ML20043F667
| ML20043F667 | |
| Person / Time | |
|---|---|
| Issue date: | 02/12/2020 |
| From: | Office of the Chief Human Capital Officer, Woodard Corp |
| To: | |
| Gary Callaway | |
| Shared Package | |
| ML20043F634 | List:
|
| References | |
| Download: ML20043F667 (24) | |
Text
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-1 of 24 USNRC HRTD
- 13. CASE STUDIES: LESSONS LEARNED, AND CONCERNS Learning Objectives As a result of this lesson, you will acquire knowledge of previous and potential EDG failures, as well as concerns about ongoing issues that can impact these vital systems.
That information will enable you to better evaluate Licensee Event Reports (LER's),
as well as relevant Information Notices and Generic Letters that pertain to EDGs. You will then have better understanding of:
- 1. Various failure scenarios involving emergency diesel generators and their support systems.
- 2. The significance and safety implications of individual licensee LERs and other documents regarding EDG issues.
- 3. The potential reliability impact of things beyond the EDG's boundaries, including lightning, underground cable faults, grid anomalies, switchyard failures, etc.
- 4. The potential unintended consequences of events in the vicinity of the EDG, such as maintenance/cleaning activity or fire suppression system actuation.
- 5. Possible shortcomings in the licensee's operational or maintenance procedures for EDGs and their support systems.
- 6. The likely effectiveness of licensee corrective actions for EDG failures.
- 7. "Aging" issues and other ongoing concerns regarding EDG systems.
13.1 EDG STARTING FAILURES Defective Air Start Motors Bench testing of two new air start motors to be installed on an EDG determined that they were defective. The motors, Ingersol-Rand series 89, had been assembled with an incorrect pinion engagement piston at the factory. The root cause was one assembler technician pulling the air start motor parts from memory instead of using the pick list for the job. A total of seven NPP's had been shipped air start motors with the wrong pinion engagement piston, which would have either prevented an EDG start or compromised the engine's fast start capability. The first few starts may have been acceptable, until the elastomer seal (O-ring) used instead of metal had been abraded. All affected air start motors were recalled and accounted for. See Figure 13-1 and 10CFR 21-0095, 20 October 2008.
Malfunctioning Speed Switch Circuits At two nuclear stations a malfunctioning annunciator power supply (dc) within the EDG's gauge board panel caused electrical noise (ac ripple) in the speed switch circuit.
That resulted in the speed switch changing state prematurely, thereby preventing EDG start. The underlying cause was a failed or degraded filter capacitor in the dc power supply. In the previous 7 years there had been 10 cases where speed switch issues had prevented start, several involving the same failure cause. Electrolytic capacitors degrade with time and dc power supplies for control equipment need to be checked periodically to verify ripple voltage is within limits. See Information Notice 2010-23.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-2 of 24 USNRC HRTD Painting Activities and Cleaning Agents There have been numerous cases where nearby painting or cleaning activities have had adverse impact on EDGs, as well as auxiliary feedwater pumps, a high pressure coolant injection pump, radiation monitors, fire detection and suppression equipment, etc. At least three reactor trips resulted. A listing and brief description for each one is available in ADAMS under Accession No ML091600446.
In a recent, very typical case, a drop of paint on an EDG fuel rack prevented the governor from moving it from the normal standby (closed) position upon a start signal. As a result, the EDG failed to start and was declared inoperable. IN 2009-14 attributed the problem to numerous work control shortcomings including inadequate supervision, communications issues, lack of training or adherence to procedures, etc.
Nevertheless, the failure could have been prevented with a thorough EDG readiness inspection and checkout following the work.
A previous report described an EDG that was cleaned with a solvent that removed fuel rack lubrication, leaving a white residue and some coagulated lubricant that bound it, preventing any rack movement by the governor. To prevent a recurrence the licensee implemented new procedures to require cleaning and lubrication of the rack, plus verification of free movement, after any cleaning or painting. In a similar case, a cleaning agent was used that contained a solvent that caused the plastic parts of 16 safety-related control switches to bond, thereby preventing their operation. These are described by IN 93-76.
Searching through the NRC archives will reveal still more of these events, such as IN 91-46, Degradation of Emergency Diesel Generator Fuel Oil Delivery Systems." It describes EDGs rendered inoperable by paint on fuel rack components, or on their exciter commutator rings. Another report describes a contractor's use of undiluted muriatic acid to clean the concrete floor of the EDG room, causing severe corrosion of electrical controls and circuits. Licensees need to apply the lessons learned from all such cases and increase prevention efforts.
13.2 CONTROLS-RELATED FAILURES Spurious Shutdown (Design Oversight)
In some EDG designs, the starting air system also performs a critical control function that may necessitate ensuring availability of the starting air system throughout the duration of certain analyzed events, such as station blackout. At one NPP the EDGs are individually supported by non-safety related air compressors, powered by non-class1E power supply, that maintain sufficient inventory of high pressure starting air in the safety related accumulators. This air provides motive force for the engine starting system and also supplies a pneumatic control logic system that trips the EDG when certain non-emergency engine parameters are sensed to exceed its set limits. Air pressure loss, following an engine start, may be due to system leakage or through a tripped engine protection sensor that reached an unacceptable level. When the EDG is operating in the emergency mode, the declining control air pressure first un-bypasses the protective trips that were
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-3 of 24 USNRC HRTD bypassed for the emergency mode, and further decrease in pressure results in an engine trip. This problem emphasizes the need for licensees to ensure reliability of systems that perform critical support functions for safety-related systems. More than one station was found to have this issue. The preferred solution is to have an assured means of maintaining air pressure as needed for controls during an extended EDG run, without the necessity of operator action. See IN 98-41.
Inadvertent EDG Start While performing a load rejection test of the A unit EDG in accordance with IEEE 387 and RG 1.9, an unanticipated start of the B unit EDG occurred. Evaluation indicated that at the time of the unanticipated start, a "large" load (an auxiliary feed pump) was started. The ensuing voltage dip amounted to approximately 80% of rated voltage on the emergency bus causing under-voltage relays to drop out, immediately starting the B unit EDG. The components of the system functioned properly.
A procedural deficiency was identified, in that operators should have been informed an EDG start may occur when starting this large load.
Load Sequencer Failure A licensee made upgrades in ESF load sequencing by replacing the electro-pneumatic relays with newer solid state type microprocessor units.
- However, the replacement modification design failed to consider the high magnetic environment in which the microprocessor units were to be located. The panel location subjected the units to intense magnetic flux created by adjacent electrical contact opening causing failure. EMI and RFI must be considered.
Improperly Diagnosed Governor Failures During 1992 to 1994, several plants replaced governor units because of erratic oscillatory operations. Factory tests of the governors disclosed that the governors were not faulty. Root Cause Analysis disclosed that licensees were using a large power-type relay, which operates at low voltage and milliamp currents, in the governor feedback droop circuit. This type relay was inappropriate for an electronic type application. The relay is located in the electric control panel, not the governor.
Changes in resistance of the contacts provided the sensing circuit with improper and erratic signals. Replacement with a proper relay for the application eliminated recurrence. Control relays are designed such that their contacts have more stable, lower contact resistance than power relays, making them suitable for electronics use.
Defective Governor Drive Couplings Flexible drive couplings used on a vertical drive shaft to transmit power from the engine gear train to the governor, so it can sense engine speed and regulate it, were fabricated of Isoprene instead of the specified Neoprene. The isoprene material is not suitable for the high temperature, oil rich environment of the engine gear case and is susceptible to failure, which would make the governor inoperative. Several utilities were supplied with the defective parts, subsequently recalled and replaced.
Neoprene was specified for this dynamic,
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-4 of 24 USNRC HRTD torque transmitting application because of its strength and inherent resistance to the chemicals present in the environment. The manufacturing error illuminated the need for improvements in the supplier's ability to distinguish these materials from one another. Ironically, 23 years previously a Part 21 report (Transamerica Delaval #112) had been issued to document a similar problem, including a change in the original coupling material from Isoprene to the present Neoprene. See Figure 13-2 and 10CFR 21-0090, 16 September 2005.
Ignored Circuit Breaker Problem Following an automatic reactor trip, a non-safety related electrical circuit breaker did not automatically open to isolate an electrical fault because it did not have control power to its trip circuit. The lack of control power was due to a faulty fuse assembly in the circuit breakers control power circuit. The licensees corrective action program showed that the control power indicating lights on the front panel of the breaker had not been illuminated for approximately one year!
Previously NRC issued IN 1991-78 to inform licensees of the importance of control power for circuit breakers used in safety-related applications. Later, IN 2007-34 highlighted the importance of identifying possible causes for breaker problems including the lack of control power indication. This latest case highlighted the necessity of having control power indication for both safety-related and non-safety related applications, as the latter can clearly impact vital safety systems. See IN 2010-09 and ADAMS info under Accession No. ML100880412.
Defective Governor DRU IC Chips Four Woodward governors failed, three of them during initial test and one after approximately a year of service. Each failure was indicated by the inability to adjust frequency (engine RPM) due to a defective CMOS IC chip in the digital reference unit (DRU),
and each occurred when a
raise/lower signal was given. Analysis by Woodward found evidence of internal aluminum conductor corrosion, most likely the result of delaminating of the IC package from the chips lead frame. DRUs produced between November 2000 and November 2005had potentially defective IC chips by the same semiconductor manufacturer and needed to be replaced. The first failed unit was reported by Fairbanks Morse in 2004.
(See 10CFR 21-0088.) After it became apparent that DRU's shipped over a five year period were suspect, 10CFR 21-0091 was issued on 23 January 2006, Replacement Time-Delay Relays Used in EDG Logic Susceptible to EMI Failure Brunswick replaced Allen Bradley 700RTC-series time delay relays during a refueling outage and subsequently experienced EDG failure. Investigation determined the relays would cycle each time they saw a transient produced by operation of other relays on the circuit. Comparison of old and new relays determined A-B had changed the design to use a Complex Programmable Logic Device (CPLD) due to obsolescence of the IC chip in this commercial relay. Transient Voltage Suppressors (TVS) were installed to prevent recurrence of EMI-induced failures. See Part 21 Report of 25 June 2015 and also ML15149A148.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-5 of 24 USNRC HRTD 13.3 ENGINE-MECHANICAL FAILURES Crankcase Explosions (Recap)
Chapter 12 covered the problem of 13 crankcase explosions in Cooper-Bessemer KSV engines. The manufacturer and the licensees involved eventually found and corrected the causes, although hindsight indicates that effort should have proceeded more rapidly, considering the seriousness of the problem. Whether that conclusion is considered to be fair or not, any licensees having an effective lube oil analysis and trending program would have been made aware of the ongoing engine damage in time to prevent catastrophic failure.
Defective Diesel Cam Roller Bushings The (fuel pump) cam roller bushings for Fairbanks Morse OP engines shipped to 15 NPP's may have been made from an incorrect leaded brass material which is much softer than the specified bronze material. The bushings made from the soft material wear out quickly (in one case, less than 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> of engine run). This results in a shorter fuel injection pump stroke, poor fuel injection characteristics, more exhaust opacity, and decreased engine power.
EDGs with this defect may not be able to achieve their maximum load rating and, therefore, may not be able to perform their intended safety function. Fairbanks Morse implemented inspections and supplier certification of cam hardness 30 July 2001.
Therefore, all cam roller bushings shipped prior to that date are considered suspect.
For additional information see 10CFR 21 Notification by FM, dated 9 April 2007.
Defective Nordberg Engine Valve Seats A significant safety hazard was reported by the manufacturer regarding the potential of Nordberg engine valve seat inserts to 'drop' from the bore of the cylinder head into the cylinder with probable resulting damage to the cylinder head, power valves, piston, cylinder
- liner, exhaust manifold and turbocharger. This could result in loss of the intended 'Safety Function' of the EDG. The problem was attributed to the originally specified amount of interference fit for the inlet and exhaust valve seat inserts, in the area between the cylinder head bore and the inserts." This did not become apparent until field failure(s) occurred outside the US.
The manufacturing specification was corrected and the two affected NPP's were alerted of the problem. See 10CFR 21 Notification dated 13 June 2006.
Engine Damage Caused by Maintenance A routine lubricating oil analysis identified a high concentration of chromium in the oil of the B unit EDG. This caused the unit to be declared inoperable, as chromium is a key element used in cylinder liners and piston rings. Internal inspection found significant scoring of those components. Two days earlier similar damage to the cylinder liner and piston rings of the D unit EDG had been found and it was being repaired.
Further investigation found that sand (aluminum oxide) was in the combustion air intake manifold of both EDGs. It was concluded the sand originated from recent cleaning-coating of the water side of the combustion air intercoolers. Inadequate protection of the air side of these heat
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-6 of 24 USNRC HRTD exchangers during sand blasting allowed the sand to become lodged in the fins.
Subsequent operation of these units introduced the sand into the cylinders where abrasive action caused scoring of the cylinder liners and piston rings.
NOTE: It was found that three years earlier a similar situation had occurred. Two combustion air intercoolers had been cleaned by sand blasting. However, prior to reinstallation, maintenance personnel had observed the sand in the air side of the inter-coolers, so they were cleaned before being installed. Obviously, no lesson was learned from that previous
- incident, as the procedure should have been modified to prevent recurrence. See IN 90-80.
Valve Keeper Seals Missing from Rebuilt Cooper KSV Engine Heads, Allowing Keepwarm Oil to Enter Cylinders.
South Texas reported lube oil was expelled from a cylinder as the engine was barred (one of their routine EDG pre-start checks).
They found all eight keeper sealstwo each on four valvesmissing on that rebuilt head.
Figure 13-3 illustrates the seal locations.
The lube oil in the cylinder originated in the keepwarm system that provides a constant flow of oil through the engine during standby (including the valve rocker arm assembly).
Depending on part tolerances and wear, some can leak onto valve stems and the missing valve keeper seals are designed to prevent it from running down the valve stem and into the engine. During a long standby period, cylinder hydraulic lock could occur, so this case is a testament to the practice of barring or slow-rolling EDGs before start.
ESI improved their rebuild documentation and all possibly affected heads in stock or installed on engines were inspected. The plants affected were Cooper, South Texas, Bryon. See Part 21 Report of 23 April 2013.
13.4 FIRE PROTECTION SYSTEM ISSUES, BUILDING FIRES Deaths Due to Inadvertent Discharge of CO2 Fire Protection Systems Carbon Dioxide (CO2) fire suppression systems are common in nuclear power plants, protecting spaces such as cable spread rooms, switchgear rooms, and EDG rooms. CO2 suppresses fire by displacing Oxygen and smothering it. Personnel will be similarly affected unless they evacuate immediately. CO2 installations protecting an EDG room will also stop the engine if its intake air comes from the room instead of being ducted in from outdoors.
Several NPP's and other nuclear facilities have experienced inadvertent discharges of their CO2 systems. Each of these incidents underscored the critical need to have self-contained breathing apparatus (SCBA) immediately available and plant personnel trained in their use. The SCBA should be the type with integral radio communications and also compatible with corrective lenses.
Other necessary measures include having clearly marked and quickly accessible exits from spaces protected by CO2. The lack of such measures contributed to one fatality and several life-threatening injuries at the Idaho National Engineering Laboratory in 1999 when a CO2 system discharged with no warning. The accident investigation
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-7 of 24 USNRC HRTD board determined that since 1975 there have been a total of 63 deaths and 89 injuries as a result of unintended discharge of these fire suppression systems.
No reports of unintended discharge of a CO2 system in an EDG room were found in public documents at NRC. However, the potential exists for such an event to occur and impact the EDG and/or personnel. It is important that licensees consider such an eventuality and take measures to assure that the only result from a CO2 discharge would be the intended fire suppression. Toward that end, some licensees have changed these systems to be activated only by manual means. Another very desirable feature is a mechanical time delay that has an integral CO2-driven siren. Located in the piping just downstream of the high pressure CO2 tanks, it sounds for a brief period to warn of the impending release of gas into the space.
For more information see IN 99-05.
Inadvertent Discharge of Halon 1301 or Clean Agent Gaseous Fire Suppression Unlike CO2, Halon 1301 and the alternate "clean agent" fire suppression gasses put out fires without adverse effect on people, if applied in the proper concentration. When they come into contact with a fire they do decompose into some compounds that should not be breathed, so evacuation or SCBA gear are still advised. If used to protect an EDG room they have the same potential to stop the engine as CO2 if the combustion air intake is in the EDG room.
Because all gaseous agent fire suppression systems are rather complex, there is greater potential for inadvertent discharge. IN 2007-23 related an incident in which a Halon 1301 manual release ("pull") station was mistaken for a fire alarm system manual station, with the predictable outcome. Some systems installed in the 1970's and 1980's were susceptible to being activated from nearby portable radio communications devices and in one case at a NPP the Halon system was triggered by a camera flash while the control panel cover was off. (See IN 97-82).
NOTE: A number of Information Notices have been issued regarding problems with fire protection equipment, including recalls of defective sprinkler heads (sticking O-rings that prevented sprinkler actuation by a fire),
defective fire hydrants, etc..
EDG Building Fires Resulting from Improper Roof Repairs After 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> of a 24-hour endurance run (surveillance test) of the E-3 emergency diesel generator, combustible roofing material on the EDG building caught fire near the diesel exhaust pipe penetration (roof stack) area. The roofing material was in contact with the steel penetration sleeve the EDG exhaust pipe passes through. The root cause was improper installation of roofing materials during re-roofing.
When the EDG is running the temperature of the exhaust stack reaches approximately 900ºF, while asphalt roofing paper ignites at about 400ºF. The consequences of this "non-safety-related modification" once again demonstrate that any work in the vicinity of the EDG requires administrative oversight and inspection. While roof work is in progress that should include a fire watch and extinguishers. See IN 2007-17.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-8 of 24 USNRC HRTD NOTE: Another Information Notice gave the details of other recent fires at NPP's.
Several were caused by a lack of sufficient switchgear maintenance, an increasing concern as the ages of plants approach or surpass their original design lifetime and it becomes difficult or impossible to obtain spares. As previously discussed, this is also true for some EDG components, including legacy governors and voltage regulators.
Some important firefighting lessons were also learned and they have potential implication for EDGs, though the described fires did not directly involve those systems.
See IN 2002-27.
Issues Potentially Affecting Nuclear Facility Fire Safety Underwriters Laboratories and the Defense Logistics Agency have recently issued alerts regarding fire protection equipment: These include notice of counterfeit fire protection items including fire hose, fire extinguishers, sprinkler hangers, and various types of fire sprinklers. All have fake UL labels or other certifying agency marks. Licensees can go to on-line resources for more details and info on how to tell pedigree parts from the fakes.
Also, UL issued notice of changes in their electrical cable-rating certification program.
Testing of electrical cables currently having a 2-hour fire resistance rating per ANSI/UL 2196 revealed they no longer consistently met the criteria. Therefore, three classes of such cable can no longer bear the UL mark.
Licensees should be aware of these issues as they maintain required fire protection features and manage their procurement process. See IN 2013-02.
13.5 ENGINE COOLING FAILURES Fouled Heat Exchangers The EDGs in this discussion were tandem units, two diesel engines powering one generator. The 1A generator was powered by engines A and B. The 1B generator was powered by engines C and D. Both generator sets were operating under load, supplying a 480 volt essential power bus.
Approximately 30 minutes into the run, engine D (generator set 1B) tripped on high jacket water temperature. Shortly afterwards the C engine tripped, also from an over-temperature condition.
Investigation found the jacket water heat exchangers were fouled. This reduced the ability of the engine to reject heat, which led to overheating. It would have made the EDG inoperable during an emergency.
Corrective action included cleaning the heat exchangers for both generator sets. It was determined that the annual schedule for cleaning them was not adequate. The frequency for this preventive maintenance item was upgraded to quarterly.
NOTE: There is always increased potential for fouling and scaling when an on-site water supply is used in a heat exchanger. Also, at some sites water temperature may rise high enough to compromise heat exchanger efficiency, resulting in a risk of EDG over-heating when running near rated load.
Water Leaking Into Cylinder During an engine bar or slow-roll check preparing for a routine EDG surveillance
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-9 of 24 USNRC HRTD test, several pints of water were found in an engine cylinder. The pre-run check enabled the licensee to avert severe engine damage.
After removing the cylinder module, it was found that a small leak path had slowly developed on the head gasket, allowing the jacket cooling water to intrude into the cylinder. The engine had been run 7 days earlier without difficulty. Apparently, a sufficient amount of fluid had leaked after that previous test to partially fill the cylinder with water. The licensee determined that if the EDG had been started without first being checked for water in the cylinders, it would have been severely damaged by hydraulic lockup of the cylinder.
While performing a previous bar/slow-roll check in 1987, the licensee discovered the same condition on another EDG, caused by a cracked cylinder. Five years previous, an EDG at another facility had been severely damaged because it was started after water leaked into a cylinder through a cracked cylinder wall, and they learned from that.
Because of the incompressible nature of water, lube oil, and fuel oil, the presence of significant amounts of fluid in an engine cylinder can cause hydraulic lockup during the compression stroke. When the force from the starter and other firing cylinders tries to overcome this lockup, the engine can be severely damaged. The fluid can come from a number of sources such as a leaking head gasket, a cracked cylinder or head, or a defective fuel injector. For the Fairbanks Morse OP engine, it can occur if the pre-lube system is run for more than a short period prior to start, as lube oil for the upper crank area can pool under the top pistons and leak down. See IN 91-62.
NOTE: Not all licensee's "bar over" EDGs before a surveillance or post-maintenance run, as puts them temporarily out-of-service while this is being done (engine is locked out, petcocks are open). However, diesel manufacturers recommend it, especially after a significant period without being run.
In these two cases, that practice certainly prevented extended "out-of-service" time, and would have done so for the prior case.
EMD Jacket Water Pump with Incorrect Impeller Orientation.
EMD engines have two centrifugal engine jacket water pumps (one for each bank) and both rotate in the opposite direction from the crankshaft. In nuclear applications the EMD is frequently used in tandem, two engines driving one generator in between them.
That arrangement requires the engines to run in opposite rotation from each other.
Therefore, the water pumps for left hand rotation engines use different impellers than the pumps for right hand rotation engines.
Grand Gulf reported a pump with the wrong impeller, which results in lower output from the pump, degrading engine cooling. The engine could have failed when running near full rated load. ESI improved visual aids and advised licensees to check impellers on all pumps in stock, and on potentially affected EDGs. See Part 21 Report, 30 March 2011.
13.6 FUEL OIL/LUBE OIL RELATED Leaks Caused by Fatigue Cracking Several NPP sites have experienced leaks in the piping for fuel oil, lubricating oil, and water. Many of these leaks resulted from
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-10 of 24 USNRC HRTD fatigue cracks in welded joints, induced by normal engine vibration. Some involved Fairbanks Morse OP engines produced at a time when partial-penetration welded joints were used in the fabrication process. Those met the procurement specifications and such welds are actually stronger than the piping. However, full-penetration weld joints per ASME Code Section III, Class 3 (now used by the manufacturer) have more resistance to fatigue cracking.
This type problem is certainly not unique to the FM OP, which typically has perhaps 200 welds on the skid-mounted components.
The Owner's Group has actively pursued this issue and some licensee's have replaced the piping or welds in areas of concern. All licensees need to be aware of the potential for fatigue cracking of any model EDG and its components, especially as running hours increase. See IN 98-43.
Cold Fuel Oil Concerns NRC electrical distribution safety functional inspections have determined that multiple sites have fuel specifications that do not adequately assure the proper cold weather characteristics. Specifically, the pour point and cloud point criteria were inappropriate for the potential lowest temperatures at the sites. That could result in loss of fuel flow during EDG run, either from filter-injector clogging by wax crystals or from the fuel oil dropping below the specified "pour point" (at which it will cease to flow). The most concern is for sites with above-ground fuel tanks or above-ground fuel piping without heat tracing powered from a safety source.
Routine surveillance runs are not likely to reveal this problem, as the licensee may not operate any EDG long enough to observe the effect of cold fuel oil. Most of the fuel used during these tests will be from day tanks, which are at a much higher temperature due to being located in the EDG rooms. In contrast, an accident may require continuous operation of the emergency diesel generators for several days. The warmer fuel in the day tanks would be depleted and the EDGs would then be required to perform on fuel oil at a temperature near the outside temperature.
Fuel oil that is not properly specified (procured) for the lowest-use temperature the site could experience may lead to a common-mode failure of all the emergency diesel generator units. The specified pour point of the fuel oil should be at least 10ºF below the lowest ambient temperature the fuel may be exposed to. In cold climates that may require fuel tanks and lines to be insulated and provided with heat tracing in order to maintain a proper viscosity and avoid the formation of wax crystals. See IN 94-19.
Cylinder Failures Caused by Improper Fuel Oil Following 110 percent load surveillance tests, engine clattering was noted, and the engine was shut down. Inspection revealed two badly overheated pistons, scored liners, and badly worn connecting rod and wrist pin bearings. Based on the appearance of the parts, the engine would have seized and/or connecting rods would have broken if operation had continued. Unfortunately, this was the tip of the iceberg, as other EDG engines at the site had similar damage.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-11 of 24 USNRC HRTD All fuel injectors were coated with paraffin such that several cylinders were either not firing or were producing only a small amount of power. As a consequence, other properly firing cylinders were operating in a severely overloaded condition in order to make up the power. This was confirmed by records of extremely low and high exhaust gas temperatures from respective cylinders.
Analysis of the fuel oil disclosed non-specification fuel. Draining the tanks and replacing the fuel corrected the cause of this problem. This is yet another case that supports fuel analysis and trending.
High Pressure Fuel Leak During a post-maintenance test run of a 4-stroke cycle diesel engine, a maintenance supervisor noticed fuel spraying from the high pressure line for cylinder 1R. He immediately ordered the unit shut down. A fire hazard existed since the number 1R fuel pipe was in close proximity to the hot exhaust piping and right bank turbocharger!
The immediate corrective action required replacement of the high pressure fuel pipe.
Since this type of fuel leakage was not
- uncommon, the engine manufacturer developed a double wall fuel pipe for replacement, one with more gradual bends.
With the outer wall, should a leak develop in the high pressure pipe, the fuel would be captured and directed to a return or drip line.
The fuel would then be returned to the fuel oil storage tank.
Pre-operational and post-operational walk-around inspections are important, as are those conducted during the run. This case could have easily resulted in a serious fire.
Lube Oil Incompatibility with Low-S Fuel (Low-Sulfur Fuels: 500ppm maximum S)
During pre-operational testing of a new EDG, wide fluctuations in the crankcase pressure were noted, as well as lube oil seeping out the crankshaft seal. After inspection and further analyses, heavy carbon-like build-up was found on pistons and behind the piston rings, plus scuffing of the cylinder walls, in this and other EDGs.
A root cause analysis team was formed and by a process of elimination settled on possible fuel oil-lube oil incompatibility.
They found that compatibility depends, in part, on the type of fuel being burned, as the lubricating oil contains an additive package that neutralizes the products of combustion, most importantly sulfuric acid, to prevent engine corrosion. The amount of additive needs to be adjusted as a function of the sulfur content of the fuel oil.
The lubricating oil originally selected was an American Petroleum Institute (API) CD-grade synthetic oil. For the fuel oil used in the engines at that time, the specification was for sulfur content not to exceed 0.30 percent. In early 1995, the supplier of fuel oil switched to "low sulfur" fuels having 0.05 percent (500ppm) or less in order to meet new Environmental Protection Agency requirements intended to reduce sulfuric acid emissions. With the reduced amount of sulfur, there would be more unreacted additive in the lubricating oil, resulting in the formation of deposits when some of the oil was burned. These deposits built up behind the piston rings, forcing the rings to extrude and come into contact with the cylinder liner wall, resulting in scuffing.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-12 of 24 USNRC HRTD After this problem was identified, the safety-related EDG was rebuilt with new cylinder liners, pistons, and piston rings. On the basis of the findings of the root cause analysis team, the safety-related EDG was supplied with different lubricating oil, an API CG-4 grade mineral-based oil. A series of acceptance tests were then run to validate the root cause. After 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> of operation the safety-related EDG was inspected and no abnormal conditions were found. See IN 96-67.
NOTE: Another characteristic of synthetic lubricating oil was identified during review of this event. Synthetic oils contain diester additives required to improve solubility of oil additives. In diesel engines with low oil sump temperatures, water may accumulate in the sump because the temperature is too low to vaporize it. This water might cause hydrolysis of the diesters and the resulting acids would react with calcium in the additive to form insoluble compounds (soaps). These compounds may clog filters and degrade diesel engine performance.
13.7 CONCERNS FOR ULTRA-LOW SULFUR FUEL, REQUIRED IN 2010 (ULS = 15PPM MAX S)
ULSD has a number of properties that have potential to degrade or render inoperable the associated diesel engine or may create a condition that is inconsistent with current plant design and licensing bases. The ULSD issue effects all licensee diesel generators that are safety-related and/or important to safety, thereby, presenting a possible common mode failure. However, although there are *potential* effects from ULSD fuel oil, experience has taught us that all of them are manageable using ordinary means and methods. Alert licensees with a proactive, condition based approach to EDG system maintenance will not be impacted by the changes in Sulfur content from 3000ppm to 50ppm and now 15ppm. It will simply require them to evaluate potential ULSD impacts and, in concert with their fuel oil, lube oil, additive, and filter suppliers, as well as tank monitoring specialists, take the measures needed to ensure their plant operations remain consistent with their current design and licensing basis.
Several diesel fuel properties other than sulfur concentration change as a result of moving to ULSD. Any of the following characteristics may adversely affect diesel engine performance. See IN 2006-22.
Energy Content In general, the processing required to reduce sulfur to 15 ppm also reduces the aromatics content and density of diesel fuel, resulting in a reduction in volumetric energy content (BTU/gallon). The drop in energy content is 1.2 percent, or more. Less energy content of the fuel can reduce the instantaneous output rating of the diesel engine. The reduced output rating may be less than the value specified in the plants design and licensing basis, potentially rendering the diesel inoperable.
The reduced energy capacity of the ULSD may result in increased fuel consumption such that the onsite fuel storage capacity for the emergency diesel generators may be insufficient to satisfy the plants design and licensing basis for diesel operation duration before offsite replenishment is needed.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-13 of 24 USNRC HRTD Fuel Particulate Build-up Increases Additives to increase lubricity and to inhibit corrosion used by different refineries and wholesale suppliers can react or become unstable in storage, which can result in increased fuel particulates that may foul or plug filters and fuel injection equipment, and can affect suitability of some testing methods.
Some nuclear plant licensees using ULSD have observed an increase in the rate of particulate buildup in samples from their diesel fuel oil storage tanks.
Fuel System Seal Leaks Non-nuclear industry operating experience using ULSD shows an increased incidence of fuel system leaks at points where elastomers (O-rings) are used to seal joints, with most leaks occurring at the fuel pump and injectors. The evidence to date suggests the problem is linked to a reduction in the aromatics content of the ULSD which affects seal swelling, as does seal material and age of the material.
Compatibility with Lubricating Oil See previous discussion for IN 96-62. The concerns for ULSD mirror those for LSD and the industry has learned much about them.
Microbial Growth Diesel fuel that was desulfured at the refinery through hydrocracking (versus hydrotreatment) may have a
greater propensity for microbial growth due to an increased concentration of n-alkanes (linear molecules).
Incompatible Metals There are no known compatibility issues with aluminum, carbon steel, stainless steel, and bronze. However, copper and zinc are incompatible with ULSD because both are oxidative catalysts that will accelerate the formation of sediments, gels, and soaps (ASTM D975, Appendix X2.7.2).
Lubricity Lubricity is a measure of the fuels ability to lubricate and protect the various parts of the engines fuel injection system from wear.
The processing required to reduce sulfur to 15 ppm also removes naturally-occurring lubricity agents in diesel fuel. Rotary and distributor type fuel pumps are completely fuel-lubricated resulting in high sensitivity to fuel lubricity. Refiners treat the diesel fuel with additives on a batch to batch basis to ensure adequate lubricity. Therefore, receipt of ULSD with inadequate lubricity is possible, but unlikely.
13.8 COMBUSTION/VENTILATION AIR Engine Exhaust and/or Room Cooling Exhaust Recirculation to Intake(s)
Manufacturers' ratings of emergency diesel generators for specific applications are based upon specific maximum for EDG room temperature and combustion air inlet temperature, non-contaminated combustion air with proper oxygen content, and specific maximum for intake air depression and exhaust back pressure.
Several licensees have discovered problems in one or more of these areas.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-14 of 24 USNRC HRTD Most often there has been a problem with combustion exhaust and /or room cooling exhaust recirculation back into the room, and /or combustion air intakes. Root Causes have been lack of consideration of other roof top or adjacent structures, the effects of wind direction/pressure, and the suction created by the air intakes.
Recently when a manufacturer provided up-rating modifications of 10 percent for installed EDG units, the licensee could not take advantage of it without first eliminating up to 15 percent recirculation of engine and ventilation exhausts back into the engine combustion and cooling air intakes.
13.9 SPECIAL CONCERNS FOR BIODIESEL FUEL (B5)
In 2008 the American Society for Testing and Materials approved a change to ASTM D975-08a, Standard Specification for Diesel Fuel Oils. Effective in early 2009, No. 2 petrodiesel fuel oil could have up to 5%
biodiesel blend (B5) without being so labeled, as if still a petroleum-only product.
The NRC is very concerned at the potential implications of this action. Their position included this statement: "The introduction of biodiesel blends into the No. 2 diesel fuel supply raises potential generic applicability and common-cause failure concerns because of the possibly adverse physical properties associated with biodiesel use in diesel engines including the safety-related emergency diesel generators (EDGs)."
For the reasons discussed below, a B5 blend could be problematic for EDGs and other safety function diesel engines:
Cleaning Effect:
B5 has a solvent effect that loosens accumulated sediment in fuel oil storage tanks, possibly clogging filters. If fact, it will actually dissolve some kinds of paint if left on long enough. Licensees can clean tanks, upgrade filters, and check filters more often before any use of B5 (if they are even aware of it).
Water:
B5 contains suspended water particles from its manufacturing process. The water will, in time, fall out of suspension and form "dirty water" in the fuel oil storage tank, which eventually leads to the formation and growth of algae. Licensees can use a moisture dispersant and biocide, add a fuel-water separator to the system, and keep tanks topped off.
Biodegradation:
B5 is biodegradable, and the presence of water, heat, oxygen, and other impurities accelerate the degradation of the fuel supply. Storage for longer than 3-6 months is not recommended.
Material Incompatibility:
Brass, bronze, copper, lead, tin, and zinc in tanks and fittings may accelerate the oxidation process of B5, creating fuel insolubles or gels and salts. Licensees should avoid using zinc linings, copper pipes and fittings, or brass regulators with B5.
They should also verify that elastomeric materials, such as hoses, gaskets, and O-rings are compatible with B5.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-15 of 24 USNRC HRTD Temperature Protection:
Biodiesel's components have higher cloud points than petroleum components and they vary considerably with the source of the biodiesel feedstock, which is not even specified in B5 blends.
The net effect of unlabeled B5 diesel fuel oil may not be known for some years. It is yet another reason for licensees to have an effective program of fuel oil sampling, test, and analysis. For additional information see IN 2009-02.
13.10 SWITCHYARD / DISTRIBUTION Single-Failure and Fire Vulnerability of Electrical Safety Buses During a triennial fire protection inspection of a nuclear power station, NRC inspectors discovered an electrical protection and metering circuit which, if damaged, could electrically lock out redundant safety buses and prevent re-energization of the buses from either of the offsite power sources or emergency diesel generators (EDGs).
The safety buses were normally powered by one of two offsite sources. Each bus also had an EDG for standby power. The electrical protection and metering system used current transformers for measuring power consumption and sensing overloads or faulted conditions. The protection and metering circuit for each offsite power supply included three CTs at the feeder breaker to each safety bus, phase over-current relays, and ground overcurrent relays, all connected in a basic residual scheme.
The arrangement included one watt-hour meter to sum the power to both safety busses. This interconnection of protection and metering circuits between two safety busses was identified by the inspectors as a common-mode failure vulnerability. A failure on this interconnected circuit, such as a fire-induced cable fault or watt-hour meter
- failure, would be interpreted by the protection system as an electrical bus fault on both safety busses. Consequently, the relay logic would lock out both redundant safety buses and prevent re-energization from any power source.
The licensee modified the wiring in the overcurrent protection circuits to align each monitoring circuit to one safety bus and to disconnect the watt-hour meters. In this corrected configuration, each circuit is contained within one switchgear, so that a single fault or a fire will affect only one safety bus.
NOTE: Chapter 1 introduced the concept that onsite power supplies are required to be redundant and independent, such that safety functions could not be compromised by a single failure in either one. Following the situation described above, inspectors found similar single-point vulnerabilities at five other NPPs and concluded that such problems were likely widespread.
Large Transformer Failures Industry operating experience has indicated an increasing trend in large transformer failures. Improved preventive maintenance and monitoring practices have helped to identify some problems before they developed to the point of failure, but the
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-16 of 24 USNRC HRTD number of large transformers events has not decreased and, in fact, continues to rise.
Transformer failures have resulted in eight declared plant events from January, 2007, to February, 2009, making them the second leading reason for such declarations. While the large transformer failures have generally been non-safety related, they are within the scope of the Maintenance Rule, 10 CFR 50.65. A review of licensees root cause evaluations for the large transformer failures show that the events are often the result of ineffective implementation of the transformer maintenance program.
Some utilities have installed an online automated oil analysis and monitoring system to support decisions regarding preventive and corrective maintenance to improve transformer reliability. IEEE Standard C57.140-2006, IEEE Guide for the Evaluation and Reconditioning of Liquid Immersed Power Transformers, provides guidance on this matter. However, NRC has not endorsed this document and the recommendations it contains are not NRC requirements. See IN 2009-10.
Submerged Electrical Cable Failures In 2006, the NRC began a detailed review of underground electrical power cables after moisture-induced cable failures were identified at several plants. The cables were exposed to submergence in
- water, condensation, wetting, and other stresses.
Because these cables are generally not designed or qualified for submerged or wet environments, the possibility that more than one cable could fail has increased and such multiple failure could disable safety-related accident mitigation systems.
NRR staff reviewed the available operating experience of cable failures and observed that some cables at nuclear power plants, which were qualified for 40 years through the licensees equipment qualification programs, were failing before the end of their qualified life. Staff identified 23 LERs and two morning reports from 1988 to 2004 that described failures of buried medium-voltage AC and low-voltage DC power cables as a result of insulation failure. A particular failure mode of medium voltage cables subject to wet conditions, called water treeing, is shown in Figure 13-4.
The most recent Information Notice on this subject included descriptions of specific cable failure occurrences at Monticello, Fermi, Point Beach, Beaver Valley, Wolf Creek, Callaway, Peach Bottom, Three Mile Island, and Vermont Yankee nuclear power stations. This underscores concerns that many licensee are not maintaining safety-related power or low voltage cables in their designed and tested environment.
The NRC issued GL 2007-01 to gather information on inaccessible or underground power cable failures for all cables that are within the scope of the Maintenance Rule, 10 CFR 50.65. The NRC expects licensees to identify conditions that are adverse to quality for cables, such as long-term submergence in water.
Upon discovery of a submerged condition, the licensee should take prompt corrective actions to restore the environment to within the design specifications for the cable, immediately determine its operability for the design function, and determine the impact of such adverse environment on the design life
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-17 of 24 USNRC HRTD of the cable. These corrective actions typically involve the removal of water, the installation of a sump pump or repair of the drainage, and cable evaluation including testing where appropriate.
Long-term corrective actions should involve establishing a condition monitoring program for all cables which are inaccessible and underground and under the maintenance rule, including testing of cables to verify they are not degraded, as well as visual inspection of underground cableways for water accumulation, to assure continued cable operability. See IN 2010-26.
13.11 GRID RELIABILITY CONCERNS LOOP/SBO More Likely in the Summer In 2003 the NRC released NUREG-1784, a study showing that switchyard and grid-related LOOP events occurred mostly during the summer months. A subsequent report confirmed an increased frequency of loss-of-offsite power (LOOP) and station blackout (SBO) events during the summer period (i.e., May through September).
A new report by INEL, NUREG/CR-6890, "Re-evaluation of Station Blackout Risk at Nuclear Power Plants," was published in December 2005 (ADAMS Accession Nos.
ML060200477, -060200479, -060200510).
The new report confirmed the earlier observations and showed the following insights regarding seasonal risk trends:
- The SBO risk increased by a factor of two during the summer period between 1997 and 2004. There were 22 summer and 2 non-summer LOOP events.
- The overall LOOP frequency is more than twice as high during the summer period, compared to the average.
- The probability of LOOP after a reactor trip is greater during the summer period.
- All 4 categories of LOOP events (plant, switchyard, grid, and weather-centered) had higher frequencies during the summer period.
Although no specific recommendations were made, these data have a number of potential safety implications for licensee operations, including their scheduling of maintenance on EDGs and other safety systems. See IN 2006-06.
Grid Reliability Impact on Plant Risk On 14 August 2003 the largest power outage in U.S. history occurred in the Northeastern United States and parts of Canada. Nine U.S. NPPs tripped, of which eight lost offsite power, along with one NPP that was already shut down. The length of time until power was available to the switchyard ranged from approximately one hour to six and one half hours. Although the onsite emergency diesel generators (EDGs) functioned to maintain safe shutdown conditions, this event was significant in terms of the number of plants affected and the duration of the power outage.
The loss of all alternating current (AC) power to the essential and nonessential switchgear buses at a NPP involves the simultaneous loss of offsite power (LOOP),
turbine trip, and the loss of the onsite emergency power supplies (typically EDGs).
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-18 of 24 USNRC HRTD Such an event is referred to as a station blackout (SBO). Risk analyses performed for NPPs indicate that the SBO can be a significant contributor to the core damage frequency. Although NPPs are designed to cope with a LOOP event through the use of onsite power supplies, LOOP events are considered precursors to SBO. An increase in the frequency or duration of LOOP events increases the probability of core damage.
It is clear that the grid has become more stressed. The underlying causes of lower reserve capacity or coping ability are not as important as taking actions to compensate for the perceived decrease in grid reliability.
Complicating the equation is the fact that LOOP events can have other unpredictable initiators such as natural events, potential adversaries, human error, design problems, etc. In response to grid reliability concerns, the NRC issued Generic Letter 2006-02:
"Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power."
A full discussion of GL 2006-02 is beyond the scope of this Course. Licensees were directed to provide substantial data relative to grid concerns. Some of its goals are:
- Better communications between the NPP operator and the Transmission System Operator (TSO) regarding grid and plant status.
- TSO use of analysis tools to determine the impact of the loss or unavailability of various transmission system elements.
- Real-time NPP operator knowledge of grid status, especially whether loss of the NPP will result in a LOOP event.
- status, especially grid-risk-sensitive maintenance activities.
- Determine if additional NPP operator training is needed for the above.
It is especially important that the NPP operator know when the trip of the NPP will result in a LOOP to the plant. A reduction in NPP switchyard voltage due to a trip is the main cause of a LOOP event. It is important to understand the transmission systems can generally tolerate voltages lower than required by NPP TS for system, structures and components (SSC) operability. As a result, the TSO will not necessarily keep the transmission system voltage above the level needed for the NPP unless the TSO has been informed of the needed voltage level and agreements have been formalized to maintain the voltage level.
13.12 THE TICKING CLOCK: AGING ISSUES RELEVANT TO EDGS Post-TMI Load Creep At first glance this may not seem to be an aging issue but the design basis of a plant can become outdated due to changes. As safety equipment is modified, replaced, or updated the EDG loads often change. Other factors such as ULS diesel fuel oil affect EDG calculations. The issues described by IN 93-17 and the subsequent TI 2515/176 regarding EDG design basis adequacy are also relevant.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-19 of 24 USNRC HRTD Underground Fuel Tanks All UG steel fuel tanks will eventually leak.
It's only a question of when. Coatings and well-maintained cathodic protection will delay the inevitable but licensees must be vigilant for tank problems, as water and rust will severely compromise EDG fuel oil. An effective program of fuel oil analysis and trending must be in place. See RG 1.132 Rev 2 (June 2013). It now specifies flash point as a fuel quality to check before off-loading (further tests later), requires tanks to be checked for condensate (water) monthly, and sets a 10-year cycle for tanks to be drained, cleaned, and internally inspected.
Replacement Parts Unavailability This is impacting all NPP systems. For EDGs the concerns include legacy engine governors, as well as circuit breakers, relays, and parts for engine accessories or support systems. Substitution of other components may be necessary.
NRC has expressed concern about the process of Commercial Grade Dedication (CGD), whereby suppliers dedicate ordinary commercial-grade parts for NPP safety function use. This should involve evaluation of critical characteristics including function, environmental, seismic, EMI/RFI, etc. In some cases the evaluations can take credit for testing done on similar items. However, NRC has found instances where that was improperly applied, or similarity was not established. Inadequate implementation of the CGD process may result in commercial-grade items not being properly applied to perform safety functions. See IN 2014-11.
Electric Cable Insulation Degradation Concerns about submerged electrical cable failures have already been discussed in this Chapter. NRC Generic Letter 2007-01 had a broader perspective, all underground or inaccessible cables within the scope of 10 CFR 50.65. It requested licensees provide a history of failures involving such cables.
Further, it asked them to describe their cable inspection,
- testing, and monitoring programs to detect the degradation of those that are inaccessible or underground and support EDGs, offsite power, etc.
Cross-linked polyethylene insulated cable (Type XLP) has been an electrical industry concern for decades, whether in wet or dry locations. XLP is no longer manufactured and it deserves special attention. Cable monitoring programs must deal with the fact there is no single non-destructive test to accurately predict failure.
For those seeking more information on this subject, the NRC has issued NUREG/CR-7000 (BNL-NUREG-90318-2009), "Essential Elements of an Electric Cable Condition Monitoring Program."
Battery Expected Life and its Potential Impact on Surveillance Requirements Class IE batteries used to supply DC loads at NPPs are the lead-acid type and degrade over time, primarily due to buildup of Lead Sulfate on the plates. Battery curves will typically show the capacity tapering off to 80% at 20 years, the presumed end-of-life.
At that point IEEE 450-2002, endorsed by RG 1.129, recommends replacement.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-20 of 24 USNRC HRTD These batteries serve a critical function, as they provide power during station blackout (SBO) for EDG starting and loading, many instrumentation and control circuits, and emergency lighting. NRC has expressed concern that NPP Tech Spec Surveillance Requirements may be non-conservative, as they may not consider post-TMI load creep, all post-accident DC loads resulting from plant Design Basis Events, or operating near minimum temperature. Accordingly, an 85% capacity assumption at 15 years of service was viewed favorably. Licensees were also alerted that surveillance criteria might need adjustment to be conservative for expected battery life. See IN 2013-05.
Beyond-Design-Basis Events: Flooding Fukushima will be studied for decades as a classic beyond-design-basis event. In that instance, new information had resulted in aging of plant design assumptions. After Fukushima, NRC focused on a spectrum of potential flooding events: storm surge, river flooding, dam breakage, etc. Some plants have vulnerabilities for flooding from events less than their design basis, as a result of infrastructure deterioration. See IN 2015-01 Accumulated Impact of Unnecessary Fast Starts of EDGs Some licensees still persist in performing fast starts with immediate heavy loading, a topic that has been extensively discussed in this Manual. They are damaging their EDGs and taking years off of useful life. This is particularly troublesome in view of the license extension for many plants. They need to understand the new direction of IEEE 387-1995 and RG 1.9 Rev 4 The Human Factor: The Heavy Loss of Experienced Personnel A high percentage of those who entered the nuclear industry in its earlier years are retiring. Their departure is impacting the experience level at licensee facilities and also within NRC. That poses a challenge for both regulators and licensees as the nuclear power industry has to gear up for the new wave of plant construction and operations.
It cannot be allowed to impact NPP safety.
The real challenge is how to assure that.
13.13 INDUSTRY EDG ACTIVITIES The nuclear industry employs several mechanisms to address issues such as EDG failures, events, and mitigation of failure impact on operability and reliability.
Utilities and EDG manufacturers participate in Owner's Groups that track specific EDG
- problems, develop operational and/or maintenance solutions, and also issue documentation for other EDG users and industry support organizations. Owner's Groups for Cooper-Bessemer, Fairbanks-Morse, EMD, and Cooper Industries/
Enterprise Group keep abreast of EDG problems through "Alert Lists."
Support organizations such as the Electric Power Research Institute (EPRI) and the Institute of Nuclear Power Operations (INPO) help disseminate EDG operational and failure data to all Owner's Groups through the Nuclear Plant Reliability Data System (NPRDS). INPO also maintains an equipment failure data base (EPIX). The World Association of Nuclear Operators (WANO) serves a similar global role.
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-21 of 24 USNRC HRTD Figure 13-1 Correct and Incorrect Air Start Motor Sub-Assembly
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-22 of 24 USNRC HRTD Figure 13-2 Location of Defective DeLaval Governor Drive Coupling
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-23 of 24 USNRC HRTD Figure 13-3 Location of Missing Cooper KSV Engine Valve Keeper Seals
Emergency Diesel Generator Case Studies: Lessons Learned, and Concerns Rev 3/16 13-24 of 24 USNRC HRTD Figure 13-4 Depiction of Water Tree in Electrical Cable Insulation (Fault paths utilize microscopic bubbles of ionized gas that conduct)