems that provide support to the EDG and perform other plant functions are outside the boundary, with the understanding that the boundary interface function must be L
maintained. IEEE Std 387-1984 and ANSI /ASME OM-16 (Draft) provide similar definitions of components and system boundaries and may also be used as guidance.
(4) Revision 2, Appendia 2, apegg,n g,viou/tuality yelldetton report s m itted 5/1/86, J. George (TD1) a to it. Denton(wec) was utilised in revisire plant specific Technicet specifications.
21
~
-+
.g,,,,,
,,.e,-,_,,,,,,_n m,..
-,m, e---,,
w
l
}
A surve131ance plan should consider the following:
1.
Reliability considerations related to EDG component and support systems design and operational characteristics. Significant common cause effects should also be identified.
l 2.
Engine manufacturers' surveillance recommendetions.
l 3.
Failures caused by suryc.illance activities.
l 4.
Engine and component year ccisiderations.
5.
Frequency and nature of surveillance.
6.
Prior operational history as derived from on-site EDG experience and from other engines of the same make at other nuclear plants.
This surveillance plan shoula provide the basis for l
perfor-r.nce monitoring, o.intenance activities, and failure an lysis procedures.
Figures 4 and 5 provide examples of types of periodic surveillance activitied that have proven effective. When performing such survaillance, it is important to capture the actual values of critical parameters since s.uch data would be i
extremely useful in carrying out failure analyses, as well as i
providing data for long-tern EDG condition monitoring.
l 6.3 EDG Performance Monitorina Performance monitoring and data trending should be based on considerations discussed in Regulatory Position 6.2 and should be applied to equipment that is run on a continual or on a near continual basis. The purpose is to monitor certain parameters on an ongoing basis in order to obtain information about the state of physical conditions that may potentially impact the operability of a piece of equipnent, and which could be used for trending purposes. Such trends may signal a degradation in a particular condition. Evaluation of such conditions may provide a means of detecting onset of potential failure, thereby allowing corrective actions to be taken before actual failure occurs. The examples shown in Figures 4 and 5 should be developed from on-l site operational experience, industry-wide applicable data, and manufacturers' recommendations.
22
.o,v 6.4 EDG Maintenance Proaram i
A maintenance program should be based on reliability considerations and should actively interface with other alements of the EDG reliability program. Proper maintenance is an l
important contributor to EDG reliability from both preventive and I
correctiva aspects. Generally speaking, ECG maintenance programs should be based on the following principlest a.
Recommended vendor maintenance actions and schedule for implementation.
b.
site-specific operational history and reliability characteristics of the EDG components and support j
systems.
c.
Spare parts considerations to ensure that such j
parts are in stock when needed, with ample spares.
I d.
Such factors as repair time, potential failure severity, and recurrence of known failures should be l
utilized in scheduling maintenance, j
e.
Long-term shintenance scheduled during refueling outages should be based on engine performance experienced.
6.5 EDG Failure Analysis and Root cause Investination An EDG reliability program should have failure analysis procedures designed to systematically reduce problems or failures l
to corrective actions.
1 Failure analysis starts from the most apparer.c symptoms and progresses to determination of underlying causes or incipient r
conditions. Root cause analysis goes further and attempts to i
find underlying causes relating to design, engine operation or maintenance.
Figure 6 outlines a systematic approach to failure and root cause ane. lyses.-
When performing a root cause analysis, the method of categorising underlying causes is important so that corrective action con be integrated into both plant activities and the EDG
+
reliability program. A typical classification system should consider the followings i
a.
Manufacturing and design i
b.
Quality control c.
Procedures i
23 l
1 l
l l
,. ~
d.
Training
)
e.
Communication f.
Human factors g.
Management j
6.6 Problea closecut An EDG reliability program should have a problem closeout process established to ensure that effective solutions have been found and implemented.
Continued recurrences should be examined from the viewpoint of whether the EDG reliability is adequate to meet station.*:lackout requirements and whether near-term engine teardown and rebuilding should be scheduled.
6.7 Data canture and Utilization An EDG reliability program should have a data collection, storage, and retrieval system that can be accessed by personnel assigned to acnitoring and maintaining the EDGs. The data system does not need to be a special-purpose dedicated system, but I
access to " current" information should be a major consideration.
Typical types of information that should be included are as follows:
a.
EDG-specific testing and failure history l
b.
Surveillance test results c.
Failure and root cause analysis results d.
Manufacturer's recommendations and related data e.
Input from preventive maintenance activities f.
Input from corrective maintenance activities
[
g.
Industry-wide operating experience 6.8 Assioned Resnonsibilities and Manaaement Oversicht An EDG reliability program should have clear assignment of responnibility for carrying out the respective progras elements.
Such assignments should be based on properly troined and qualified staff to perform the activities needed, and should ensure that qualified personnel are assigned.
24
,u l
A management oversight function (or procedures) should also i
be available to review the effectiveness of the reliability program and reliability levels being sustained, independent of i
the day-to-day EDG activities. Such a plant-wide function may
{
already exists however, a routine evaluation of EDG pertornance should be incorporated into the plant performance review process.
D.
IMPLEMENTATION The purpose of this section is to provide information to applicants regarding the NRC staff's plans for using this i
regulatory guide.
Except in those cases in which an applicant proposes an acceptable alternative method for complying with the specified portions of the commission's regulations, the methods described in this guide will be used in the evaluation of selection, design, qualification, and testing of diesel generator units used as onsite electric power systems for the following nuclear power plants:
- 1. Plants for which the construction permit is issued after the issue date of the final guide,
- 2. Plants for which the operating license application is docketed 6 months or more after the issue date of l
the final guide, J
- 3. Plants for which the licensee v'oluntarily commits to the provisions of this guide.
The NRC Staff also intends to apply this Regulatory Guide to monitor emergency diesel generator reliability levels and to review existing or proposed EDG reliability prograab for meeting the station blackout rule, 10 CPR 50.63 in accordance with Regulatory Positions 3 and 6.
)
Activities associated with Regulatory Positions 1, Design Considerations and 2.3.1, Preoperational Testing will not have to be repeated by licensees or applicants which have completed such i
activities. Previous submittals by applicants, licensees, or l
other parties such as by the TDI owners Group, can be used where p
appropiate.
This regulatory guide will become effective 2*/0 days after issuance.
l l
\\
25 l
l l
f o*
j i l
REGULATORY ANALYSIS A separate regulatory analysis was not prepared for this regulatory guide.
The regulatory analysis prepared for the station blackout rula, NUREG-1109, " Regulatory /Backfit Analysis i
for the Resolution of Unresolved Safety Issue A-44, Station Blackout," provides the regulatory basis for this guide and examines the costs and benefits of the rule as implemented by the guide.
A copy of NUREG-1109 is available for inspection and copying for a fee at the NRC Public Document Room, 2120 L Street NW., Washington, DC.
Copies of NUREG-1109 may be purchased from the Superintendent of Documents, U.S. Government Printing Office, Post Office Box 37082, Washington, DC 20013-7802; or from the National Technical Information Service, Springfield, VA 22161.
--- References ---
l 1.
NUMARC B700, Appendix D draft dated August 28, 1989 2.
ANSI /ASME Standard OH-16, " Inservice Testing and haintenance of Diesel Drives in Nuclear Power Stations" ONb-1989 Addenda, May 31,1989.
i o
k i
l l
r 26 l
l l
.x_
.a-sua
-,-u.s*
-m"
--m's m-"=~-"*-*+~-**~~==>---~~a-< - - ~ - + - - + '
' ~ -
Y j,-
l l
~
4, s
.~
i 1
hf
!jji
$1 I
g-l, gji' lih!Ilf l
j,,
l i l !!il
!)l!I i
1 Il=a 1
I
[hll 1
lIlI
}
l l
ji g
s ]I II.!.
all!I 5
l p.ek
,, _ _ _ _ - _. ~ _. _ _ _ _.
-