ML19354E746
| ML19354E746 | |
| Person / Time | |
|---|---|
| Issue date: | 11/28/1989 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML19354E733 | List: |
| References | |
| REF-GTECI-A-44, REF-GTECI-B-56, REF-GTECI-EL, REF-GTECI-SC, TASK-A-44, TASK-B-56, TASK-OR, TASK-RE, TASK-RS-802-5 REGGD-01.009, REGGD-1.009, NUDOCS 9002010286 | |
| Download: ML19354E746 (34) | |
Text
-..
I s
i IN_giDSURE l',
Revision 3 Working Draft 11-28-89 REGULATORY GUIDE 1.9 (TASK RS 802-5) 1 I
SELECTION, DESIGN, QUALIFICATION, TESTING, 7WD RELIABILITY OF DIESEL GENERATOR UNITS USED AS CLASS 1E ONSITE ELECTRIC POWER SYSTEMS i
AT NUCLEAR POWER PLANTS A.
INTRODUCTION Electric Power Systems," of Appendix A, Criterion 17,
" General Design Criteria for Nuclear Power Plants," to 10 CFR Part 50, " Domestic Licensing of Production and Utilisation Facilities," requires that onsite electric power systems have l
suf ficient independence, capacity, capability, redundancy, and testability to ensure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure l
boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of J
postulated accidents, assuming a single failure.
l Criterion 18, Inspection and Testing of ' Electric Power i
Systems," of Appendix A to 10 CFR 50 requires that electric power systems important to safety be designed to permit appropriate periodic inspection and testing to assess the continuity of the systems and the condition of their components.
Criterion XI, " Test control," of Appendix B, " Quality
[
Assurance Criteria for Nuclear Power Plants and Puel* Reprocessing Plants," to.10 CFR 50 requires that -(1) measures'be provided for l
l Verifying or checking the adequacy of design by design reviews, l
by the use of alternative or simplified calculational methods, or by the performance of a suitable testing program and (2)- a test program be established to ensure that systems.and components perform satisfactorily and that the test program. include l
operational tests during nuclear power plant operation.
j b
4 1
9002010286 900122 FDR REVGP ERGNUMRC h
4 FDC 4
l 4,.'
1 m
m wy.e---t- - -
-p-*,,
..g.s.,yp%
--,-*e w,,
w-
-rm9,py,yg..
,,.veg.,
,,.m.
9ge g-.,-ww_4,,
,..--y au-aa
,_.,m.,_
_,,,, _ _ __mmw__
s 10 CTR 50.63, " Loss of All Alternating Current Power,"
requires that each light-water cooled nuclear power plant be able to withstand and recover from a station blackout (i.e., loss of offsite and onsite emergency ac power system) for a specified duration.
Section 50.63 identifies the reliability of ont.ite emergency ac power sources as being one of the main factors contributing to risk of core melt resulting from station blackout.
Diesel generator units have been widely used as the power source for the onsite electric power systems.
This regulatory guide provides guidance acceptable to the WRC staff for complying with the Commission's requirements that diesel generator units intended for use as onsite emeratney power sources in nuclear power plants be selected with sufficient capacity, be qualified, and be maintained to ensure availability of the required emergency diesel generator performance capability for station blackout and design basis accidents.
This guide has been prepared for the resolution of Generic Safety Issue B-56, " Diesel Reliability," and is related to Unresolved Safety Issue (USI),A-44, " Station Blackout."
The resolution of USI A-44 eetablished a need for an emergency diesel generator (EDG) reliability program that has the capabi3ity to achieve and maintain the emergency diesel generator reliability levels in the range of 0.95 per demand or better to cope with station blackout.
This guide recognizes that unless diesel generators are properly maintained, their capabilition to perform on demand may degrade. The cond; tion of the diesel units must be monitored during the t3st and maintenance programs,-and appropriate parametric trends must be noted to detect potential failures; l
appropriate prsvantive maintenance should be performed.
i (Insert for ACRS approval will be added later) l Any information collection activities mentioned in this regulatory guide are contained as requirements in 10 CFR Part 50, which provides the regulatory basis for this guide.
The l
information collection requirements in 10 CFR Part 50 have been l
cleared under OMB Clearance No. 3150-0011.
2 w.
1 i
B.
DISCUSSION A diesel generator unit selected for use in an onsite i
electric power system should have the capability to (1) start and i
acculerate a number of large motor loads in rapid succession while maintaining voltage and frep ency within acceptable limits, (2). provide power promptly to engineered safety features if a loss of offsite power and an accident occur during the same time j
period, and (3) supply power continuously to the equipment needed to maintain the plant in a safe condition if an extended loss of offsite power occurs.
4 j
IEEE Std 387-1984,N "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power supplies for Nuclear i
Power Generating Stations," delineates principal design criteria and qualification and testing guidelines that, if followed, will help ensure that selected diesel generator units meet performance requirements.
(IEEE Std 387-1977 was endorsed by Revision 2 of Regulatory Guide 1.9, " Selection, Design, and Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants.")
IEEE Std 387-1984 was developed by Working Group 4.2C of the Nuclear Power Engineering Committee (NPEC) of the Institute of Electriegl and Electronics Engineers, Inc. (IEEE), approved by NPEC, and subsequently approved by the IEEE Standards Board on March 11, 1982. Std 387-
"IEEE Standard 1984 is supplementary to IEEE Std 308-1974, criteria f,or class 1E Power Systems and Nuclear Power Generating Stations," and specifically amplifies paragraph 5.2.4, " Standby Power Supplies," of IEEE Std 308 with respect to the application of diesel generator units.
IEEE Std 308-1974 is endorsed, with certain exceptions, by Regulatory Guide 1.32, " criteria for Safety-Related Electric Power Systems for Nu' clear Power Plants."
IEEE Std 387-1984 also references other standards that contain valuable information. Those referenced standards not endorsed by a regulatory guide or incorporated into the regulations, if used, are to used in a manner consistent with current regulations.
A knowledge of the characteristics of each load is essential' i
l in establishing the bases for the selection of a diesel generator unit that is able to accept large loads in rapid succession.
The majority of the emergency loads are large induction motors.
This type of actor draws, at full voltage, a starting current five to i
eight times its rated load current.
The sudden large increases in current drawn from the diesel generator resulting from the startup of induction motors can result in substantial voltage reductions. The lower voltage could prevent a motor-from
- starting, i.e.,
accelerating its load to rated speed in the (1) Coples may be obtelned from the Institute of Electrical and Electronics Erwinners, Inc.,
lEtt Service Center, 645 Moes Lane, P.O. Box 1331, Piscotsway, NJ 08855 3
4 i
w._
r y---
,..-,..w
,_._._._,_m_m
required time, or could cause a running motor to coast down or stall.
Other loads, because of low voltage, might be lost if their contactors~ drop out.
Recovery from the transient caused by starting large motors or from the loss of a large load could cause diesel engine overspeed that, if excessive, might result in a trip of the engine, i.e.,
loss of the class 1E power source.
These same consequences can also result from the cumulative effect of a sequence of more moderate transients if the system is not permitted to recover sufficiently between successive steps in a loading sequence.
Generally it has been industry practice to specify a maximum voltage reduction of 10 to 15 percent when starting large actors from large-capacity power systems and a voltage reduction of 20 to 30 percent when starting these motors from limited-capacity power sources such as diesel generator units. Large induction motors can achieve rated speed in less than 5 seconds when powered from adequately sized diesel generator units that are capable of restoring the bus voltage to 90 percent of nominal in about i second.
Protection of the diese1' generator unit from excessive overspeed, which can result from an improperly adjusted control system or governor failure, is afforded by the immediate operation of a diesel generator unit trip, usually set at 115 percent of nominal speed.
Similarly, in order to prevent substantial damage to the generator, the generator differential current trip must operate immediately upon occurence of an internal fault There are other protective trips provided to protect the diesel generator units from possible damage. However, these trips could interfere with the successful functioning of the unit when it is most needed, i.e.,
during accident conditions.
Experience has shown that there have been numerous occasions whcn these trips have needlessly shut down diesel generator units because of spurious operation of a trip circuit.
consequently, it is important that measures be taken to ensure that spurious actuation of these other protective trips does not prevent the diesel generator unit from performing its function.
Ths uncertainties inherent in estimates of safety loads at the construction parait stage of design are sometines of such magnitude that it is prudent to provide a substantial margin in.
selecting the load capabilities of the diesel generator unit.
This margin can be provided by estinating the loads conservatively and sc3 ecting the continuous rating of the diesel generator unit so that it exceeds the sua of the loads needed at l
any one time.
A more accurate estimate of safety loads is possible during the operating license stage of review because detailed designs have been completed and component test and preoperational test data are usually available.
At this point the NRC permits the consideration of a somewhat less conservative 4
I i
I approach, such as operation with safety loads within the short-time rating of the diesel generator unit.
The reliability of diesel generators is one of the main factors affecting the risk of core damage from a station blackout event.
Thus, attaining and maintaining high reliability of diesel generators at nuclear power plants is necessary to reduce the probability of station blackout.
" Station Blackout,".the reliability of the diesel generator is one of the factors to be used to determine the length of time a plant should be able to cope with a station blackout.
If all other factors (redundancy of emergency d!esel generators, frequency of loss of of fsite power, and probable time needed' to restore offsite power) remain constant, a higher reliability of the diesel generators will result in a lower probability of a total loss of ac powkr (station blackout) with a corresponding coping duration for certain plants according to Regulatory Guide 1.155.
High reliability should be designed into the diesel generator units and maintained throughout their service lifetime.
This can be achieved by appropriate testing, maintenance, operating programs, and institution of a reliability program designed to monitor, improve, and maintain reliability at selected levels.
This guide provides'* explicit guidance in the areas of preoperational testing, periodic testing, reporting requirements, and valid demands and failures.
The preoperational and periodic testing provisions set forth in this guide provide a basis for taking corrective actions needed to maintain high inservice reliability of installed diesel generator units.
The data developed will provide an ongoing demonstration of performance and reliability for all diosal generator units after installation and during service.
This revision of Regulatory Guide 1.9 integrates into a single regulatory guide pertinent guidance previously addressed in Revision 2 of Regulatory Guide 1.9, Regulatory Guide 1.108, and Generic Letter 84-15, and it endorses guidelines set forth in IEEE Std 387-1984.
In addition, this guide describes a means for meeting the minimum diesel generator reliability goals in Regulatory Guide 1.155.
This guide also provides principal elements of a diesel generator reliability program designed to maintain and monitor the reliability level of each diesel 1
generator unit over time for assurance that the selected reliability levels are being achieved.
Concurrent with the development of this regulatory guide, and consistent with discussions with NRC staff, the Nuclear i
Management and Resources Council (NUMARC) has revised NUMARC 5
l i
i 8700, Appendix D, "EDG Reliability Program," to provide guidance on a reliability program to ensure that EDG reliability target l
levels selected for station blackout are maintained, and on actions to be taken if EDG reliability targets are not being met.
The NRC staff has reviewed this revised guidance and concludes that NUMARC 8700, Appendix D, provides guidance for an EDG reliabilty program in large part identical to those portions of 4
this guide which deal with an EDG reliability program and the monitoring of EDG reliability. Table 1 of this regulatory guide i
j provides a section-by-section comparision between Regulatory l
Guide 1.9, Revision 3 and NUMARC - 8700, Appendix D j
(Revised).
C.
REGULATORY POSITION Conformance with the guidelines in IEEE Std 387-1984 "IEEE Standard criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," provides a j
wethod acceptable to the NRC staff for satisfying the j
Commission's regulations with respect to design, qualification, i
and periodic testing of diesel generator units used as onsite electric power systems for nuclear power plants subject to the following:
1 1.
DESIGN CONSIDERATIONS The guidelines of IEEE Std 3c7-1984 should be supplemented as follows:
1.1 Section 1.2, " Inclusions," of IEEE Std 387-1984 should 4
be supplemented to include diesel generator auto controls, manual controls, and diesel generator output breaker.
i 1.2. When the characteristire af the required diesel generator loads are not accurata}/ known, such as during the construction permit stage of design, each diesel generator unit of an onsite power supply system should be selected to have a i
continuous load rating (as defined in Section 3.7.1 of IEEE Std 387-1984) equal to or greater than the sum of the conservatively
- estimated loads (nameplate) needed to be powered by that unit at i
any one time.
In the absence of fully substantiated performance characteristics for mechanical equipment such as pumps, the electric motor drive ratings should be calculated using conservative estimates of these characteristics, e.g., pump runout conditions and motor efficiencies of 90 percent or less and power factors of 85 percent or lower.
1.3. At the operating license stage of review, the predicted i
loads should not exceed the continuous rating (as defined in Section 3.7.2 of IEEE Std 387-1984) of the diesel generator unit.
i 6
1.4 Section 5.1.2, " Mechanical and Electrical capabilities,"
of IEEE Std 387-1984 pertains, in part, to the starting and load-accepting capabilities of the diesel generator unit.
In conformance with Section 5.1.2, each diesel generator unit should be capable of starting and accelerating to rated speed, in the required sequence, all the needed engineered safety feature and emergency shutdown loads.
The diesel generator unit design should be such that at no time during the loading sequence should the frequency decrease to less than 95 percent of nominal nor the voltage decrease to 1 mss than 75 percent of nominal (or a larger decrease in voltage and frequency may be justified for a diesel generator unit that carries only one large connected load).
Frequency should be restored to within 2 percent of the nominal in less than 60 percent of each load-sequence interval for step-load increase and in less than 80 percent of each load-sequence interval for disconnection of the single largest load, and voltage should be restored to within 10 percent of nominal within 60 percent of each load-sequence time interval. (A greater percentage of the time interval any be used if it can be justified by analysis.
However, the load-sequence time interval should include sufficient margin to account for the accuracy and repeatability of the load-sequence timer.) During recovery from transients caused by the disconnection of the largest single load, the speed of the diesel generator unit should not exceed the nominal speed plus 75 percent of the difference between nominal speed and the overspeed trip setpoint or 115 percent of nominal, whichever is lower.
Furthermore, the transient following the complete loss of load should not ceuse the speed of the unit to attain the overspeed trip setpoint.
1.5 Diesel generator units should be designed to be testable as discussed in Regulatory position 2.
The design should include provisions so that testing of the units will simulate the parameters sf operation (manual start, automatic start, load sequencing, load shedding, operation time, etc.), normal standby conditions, and environments (temperature, humidity, etc.)'that would be expected if actual demand were to be placed on the system. If prewara systems designed to maintain lube oil and jacket water cooling at certain temperatures or prelubrication systems or both are normally in operation, this woul'd constitute normal standby conditions for that plant.
1.5.1 The units should be designed to automatically transfer from the test mode to an emergency mode upon receipt of emergency signals.
- 4. 5. 2 The nit-e-shoute b: d::igned for c al;;;r ret: ;!
etartig and Icedleg-for t::t purp;;;; :nd for f :ter terting end-4eadleg-eet
- for - re: pen
- to plant :::rgen;y ;;ndition:. "'h; etart4ng and-10 ding rates :hould be con istent with the manufacture ':-re. W ati n:.
1 7
l
1.6 Design provisions should include the capability to test each diesel generator unit independently of the redundant units.
Test equipment should not cause a loss of independence between redundant diesel geraerator units or between diesel generator load groups.
1.6.1 Testability should be considered in the selection and location of instrumentation sensors and critical components (e.g., governor, starting system components). Instrumentation sensors should be readily accessible and designed so that their inspection and calibration can be verified in place. The overall design should include status indication and alara features.
1.7 Section 5.5.3.1, " Surveillance Systems," of IEEE Std 387-1984 pertains to status indication of diesel generator unit conditions. The guidance in this section should be supplemented as follows:
1.7.1 A surveillance system should be provided with remote indication in the control room for displaying diesel generator unit status, i.e., under test, ready-standby, lockout.
A seans of communication should also be provided between diesel generator unit testing locations and the main control room to ensure that the operators are cognizant of the status of the unit under test.
1.7.2 In order to facilitate trouble diagnosis, the surveillance system should indicate which of the diesel generator protective trips has been activated first.
128 Section 5.5.4, " Protection," of IEEE Std 387-1984 pertains to bypassing diesel generator protective trips during eneraenev conditions should be r vi :d t; r;;d interpreted as follows:
The diesel generator unit should be automatically tripped on an engine overspeed, inw oil pressure, and generator-differential overcurrent. AT1 other diesel generator protective trips other then :ngin: ;ver:p :0, 1;; ;il pr ::::: :nd g ncret:r differ:ntiel ;ver;;rr:nt should be handled in one of two ways (1) a trip should be implemented with two or more measurements for each trip parameter with coincident logic provisions for trip actuation, or (2) a trip may be bypassed under accident conditions provided the operator has sufficient time to react appropriately to an abnormal diesel generator unit condition.
The design of the bypass circuitry should include the capability for (1) testing the status and operability of the bypass circuits, (2) alarming in the control room for abnormal values of all bypass parameters (common trouble alarms may be.used),
8
~ - - -
1 and (3) annually resetting the trip bypass function.
Capability for automatic reset is not acceptable.
l Section 5.5.4 (2) of IEEE Std 387-1984, on retaining all protective devices during diesel generator testing, does not apply to a periodic test that demonstrates diesel generator l
system response under simulated accident conditions per Regulatory Position 2.2.5 and 2.2.12.
i 2.
DIESEL GENEP.S. TOR TESTING Section 3, " Definitions, "Section 6, " Testing," and Section 7, " Qualification Requirements," in IEEE Std 387-1984 should be supplemented as discussed below.
2.1 Definitions The following definitions # are applicable to the positions l
of this regulatory guide that address testing, reliability a
calculations, record-keeping, and reporting of performance.
]
Start demands:
All valid and inadvertent start demands, H
including all start-only demands and all start demands that are followed by load-run demands, whether by automatic or manual initiation.
A start-only demand is a demand in which the energency generator is started, eMehe ;;;;ifi:d v lt;;; 07.0 fr:p;r.;y, but no attempt is made to load the emergency diesel generator. See " Exceptions" below.
\\
start failures:
Any failure within the energency-generator systen that prevents the generator from achieving specified frequency (or speed) and voltage is classified as a valid start failure. ( For the monthly surveillance tests, the energency diesel generator can be brought to rated speed and voltage in a time that is recommended by the manufacturer to minimize stress J
and wear. Similarly, if the aenerator fails to reach rated sneed and voltaae in the orecise time reauired by technical specifications the start attemet is not considered a failure if, the test demonstrated that the cenerator would start and run in l
an emeraency.) See " Exceptions" below.
Any condition identified-in the course of maintenance inspections (with the EDG in the standby mode) that would definitelv have resulted in a start failure (2) Additionet useful Inforeetion on testire and test definitions can be foural in the festry wide Plant Pe*formance Indicator Program (PPIP) and the ADE Olm Port 4, alrservice Testire and nelntenance of Dieset Drives et Nacteer Power Plants.* Copies can be obtelned by contacting IbP0 or the ANE.
(3) These definitions are constetent with the reportirg rules for Irdstry wide Plant Perforamnce Indicator Program (PP!P).
l 9
~ - -
- -.. - -.... -. - - - - - ~ - - -
l s
Load-run demandst To be valid, the load-run deoend attempt must follow a successful start and meet one of the following criterlat (See " Exceptions" below.)
A load-run of any duration that results from a real l
o (e.g. not a test) automatic or manual signal.
o A load-run test to satisfy the plant's load and duration test specifications.
other operations (e.g., special tests) of in which the o
diesel generator is planned to run for at least one hour with at least 50 percent of design load.
Load-run Failurest A load-run failure should be counted when the emergency diesel generator starts but does not pick up load q
and run successfully. Any failure during a valid load-run demand 1
should be counted. See " Exceptions" below. For monthly i
surveillance tests, the diesel generator can be loaded at a rate l
that is recommended by the manufacturer to minimize stress and wear. Similarly, if the generator fails to load in the precise time required by technical specifications, the load-run attempt is not considered a failure if the test demonstrated that the generator would load and run in an emergency. Any condition identified in the course of maintenance inspections (with the EDG in the standby mode) that definitely would have resulted in a i
load-run failure if a demand had occurred should be counted as a e
valid load-run demand and failure, Exceotions: Unsuccessful attempts to start or load-run should not be counted as valid demands or failures when they can be definitely attributed to any of the followings o spurious operation of a trip that would be bypassed in the emergency operation mode (e.g. high cooling water temperature trip) o Malfunction of equipment that is not required to operate during the emergency operating mode (e.g.,
synchronizing circuitry).
o Intentional termination of the test because of alarmed or observed abnormal conditions (e.g., small water or oil I
leaks) that would not have ultimately resulted in significant emergency generator damage or failure, component malfunctions or operating errors that did not o
prevent the emergency diesel from being restarted and brought to load withing a few minutes (i.e., without i
corrective maintenance or significant problem diagnosis) 6 10 3
U i
- a f
- ::;r; t: ;t;rt f; :;;ing n ;;t;;
- t;;;ti;)
- in;dv;rt;nt : tert d;;:nd 'if ;;t;;t;d ;nly j
en : 1;;; ;f ;ff;it; p;u;r), if r;;t:rt;d ;;;;;11y rithin fiv; sinut:; fr;; th: fir;t ; tert ;tt;;pt.
J
- If th
- 00 f il; to r;;;h r;t;d ;;;;d ;nd v;1t;;; ;nd
- t;d 1;;d in th; pr;;ia; ti;; requir d by 7;;hni;:1 Op;;ifi;;ti;n:, th; ; tert ett ;pt :nd 1;;d run
- tt;;pt ;h;;1d n;t h; ;;n;id
- r:0 f ilur; if th: 0;;t l
0;;;n:tr;t;d th:t th; 200 ;;;14 h;v; ;t:rt;d ;nd 1;;d:d in l
- n ;;;r;;n;y :nd ;h;;1d th;r:for; b r;t in;d in th; 200 l
veilchility d:t: h;;;.
)
o A failure to start because a cortion of the startina system was disabled for test nurgpses, if followed by a f
successful start with the startina systen in its garagl i
aliannant.
Each emergency diesel generator failure that results in the emergency diesel generator being declared inoperable should be counted as one demand and one failure. Exploratory tests during i
corrective maintenance and the successful test that is run following repair to verify operability ' prier t; d;;1; ring
- p;r;hility) should not be counted as demands or failures ghgD the EDG has not been declared oeerable aamin.
I I
2.2 Test Descrietions The following test descriptions are applicable to Regulatory Positions 3 and 4.
Table 2 describes the sequence of qualifica-tion and surveillance testing. Detailed procedures should be q
provi6ed for each test defined in Regulatory Position 2. The.
procedures should identify special arrangements or changes in j
l normal system configuration that must be made to put the EDG i
under test. Junpers and other non-standard configurations or arrangements should not be used subsequent to inatial equipment i
startup testing.
2.2.1 Start-Test
Demonstrate proper startup from ambient l
conditions and verify that the required design voltage'and frequency is attained.
For these tests, the diesel generator can be slow-started, be prelubricated, have prewarned. oil and water
.i circulating, and should reach rated speed on a prospecified l
schedule that is selected to minimize stress and wear.
)
2.2.2 Load-Run Test Demonstrate full-plant emergency load carrying capability, or 90 to 95 percent of the continuous rating of the EDG, for an interval of not less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and until temperature equilibrium has been attained.
This test may be accomplished by synchronizing the generator with offsite power. :
The loading and unloading of a diesel generator during this test 11
should be gradual and based on a prescribed schedule that is selected to minimize stress and wear on the diesel generator.
2.2.3 Fast-Start Test Demonstrate that each diesel generator unit starts from ambient conditions (if a plant has normally operating prelube and prewarm systems, this would constitute its ambient conditions) and verify that the diesel generator reaches stable required voltage and frequency within acceptable limits and time, as defined in the plant technical specifications.
2.2.4 Legg-of-offsite Power (LDOP) Test:
Demonstrate by simulating a loss of offsite power that (1) the emergency buses are deenergized and the loads are shed from the energency buses and (2) the diesel generator starts on the auto-start. signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, energizes the auto-connected shutdown loads through the load sequencer, and operates for a miniaua of 5 minutes.
2.2.5 SIAS Test:
Demonstrate that on a safety injection auto-start (SIAS) signal, the, diesel generator starts on the auto-start nignal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, and operates on standby for greater than or equal to 5 minutes.
2.2.6 combined sIAs and LOOP Test:
Demonstrate by simulating a loss of offsite power in conjunction with SIAS that (1) the emergency buses are deenergized and loads are shed from the emergency buses and (2) the diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, energizes auto-connected loads through the load sequencer, and operates while loaded with the auto-connected loads for greater than or equal to 5 minutes.
2.2.7 sinale-Load Reiection Testt Demonstrate the emergency diesel generator's capability to reject a loss of the largest single load and verify that the voltage and frequency requirements are met and that the unit will not trip on overspeed.
2.2.8 Pull-Load Reiection Test:
Demonstrate the diesel generator's capability to reject a load equal to 100 percent of the automatically sequenced loads, and verify that the voltage requirements are met and that the unit will not trip on overspeed.
2.2.9 Endurance and Marain Testt Demonstrate full-load carrying capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, of which 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> should be at a load equivalent to 110 percent of 12 I
the automatically sequenced loads of the diesel, and 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> at a load equivalent to the automatically sequenced loads. Verify that voltage and frequency requirements are maintained.
2.2.10 Hot Restart Test:
Demonstrate hot restart functional capability at full-load temperature conditions by, verifying that the diesel generator starts on a manual or auto-start signal, attains the required voltage and frequency within acceptable limits and time, and operates for longer than 5 minutes.
2.2.11 Synchronizina Test:
Denonstrate the ability to (1) synchronize the diesel generator unit with offsite power while the unit is connected to the energency load, (2) transfer this load to the offsite power, (3) isolate the diesel generator unit, and (4) restore it to a standby status.
2.2.12 Protective-Trie BVeans Test:
Demonstrate that all automatic diesel generator trips (except engine overspeed, oil pressure, and generator differential) are automatically bypassed upon a safety injection actuation signal.
i 2.2.13 Test Mode chance-over Test:
Demonstrate that with the diesel generator operating in the automatic test mode while connected to its bus, a simulated safety injection overrides the test mode by (1) returning the diesel generator to standby operations and (2) automatically energizing the energency loads from offsite power.
Demonstrakethat,bystarting 2.2.14 Redundant Unit Test:
and running both redundant units simultaneously,iesel generatorpotential conson failure modes that may be undetected in single d unit tests do not occur.
2.3 Pre-Deerational and Surveillance Testina Table 2 relates pre-operational and surveillance tests to the anticipated schedule for performance (e.g., pre-operational, -
i monthly surveillance, 6-month, scheduled refueling period, and 10-year testing).
All tests should be in general accordance with the manufacture's recomendations for reducing engine wear, including cool-down operation at reduced power, followed by postoperation lubrication.
2.3.1 Pre-ooerational Testina:
A pre-operational test program should be implemented for all diesel generator systems following assembly and installation at the site.
This prgran should include the tests identified in Table 2 and'be carried out per the test definitions in Regulatory Position 2.2.
13 I
m
In addition, demonstrate through a minimum of 25 valid start-and-load demands (or tests) without failure on each installed diesel generator unit that an acceptable level of reliability has been achieved to place the new EDG into an operational category.
2.3.2 surveillance Testina.:
After the plants are licensed g
(after fuel load), periodic surveillance testing of each diesel generator must demonstrate continued capability and reliability of the diesel generator unit to perform its intended function.
When the EDG is declared operational in accordance with plant technical specifications, the following periodic test program should be implemented.
2.3.2.1 Monthiv Testina:
After completion of the diesel generator unit reliability demonstration during preoperational testing, periodic testing of diesel generator units during normal plant operation should be performed.
Each diesel generator should be started and loaded as defined in Regulatory Positions 2.2.1 and 2.2.2 at least once in 31 days (with maximum allowable extension not to exceed 25 percent of the surveillance interval) on a staggered basis.
2.3.2.2 six-Month for 184 days) Testingt In order to demonstrate the'caDability of the EDG to provide the necessary power to mitigate the large-break loss-of-coolant accident coincident with loss of offsite power, once every 6 months each diesel generator should be started from standby conditions to verify that the diesel generator reaches stable rated voltage and frequency within acceptable limits and time as specified in plant Technical specifications, and operates for 5 minutes (see also Table 2).
2.3.2.3.
Refueline outaae Testina overall diesel generator unit design capability should be demonstrated at every refueling outage by performing the tests identified in Table 2.
2.3.2.4.
Ten-Year Testina Demonstrate that the trains of standby electric power are independent once per lo years (during a plant shutdown) or after any modifications that could affect diesel generator independence, whichever is the shorter, by starting all redundant units simultaneously to help identify certain common failure modes undetected in single diesel generator unit tests.
2.3.3 corrective Action Testinat Following the occurrence and correction of a degrading situation as defined in Regulatory Position 3.5 for a problem EDG, the surveillance testing interval for that EDG should be reduced to no more that-7 days, but no less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This test frequency should be maintained 14
s i
until seven consecutive failure-free start and load-run tests have been performed to demonstrate the effectiveness of corrective actions taken and recovery of reliability levels.,At
,that time, monthly surveillance testing can be resumed. However, 1
if subsequent to the seven failure-free. tests, one or more additional failures occur such that there are again four or rore failures in the last 25 tests, the testing interval should seein be reduced as noted above and maintained until seven conscusti%s failure-free tests have been performed. The EDG undergoint 1
corrective action testing should be considered " operable" auless other license requirements necessitate declaring the EDG inoperable.
3.
EDG RELI_ ABILITY GOALS AND CALCULATIONS Reliability goals for emergency diesel generators (EDGs).
and related calculational methodology are 4.s follows:
L 3.1 Reliability Goals for Station Blackout i
In order to comply with 10 CFR 50.63, " Loss of All Alternating Current Power," and the guidance in Regulatory Guide 1.155, " Station Blackout," th6 minimum EDG reliability should be targeted at 0.95 or 0.975 per demand for each EDG for plants in emergency ac (EAC) Groups A, B, and C and at 0.975 per demand for each EDG for plants in EAC Group D (see Table 2 of Regulatory Guide 1.155).
Section 3.2 erill be deleted and sections will be renumbered.
0.2 0;;icn B;;i; 1;;id:nt A;;;;;= nt A qu:ntit;tiv; 500 r;110bility target f;; d;;ign b;;i; i
- id;nt; h0
- n;t i;;n ;;t
- bli;hed. If en 200 relictility-
- ti;;t; i
- n;;ded f;r pl;nt
- p;;ific inA;, it ;h;uld-be
- 1;ul:ted u:ing nly th; : :::;;ful."i;;; dict;" : tert;, wh;r; i;;; dict; i; defin;d :: the ti;; r;quir:0 f;r th: 200 t; b; evcilable for d;;ign b :i 1;;': ;f ;;;1ent ;;;ident; end Oth;;
limiting plant-trenzient ;;;rgen;y ;1;;tri;;l 1;;d < Ther:f;r;,
del;y;d ; tarts (i.., : tert;. that cre r;; tarted ::nu lly within 5-minute: fr;; th; fir:t ; tert ettcapt) d;;;;d
- ful f;r station black;;t a;;;;;;;nt
- p;r ;x;;pti;n; n;ted in 0 gul
- teey rc;iti;n 2.1 h;;1d n;t b; ;;n;ider;d f;r d;;ign b
- i;
- id:nt
- nt.
i 3.2-Diesel Generator Reliability Calculations
)
Calculation of EDG reliabilities should be based on the definitions consistent with the reporting rules for thel Industry-l wide Plant Performance Indicator Program'or equivalent and the definitions in Regulatory Position 2.1.
15 l
4 The evaluation of a nuclear unit's EDG reliability should take into account the demand and failure experience of all EDGs that provide emergency AC power for the unit. Calculation of EDG rel.iability levels should be based on-the last 50 and 100 demands in the following nanner:
- 1) Start Reliability (SR) is defined as P
I SR =
Number of Successful Starts Total Number of Valid Start Demands 1
- 2) Load-run Reliability (LR) is defined'as:
LR =
Number of Successful Load-runs Total Number of Valid Load-Run Demands (SR) *'(LR)'
- 3) EDG Reliability
=
Table 3 provides guidance for combining data from individual EDG performance to arrive at a nuclear unit reliability estimate.
TABLE 3.
COMBINING EDG FAILURE EXPERIENCE EDG Configuration Method'for Combinina
-1 2,3,4 EDGs dedicated to Use combined failure nuclear unit experience of all EDGs.
1 2 3,4 EDGs shared between Use combined failure between units experience of-all EDGs for all units.
1 dedicated EDG at each Each unit uses the combined unit and 1 shared between failure experience of its.
i units dedicated =EDGs and the shared EDG.-
2 dedicated EDGs at each unit Each unit uses the combined and~1 shared between units
-failure experience of itsL _ _
dedicated EDGs and the shared-EDG.
2 dedicated EDGs and 1 FPCS Use the combined? failure EDG or diverse EDGs within the experience of similar.EDGs and same unit separately consider the-
= failure-experience of different EDGs.
The calculations discussed above will-be point estinates of reliability and will have inherent uncertainties because of-the sample size available. A point estimate reliability calculation 16
P for a 50-demand sample that falls below 92. percent, or for a 100-demand sample that falls below 93 percent, is an indication that the true underlying reliability may have fallen below 95 percent. A point estimate reliability calculation for a 50-demand sample that falls below 94 percent, or for a 100 demand sample that falls below 96 percent, is an indication that the true underlying reliability may have fallen below 97.5 percent.
Ac.tions to be taken are discussed below.
3.3 EDG Reliability Procram Monitorina Data from surveillance tests and unplanned starts can be used to estimate achievement of: a nuclear unit's EDG reliability L
targets and also to detect a deteriorating situation for both the reliablity program and individual EDGs. Failures encountered in the last 20, 50, and 100 demands can'be related to nuclear unit target reliabilities as in Table 4 Table 4 Action Levels and Remedial Actions Target Action Demand Failure Remedial Reliability Level
, Combinations'(All EDGs)
Actions
.95 Mild 3/20 gr 5/50 gr 8/100 (1)
Strong 5/50 add 8/100 (2)
.975 Mild
'3/20 SI 4/50 QI 5/100 (1)
Strong 4/50 ADA S/100 (2)
(1) Take action per Figure 1 for a Mild Action Level.
(2) Take action per Figure 1 for a Strong Action Level.
3.4 Problem EDG I
A problem diesel is defined as an individual'EDG eperiancing i or more failures in the last 20 demands. Should this case l
arise, a Mild Action Level would be declared and the actions defined in Figure 1 would be undertaken. If the problem EDG experiances an additional failure, such that there have been 4 failures in the last-25 demands, then a strong Action Level vould be declared.
Following completion of corrective programmatic actions as defined in Steps 1 4 of column 3 (Strong Action Level) of s
Figure 1, restoration of EDG reliability levels for any problem-EDG (i.e. a single EDG exhibiting 4/25 failures) should be i
demonstrated by conductiong seven consecutive failure free starts-and load-run tests as-defined in Regulatory Position 2.3.3. If 1
during this correective action testing, that EDG experiances another failure, the seven consecutive failure free tests must be repeated until tref are sucessfully completed. All starts and 1-17 i
4-i s
load-runs performed during the corrective action testing should be included in the EDG reliability data base so long as the EDG is declared operable. Exploratory tests conducted while the EDG is declared inoperable should not be included in the data base.
If the same EDG experiances an additional failure such that there have been 5 failures in the last 25 demands, consideration should be given to declaring that problem EDG inoperable in accordance with plant-Technical Specifications and determining if a overhaul of that EDG is necessary based on the nature of re-occuring failures and level degraded reliabilty.
If reliability levels have degraded to the point where a major overhaul of the problem EDG is deemed necessary, then following such major overhaul, seven consecutive failure-free tests (per Regulatory Position 2.2.3) should be successfully completed in order to demonstrate restored reliability level prior to returning to that EDG to normal monthly surveillance test frequency. This data should also be included in the nuclear unit EDG reliability test database.
3.5 Recovery from a strona Action Level (EDG Procram)
Recovery from a Strong Action Level should be based on continued monitoring of the nuclear unit EDG reliability level and-the demand-failure combinations shown in Table 4. The plant would not revert to a' reduced action level until the number of demand-failures was adequately reduced, or two years from the last failure while in an exceedance,-which ever occurs first.
However, prior to reverting to a no exceedance state, all identified improvement actions must be completed-within the two year period.
Should a plant continue in an exceedance state because of new failures, these failures should be. evaluated against improvement actions previously identified for implementation. The purpose of this evaluation would be to assess whether prior-conclusions and attendant recommendations should be revised due' to continued failures.
4.
RECORDKEEPING GUIDANCE Guidance from Section 7.5.2, " Records and Analysis,* of IEEE Std 387-1984 should be supplemented as follows:
All demands, as defined in Regulatory Position 2.1, should be logged and' continually updated for each diesel generator. based on surveillance testing and experianced failures.
The log should be maintained in auditable form and should include sufficient detail to permit review ~and audit of reliability calculations in accordance with Regulatory Position 3.3. The log should also 18 i
include a recalculated nuclear unit reliability estimate following occurrence of a load-run= demand.
Maintenance, repair,_and out-of-service time as well as cumulative maintenance and operating data (hours of operation) should also be logged.
The out-of-service time should include the hours the diesel generator is removed from service (declared' inoperable) for preventive maintenance, corrective maintenance following a failure, modifications,_or for support systems out of service.
The out-of-service time for diesel generators during refueling need not be logged if the diesel generator is i,
electively removed from service (i.e., no failure has occurred).
After a_ failure experienced during refueling, the actual. time spent in corrective maintenance should be logged as out-of-service time.
s 5.
REPORTING CRITERIA l
When reporting EDG failures, all plants should conform with l
the provisions of 10 CFR 50.72, 10 CFR 50.73, 10 CFR 21, plant l
technical specifications, and other current NRC reporting regulations, j
If a mild action level condition comes about, the NRC on-site inspector should be notified and a report prepared within-30 days that would be maintained at the site for-NRC audit. This-report should include the following information:
j 1.
A summary of all tests within the time period over which the last 20,50 and 100 valid tests were performed, with emphasis on those tests with failures.
2, A description of the failuras, underlying causes,,and-l corrective actions taken.
3.
The nuclear unit EDG reliability level per Regulatory
- l Position 3 at the time a mild action level condition I
was entered.
l 4.
An assessment of.the corrective actions to be taken with l
respect to restoration of reliability: level, j
1 If a strong action level situation comes about, both the NRC:
i Region and Headquarters should be notified within 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s-and y
the activities outined in column 3 of Figure.1 should be-
-l undertaken.
A schedule for implementing corrective actions and a 4
report containing the above four items should_be-submitted to the NRC within 30 days..
j i
i 19 i
t 4
6.
EMERGENCY DIESEL GENERATOR RELI ABILITY PROGRAM Regulatory Guide 1.155 describes a means acceptable to the NRC staff for meeting the requirements of 10 CFR 50.63 and identifies the need for an EDG reliability program designed to maintain and monitor EDG reliability levels to ensure that selected reliability levels are being achieved.
This section provides guidance regarding the principal elements for such a reliability program. Although current industry practices may group activities-discussed below somewhat differently,-existing EDG reliability and maintenance programs j
should encompass the elements discussed below..
The principal elements of an EDG' reliability. program-(or i
activities) should encompass.the following:
1.
An EDG reliability target level corresponding-to that selected for compliance with 10 CFR 50.63.
2.
A surveillance clan'that identifies EDG subcomponents and subsystems, surveillance i
parameters, surveillance frequency, and incorporates manufacturer recommendations.-
This plan should define the monitoring i
requirements to be used by the other elements j
of the EDG reliability program.
i 3.
Performance monitorina of important parameters on an ongoing basis to obtain information on the state of the EDG and i
components so that precursor conditions are identified prior to failure.
This information can also be-used for maintenance-related activities.
4.-
A maintenance Drearam designed for both preventive and corrective actions based on operational history and past maintenance activities, vendor recommendations, spare parts considerations, and the-results of surveillance monitoring.
i 5.
Failure analyses, including root cause analyses, that have been developed for the onsite EDGs and that can be used~to reduce failures and root causes to corrective a
actions for avoidance in the future.
6.
Problem closeout Drocess that establishes criteria for closeout of reliability and 20 l
n.
operations-related problems, and that provide for follow-up surveillance to ensure that the i
problem has been corrected and that i
latent long-term effects (i.e., excessive wear) will not recur.
1 7.
A data acauisition system (or equivalent neans) that provides for data capture, storage, and retrieval capability.to all elements of the reliability program.
8.
Defined resDonsibilities and nanaaement SYprsicht to ensure that the reliability j
program elements are functioning effectively and that target reliability-levels are being sustained.
I The interaction of the respective EDG reliability program l
elements is shown in Figure-2.
-i The principal elements of an EDG reliability program as defined above are provided as' guidelines.-Other reliability' programs that include the same or similar activities may also be used,suchp9s the TDI owner's Group maintenance and surveillance activities.
Such programs should be reviewed for consistency-j with Regulatory Guide 1.155 and this regulatory guide.
6.1 Diesel Generator Ra'llability Tarcet Regulatory Guide 1.155 provides guidance on selecting an EDG reliability target. Regulatory Position 2 of-Regulatory Guide-1.9, Revision 3 provides guidance for-periodic testing related to determining EDG reliability levels. Regulatory' Position 3 of Regulatory Guide 1.9, Revision 3 provides guidance for. estimating reliability levels being achieved and corrective actions that should be taken to correct a deteriorating situation.
l t1 report admitted 5/1/86, J. Georse(TDI)
(4) Revislao 2, Appendia 2, " Design Review /eustity Valldettene to R. Dentantuac) was utill ed in revising plent specific Technicet Specifications.
6.2 Diesel Generator Surveillance Plan t
1 A surveillance plan should: identify the EIXi components. (or subsytems) and support systems. Figure 3 provides an example of
. j typical components and support systems that should be considered 1
defining an EDG boundary. Those components whose function'is solely to support the EDG are to be viewed as within the'EDG-boundary. The systems that provide support to the EDG and perform +" "- ";,r*
functions are outside the boundary, with the 21
+
E
understanding that the boundary interface function must be maintained. IEEE Std 387-1984-and ANSI /ASME OM-16 provide similar definitions of components and system boundaries and may also be used as guidance.
A surveillance plan should consider the following:
1.
Reliability considerations related to EDG component and support systems design and operational characteristics. Significant common cause j
effects should also be identified.
1 i
2.
Engine manufacturers' surveillance recommendations.
- 3..
Failures caused by surveillance activities.
4.
Engine and component daaradation considerations 5.
Frequency and nature of surveillance.
6.
Prior operatiohal history as derived from on-site EDG experience and from other engines of the l
same make at other nuclear plants.
This surveillance plan should provide the basis for i
performance monitoring, maintenance activities, and failure analysis procedures.
j Figures 4 and 5 provide examples of types of periodic surveillance activities that have proven effective. When i
performing such surveillance, it is important to capture the actual values of critical parameters since such data would be extremely useful in carrying out failure analyses, as well as providing data for long-tern EDG condition monitoring.-
1 6.3 EDG Performance Monitorina Performance monitoring and data trending.should be based on considerations discussed in Regulatory Position 6.2 and should be applied to equipment that is run on a continual or on a near continual basis. The purpose is to monitor certain-parameters on an ongoing basis in order to obtain information about'the state of physical conditions.that may potentially impact the operability of a pisce-of equipment, and which could be used for trending purposes. Such. trends may signal a degradation in a s
particular condition. Evaluation of such conditions may provide a means of detecting onset of-potential failure, thereby allowing corrective actions to be taken before actual failure occurs. The-examples shown in Figures 4 and 5 should be developed frc; based 22 l
1
\\
l c
i
~t
~
I ED on-site operational experience, industry-wide applicable data, and manufacturers' recommendations.
6.4 EDG Maintenance Procram i
A maintenance program should be based on reliability considerations and should actively interface with other elements of the EDG reliability pro cam.
EDG maintenance programs should-be based on the following ; inciples' a.
Recommended vendor maintenance actions and schedule for implementation.
b.
Site-specific operational history and reliability characteristics of the EDG components and. support systems.
c.-
Spare parts considerations to ensure that such parts are in stock when needed, with ample-spares.
d.
Such factors as repair time, potential failure severity, and recurrence of known failures should be utilized in scheduling maintenance, e.
Long-term maintenance scheduled during refueling outages should,be based on engine performance experienced..
6.5 EDG Failure Analysis and Root Cause Investiaation An EDG reliability-program should. have failure: analysis procedures designed to systematically reduce problems or failures to corrective actions.
Failure analysis starts from the most apparent symptoms and progresses to determination of underlying causes or-inc,ipient l
conditions. Root cause analysis goes further and attempts to find underlying causes relating to design, engine operation or maintenance.
Figure 6 is an example of a systematic approach to failure and root cause analyses.
When performing a root cause analysis, the method of.
j.
categorizing underlying causesiis important so that correctiveL action can be-integrated into both plant activities and the EDG reliability program. A typical classification system should consider the following:
a.
Manufacturing and design b.
Quality control
~
23 e
4
~
.=
-..~,,
,,-a 4
c.
procedures d.
Training i
e.
Communication f.
Human factors
- 6. 6 - Problem closecut An EDG reliability program should have a problem closeout:
process established to ensure that-effective solutions have been found and implemented.
Continued recurrences should-.be examined from the viewpoint of whether the EDG reliability. is adequate-to meet station blackout requirements and whether near-term engine teardown and rebuilding should be scheduled.
6.7 Data Cacture and Utilization An EDG reliability program should have-a data collection,-
storage, and retrieval system'that can'be accessed by personnel assigned to monitoring and maintaining the EDGs.'The data system does not need to be a special-purpose dedicated system, but access to " current" information should be a major consideration.
Typical types of information.that should be included are as follows:
l i
EDG-specific-testing'and failure'h'istory
'{
a.
b.
Surveillance test results c.
Failure and root cause analysis results d.
Manufacturer's recommendations and related data e.
Input from preventive maintenance activities y
f.
Input from corrective maintenance activities-j g.
Industry-wide operating experience:
6.8 Assianed Resoonsibilities and Manacement Oversicht An EDG reliability program should have. clear assignment of i
responsibility for carrying out the respective program elements.
such assignments should be based on properly trained and qualified staff to perform the activities needed, and should ensure that qualified personnel are assigned.
24
- 6
A management oversight function (or procedures) should also be available to review the effectiveness of the reliability program and reliability levels being sustained,. independent of the day-to-day EDG activities. Such a plant-wide function may already exist; however, a routine evaluation of EDG performance should be incorporated into the plant performance review process.
D.
IMPLEMENTATION The purpose of this section is to provide information to applicants and licensees.regarding the NRC staff's plans for using this regulatory guide.
Except in those cases in which an applicant proposes an acceptable alternative method for complying with the specified portions of the Commission's regulations, the methods described in Reculatory Positions 1 and 2 of,this guide will be used in the evaluation of selection, design, qualification, and testing of diesel generator units used as onsite electric power systems for.
_j the following nuclear power plants:
- l
- 1. Plants for which the construction permit is issued-after the issue date of the final guide,
'l
- 2. Plants for which the operating license application is docketed 6 months or more after.the issue date of the final guide,
- 3. Plants for which the licensee voluntarily commits to the provisions of this guide.
The NRC Staff intends to ;pply gag Regulatory Positions C.3 and C.6 of this Regulatory. Guide te in evaluatina the adecuacy of EDG reliability levels for existina EDGs, and in evaluatina tha adecuacy of tc r;vi;; existing or proposed EDG reliability programs for determining conformance with 10'CFR 50.63, " Station Blackout".
l t
Activities associated,with Regulatory Positions'1, Design i
considerations and 2.0, Diesel Generator Testing, such as 2.3.1, Preoperational Testing will'not have to be repeated by licensees 1
or applicants which have completed such activities. Previous submittals by applicants, licensees, or otherl parties such as_by i
the.TDI owners Group, can be used where appropiate.
The definitionr in Reculatory Position 2.1 are identical to definitions used in INPO's Industry-wide Plant Performance Indicator Procram.
25 l
t 1
I
- = _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _....
This regulatory guide will become effective 270 days after issuance.
REGULATORY' ANALYSIS A separate regulatory analysis was not prepared for this regulatory guide.
The regulatory analysis prepared for the l
station blackout rule, NUREG-1109, " Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station l
Blackout," provides the regulatory basis for this guida and examines the costs and benefits of the rule as implemented by the guide.
A copy of NUREG-1109 is available for inspection and:
copying for a fee at the' NRC Public Document Room, 2120 L Street i
NW., Washington, DC.
Copies of NUREG-1109 may be purchasedLfrom the Superintendent of Documents, U.S. Government Printing i
d(s office, Post Office Box 37082, Washington, DC 20013-7802; or from the National Technical Information Service, Springfield, VA 22161.
1
--- References ---
]
1.
NUMARC 87-00, Appendix D draft dated November 6, 1989 2.
ANSI /ASME Standard OM-16, " Inservice Testing and Maintenance of Diesel Drives in Nuclear Power Stations" OMb-1989' Addenda, May 31,1989.
.j i
I J
i l
i 26 l
i
l
.s (11 8649)
TABLE-1 CROSS-REFERENCE BETWEEN REGUIATORY GUIDE 1.9, REV.-1 AND NUMARC-8700, APPENDIX D RG 1.9,REV 3 NUMARC-8700 SECTION APPENDIX D
v Section A, Introduction (Use RG 1.9,Rev.3)
Section B, Discussion (Uno RG 1.9,Rev.3)
Section C, Regulatory Positions C.1, Design considerations (Uses RG 1.9,Rev.3)
C.2, Diesel Generator Testing C.2.1, Definitions D.1 C.2.2, Test Descriptions (Use RG 1.9,Rev.3)
C.2.3, Preoperational-and' surveillance-Testing (Use RG 1.9,Rev.3) 1 C.3., EDG Reliability Goals and j
Calculations C.3.1, Reliability Goals for 880 WUMARC B700, Sec. 3.2.4 c.3.2, Diesel. Generator Reliability calculax. ions D.2.2 C.3.3, EDG Reliability Program.
Monitoring D.2.3,D.2.4 4
C.3.4, Problem EDG D.2.4.4' C.3.5, Recovery From A Strong Alert D.2.4.3 (EDG Program)
C.4, Record Reeping Guidance D.2.1 C.5, Reporting Criteria D.2.5 C.6, EDG Reliability Prcgram D.3 C.6.1, Diesel Generator Reliability Target D.2.3 C.6.2, Diesel Generator Surveillance Plan D.3.1-C.6.3, EDG Performance Monitoring.
D.3.2 C.6.4, EDG Maintenance Program D.3.4 C.6.5, EDG Failure Analysis and
' Root Cause Investigation D.3.5 i
.C.6.6, Problem close-out D.3.6 C.6.7, Data Capture & Utilisation D.3.3 C.6.8, Assigned Responsibilities and Management oversight (Use RG'1.9,Rev.3) section D, Implementation Introduction
0 a
i TABLE 2
- s.
N Pat OPERA 11tBAL & REtWEILLABCE TESTING j
Befer to tefusting PesWonC22 Pre-retienal et it.
Month 1 Eth 96 Tear for DeseetotIon Lest aa+ar lesta 3 13,,
1ests
_lasia_
hbMost R >>
R-hh'e'ves.
R >>
R c.t.t.3
- i Fest*8 tert fest R
R C.t.t.6 Less of Offatte Power (LDDP) Test R
R 2
C.t.t.5 j
S1AS test R
R C.2.2.6 f
Castined 8tAS & LaCP Test X
X Ird Lead Rejectlen Test R
R i
u I sed Rejection Test X
R C.t.t.9 trerence and margin Test R
R C.I.t.10 il act Re etert feet I
X C.2.2.11 Synchrentaire Test R
h C.t.I.12 Protective frip Bypeas Test R
R C.I.R.13 1
Test mese Charge Over fast X
R C.I.t.14 teessant Smit Test R
R (e) Tech Spec respirements take precedent to this table.
(b) Inctudert in each of the 5 tests descrfbed in segutetery post tien C.R.3.1 '
l a
e r
W
f s
t 4
- m Idilig li I"Hgp.4ui=.yn..j!!IilT!limuillad l D
j i
i 3, U-1 qj!i l
Hj!l'111!!II}f j,ll
- l l
l I !if;
[I f
i a
p j~
i I !!l!- i;I r
}
13 T
I I. :
g
[ h 01.
.)
a ill i
I !a
10 CFR 50 Section 50.63 1T EDG Reliability Target Level Responsibilities.
and Management \\-
Oversight n -
l
\\
Surveillance Maintenance Requirements Program j
i Data System a
i I r-1 I Failure Analysis Performance and Root Cause Men!!oring Investigations Problem i
Closeout Figure 2 -Interaction of EDG Reliability Program Elements I
y EW Class 1E AC Dist@ution d
System Emergency Diesef Generseer system Boundary 7..a..........................
...n............s...........................*
0 3 EDG e
1f Lehriestion Govemor and Exhausi
/ BREAMER l l
Conteceand System Conevolsystem system Protection j.
system h
h
=
! =
Diesel Engine H
o-~
l!
=
s,sem n
p g
]
a ea-coa =
,,,,a,,,
Fues os voamer
- andverwasnon siamo coneueson 7
sys,.m neouiaior system j
system symem a symem i
andsuppsy e
o e.......................................,.7....o
- FuW Oli coonn,weeer 8'o'**' 8"d suppe syseen supper r
Figure 3 - 8mergency Diesel Generator' Systems, Boundary and Support Systems
-~
-___a'm
~
1.
4 e
e o
i
)
FIGURE 4. EDG 85177 OR DAILY SURVEILIANCE (EXAMPIR)-
coverner svatan 7mbe-oil system Governor oil level-Inbe-oil inlet temperature.
verify load limit settings Inbe oil outlet temperature Governor setting,in Lube-oil sump level '
Auto /Nanual Imbe-oil strainer / filter-diffarential pressure visual inspection for leaks Diesel /Generater Oil Imvel of pedestal bearing Puel oil systen Turbo oil level Intercooler leak inspection-Day tank level Turocharger lube oil level Storage tank level bleed fuel Drain ao.sture from exhaust oil filters silencers Visual inspection for leaks Bleed fuel oil filters
- Verify alarss clear Diesel starting selee.tcr switches'in remote DS breaker raeote-loe%1 select switch in: remote a
Verify auto-manual j
regulators, set in normal
-)
range
.i check water and fuel boses 1
.7acket water system Check starter actors Check exhaust system i
u.
.7acket water inlet temperature
.7acket. water outlet temperature l
Expansion tank level Visual inspection Eleetrienle q
Startints Air systen Auto / Manual switch in auto Air receiver pressure Appropriate breakers racked Blowdown air receiver in compressor oil level' Power to Breaker: verified ~
Check operation of compressor Aligned to appropriate 1
traps power source Fault Indicator
- i
- Weekly surveillance e
o o
v TIGURE 5. MONTHLY EDG SURVIILIANCE (EXAMPLE)
Severner Systen
.u_
blesel/Generater Visually inspect fuel systen Inspect linkage for looseness
~
for leaks i
Puel 011 System Visually inspect for exhaust leaks l
Drain water from crankcase vent check automatic shutdown Fuel filter Dp piping verify generator synchronization Inspect for leaks Storage tank level check immersion heater verify transfer pump operability operability i
Engine coolant level Fuel oil pressure Manifold pressure Crank case pressure (or vacuun)
Storage tank level verify transfer pump Air inlet tamperature operability Turbo temperature Fuel oil pressure Intercooler outlet temperature Ventilation fan operability Cylinder. exhaust temperature (each) 121be-011 system Cooling water supply temperature stator temperature check lube-oil for fuel oil dilution startine Air systen Lube-oil chemical analysis compressor oil pressure Inspect for leaks Imbe-eil filter differential compressor oil level Embe-eil pressure Air pressure Lube-oil level Inspect for leaks Turbo lube-mil pressure
=-
Lube ~ oil. inlet temperature Jacket Water Systen Lube-oil outlet temperature Inspect for leaks check water treataant*
ponerator i
Heat exchanger outlet temperature Gen Frequency Engine outlet temperature Gen voltage system pressure Turbo outlet temperature Gen Amps Gen EW
- Quarterly surveillance Q
i 4
1
.s o-Monitor EDG Performance i f Failure or off normal
- condition observed U
P,abiam closeout Determine proximate cause Aggggg it (tallure cause analysis) surveillance or performance monitoring i r should be ottered Compare to past failures / conditions to indicate possibie.
~d k~
systematic cause l
No Systematic Cause l
Systematic Cause if i
Perform root cause analysis U
Generic
.l Review other plant Generic or Cause l
records (NPRDS),
plant-specific Ageneric m
industry groups, etc.
cause?
cure exists?-
~
.j
. Plant No I =
1 L Yes-M Cause U 1
I Review operational Determineif implement procedures, install operation or cure special monitoring design < elated If required -
cause Design Operation Related Related i
Redesign to Change operations correct problem
' to correct problem
{
u U -
Figure 6 - Failure and Root Cause Analysis Logic i
e