ML20044B420
| ML20044B420 | |
| Person / Time | |
|---|---|
| Issue date: | 10/29/1990 |
| From: | Remick F NRC COMMISSION (OCM) |
| To: | Chilk S NRC OFFICE OF THE SECRETARY (SECY) |
| Shared Package | |
| ML20042D089 | List:
|
| References | |
| FRN-57FR14514, REF-GTECI-B-56, REF-GTECI-EL, RULE-PR-50, TASK-B-56, TASK-OR AE06-1-070, AE6-1-70, NUDOCS 9011270160 | |
| Download: ML20044B420 (2) | |
Text
!
s""*%o A7EOla-f
. '..i UNITED STATES 8
NUCLEAR REGULATORY COMMISSION -
o 3
E WASHINGTON, D.C. 20555 o
'+9.....,o e'
OFFICE OF THE COMMISSIONER October 29, 1990 MEMORANDUM FOR:
Samuel J.
Chilk Secretary FROM:
F emick
SUBJECT:
oECY-90-340, RESOLUTION OF GENERIC SAFETY ISSUE B-56, " DIESEL GENERATOR RELIABILITY" I would like to request that SECY-90-340 be converted from an Information Paper to a Notation Paper.
I also request that the staff review the transcript of the October 26, 1990, Commission meeting with NUMARC and comment on
~'
statements made by the industry representatives on this issue.
It might be worthwhile for the staff ~t6 consider wording the 50.54 (f) letter to remove any implication that the request for information is being used to impose new regulatory requirements.
The staff's proposed letter (in SECY-90-340) is being interpreted by some as requiring (e.g.,
"your response should take one of the following forms:...") commitment to implement NUMARC's Initiative SA and Regulatory Positions C.3, C.4, C.5, and C.6 of Revision 3 to Regulatory Guide 1.9, thus elevating Regulatory Guide 1.9 and NUMARC's initiatives to a requirement without going through the rulemaking process.
According to staff's paper, all but a handful of licensees appear to be meeting the emergency diesel generator (EDG) reliability targets of.95 or.98, as appropriate.
It is my understanding that staff wants to issue the 50.54(f) letter in order to strengthen the basis for enforcement actions to upgrade a licensee's EDG reliability when it falls below the.95/.98 target level.
ff
,. f m
(, @\\0@\\q 0
/
g m-d O
l'
'i=
/.' f' E
t During the Commission briefing on the state of the nuclear industry, NUMARC indicated that the industry made commitments to maintain a reliability goal and that the commitment is docketed If that is the case, why is this letter necessary?
Doesn't the coping analysis performed by a licensee as required by 10 CFR i
50.63 clearly imply th&t the assumptions used in the coping l
analysis are binding throughout the life of the plant?
If so, wouldn't a generic letter which informs industry that the staff intends to enforce those commitments serve the same purpose?
l However, if the rule does not require the EDGs to maintain a specified reliability level, is the station blackout rule j
incomplete?
Is the 50.54 (f) letter the only option available to j
staff to get the handful of licensees to conform to the assumptions made in their coping analyses for the duration of the
)
l operating life of the plant?
Whatever the case, I would i
l appreciate staff addressing these and other related issues identified by NUMARC at the October 26, 1990 Commission meeting before voting on this matter.
l cc:
Chairman Carr Commissioner Rogers 1
Commissioner Curtiss I
i l
t
(
kk _
3 i
Afo 4-1 I
j l-g>RREGuql*
l s
1 i
Ae S,
\\
k,-
4 A
og *u /
October 3, 1990
" " ~ " ~ ' "
The ComR LICY ISSUE i
For:
James M. TappfOrmation) l From:
l Executive Director for Operations
Subject:
RESOLUTION OF GENERIC SAFETY ISSUE B-56, " DIESEL GENERATOR RELIABILITY" i
{
Purpose:
This paper is to inform the Commission of the staff's intended resolution of the subject issue. The staff is informing the j
Commission of this matter pursuant to Commission direction in cases where our actions do not agree with ACRS 3
j recommendations.
Background:
The Station Blackout Rule (10 CFR 50.63) became effective
]
July 21, 1988 and required that licensed LWRs be able to withstand for a specified duration and recover from a station blackout (580).
Regulatory Guide (RG) 1.155, " Station Blackout" (which was issued with the SB0 Rule) provided guidance for meeting the requirements of the SB0 Rule and i
referenced NUMARC-8700, " Guidelines and Technical Bases for l
NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," November 1987.
RG 1.155 identified the need for nuclear unit EDG reliability levels of 0.95, or higher, and identified a need for an EDG reliability program designed to monitor and maintain the reliability levels of each power source to assure that the selected reliability levels are being achieved.
The USI A-44, " Station Blackout" Federal Reaister Notice (53 FRN 23217) noted that: "The station blackout rule is closely related to several NRC generic programs - " and also stated (53 FRN 23218): "The resolution of B-56 will provide specific guidance for the staff or industry to use to review the adequacy of diesel generator reliability programs consistent with the resolution of USI A-44."
As a result, the resolution of GSI B-56 was directed at developing a regulatory guide which would:
NOTE:
TO BE MADE PUBLICLY AVAILABLE IN 10 WORKING DAYS PROM THE
Contact:
DATE OF THIS PAPER Warren Minners X23900
\\
fr 9 0/D){ N Oqt a\\
~
O
a.
Consolidate guidance on diesel generators previously provided in RG 1.9, Rev. 2, RG 1.108, Rev. I and Generic Letter 84-15, into a single guide (RG 1.9, Rev. 3).
b.
Incorporate proven industry practices, eliminate cold fast starts and minimize accelerated testing.
Define an EDG reliability program, thereby supplementing c.
guidance provided in RG 1.155.
l d.
Provide common guidance for staff and industry for monitoring and maintaining EDG reliability, and actions to be taken to correct a deteriorating situation.
Regulatory Guide 1.9, Revision 3 (proposed) was issued for comment in November 1988.
The staff and NUMARC held almost monthly meetings from July 1988 through August 1989, the goal being to develop mutually acceptable NRC and industry guidance documents for resolving GSI B-56.
The staff and NUMARC reached agreement on
[
respective guidance documents in November 1989 and the results were submitted to the CRGR. The CRGR recommended endorsement i
l of NUMARC's November 6, 1989 draft version of Appendix D of i
NUMARC-8700. Subsequently, NUMARC formally submitted Appendix D on May 2,1990, but with a significantly reduced scope from the November 1989 version of Appendix D.
NUMARC also opposed use of a 50.54(f) letter to issue the Regulatory Guide.
The staff revised Regulatory Guide 1.9, Revision 3 to reference NUMARC's Appendix D (May 2,1990), where possible, and to provide supplementary guidance to compensate for tha reduced scope of Appendix D.
In order to assure that an EDG reliability program such as in Regulatory Guide 1.9, Revision 3, or its equivalent, is routinely implemented and is subject to NRC inspection, and since NUMARC initiatives are not license commitments, a 50.54(f) letter was proposed.
The revised B-56 resolution package was again reviewed at CRGR Meeting 190 (July 25, 1990).
CRGR recommended that supplemental guidance not included in NUMARC Appendix D be moved to an Appendix in the regulatory guide and clearly noted as being provided for illustrative purposes (see enclosed CRGR meeting minutes).
The regulatory guide and proposed revisions were reviewed with the ACRS on August 9-10, 1990. The ACRS recommended that: a) the guidance contained in Regulatory Guide 1.9, Revision 3, Sections C.6-2 through C.6-7 be removed and b) the staff not issue a 50.54(f) letter to impose adoption of Regulatory Guide 1.9, Revision 3.
The ACRS letter and our proposed response are enclosed.
Discussion:
The staff recognizes the industry-wide achievement of improved EDG reliabilities, but is also aware that a small number of plants (i.e., 3-5 on an annual basis) still exhibit plant EDG reliabilities of less than 95%.
The staff's concerns rest
with this small number of plants and the knowledge that EDG reliability can vary with time.
Further, despite apparent success based on achievement of high overall reliabilities, operating experience such as that discussed in the Vogtle Unit 1 IIT report (NUREG-1410) reveal that individual plant EDG maintenance practices are not always effective in correcting root cause problems.
For example, Vogtle's problems with CALCON sensors existed from 1985 to 1990, and INP0 guidance on EDG failures was not effectively implemented.
Yet Vogtle's reliability monitoring program apparently did not detect the need for corrective action.
Station Blackout (SBO) has been calculated to be among the dominant contributors to core damage and early containment failure.
For those plants where currently implemented EDG reliability monitoring and maintenance are
- working, implementation of Regulatory Guide 1.9, Revision 3 should not result in a significant impact since both the regulatory guide and 50.54(f) letter provide ample opportunity to retain current effective methods.
For those plants where a deteriorating situation persists or may occur in the future (i.e.,
problem EDG) the regulatory guide provides common guidance to both staff and licensee on how to detect and respond to the situation.
The staff concludes that issuance of Regulatory Guide 1.9, Revision 3 by means of a 50.54(f) generic letter is appropriate to assure the resolution of GSI B-56.
This course of action is consistent with notification provided with issuance of the Station Blackout Rule (53 FRN 23218).
Further the staff believes that such action strengthens safety against prospectively flawed coping analyses for station blackout and an emerging concern from Generic Safety Issue GSI-23 (see staff discussion in SECY-90-326 dated September 17,1990).
Summary:
The staff intends to forward the enclosed response to the ACRS and to proceed to issue Regulatory Guide 1.9, Revision 3 and the 50.54(f) generic letter.
The Office of General Counsel has assisted in the preparation of the B-56 generic letter and has no legal objection to it.
/
mesM.Tay3fr M
l xecutive Director for Operations
Enclosures:
DISTRIBUTION:
1.
CRGR Meeting Minutes (CRGR Mtg. 190)
Commissioners REG OFFICE!
2.
ACRS Letter occ EDo 3.
Proposed Response to ACRS OIG ACRS l
4.
RG 1.9, Rev. 3 GPA SECY 5.
Generic Letter (Ref. GSI B-56)
I
ENCLOSURE 1 to the Minutes of CRGR Meeting No. 190 July 25, 1990 Proposed Resolution for GSI B-56, Diesel Generator Reliability TOPIC W. Minners (RES) and A. Serkiz (RES) presented for CRGR review a revised proposal for final resolution of GSI B-56, " Diesel Generator Reliability".
The proposed resolution included proposed Revision 3 to Reg. Guide 1.9 and The B-56 issue was reviewed earlier by CRGR an implementing generic letter.
at Meetings Nos.171 and 176; and the current review package included revis-ions reflect CRGR coments and recomendations from those earlier meetings.
The proposed resolution involves backfitting; specifically, the itaposition of new NRC staff positions / guidance relating to EDG reliability monitoring and EDG reliability programs. The proposed backfits were presented as cost-justified safety enhancements by the sponsoring staff.
Copies of the briefing slides used b the staff in their presentations to the Comittee are enclosed (Attachnient 1.
BACKGROUND 1.
The documents submitted initially to CRGR for review in this matter were transmitted by memorandum dated June 19, 1990, E.S. Beckjord to E.L.
Jordan; the initial review package included the following documents:
Letter dated May 3,1990 from W.H. Rasin (NUMARC) to E.S. Beckjord a.
providing NUMARC Initiative SA.
Enclosure A - Responses to CRGR Coments (from CRGR Meeting No.176) b.
dated May 29, 1990 Enclosure B - Working Draf t, dated June 14, 1990, of Revision 3 to c.
Enclosure C - Draft Generic Letter, dated June 15, 1990, " Request for Action Pursuant to 10 CFR 50.54(f) Related to the Resolution of Generic Safety Issue (GSI) B-56, Diesel Generator Reliability" Enclosure D - Draft Backfit Analysis, dated May 30, 1990, "G1 B-56, e.
Diesel Generator Reliability" f.
Enclosure E - Draft Federal Register Notice, dated May 29, 1990 Enclosure F - Appendix D, Dated May 2,1990, to NUMARC B7-00, g.
" Guidelines and Technical Bases for HUMARC Initia-tives Addressing Station Blackout at Light Water Reactors"
J ^
Enclosure G - Draft memorandum, dated May 8,1990, " Resolution of l
h.
Generic Safety issue B-56, EDG Reliability", and enclosed model Safety Evaluation Report A revision to the initial B-56 review package was transmitted by 2.
memorandum dated July 9,1990 (Attachment 2).
NUPARC provided comments on the proposed resolution for GSI B-56 directly 3.
to CRGR via letter, dated July 18, 1990, to E.L. Jordan (Attachment 4).
CONCLUSIONS / RECOMMENDATIONS As a result of their review of the B-56 issue, including the discussions with the staff at this meeting, the Committee recommended in favor issuance of pro-posed Revision 3 to Reg. Guide 1.9 and its implementing generic letter, sub-j ject to several conditions stated below:
The staff should revise the format of proposed Revision 3 along the lines i
1.
discussed with the staff at this meeting (see Attachment 3), so that Regulatory Position C.6 identifies the principal elements of an EDG reliability program acceptable to NRC, but the detailed content currently i
included under C.6.2, C.6.3, C.6.4, C.6.5, C.6.6 and C.6.7 is moved to a i
new Appendix. The new Appendix should note explicitly that the detailed information provided therein is intended as illustrative examples and considerations that could be used, by licensees who choose to do so, in developing EDG reliability programs based on the principal elements contained in Regulatory Position C.6. (or the equivalent guidance in the NUMARC Appendix D dated 5/2/90). Also, the Reg. Guide should state i
explicitly that the principal elements of the EDG reliability program identified in Regulatory Position C.6 are intended as guidelines, which need not be used by a licensee to replace or supplement an existing 4
successful program.
2.
The staff should revise the proposed implementing generic letter to make clearer that NRC is, in accordance with the provisions of 10 CFR 50.54(f), requiring licensee response as to whether they will provide a regulatory commitment (a) to implement NUMARC Initiative 5A, and (b) to implement voluntarily the guidance for monitoring and maintaining EDG reliability in Regulatory Positions C.3, C.4, C.5 and C.6 of Revision 3 to Reg. Guide 1.9 (or equivalent guidance in NUPARC's Appendix D), as the means of complying with 10 CFR 50.63; and, if not, describe their altern-ative method for compliance with the rule. Specifically, the wording in the last paragraph on page 1 of the proposed generic letter (e.g., the reference to " complying with" the Regulatory Posititons in Reg. Guide 1.9) should be revised or deleted, to make clear that this letter is a generic information request only, and to avoid any suggestion that the letter is intended to impose new regulatory requirements. The wording in the first paragraph on pages 1 and 2 is generally more suitable in that regard, and should be used as the model.
Also the discussion under " Purpose and Background" in the proposed generic letter should be expanded to discuss the linkage between GSI B-56 and 10 CFR 50.63 (Station Blackout rule), specifically with respect to identification of the need for detailed guidance for monitoring EDG reli-ability and for EDG programs.
4 1 l
The staff should reexamine the wording of the Backfit Analysis provided 3.
with the review package for the B-56 issue, and the "Backfit Discussion" in the proposed implementing generic letter, and revise as appropriate to make clear that the staff is reaffirming at this time (in the light of the most current information available) the applicability of the bounding i
type cost estimates made for anticipated EDG reliability activities in the USI A-44 resolution approved earlier in connection with the Station The comments received f rom NUMARC seem to lack recogni-Blackout rule.
tion of this relationship, and a more explicit (perhaps expanded) discus-sion of this point in the B-56 package may be helpful.
The CRGR considered explicitly in discussions with the staff at this 4.
comments submitted formally by NUMARC in their July 18, 1990 meeting (Attachment 4), and reviewed the proposed responses to those letter The coments provided at the meeting by the staff (Attachment 5).
Committee agreed with the overall thrust and tone of the proposed responses, and offered specific suggestions for several minor changes In finalizing the to improve their clarity and internal consistency.
responses, the staff will consider expanding (the discussion in areas that address policy type issues raised by NUMARC e.g., whether there is any current need for detailed regulatory guidance on EDG reliability programs, and the effects of the recent Appendix D revisions by NUMARC).
The CRGR noted their disappointment and consternation at the recent 5.
NUMARC action in removing abruptly from their Appendix 0 guidance document much of detailed guidance on EDG programs previously included This action by NUMARC followed several years of extensive coord-there.
inative effort by the NRC staff to develop, in cooperation with NUMARC, complementary detailed EDG guidance (specifically, Revision 3 to Reg.
As a result of those Guide 1.9 and the NUMARC Appendix D document).
coordinated efforts, the NUMARC Appendix D guidance reviewed by CRGR at Meeting No. 176 was judged to be a fully acceptable equivalent to the detailed guidance in the staff's proposed Revision 3 to Reg. Guide 1.9.
At that point, the Comittee recomended, and the staff agreed in prin-ciple, that Appendix D should be adopted (essentially without excep-tion) as an industry standard, suitable for referencing by the licensees as acceptable means for monitoring and maintaining EDG reliability.
The staff informed NUMARC of the planned endorsement of, and reliance on, the Appendix D guidance by NRC. Notwithstanding, NUMARC chose to abrupt-ly remove from Appendix D in a recent revision much of the detailed EDG program guidance that made it suitable for referencing as a standard.
That action by NUMARC at this late stage has rendered largely a waste the expenditure of significant staff resources and CRGR review time over the last year-or-more, pursuing development of complementary detailed NRC and NUMARC guidance on EDG program.s. Beyond the waste of staff resources in-volved, the time spent by the staff in pursuing that objective in good j
faith represents a year-or-more of unnecessary delay in coming to regula-tory closure on the B-56 issue as now proposed by the staff.
There was a CRGR consensus that the Chairman should send to the EDO a 1
separate letter more fully discussing the circumstances involved, and expressing the Comittee's concern regarding the broader policy implic-J ations of the NUMARC action.
1
g., a y UNITED ST ATES
[
E'h e h
NUCLE AR REGULATORY COMMISSION I
ADVISORY COMMITTEE ON RE ACTOR SAFEGUARDS g@* " ' -l W ASHINGT ON. D C. 20555 J
/
~
=....
Ef4 CLOSURE 2 August 14, 1990 The Honorable Kenneth M.
Carr Chairman U.S. Nuclear Regulatory Commission Washington, D.C.
20555
Dear Chairman Carr:
SUBJECT:
PROPOSED RESOLUTION OF GENERIC SAFETY ISSUE B-56, " DIESEL GENERATOR RELIABILITY" During the 364th meeting of the Advisory Committee on Reactor Safeguards, August 9-11, 1990, we reviewed the NRC staff's proposed resolution of Generic Safety Issue (GSI) B-56,
" Diesel Generator Reliability." Our Subcommittee on AC/DC Power Systems Reliability also reviewed this matter during a meeting on August 8,
1990.
During these reviews, we had the benefit of discussions with representatives of the NRC staff and of NUMARC.
We also had the benefit of the documents referenced.
In our
- view, this proposed resolution includes unjustified imposition of maintenance requirements on the licensees, in contravention of the Commission's decision to defer issuance of a maintenance rule pending assessment of licensees' maintenance programs.
The proposed resolution of GSI'B-56 involves two steps.
- First, Section C.6 of proposed ' R.G.
1.9, Rev.
3, contains an explicit example of a diesel generator reliability program, including maintenance, with detailed checkoff and corrective action lists.
Second, the staff proposes to require adoption of R.G.
1.9, Rev.
3, by a generic letter pursuant to 10 CFR 50.54(f).
As background, GSI B-56 is related to the Station Blackout Rule (10 CFR 50.63).
The staff issued R.G.
1.155, " Station Blackout," to provide guidance for compliance with this rule.
R.G.
1.155 identified the need for a reliability program to achieve and maintain diesel generator minimum reliability levels of 0.95 or 0.975 per demand, depending on the blackout duration coping requirements calculated for a particular plant.
R.G.-1.9, Rev.
3, provides guidance for a reliability program by integrating into a single regulatory guide pertinent guidance now addressed in R.G.
1.9, Rev.
2, R.G.
1.108, Rev.
1, and Generic
The lionorable Kenneth M.
Carr 2
August 14, 1990 Letter 84-15.
In addition, R.G.
1.9, Rev.
3, endorses IEEE Standard 387-1984.
This guide also describes a means for meeting the minimum diesel generator reliability goals contained in R.G.
1.155.
j In developing the guidance contained in R.G.
1.9, Rev.
3, for the diesel generator reliability program, the staff has taken cog-nizance of related industry initiatives and programs, and for the most part is consistent with current industry practices.
Both the staf f and the industry seem to be in agreement concerning R.G. 1.9, Rev.
3, except for those parts of Section C.6 and accompanying figures and tables that prescribe in detail the requirements for a diesel generator reliability program.
NUMARC maintains that the licensees have committed to monitoring diesel generator reliability, and have docketed their commitments to maintain the chosen target reliability -levels to comply with the Station Blackout Rule.
NUMARC considers that these commitments together with their initiatives are sufficient to ensure acceptable diesel generator reliability.
Both the staff and NUMARC agree that diesel generator reliability has improved and the industry as a whole is maintaining reliability above the chosen target levels.
NUMARC maintains that these efforts and results are adequate and that the prescriptive guidance contained in R.G.
1.9, Rev.
3, is unwarranted.
We believe that the commitments of the licensees to monitor and maintain diesel generator reliability above the chosen target levels and the industry initiatives are sufficient to ensure acceptable diesel generator reliability under the Station Blackout Rule.
If plants fall below the target levels, these plants shculd be identified and corrective actions will be taken.
i We recommend that the prescriptive guidance contained in R.G.
1.9, Rev.
3, Sections C.6-2 through C.6-7 be removed, along with the l
related figures and tables.
In addition, the staff should not issue a 50.54(f) letter to impose adoption of R.G.
1.9, Rev.
3.
Additional comments by ACRS Member Harold K.
Lewis are presented below.
Sincerely, bl u
C :r.
C:
l
-,,w s~=
l r-t l-i i
The lionorable Kenneth M.
Carr 3
August 34, 3990 Additional Comments by ACRS Member Harold W, Lewis i
I First, I don't see the problem this program is supposed to solve.
Everyone seems to agree that diesel reliability is good and improving, and that each diesel f ailure should be analyzed for root cause, to reduce the likelihood of recurrence.
The remaining issue is the relevance of the threshold values.
- Clearly, failure experience is an indicator of the underlying reliability -- the question is how to use the data.
I am surprised that such a trivial measure as a collection of arbitra'ry threshold values has been chosen.
Once the f ailure data have been collected, it is no harder to make full use of the data, by calculating a set l
l of confidence limits on the underlying reliability.
Such a l
procedure makes optimal use of the data, and can be recalculated after each attempt to start, with the expenditure of a few microseconds of computer time.
The trends and their significance can then be monitored.
I see no excuse for throwing away data, once collected.
Despite the staff assertions that this would be far more difficult, it would in fact be trivial.
References:
1.
U.S. NRC Regulatory Guide 1.9, Rev. 3 (June 14, 1990), Working
-Lraft,
" Selection,
- Design, Qualification,
- Testing, and
- m
. Reliability of Emergency Diesel Generator Units Used As Class 1E Onsite Electric Power Systems At Nuclear Power Plants."
2.
U.S.
NRC. Regulatory Guide 1.9, Rev.
2 (December 1979),
" Selection, Design, Qualification of Diesel-Generator Used as i
Standby (On-Site)
Electric Power Systems at Nuclear Power l
Plants."
l 3.
Nuclear Management and Resources Council, NUMARC 87-00, i
(Revision 1),
" Guidelines' and Technical Bases for NUMARC Initiatives Addressing Station Blackout At Light Water Reactors," Appendix D, "EDG Reliability Program," May 2, 1990 4.
IEEE Standard 387-1984, "IEEE Standard Criteria for Diesel-I Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," June 1984.
5.
U.S.
Nuclear Regulatory Commission, Regulatory Guide 1.155 (Task SI 501-4), " Station Blackout," August 1988.
6.
U.S.
Nuclear Regulatory Commission, Regulatory Guide 1.108, Rev.
1,
" Periodic Testing of Diesel Generators Used As On-Site Electric Power Sysens At Nucleir I-ower Plants," August 1977.
7.
Generic Letter 84-15, " Proposed S ':: 1.:tions to Impros:
l Mainta in Diesel Generator liel j abi );
," Ju!" 1, 1984 l
l
(..
l l
MEMORANDUM FOR:
Carlyle Michelson, Chairman Advisory Committee on Reactor Safeguards FROM:
James M.
Taylor Executive Director for Operations
SUBJECT:
PROPOSED RESOLUTION OF GENERIC SAFETY ISSUE B-56 " DIESEL GENERATOR RELIABILITY" This is in response to your letter to the Chairman dated August 14, 1990 on the above subject.
I think that there is i
general agreement that maintaining diesel generator reliability is important and that the actions outlined in the proposed Regulatory Guide (which are the same as provided in the NUMARC-8700, Appendix D, May 2, 1990) are appropriate practices to follow in order to attain the needed reliability.
Both NUMARC and the ACRS believe that a 50.54 (f) letter should not be issued and that the guidance contained in the proposed Regulatory Guide 1.9, Revision 3, Sections C.6.2 through C.6.7 is prescriptive and should be removed.
We agree with your recommendation to remove the guidance contained in Sections C.6.2 through C.6.7 of Regulatory Guide 1.9, Revision 3.
This material has been placed in an appendix and clearly identified as only considerations and illustrative examples based on good practices.
Thus, this material does not reflect regulatory positions and licensees would not have to replace current proven good practices just to prescriptively conform to the Regulatory Guide.
The Regulatory Guide retains the portion of Section C.6 which lists the principal elements of an EDG reliability program.
These elements are identical to the elements identified in NUMARC-8700, Appendix D (May 2, 1990).
Although these principal elements include a maintenance program, this is not, as you state, an " unjustified imposition of maintenance requirements on the licensees in contravention of the Commission's decision to defer issuance of a maintenance rule...."
I believe that this is consistent with the Station Blackout Rule, and the recognition that diesel generator reliability has high safety significance.
My belief is based on the Federal Register Notice (53 FRN 23218)
i I
! t f
for the Station Blackout Rule which stated that the " resolution j
of B-56 will provide specific guidance for use by the staff or j
industry to review the adequacy of the diesel generator reliability programs...."
The basic elements of an EDG reliability program were included in
]
Regulatory Guide 1.155, which was reviewed by the Commission and j
the ACRS, and was concurrently issued with the-Station Blackout j
Rule.
Regulatory Position C.1.2 of this guide clearly stated j
that reliable operation of emergency ac power sources should be i
)
ensured by a reliability program designed to monitor and maintain l
reliability levels.
Regulatory Guide 1.155 identified typical ~
}
program activities such as surveillance testing and reliability l
j monitoring, and "a maintenance program that ensures that the target EDG reliability is being achieved...."
The proposed Regulatory Guide 1.9, Revision 3 does no more than. adopt this j
position and provide a reliability program structure-in the form of seven elements which are identical to NUMARC's elements, including more specific guidance on surveillance testing and
{
reliability monitoring.
We agree with NUMARC that diesel generator reliability is now
]
generally good and that the industry has. demonstrated its j
capability to maintain reliability at, and even above, the target i
levels.
However each year a few plants fall below SBO i
reliability targets.
Our objective in establishing guidance for j
diesel generator reliability programs is to define a program-that 4
incorporates the practices of utilities that have high EDG-l reliability.
Therefore the program should have little or no i
impact on utilities that have good reliability and provides l-proven guidance to improve the performance of those that don't.
i The program is intended to require little NRC oversight beyond j
normal audit inspections.
For example, the current reporting of
[
j every diesel generator failure that'now is required of
~
j approximately half the licensees would be eliminated.
Only major j
degradations in reliability would be reportad (i.e.,
4 failures i
in 25 demands which is a point estimate reliability of 84%).
In i
order to realize this intent, we'need to have an agreed upon l
program that utilities can follow without our continual close j
monitoring.
)
)
We also have considered your recommendation not to issue a j
j 50.54 (f) letter, but see no better alternative.
We have reviewed l
l the applicability and appropriateness of a 50.54 (f) letter with j
OGC who has reviewed this letter and has no legal objection to i
this approach.
The staff believes that this letter is needed to obtain a docketed commitment from each licensee to implement l
lj.
V t
1 i
I
. NUMARC Initiative 5A and Appendix D of NUMARC-8700 and Regu.'.atory Guide 1.9, Revision 3, Positions C.3, C.4, C.5, and C.6 or to identify alternative actions.
While, as you note, licensees have a docketed commitment to the chosen target reliability leve7.s in compliance with the Station Blackout Rule, they have no docketed commitment to monitor diesel generator reliability nor to any other of the elements of a reliability program.
Of most concern is a lack of a commitment to the actions they would take if the reliability falls below the target values.
Thus, overall, we continue to believe that the letter is needed to assure docketed licensee commitments in this important area.
James M.
Taylor Executive Director for Operations l
l 1
l l
l l
~
. =
I ENCLOSURE 4 Revision 3 9/24/90 l
REGULATORY GUIDE 1.9 (TASK RS 802-5)
SELECTION, DESIGN, QUALIFICATION, TESTING, AND RELIABILITY OF EMERGENCY DIESEL GENERATOR UNITS USED AS CLASS 1E ONSITE ELECTRIC POWER SYSTEMS AT NUCLEAR POWER PLANTS 1
A.
INTRODUCTION Criterion 17, " Electric Power Systems," of Appendix A,
" General Design Criteria for Nuclear Power Plants," to 10 CFR Part 50, " Domestic Licensing of Production and Utilization I
Facilities," requires that onsite electric power systems have sufficient independence, capacity, capability, redundancy,.and testability to ensure.that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational l
occurrences and (2) the core is cooled and containment integrity l
and other vital functions are maintained in'the event of postulated accidents, assuming a single failure.
Criterion 18, " Inspection and Testing of Electric Power Systems," of Appendix A to 10 CFR 50 requires that electric power systems important to safety be designed to permit appropriate periodic inspection and testing to assess the continuity of the systems and the condition of their components.
Criterion XI, " Test Control," of Appendix B,
" Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," to 10 CFR 50 requires that (1) measures be provided for verifying or checking the adequacy of design by design reviews, by the use of alternative oc aimplified calculational methods, or by the performance of a suitable testing program and (2) a test 1
program be established to ensure that systems and components' j
perform satisfactorily and that the test program include operational tests during nuclear power plant operation.
j l
I'c
i 4
i Section 50.63, " Loss of All Alternating Current Power," of 10 CFR Part 50 requires that each light-water-cooled nuclear power plant be able to withstand and recover from a station blackout (i.e.,
loss of offsite and onsite amargency ac power systam) for a specified duration.
The reliability of onsite j
amergency ac power sources is one of the main factors l
contributing to risk of core melt resulting from station i
l blackout.
l Diesel generator units have been widely used as the power l
source for onsite electric power systems.
This regulatory guide
(
provides guidance acceptable to the NRC staff for complying with the Commission's requirements that diesel generator units intended for use as onsite amargency power sources in nuclear I
power plants be selected with sufficient capacity, be qualified, l
and be maintained to ensure availability of the required l
amargency diesel generator performance capability for station l
blackout and design basis accidents.
This guide has been prepared for the resolution of Generic Safety Issue B-56, " Diesel Generator Reliability," and is related i
to Unresolved Safety Issue (USI) A-44, " Station Blackout."
The resolution of USI A-44 established a need for an amargency diesel generator (EDG) reliability program that has the capability to i
achieve and maintain the emergency diesel generator reliability I
levels in the range of 0.95 per demand or better to cope with station blackout.
This guide recognizes that unless emergency diesel generators are properly maintained, their capabilities to perform on demand may degrade.
The condition of the diesel units must be monitored during test and maintenance programs, ac.d appropriate parametric trends must be noted to detect potential failures; appropriate preventive maintenance should be performed.
All previous Jicensing commitments based on Regulatory Guides 1.9 and 1.108 are considered to be in effect until a licensee revises plant technical specifications.
j The regulatory basis for information collection activities mentioned in this regulatory guide are contained as requirements in 10 CFR Part 50, which provides the regulatory basis for this guide.
The information collection requirements in 10 CFR Part 50 have been cleared under CMB Clearance No. 3150-0011.
2
i l
B.
DISCUSSION An emergency diesel generator unit selected for use in an onsite electric power system should have the capability to (1) start and accelerate a number of large motor loads in rapid succession while maintaining voltage and frequency within acceptable limits, (2) provide power promptly to engineered safety features if a loss of offsite power and an accident occur during the same time period, and (3) supply power continuously to the equipment needed to maintain the plant in a safe condition if an extended loss of offsite power occurs.
I IEEE Std 387-1984,2 "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear l
Power Generating Stations," delineates principal design criteria l
and qualification and testing guidelines that, if followed, will l
help ensure that selected diesel generator units meet performance j
requirements.
(IEEE Std 387-1977 was endorsed by Revision 2 of l
" Selection, Design, and Qualification of l
Diesel-Generator Units Used as Standby (Onsite) Electric Power l
Systems at Nuclear Power Plants.")
IEEE Std 387-1984 was developed by Working Group 4.2C of the Nuclear Power Engineering l
Committee (NPEC) of the Institute of Electrical and Electronics Engineers, Inc. (IEEE), approved by NPEC, and subsequently approved by the IEEE Standards Board on March 11, 1982.
Std 387-1984 is supplementary to IEEE Std 308-1974, "IEEE Standard Criteria for Class 1E Power Systems and Nuclear Power Generating Stations," and specifically amplifies paragraph 5.2.4,
" Standby Power Supplies," of IEEE Std 308 with respect to the application of diesel generator units.
IEEE Std 308-1974 is endorsed, with certain exceptions, by Regulatory Guide 1.32, " Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants."
IEEE Std 387-1984 also references other standards that contain valuable information.
Those referenced standards not endorsed by a regulatory guide or incorporated into the regulations, if used, are to be used in a manner consistent with current regulations.
' Copies may be obtained from the Institute of Electrical and Electronics Engineers, Inc., IEEE Service Center, 445 Hoes Lane, P.
O. Box 1331, Piscataway, NJ 08855.
3 l
I
1 i
l A knowledge of the characteristics of each load is essential in establishing the bases for the selection of an emergency diesel generator unit that is able to accept large loads in rapid succession.
The majority of the emergency loads are large induction motors.
This type of motor draws, at full voltage, a starting current five to eight times its rated load current.
The sudden large increases in current drawn from the diesel generator resulting from the startup of induction motors can result in substantial voltage reductions.
The lower voltage could prevent a motor from starting, i.e.,
accelerating its load to rated speed l
in the required time, or could cause a running motor to coast down or stall.
Other loads might be lost because of low voltage if their contractors drop out.
Recovery from the transient caused by starting large motors or from the loss of a large load could cause diesel engine overspeed that, if excessive, might result in a trip of the engine, i.e.,
Ic ss of the Class lE power l
source.
These same consequences can alco result from the I
cumulative effect of a sequence of more moderate transients if the system is not permitted to recover sufficiently between successive steps in a loading sequence.
Generally it has been industry practice to specify a maximum voltage reduction of 10 to 15 percent when starting large motors from large-capacity power systems and a voltage reduction of 20 to 30 percent when starting these motors from limited-capacity power sources such as diesel generator units.
Large induction motors can achieve rated speed in less than 5 seconds when powered from adequately sized emergency diesel generator units that are capable of restoring the bus voltage to 90 percent of nominal in about 1 second.
Protection of the emergency diesel generator unit from excessive overspeed, which can result from an improperly adjusted control system or governor failure, is afforded by the immediate operation of a diesel generator unit trip, usually set at 115 percent of nominal speed.
Similarly, in order to prevent substantial damage to the generator, the generator differential current trip must operate immediately upon occurrence of an internal fault.
There are other protective trips provided to protect the emergency diesel generator units from possible damage.
However, these trips could interfere with the successful functioning of the unit when it is most needed, i.e.,
during accident conditions.
Experience has shown that there have been numerous occasions when these trips have needlessly shut down j
emergency diesel generator units because of spurious operation of a trip circuit.
Consequently, it is important that measures be 4
taken to ensure that spurious actuation of these other protective trips does not prevent the emergency diesel generator unit from performing its function.
The uncertainties inherent in estimates of safety loads at the construction permit stage of design are sometimes of such magnitude that it is prudent to provide a substantial margin in selecting the load capabilities of the emergency diesel generator unit.
This margin can be provided by estimating the loads conservatively and selecting the continuous rating of the amargency diesel generator unit that exceeds the sum of the loads needed at any one time.
A more accurate estimate of safety loads is possible during the operating license stage of review, because detailed designs have been completed and component test and preoparational test data are usually available.
The reliability of diesel generators is one of the main factors affecting the risk of core damage from a station blackout ovent.
Thus, attaining and maintaining high reliability of amargency diesel generators at nuclear power plants is a major consideration for the reducting the probability of station blackout.
In Regulatory Guide 1.155, " Station Blackout," the reliability of the diesel generator is one of the factors to be used to determine the length of time a plant should be able to cope with a station blackout.
If all other factors (redundancy of amergency diesel generators, frequency of loss of offsite power, and probable time needed to restore offsite power) remain constant, a higher reliability of the diesel generators will result in a lower probability of a total loss of ac power (station blackout) with a corresponding coping duration for certain plants according to Regulatory Guide 1.155.
High reliability should be designed into the emergency diesel generator units ano maintained throughout their service lifetime.
This can be achieved by appropriate testing, maintenance, operating programs, and institution of a reliability program designed to monitor, improve, and maintain reliability at selected levels.
This guide provides explicit guidance in the areas of preoperational testing, periodic testing, reporting requirements, and valid demands and failures.
The preoperational and periodic testing provisions set forth in this guide provide a basis for taking corrective actions needed to maintain high inservice reliability of installed emergency diesel generator units.
The data developed will provide an ongoing demonstration of l
5 l
performance and reliability for all emergency diesel generator units after installation and during service.
This revision of Regulatory Guide 1.9 integrates into a single regulatory' guide pertinent guidance previously addressed in Revision 2 of Regulatory Guide 1.9, Revision 1 of Regulatory Guide 1.108, and Generic Letter 84-15, and it references, as appropriate, guidelines set forth in IEEE Std.387-1984.
In addition, this guide describes a means for meeting the minimum diesel generator reliability goals in Regulatory Guide 1.155.
This guide also provides guidance for an emergency diesel generator reliability program designed to monitor and maintain EDG reliability levels.
l Concurrent with the development of this regulatory guide,.
the Nuclear Management and Resources Council (NUMARC).has revised NUMARC-87-00, " Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors."
i NUMARC-8700, Revision 1, Appendix D, "EDG Reliability Program,"
which (5-2-90) provides for monitoring nuclear unit EDG reliability levels and remedial actions to restore EDG l
reliability to meet those values selected for station ~ blackout.
The NRC staff has reviewed NUMARC's revised Appendix D and finds it acceptable for monitoring EDG reliability levels.
Table 1 of this regulatory guide provides a cross reference between Revision 3 of Regulatory Guide 1.9 and NUMARC 8700, Revision 1, Appendix D (5-2-90).
C.
REGULATORY POSITION-Conformance with the guidelines in IEEE Std 387-1984 "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," is a method acceptable to the NRC staff for satisfying the Commission's regulations with respect to design, qualification, and periodic testing of diesel generator units used as onsite I
6 i
i l-
i electric power systems for nuclear power plants. subject to the following:
1.
DESIGN CONSIDERATIONS I
The guidelines of IEEE Std 387-1984 should be supplemented as follows:
1.1 Section 1.2,
" Inclusions," of IEEE Std 387-1984 should be supplemented to include diesel generator auto controls, manual controls, and diesel generator output breaker.
1.2. When the characteristics of the required emergency diesel generator loads are not accurately known, such as during the construction permit stage of design, each emergency diesel l
generator unit of an onsite power supply system should be selected to have a continuous load rating (as defined in Section 3.7.1 of IEEE Std 387-1984) equal to or greater than the sum of the conservatively estimated loads (nameplate) needed to be powered by that unit at any one time.
In the absence of fully substantiated performance characteristics for mechanical equipment such as pumps, the electric motor drive ratings should be calculated using conservative estimates of these characteristics, e.g.,
pump runout conditions and motor efficiencies of 90 percent or less and power factors of 85 percent or lower.
1.3. At the operating license stage of review, the predicted loads should not exceed the continuous rating (as defined in Section 3.7.2 of IEEE Std 387-1984). of the diesel generator unit.
1.4. Section 5.1.2,
" Mechanical and Electrical l
Capabilities," of IEEE Std 387-1984 pertains, in part, to.the:
i starting and load-accepting capabilities of the diesel generator l
unit.
In conformance with Section-5.1.2, each diesel generator l
unit should be capable of starting and accelerating to rated i
speed, in the required sequence, all the needed engineered safety feature and emergency shutdown loads.
The diesel generator unit design should be such that at no time during the loading sequence should the frequency decrease to less than 95 percent of nominal' nor the voltage decrease to less than 75 percent of nominal (a larger decrease in voltage and frequency may be justified for a diesel generator unit that carries only one large connected load).
Frequency should be restored to within 2 percent of nominal in less than 60 percent of each load-sequence interval for step-load increase and in less than'80 percent of each load-sequence interval for disconnection of the single largest load,
)
and voltage should be restored to within 10 percent"of nominal within 60 percent of each load-sequence time interval.
(A greater percentage of the time interval may be used if it can be justified by analysis.
However, the load-sequence _ time interval should include sufficient margin to account for the accuracy and repeatability of the load-sequence' timer).
During recovery from transients caused by the disconnection of the largest single load, the speed of the diesel generator unit should not exceed the nominal speed plus 75 percent of the difference between-nominal speed and the overspeed trip setpoint or 115 percent of nominal, whichever is lower.
Furthermore, the transient following the complete loss of load should not cause the speed of the unit to attain the overspeed trip actpoint.
i 1.5. Emergency diesel generator units should be designed to j
be testable as discussed in Regulatory Position C.2.
The design should include provisions so that testing of the units will simulate the parameters of operation (manual start, automatic start, load sequencing, load shedding, operation time, etc.),
{
normal standby condit.4 9ns, and environments _ (temperature, j
humidity, etc.) that would be expected if actual demand were to j
be placed on the system.
If prewarm systems designed to maintain lube oil and jacket water cooling at certain temperatures or prelubrication systems or both are normally in operation, this j
would constitute normal standby conditions for that plant.
l 1.5.1.
The units should be designed to automatically transfer from the test mode to an emergency mode upon receipt of i
emergency signals.
j 1.6. Design provisions should include the_ capability to test each emergency diesel generator unit independently of the redundant units.
Test equipment should not cause a-loss of independence between redundant diesel generator' units or between diesel generator load groups.
1.6.1 Testability should be considered in the selection and location of instrumentation sensors and critical components-(e. g., governor, starting system components).
Instrumentation sensors should be readily accessible and designed so that their inspection and calibration can be verified in place.
The overall design should include status indication and alarm features.
1.7 Section 5.5.3.1,
" Surveillance Systems," of IEEE Std 387-1984 pertains to status indication of diesel generator unit conditions.
The guidance in this section should be supplemented as follows:
8
1.7.1 A surveillance system should be provided with remote indication in the control room for displaying emergency diesel generator unit status, i.e.,
under test, ready-standby, lockout.
A means of communication should also be provided between diessi generator unit testing locations and the main control room to ensure that the operators are cognizant of the status of the unit under test.
1.7.2 In order to facilitate trouble diagnosis, the surveillance system should indicate which of the emergency diesel generator protective trips has been activated first.
1.8 Section 5.5.4,
" Protection," of IEEE Std 387-1984, which pertains to bypassing amargency diesel generator protective trips during amargency conditions, should be interpreted as follows:
The emergency diesel generator unit should be automatically tripped on an engine overspeed, low oil pressure, and generator-differential overcurrent.
All other diesel generator protective trips should be handled in one of two ways: (1) a trip should be implemented with two or more measurements for each trip parameter with coincident logic provisions for trip actuation, or (2) a trip may be bypassed under accident conditions provided the operator has sufficient time to react appropriately to an abnormal diesel generator unit condition.
The design of the bypass circuitry should include the capability for (1) testing the status and operability of the bypass circuits, (2) alarming in the control room for abnormal values of all bypass parameters (common trouble alarms may be used), and (3) manually resetting the trip bypass function.
Capability for automatic reset is not acceptable.
Section 5.5.4 (2) of IEEE Std 387-1984, on retaining all protective devices during emergency diesel generator testing, does not apply to a periodic test that demonstrates diesel generator system response under simulated accident conditions per Regulatory Positions C.2.2.5, C.2.2.6, and C.2.2.12.
9
2.
DIESEL GENERATOR TESTING-Section 3,
" Definitions," Section 6, " Testing, "*. and Section 7, " Qualification Requirements " in IEEE Std 387-1984 should be supplemented as discussed below.
2.1 Definitions The following definitions
- are applicable to the positions of this regulatory guide that address testing, reliability calculations, recordkeeping, and reporting of performance.
j Start demands:
All valid and inadvertent start demands, including all start-only demands and all start demands that are j
followed by load-run demands, whether by automatic or manual j
initiation.
A start-only demand is a demand-in which the emergency generator is started, but no attempt is made to load the emergency diesel generator.
See " Exceptions" below.
Start failstres:
Any failure within the emergency generator system.that prevents the generator from achieving specified frequency (or speed) and voltage.is classified as a valid start failure.
(For the monthly surveillance tests, the emergency diesel generator can be brought to rated speed and voltage in a e
time that is recommended by the manufacturer to minimize stress and wear.
Similarly, if the generator fails to reach ratad speed j
and voltage in the precise time required by technical specifications, the start attempt is not considered a failura if the test demonstrated that the generator would start and run in an emergency).
See " Exceptions" below. 'Any condition identified l
in the. course of maintenance inspections (with the EDG in the l
standby mode) that would definitely have resulted in a start i
failure if a demand had occurred should be-counted as a valid r
start demand and failure.
i
' Additional useful infczmation on testing and test definitions can be found in the ASME OEM Part 16, " Inservice Testing and Maintenance of Diesel Drives at Nuclear Power Plants."
Copies can be obtained by contacting the American Society of Mechanical Engineers (ASME), United Engineering Center, 345 East 47th Street, i
New York, NY 10017.
- These definitions are taken from NUMARC-8700, Revision 1,
Appendix D, May 2, 1990.
10 7
m.
m-,.
_.--.,_.,,.._w-
.-__.-,.m,.
.,m.,m..-
y.,
%.m..-
~
1 l
Load-run demands: To be valid, the load-run attempt must l
follow a successful start and meet one of the following criteria:
l (See " Exceptions" below.)
i o
A load-run of any duration that results from a l
real (e.g., not a test) automatic or manual signal.
o A load-run test to satisfy'the plant's load and duration test specifications, o
other operations (e. g., special tests) in which the emergency diesel generator is planned to run for at least one hour with at least 50 percent of design load.
i Load-run Failures: A load-run failure should be counted when the emergency diesel generator starts but does not pick up load and run successfully.
Any failure during a valid load-run demand should be counted.
See " Exceptions" below.
(For monthly surveillance tests, the emergency diesel-generator can be loaded at a rate that is recommended by the manufacturer to minimize stress and wear.
Similarly, if the generator fails to load'in the precise time required by technical specifications, the load-run attempt is not considered a failure if the test demonstrated that the generator would load and run in an emergency.)
Any-condition identified in the course of maintenance inspections (with the EDG in the standby mode) that definitely would have l
resulted in a load-run failure if a demand had occurred should be counted as a valid load-run demand and failure, i
Exceptions: Unsuccessful attempts to start or load-run should not be counted as valid demands or failures when they can be definitely attributed to any of the following:
o Spurious operation of a trip that would be bypassed in the emergency operation mode (e. g.
high cooling water temperature trip) o Malfunction of equipment that is not required to operate during the emergency operating mode (e.g.,
synchronizing circuitry).
o Intentional termination of the test because of alarmed or observed abnormal conditions (e. g.,
small water or oil leaks) that would not have io 11
~,
_1
)
-l l
ultimately resulted in significant emergency generator damage or failure.
Component malfunctions or operating errors that o
did not prevent the emergency diesel generator from being restarted-and brought to load within a few minutes i.e.,
without corrective maintenance or significant problem diagnosis).
o A failure to start because a portion of the starting system was disabled for test purposes, if followed by a successful start with the starting system in its normal alignment.
Each emergency diesel generator failure that results in the emergency diesel generator being declared inoperable should be counted as one demand and.one failure.. : Exploratory' tests during corrective maintenance and the successful test that is run i
l following repair to verify operability should not be' counted as demands or failures when the EDG has not been declared operable again.
1 2.2 Test Descriptions 2
The following test descriptions are to be used with j
Regulatory Positions C.3 and C.4 (see also C.1.5 and C.2.3).
l Table 2 describes the sequence of qualification and surveillance testing.
There should be detailed procedures for each test l
defined in Regulatory Position C.2.2.
The procedures should l
identify special arrangements or changes in normal system configuration that must be made to put the EDG under test..
Jumpers and other nonstandard configurations or arrangements should not be used subsequent to initial equipment startup-testing.
2.2.1 Start Test:
Demonstrate proper startup from standby conditions, and verify that the required design voltage and frequency is attained.
For these tests, the emergency diesel generator can be slow-started, and reach rated speed on a i
prescribed schedule that is selected to minimize stress and wear.
[
2.2.2 Load-Run Test:
Demonstrate 95 to 100 percent of the continuous rating of the EDG, for an interval of not less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />'and until temperature equilibrium has been attained.
This test may be accomplished by synchronizing the generator with i
offsite power.
The loading and unloading of an emergency diesel l
generator during this test should be gradual and based on-a 12 f
1:
1 prescribed schedule that is selected to minimize stress and wear
)
i on the diesel generator.
2.2.3 Fast-Start Test:
Demonstrate that each emergency diesel generator unit starts from standby conditions (if a plant l
has normally operating prelube and keep-warm systems, this would i
constitute its standby conditions), and verify that the emergency 1
l diesel generator reaches required voltage and frequency within l
acceptable limits and time as defined in the plant technical specifications.
2.2.4 Loss-of-Offsite-Power (LOOP) Test:
Demonstrate by simulating a loss of offsite power that (1) the emergency buses are deenergized and the loads are shed from the emergency buses and (2) the emergency diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage j
and frequency and energizes permanently connected loads within l
acceptable limits and time, energizes the auto-connected shutdown l
loads through the load sequencer, and operates for a minimum of 5 minutes.
2.2.5 SIAS Test:
Demonstrate that on a safety initiation actuation signal (SIAS), the emergency diesel generator starts on i
the auto-start signal from its standby conditions, attains the requized voltage and frequency within acceptable limits and time, and operates on standby for greater than or equal to 5 minutes.
2.2.6 Combined SIAS and LOOP Tests:
Demonstrate that the EDG can satisfactorily respond to a loss of offsite power (LOOP) in conjunction with SIAS in whatever sequence they might occur (e.g. LOCA followed by delayed LOOP or LOOP followed by LOCA).
A simultaneous LOOP /LOCA event would be demonstrated by simulating a LOOP and SIAS an verifying that (1) the emergency buses are deenergized and loads are shed from the emergency buses and (2) the emergency diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency and energizes permanently connected loads within l
acceptable limits and time, energizes auto-connected loads through the load sequencer, and operates while loaded with the auto-connected loads for greater than or equal to 5 minutes.
2.2.7 Sinole-Load Reiection Test:
Demonstrate the emergency diesel generator's capability to reject a loss of the largest single load and verify that the voltage and frequency requirements are F.ct and that the unit will not trip on overspeed.
l l
13 l
i
I l
l 2.2.8 Full-Load Reiection Test:
Demonstrate the emergency l
diesel generator's capability to reject a load equal to 95 to 100 l
percent of it's continuous rating and verify that the voltage requirements are met and that the unit EDG will not trip on overspeed.
l 2.2.9 Endurance and Marcin Test:
Demonstrate full-load carrying capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, of l
which 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> should be at a load equal to 105 to 110 percent of I
the continuous rating of the emergency diesel generator, and 22 j
hours at a load equal to 95 to 100 percont of it's continuous rating.
Verify that voltage and frequency requirements are j
maintained.
2.2.10 Hot Restart Test:
Demonstrate hot restart functional capability at full-load temperature conditions by verifying that the emergency diesel generator starts on a manual or auto-start signal, attains the required voltage and frequency within acceptable limits and time, and operates for longer than 5 minutes.
2.2.11 Synchronizine Test:
Demonstrate the ability to (1) synchronize the amargency diesel generator unit with offsite l
i power while the unit is connected to the amargency load, (2) transfer this load to the offsite power, and (3) restore the EDG to ready-to-load status.
2.2.12 Protective-Trip Bypass Test:
Demonstrate that all automatic emergency diesel generator trips (except engine overspeed, oil pressure, and generator differential) are automatically bypassed upon a safety injection actuation signal.
This test may be performed in conjunction with Regulatory Positions 2.2.5 and 2.2.6.
2.2.13 Test Mode Chance-over Test:
Demonstrate that with l
the amergency diesel generator operating in the automatic test l
mode while connected to its bus, a simulated safety injection l
signal overrides the test mode by (1) returning the emergency diesel generator to standby operations and (2) automatically energizing the emergency loads from offsite power.
2.2.14 Redundant Unit Test:
Demonstrate that, by starting and running both redundant units simultaneously, potential common failure modes that may be undetected in single emergency diesel l
generator unit tests do not occur.
14 l
l l
)
2.3 Pre-Operational and Surveillance Testinq l
Table 2 relates pre-operational and surveillance tests to the anticipated schedule for performance (e.g.,
pre-operational, monthly surveillance, 6-month, scheduled refueling period, and 10-year testing).
l All planned tests as described in Regulatory Positions C.2.2 should be preceeded by a prelube period and should be in general accordance with the manufacture's recommendations for reducing engine wear, including cool-down operation at reduced power followed by postoperation lubrication.
2.3.1 Pre-Operational Testing:
A pre-operational test program should be implemented for all amargency diesel generator i
systems following assembly and installation at the site.
This program should include the tests identified in Table 2.
j l
In addition, demonstrate through a minimum of 25 valid start-and-load demands in accordance with Regulatory Positions C.2.2.1 and C.2.2.2 without failure on each installed amargency diesel generator unit that an acceptable level of reliability has been i
achieved to place the new EDG into an operational category.
2.?.2 Surveillance Testina:
After the plants are licensed j
(after fuel load), periodic surveillance testing of each emerge:2cy diesel generator must demonstrate continued capability and reliability of the diesel generator unit to perform its intended function.
When the EDG is declared operational in accordance with plant technical specifications, the following periodic test program should be implemented.
2.3.2.1 Monthly Testino:
After completion of the amergency diesel generator unit reliability demonstration during preoperational testing, periodic testing of diesel amargency generator units during normal plant operation shoald be performed.
Each diesel generator should be started as described in Regulatory Position C.2.2.1 and loaded as described in Regulatory Position C.2.2.2 at least once in 31 days (with maximum allowable extension not to exceed 25 percent of the surveillance interval).
15
i 4
1 2.3.2.2 Six-Month (or 184 days) Testina:'
In order to demonstrate the capability of the EDG to start from standby.and provide the necessary power to mitigate the loss-of-coolant t
i accident coincident with loss of offsite power,'once every 6 months each diesel generator should be started from standby conditions as described in C.2.2.3 to verify that the diesel generator reaches stable rated voltage and frequency within j
acceptable limits and time as specified in the plant technical specifications.
Following this test the EDG should'ba loaded as described in Reg. Position C.2.2.2.
(See also Table 2).
2.3.2.3.
Refuelino Outace Testina:
Overall emergency diesel generator unit design capability should be demonstrated at l
every refueling outage by performing the tests identified in Table 2.
2.3.2.4.
Ten-Year Testino:
Demonstrate that the trains of standby electric power are independent once every 10 years (during a plant shutdown) or after any modifications that could affect emergency diesel generator independence, whichever is the shorter, by starting all redundant units simultaneously to help identify certain common failure modes undetected in single diesel generator unit tests.
2.3.3 Corrective Action Testina - Problem EDG:
If an individual EDG experiences 4 or more failures in the last 25 demands, then following completion of corrective actions performed through the nuclear unit EDG reliability program, the restored performance of the problem EDG must'be demonstrated by conducting seven consecutive failure-free start and load-run i
demand tests (at a frequency of no less than-24 hours and of no more than seven days between each demand). All starts and load-run tests performed during this period should be included in the nuclear unit EDG reliability data set so long as the EDG is declared operable.
i t
'This test may be substituted for a monthly test.
16 t
.~
3.
EDG RELIABILITY GOALS AND MONITORING Reliability goals for emergency diesel generators and their j
monitoring are as follows:
l 3.1 Reliability Goals for Station Blackout i
In order to comply with 10 CFR 50.63, " Loss of All Alternating Current Power," and the guidance in Regulatory Guide 1.155, " Station Bisckout," the minimum EDG reliability-should be targeted at 0.95 or 0.975 per demand for'each EDG for plants in emergency ac (EAC) Groups A, B,
and C and at 0.975 per demand for each EDG for plants in EAC Group D (see Table-2 of Regulatory Guide 1.155).
EDGs credited to each nuclear unit's station blackout coping assessment should be monitored and maintained at or above the target reliabilities selected for compliance-with 10 CFR 50.63.
3.2 EDG Reliability Monitorina l
The monitoring of EDG reliability should be based on valid demands, valid starts, and valid load-run tests as defined in i
Regulatory Position 2.1,_and surveillance tests as defined in i
Regulatory Position 2.3.
Thel determination of adequate EDG performance should be based on a reliability indicator: utilizing the performance data from the last 20, 50, and 100' demands.
The calculation of the. performance and reliability indicators for individual EDGs comprises two components':
(1) the start reliability and (2) the load-run reliability.
Since not all EEG demands include both start and load-run demands, data on these two reliability components should be gathered and evaluated individually and then combined.
An' equal number of start demands and load-run demands may not occur in the same time interval.
These reliability components are defined as follows:
1)
Start Raliability (SR) is defined as:
SR = N3mber of Successful Starts Total Number of Valid Start Demands 2)
Load-ran Reliability (LR) is defined as:
LR = Jumber of Successful Load-runs 5.'otal Number of Valid Load-Run Demands 17
. ~...
(SR) * (LR) 3)
EDG Reliability
=
The above equations produce point estimates of individual EDG reliabilities with attendant uncertainties.
Care should be taken in using such numbers in comparing plant performance with the EDG trigger values, particularly when using the last 20 demands data set.
Estimates of EDG reliability for a nuclear unit should utilize individual EDG performance data, which are then combined in a manner representative of the EDGs assigned to a specific nuclear unit.
NUMARC-8700, Revision 1, Appendix D, Table D.2-1, provides guidance for combining data from individual EDG performance to arrive at a nuclear unit reliability estimate.
3.3 Maintaininc EDG Reliability:
Maintaining EDG reliability should include the following:
(1) maintaining data on successful and failed EDG start and load-run demands.
(2) evaluating nuclear unit reliability indicators for the last 50 and the last 100 demands as well as individual EDG performance over the last 20 demands.
(3) relating calculated EDG performance and reliability indicators to trigger values established for selected target reliabilities.
(4) taking remedial actions for individual failures and for exceeding one or more trigger values.
The sample size and action levels are based on the assumption that tho minimum surveillance testing interval for each EDG is once per month.
The following failure rate triggers should be used to assess EDG performance and to determine corrective actions to be taken:
18
EDG TRIGGER VALUES Selected Target Failures in Failures in Failures in Reliability 20 Demands 50 Demands 100 Demands 0.95 3
5 8
0.975 3
4 5
The selected target reliability is that selected for the station blackout coping analysis. This value represents the underlying nuclear unit EDG reliability needed for determining the coping duration for a station blackout.
Figure 1 defines actions that should be undertaken when one or more of the triggers shown above are exceeded.
A more detailed discussion of actions related to exceeding one or more of these triggers can be found in Section D.2.4 of NUMARC's Appendix D.
3.4 Problem EDG A problem diesel generator is defined as an individual EDG that has experienced 4 or more failures in the last 25 demands.
Should this case arise, the actions taken in response to exceeding a single trigger value as defined in Figure 1 would apply.
Following completion of reliability program corrective actions, restored performance of the problem EDG should be damonstrated by conducting seven consecutive failure-free start and load-run demand tests per Regulatory Position 2.3.3.
The monthly surveillance test schedule should not be resumed until the seven consecutive tests are successfully completed.
All starts and load-runs performed during this period should be included in the nuclear unit EDG reliability data set so long as the EDG is declared operable.
This process of evaluating recent demands and taking appropriate action on the individual EDG experiencing recurring failures is a key element in providing reasonable assurance that EDG performance is restored to an acceptable level.
19
i 4.
RECORDKEEPING GUIDANCE' l
Guidance from Section 7.5.2,
" Records and Analysis," of IEEE l
Std 387-1984 should be supplemented as follows:
Utilities should retain the following information from testing related to the trigger values and remedial actions taken in response to exceeded trigger values:
(1)
Data on valid demands and failures that are used to calculate the performance and reliability indicators.
(2)
The corrective actions taken in response to individual failures.
(3)
A description of the actions taken in response to exceeding a single trigger.
(4)
A description of the EDG reliability program improvaments in response to exceeding the j
triggers for 50 and 100 damands.
(5)
The schedule of planned and in-progress j
improvements.
5.
REPORTING CRITERIA i
When reporting EDG failures, all plants should conform with the provisions of 10 CFR 50.72, 10 CFR 50.73, 10 CFR 21, plant technical specifications, and other current NRC reporting regulations.
In addition, if an individual EDG experiences 4 or more valid failures in the last 25 demands, these failures and any no-valid failures experienced by that EDG in that time period should be reported in 30 days.
This report should include the following information:
- 1. The nuclear unit EDG performance and reliability indicators as compared to the appropriate 20, 50, I
and 100 demand triggers.
l 5Licensees should also retain data relevant to the fast start tests required by Technical Specifications.
20 l
l
- 2. A description of the failures, underlying causes, and corrective actions taken.
l
- 6. EMERGENCY DIESEL GENERATOR RELIABILITY PROGRAM Regulatory Guido 1.155 describes a means acceptable to the i
NRC staff for meeting the requirements of 10 CFR 50.63 and i
identifies the need for an EDG reliability program l
designed to maintain and monitor EDG reliability levels to ensure that selected reliability levels are being achieved.
An EDG reliability program should be comprised of the following principal elements (or activities):
i 1.
Monitoring nuclear unit EDG reliability levels against i
those selected for station blackout (see also l
Regulatory Position C.3).
2.
A surveillance plan that identifies EDG support systems l
and subsystems, describes frequency and scope of testing, and incorporates manufacturer recommendations.
3.
Performance monitoring of important parameters on an l
ongoing basis to obtain information on the condition of the EDG and key components so that precursor conditions can be identified prior to failure.
i 4.
A maintenance program designed for both preventive and corrective actions based on operating history and past maintenance activities, vendor recommendations, spare parts considerations, and the results of surveillance monitoring.
(
5.
Failure analyses and root cause investigation to assist in developing corrective actions to prevent recurrence of failures.
6.
An EDG problem closeout process to ensure that the resolution of a failure or a problem is properly implemented and successful.
7.
An EDG reliability data system to ensure the availability and retrievability of important data and I
l information related to EDG reliability.
21
These principal elements of an EDG reliability program are provided as guidelines and are the same as those described in NUMARC-8700, Appendix D (5-2-90), " Introduction".
Although this guidance is based on proven industry practices, it is recognized that there are existing programs that have proven effective at maintaining high EDG reliability levels.
Therefore this guidance is not intended to replace or revise current activities or methods of a similar nature which have proven effective.
Appendix A provides a discussion of and considerations and illustrative examples which could be used in developing an EDG reliability program based on the principal elements noted above.
6.1 Monitorina Diesel Generator Reliability Monitoring of.uclear unit EDG reliability should be based l
on periodic surveillance testing as discussed in Regulatory Position C.3 and corrective actions undertaken when one or more triggers are exceeded.
(See also NUMARC-8700, Rev. 1, Appendix D).
The reliability program should provide the means for failure evaluation, corrective action, and demonstration of its effectiveness.
i r
22 l
D.
IMPLEMENTATION The purpose of this section is to provide information to applicants and licensees regarding the NRC staff's plans for using this regulatory guide.
Except in those cases in which an applicant proposes an acceptable alternative method for complying with the specified portions of the Commission's regulations, the methods described in Regulatory Positions C.1 and C.2 of this guide will be used by the NRC staff in evaluating selection, design, qualification, and testing of diesel generator units used as onsite electric power systems for the following nuclear power plants:
1.
Plants for which the construction permit is issued after the issue date of the final
- guide, 2.
Plants for which the operating license application is docketed 6 months or more after the issue date of the final guide, 3.
Plants for which the licensee commits to the provisions of this guide.
The NRC Staff intends to use Regulatory Positions C.3, C.4, C.5, and C.6 of this regulatory guide to review the monitoring of EDG reliability levels, record keeping, reporting of failures, and existing or proposed EDG reliability programs.
Implementation of this regulatory guide by the NRC staff will in no case be earlier than (270 days after issuance).
1 23 l
l
REGULATORY ANALYSIS A separate regulatory analysis was not prepared for this regulatory guide.
The regulatory analysis prepared for the station blackout rule, NUREG-1109, " Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout," provides the regulatory basis for this guide and examines the costs and benefits of the rule as implemented by the guide.
A copy of NUREG-1109 is available for inspection and copying for a fee at the NRC Public Document Room, 2120 L Street NW.,
Washington, DC.
Copies of NUREG-1109 may be purchased from the Superintendent of Documents, U.S.
Government Printing Office, Post Office Box 37082, Washington, DC 20013-7802; or from the National Technical Information Service, Springfield, VA 22161.
24
s TABLE 1 4
CROSS-REFERENCE BETWEEN REGULATORY GUIDE 1.9, REV. 3 AND NUMARC-87-00, APPENDIX D (5-2-90) i RG 1.9,REV 3 NUMARC-8700 SECTION APPENDIX D P
Section A, Introduction None (Use RG 1.9,Rev.3)
Section B, Discussion None (Use RG 1.9, Rev.3)
Section C, Regulatory Position 1 Design Considerations None (Use RG 1. 9, Rev.3) 2 Diesel Generator Testing 2.1 Definitions D.1 2.2 Test Descriptions None (Use RG 1.9, Rev.3) 2.3 Preoperational and l
Surveillance Testing None (Use RG 1. 9, Rev.3)
(
3 EDG Reliability Goals and D.2 Monitoring 3.1 Reliability Goals for SBO Introduction 3.2 EDG Reliability Monitoring D.2.3 3.3 Maintaining EDG Reliability D.2.1,D.2.3,D.2.4,D.2.5 3.4 Problem EDG D.2.4.4 f
4 Record keeping Guidance D.2.4.6 f
5 Reporting Criteria Use RG 1.9, Rev. 3 6 EDG Reliability Program Introduction 6.1 Monitoring EDG Reliability D.2 i
Section D, Implementation Introduction (Initiative SA)
Appendix A, Reliability NUMARC Topical Report Program Considerations related to Appendix D f
-25 l-
~.
l TABLE 2.
PRE-OPERATIONAL AND SURVEILLANCE (a) TESTING Refer to Refueling Regulatory Monthly Outage /
Position C.2.2 Pre-Operational Periodic 6-Month 18 Month 10-Year for DescriMinn Test Program Tests Tests Tests Tests C.2.2.1 Start Test X (b)
X C.2.2.2 Load-Run Test X (b)
X C.2.2.3 Fast-Start Test X (c)
X(c)
C.2.2.4 Loss-of-Offsite Power (LOOP) Test X
X C.2.2.5 SIAS Test X
X C.2.2.6 Combined SIAS & LOOP Test X
X C.2.2.7 Single-Load Rejection Test X
X C.2.2.8 Full-Load Rejection Test X
X C.2.2.9 Endurance and Margin Test X
X C.2.2.10 Hot Re-start Test X
X C.2.2.11 Synchronizing Test X
X C.2.2.12 Protective-Trip Bypass Test X
X C.2.2.13 Test Mode Change-Over Test X
X C.2.2.14 Redundant Unit Test X
X (a)
Tech Spec requirements take precedence to this table.
(b)
Included in each of the 25 tests described in Regulatory Position 2.3.1.
(c)
Utilities should retain data for fast starts required by Tech Specs.
This tes*.v-ay be substituted for a monthly surveillance test.
FIGURE 1 - EDG Reliability Monitoring & Maintenance Activities-t i
i
+
Periode -
Monthly e
Testing Nuclear Una EDG Faltures/Dernands Rettabihtv Tnoner Values r'
O 95 -
320 5f50 8/100 0.975 320 4/50 5/100
.New No,,,
l Failure i
Yes-I 4
Compar. with Trigger Values l
=
l t
t 9r 1r 1r l
Exceed No Exceed One Exceed 50 and 100 Triggers Trigger Demand Triggers l
i
'I 1r 1r qr -
- 1. Hoot Cause
- 1. Hoot Cause
- 1. Root Cause -
f
- 2. Currese Acton 2.. Apphenble Failures
- 2. Appheatdo Failures
- 3. Maiteenance Hatory
- 3. Mairsonance History f
- 4. Failure Panern
- 4. Failure Pattern
-l S. Correceive Adion
- 5. Program Changes.
- 6. Corrective Acuon 1r 1r I
i '
27-i
~
.. ~,.
l l
i f
I I
l l
r APPENDIX A i
l RELIABILITY PROGRAM CONSIDERATIONS I
l l
l A-1
4 i
1 i
The discussions which follow are considerations and illustrative examples (e.g.
tables A.1, A. 2 and A. 3) are not intended to replace current EDG reliability maintenance activities which have proven effective.
Rather, these comments reflect current proven practices that are discussed in more detail in NUMARC's topical report which is referenced in NUMARC-8700, Appendix D (5-2-90).
j EDG Surveillance Plan The formulation of a surveillance plan should consider the following factors:
1.
The effect that EDG support and auxiliary systems i
have on overall EDG reliability.
2.
Failures caused by surveillance.
3.
Frequency and nature of surveillance testing effects on EDG reliability and unavailability.
4.
The types of failures that can be detected by a surveillance program.
5.
Detection of failures by parameter monitoring versus testing.
6.
The ability of specialized tests to simulate actual operating conditions.
I Figure A-1 illustrates typical components and support i
systems that should be considered when defining an EDG boundary.
Those components whose function is solely to support the EDG should be viewed as within the EDG boundary. The systams that i
provide support to the EDG and perform other plant functions are shown outside the boundary, with the understanding that the boundary interface function must be maintained.
i IEEE Std 387-1984 and ANSI /ASME OM-16 provide similar definitions of components and system boundaries and may also be 4
used as guidance.
l A-2
Tables A1, A2 and A3 illustrate periodic surveillance activities that have proven effective. When performing such surveillance, it is important to capture the actual values of critical parameters since such data would be extremely useful for failure analyses, as well for long-term EDG condition monitoring.
It should also be noted that site-specific activities will vary from those shown in these tables.
EDG Performance Monitorinc:
Performance monitoring should be applied to equipment that is run on a continual or a near-continual basis.
The purpose is to monitor certain parameters on an ongoing basis in order to obtain information about the state of physical conditions that may potentially impact the operability of a piece of equipment and that could be used for trending purposes.
These trends may signal a degradation in a particular condition.
Such evaluation may detect onset of failure and allow corrective actions to be taken before failure occurs.
Equipment that is normally in a standby condition, such as an EDG, can only be monitored on a limited basis. Monitoring critical operating parameters is usually performed during monthly operational testing. In order for this monitoring to be effective, it should be applied to the following conditions:
1.
The characteristic or parameter should be a measurable condition that is known to be related to an important failure mode.
2.
The characteristic or parameter should be able to be measured conveniently and practically.
3.
The characteristic or parameter should be l
accurately monitored.
4.
Parameters recorded should be measured under the same conditions (i.e.,
load) to the extent possible, The actual values of the conditions should be recorded rather than simply verifying that they are within a specific range.
A comparison between the values obtained from successive readings ca.n then be made to ascertain the possibility of a degrading condition.
I A-3
l l
EDG Maintenance Program l
An important contributor to EDG reliability is the manner in
(
which both preventive and corrective maintenance are performed.
I l
Generally speaking, an EDG maintenance program should be based on the following:
1.
Vendor-recommended maintenence actions and schedule for implementation.
2.
Nbintenance actions should be prioritized based on such factors as repair time, severity, likelihood l
of reoccurrence.
3.
The reliability characteristics of the EDG subsystems and components should be considered when planning EDG preventive maintenance.
4.
Maintenance activities should interface with the overall EDG reliability program.
The maintenance program should have both a preventive and a corrective element.
The preventive program should be tailored to specific EDG types.
Table A4 shows illustrative examples of l
preventive maintenance activities.
EDG Failure Analysis and Root Cause Investication An EDG reliability program should include failure analysis procedures designed to systematically reduce problems or failures to corrective actions.
Failure analysis starts from the most apparent symptoms and progresses to determination of underlying causes or incipient conditions. Root cause analysis goes further and attempts to find underlying causes related to design, engine operation, or maintenance.
Figure A-2 is an example of a systematic approach to failure and root cause analyses.
A-4
l When performing a root cause analysis, the method of categorizing underlying causes is important so that corrective action can be integrated into both plant activities'and the EDG reliability program.
A typical classification system should i
consider the following:
a.
Manufacturing and design b.
Quality control i
c.
Procedures d.
Training
)
e.
Communication f.
Human factors EDG Problem Closeout:
I Attention should be given to procedures and controls used to-ensure the resolution or " closeout" of a particular problem.
The l
closeout of a failure or problem that is detected during maintenance or' surveillance should be closed out by means of a formal procedure.
A formal plant-specific procedure offers a means to prevent recurrence of the particular failure or problem.
The problem closeout procedure should be based on the-4 following considerations:
i
- 1. Criteria for closeout 4
- 2. Closeout review
- 3. Closeout monitoring l
- 4. Data system interface l
' EDG Reliability Data System An.EDG reliability program should.have a data collection, storage, and retrieval system thatican_be accessed by personnel assigned to monitoring and maintainingLthe EDGs for reviewing previous actions and EDG-performance.
Although the data system does not need to be a special purpose dedicated system, but
^
access to " current" information should be a major consideration in designing and installing such a system.
t A-5 f
l
~..-%,
.w.
r w.
i
=
l Typical types of information that should be considered in the formation of a data system are:
1.
Surveillance test results 2.
EDG failure history 3.
Failure and root cause analysis results 4.
Manufacturer's recommendations 5.
Input from the preventive maintenance program 6.
Input from the corrective maintenance program 7.
Industry operating experience l
l l
i A-6
--m--
. 6 s.
e
. m..
---.r-,.m..., _..
.e,--,,
l l
TABLE A,1 EDG SHIFT OR DAILY SURVEILLANCE CONSIDERATIONS (ILLUSTRATIVE EXAMPLE)
Lube Oil System Governor System Lube oil inlet temperature Governor oil level Lube oil outlet temperature Verify load limit settings Lube oil sump level Governor setting in Lube oil strainer / filter Auto / Manual differential pressure visual inspection for leaks Diesel / Generator Fuel Oil System Oil Level of pedestal bearing Turbo oil level Day tank level Intercooler leak inspection Storage tank level Turbocharger lube oil level Bleed fuel oil filters Drain moisture from exhaust Visual inspection for leaks silencers Bleed fuel oil filters
- Verify alarms clear Diesel starting selector switches in remote EDG breaker remote-local select switch in remote Verify auto-manual regulators set in normal range Jacket Water System Check water and fuel hoses Check starter motors Jacket water inlet Check exhaust temperature Jacket water outlet temperature Expansion tank level Visual inspection for leaks Startine Air System Ele ct ri cal
- I Air receiver pressure Auto / Manual start switch in Auto Blowdown air receiver Appropriate breakers racked in Compressor oil level Power to Breaker Verified Compressor Water traps Alignment to correct power source Fault Indicator
- Weekly surveillance j
1 A-7
i l
TABLE A.2 MONTHLY EDG SURVEILLANCE CONSIDEPATIONS (ILLUSTRATIVE EXAMPLE)
Diesel / Generator Governor System Visually inspect fuel system for leaks Inspect linkage for looseness Visually inspect for exhaust leaks Verify all control settings Drain water from crankcase vent piping Check actuator oil level Verify generator synchronization Check automatic shutdown I
Engine coolant level Filter DP Mainfold pressure Inspect for leaks Crankcase pressure Day tank level Air inlet temperature Storage tank level Turbo temperature Verify transfer pumps Intercooler outlet temperature operability Fuel oil pressure Ventilation fan operability (inlet / outlet)
Cylinder exhaust temperatures Cooling water supply temperature Stator temperature Lube Oil System Gen frequency Check lube oil for dilution Gen voltage Lube oil chemical analysis Gen Amps Inspect for leaks Gen KW LO filter DP LO pressure LO level Jacket Water System Turbo LO pressure Inspect for leaks LO inlet temperature Check water treatment LO outlet temperature EX outlet temperature Engine outlet temperature System pressure Turbo outlet temperature In addition to the above surveillances there are other less frequent inspections that may be considered.
Examples of these include the following:
TABLE A.3 LESS FREQUENT EDG SURVEILIANCES (ILLUSTRATIVE EXAMPLE)
Periodic Surveillance:
Lubrication oil Chemical Analysis Once every quarter Fuel Oil Chemical Analysis Once every quarter Non-Periodic Surveillances:
Chemical analysis of new fuel oil Upon delivery and prior to use Chemical analysis of new lubrication Oil Upon delivery and prior to use I
A-8
P TABLE A.4 TYPICAL PREVENTIVE MAINTENANCE CONSIDERATIONS (ILLUSTRATIVE EXAMPLE)
Encine Lube Oil System:
5 Clean and inspect lube oil strainer Replace lube oil filters Replace turbocharger filter element Inspect lube oil cooler Encine Coolina System:
Inspect cooling water pump Drain and replace coolant Inspect expansion tank l
Fuel Oil System:
' Replace fuel oil filters Clean and inspect fuel oil strainers Test fuel condition Startina Air System:
l Clean and inspect air strainer Replace compressor oil Inspect compressor drive belts l
Encine Maintenance:
i Replace inlet air filter oil Inspect and clean inlet air filter Inspect air box drains
- Inspect air box cooling system
- Check cylinder head to piston clearances
- Inspect cylinder liners
- Inspect rod bearings
- Inspect main bearings i
i l
-* Inspect piston rings l
- A comprehensive program based on monitoring and trending of EDG diagnostics data and engine operating parameters may be. considered in lieu of vendor reccennended "open and inspect" preventive maintenance i
procedures.
)
1 A-9 i
~_
i i
l t
FIGURE A Emergency Diesel Generator Systems, Boundary and Support Systems l
Electric Class 1E AC Power Distribution System Emergency Diesel Generator System Boundary
,...e-----------------------------------o.------------o---------------------------8 i
e 6
r g
l 3 EDG s
Control and Lubrication Govemor and Exhaust
/ BREAKER l l
Protection System Control System System l
System h
e l
lI e
i l
f
=
l e
e E -
e s
Crankcase D.iesel Eng.ine o.nerator l
ventiwion l
System l.
8 s
l h
h h
h l
Cooling Air Exciter and l
8 e
and Ventilation Starting Combustion FuelOii
. Voltage s
l System System Air System Jacket Water System Regulator System l
l and SuppY and Cooling g
e s
Water System l
Fuel Oil s
l Storage and l
Supply e
i e
S---------------------------------------------
J Cooting Water Supp!y System i
l A-10
FIGURE A Failure and Root Cause Analysis Logic Monitor EDG q
Performance If Failure or off-normat condition observed If Problem Closecut 4
Determine proximate cause Assess if (failure cause analysis) surve'llance or performance it monitoring should be offered Compare to past fallures / conditions to in6cate possible I k systematiccause No Systematic l
Cause l
Systematic Cause
~
1f l
Perform root cause analysis i
1I Generic Review other plant Generic or Cause l
records (NPRDS),
plant-specirc A generic industry groups, etc.
cause?
cure exists?
t Plant
- 0 l
Yes i
Specirc 1r Cause ir-i Review operational Determine if specialmonitoring
~
operation-or implement procedures, install design-related
. cure if required cause Design Operation Related Related Redesign to Change operations correct problem to correct problem l'
If A-11
4 ENCLOSURE 5 9/24/90 PROPOSED GENERIC LETTER (REFERENCE GSI B-56)
TO:
ALL HOLDERS OF OPERATING LICENSES OR CONSTRUCTION PERMITS FOR NUCLEAR POWER REACTORS.
SUBJECT:
RESOLUTION OF GENERIC SAFETY ISSUE (GSI) B-56,
" DIESEL GENERATOR RELIABILITY" (GENERIC LETTER 90-
)
PURPOSE AND BACKGROUND:
This generic letter is being sent to all licensees of operating nuclear power reactors and to all construction permit holders to r
determine whether licensees will voluntarily implement NUMARC's Initiative 5A, " Coping Assessment /EDG Performance,"* (see Enclosure C.1), the guidance for monitoring and maintaining i
Emergency Diesel Generator (EDG) reliability provided in NUMARC 8700, Revision 1, Appendix D and.an EDG reliability program such as described in Regulatory Position C.6 of Regulatory Guide 1.9, j
Revision 3.
The Staff has issued Revision 3 of Regulatory Guide 1.9,
" Selection, Design, Qualification, Testing and Reliability of Diesel Generator Units Used as Class lE Onsite Electric Power Systems at Nuclear Power Plants" for the technical resolution of j
GSI B-56.
This revision integrates into a single document guidance on EDG selection, design, qualification and testing previously addressed (or provided) in Revision 2 of Regulatory Guide 1.108, Revision 2 of Regulatory Guide 1.9, and Generic Letter 84-15. Reporting of EDG failures in conformance with j
10 CFR Parts 50.72 and 50.73 will continue. Licensees are also
~
encouraged to continue to report EDG failures to NPDRS.
10 CFR 50.63, " Loss of All Alternating Current Power", requires that all LWR nuclear power plants be able to withstand and recover from a station blackout.
The reliability of EDGs used-as onsite emergency AC power sources is one of four primary considerations listed in Section 50.63 for assessing the ability of the plant to withstand station blackout.
The Staff provided initial guidance for monitoring and maintaining EDG reliability for compliance with Section.50.63 in Regulatory Position'l.2 of Regulatory Guide 1.155, " Station Blackout" which recommends that
]
.m=== ewon, m-na 2 n-a-so) 1 m
.....-_, ~.,. _.,.-
1 i
2 reliable operation of onsite emergency AC power sources should be ensured by a reliability program designed to maintain and monitor l
the reliability of each power source over time for assurance that l
selected reliability levels are being achieved.
It was noted in the Federal Register Notice (53 FRN 23218) that: "The resolution j
of B-56 will provide specific guidance for use by the staff or l
industry to review the adequacy of diesel generator reliability l
programs consistent with the resolution of USI A-44."
RG 1. 9, Rev. 3 provides such specific guidance.
INFORMATION REQUIRED TO BE SUBMITTED BY ADDRESSEES:
In order to determine whether any operating license or construction permit for facilities covered by this request should l
be modified, suspended, or revoked, you are required, pursuant to i
Section 182 of the Atomic Energy Act and 10 CFR 50.54 (f), to submit information to the NRC, under oath or affirmation, within 180 days of the date of this letter, regarding your current plans for assuring adequate diesel generator reliability.
In l
particular, your response should take one of the following forms:
a.
Your commitment to implement NUMARC's Initiative 5A and Regulatory Positions C.3, C.4, C.5, and C.6 of Revision 3 to Regulatory Guide 1.9 (or equivilant NUMARC l
guidance as indicated in Table 1 of this regulatory l
guide) as your method for monitoring and maintaining EDG reliability levels for compliance with 10 CFR 50.63.
In addition, confirm your intention to implement this program at the earliest possible date, but in no case later than 270 days from the date of this letter, b.
If you do not plan to implement the above diesel generator reliability program described in Regulatory Position C.6 of Regulatory Guide 1.9, Revision 3 in full, the response shall identify with specificity the portions of the program which you do not intend to implement and the basis thereof.
c.
If you plan to use a different method for monitoring, maintaining and reporting EDG reliability levels, your response shall detail your approach and the schedule for that approach, and a schedule for implementation at each facility.
You should retain all documentation supporting this response consistent with the records retention program for your facility.
1 I
l
3 Licensees that implement NUMARC Initiative SA, and Regulatory Positions C.3, C.4, C.5, and C.6 of Revision 3 of Regulatory Guide 1.9 (or equivalent NUMARC guidance as indicated in Table 1 of this regulatory guide) may include a request to change their plant Technical Specifications (TS) to incorporate the line-item improvements noted in Enclosure C.2.
These line-item TS improvements are a result of the implementation of programmatic requirements for monitoring and maintaining EDG target reliability.
Guidance for the preparation of a proposed license amendment to implement these line-item TS improvements is provided in Enclosure C.2.
BACXFIT DISCUSSION The regulatory analysis for USI A-44 is contained in NUREG-1109,
" Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout", June 1988.
This regulatory analysis evaluated costs associated with implementation of EDG reliability programs and concluded that there will be a substantial increase in overall protection of public health and safety, and that the costs are justified in view of this increased protection.
The staff reaffirms that the regulatory analysis developed for USI A-44 is applicable to the resolution of GSI B-56 and therefore a new regulatory analysis will not be developed for GSI B-56.
In Revision 3 of Regulatory Guide 1.9, the actions proposed by the NRC staff in Regulatory Positions C.3, C.4, C.5, and C.6 represent new staff positions and are considered a backfit in accordance with NRC procedures.
The staff believes that this approach, the implementation of Regulatory Positions C.3, C.4, C.5 and C.6 of Regulatory Guide 1.9 Revision 3, is the most cost effective method for maintaining emergency diesel generator reliability since the proposed actions are consistent with l
practices developed by the nuclear industry.
A backfit analysis of the type described in 10 CFR 50.109 (a) (3) and 10 CFR 50.109(c) was performed based on the regulatory analysis of NUREG-1109.
This backfit analysis is included in the Federal Register Notice for the issuance of Revision 3 of Regulatory Guide 1.9, and will be made available in the Public Document Room along with the 4
minutes of the 171st, 176th and 190th meetings of the Committee to Review Generic Requirements that discussed the resolution of this generic issue.
l 1
l l
PAPERWORK REDUCTION ACT REQUIREMENTS This request is covered by Office of Management and Budget clearance Number 3150-0011, which expires The estimated average burden hours is 120 person-hours per license response, including assessing the new recommendations, searching data sources, gathering and analyzing data, and the required reports.
These estimated average burden hours pertain only to~
these identified response-related matters and do'not. include the time for actual implementation of requested actions.
Estimates of implementation of an EDG reliability program are reported in l
NUREG-1109, " Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout." ' Comments on the accuracy of this estimate and suggestions to reduce the burden may be directed to the U.S. Office of Management and Budget, Executive Office Building, Washington, D.C.
20503, and to the Nuclear Regulatory Commission, Records and Reports Management Branch, Office of Administration and Resources Management, Washington, D.C. 20555.
If you have any questions on this matter, please contact your project manager.
Sincerely, James G. Partlow, Associate Director for Projects Office of Nuclear Regulation i-
Enclosures:
1.
C.1 NUMARC Initiative 5A 2.
C.2 Guidance for the Preparation of l
License Amendments l
3.
List of Recently Issued Generic letters l
i l
l
1 l
Enclosure C.1 NUMARC INITIATIVE 5A i
" COPING ASSESSMENT /EDG PERFORMANCE" (Ref. NUMARC 87-00, Rev.
1, May 2,1990)
The following verbatim quote of NUMARC's Initiative SA is provided for convenience :
i "Each Utility will assess the ability of its plant (s) to cope with a " Station Blackout."
Plants utilizing i
alternate AC power for " Station Blackout" response which can be shown by test to be available to power the shutdown busses within 10 minutes of the onset of
" Station Blackout" do not need to perform any coping i
-assessment.
Remaining alternate AC plants will assess their ability to cope for one-hour.
Plants not i
utilizing an alternate AC source will assess their ability to cope for four hours.
Factors identified which prevent demonstrating the capability to cope i
for the appropriate duration will be addressed through hardware and/or procedural changes so that successful demonstration is possible.
As part of the coping assessment, utilities are required to choose an EDG target reliability (0.95 or 0.975) and are required to maintain that chosen i
reliability.
Accordingly, each utility will employ the l
following exceedence trigger values (on a plant unit i
basis) as the mechanism for monitoring EDG Target Reliability and support closure of Generic Issus B-56:
SELECTED EDG TARGET FAILURES IN FAILURES IN FAILURES IN RELIABILITY 20 DEMANDS 50 DEMANDS 100 DEMANDS 0.95 3
5 8
0.975 3
4 5
Additionally, each utility, in response to an individual EDG experiencing 4 or more failures in the last 25 demands, will damonstrate restored EDG performance by conducting seven (7) consecutive failure
-free start and load-run tests.
This reduced-form of accelerated testing shall-be conducted at a frequency of no less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and of. no mare-than seven (7) days between each demand.
Each utility will, if applicable, address this reduction in accelerated testing through changes to technical specifications or other appropriate means."
l-l
l Enclosure C.2 8-09-90 Draft GUIDANCE FOR THE PREPARATION OF A LICENSE AMENDMENT REQUEST TO MODIFY EMERGENCY DIESEL GENERATOR SURVEILLANCE, ACTION, AND REPORTING REQUIREMENTS RACKGROUND s
A program for monitoring and maintaining the reliability of emergency diesel generators (EDGs) is an essential element for assuring that the selected EDG target reliability for compliance with the station blackout rule (10 CFR 50.63) is met.
The establishment of this program in accordance with the guidance in Regulatory Positions C.3, C.4, C.5 and C.6 of Revision 3 to Regulatory Guide 1.9 will permit a reduction in the accelerated i
frequency of EDG monthly surveillance requirements that are applicable to most operating plants. For the remaining plants, the implementation of an accelerated frequency for monthly EDG surveillance requirements, consistent with a commitment to NUMARC Initiative SA, constitutes a backfit.
Also, a relaxation in the reporting requirements for EDG failures, consistent with Regulatory Position C.5 of Revision 3 of Regulatory Guide 1.9 is appropriate.
Consistent with the NRC policy on Technical Specification (TS) improvements, this guidance is provided for a license amendment request to implement these line-item TS improvements.
DISCUSSION Current plant TS typically require an accelerated frequency of once per 7 days for conducting EDG monthly surveillance requirements when the number of failures exceeds 1 in the last 20 l
or 5 in the last 100 valid tests en a per diesel generator basis.
With the implementation of a EDG reliability program conforming to the guidelines of Revision 3 to Regulatory Guide 1.9, the staff has concluded that 4 or more failures in the last 25 valid tests is acceptable for imposing an accelerated test frequency for monthly surveillance requirements.
Furthermore, the accelerated testing may be suspended following 7 consecutive failure-free tests.
Details for the new accelerated testing are j
included in the following revised TS Table 4.8.1.1.2-1.
3
-. - ~. - - -
i l
i An acceptablo alternative to the existing requirements of TS Table 4.8,1.1.2-1 is the following:
1 Table 4.8.1.1.2-1 i
DIESEL GENERATOR TEST SCHEDULE TEST FREQUENCY t
j NIMBER OF FAILURES IN LbST 25 VALID TESTS
- l 53 Once per 31 days i
i
>4 Once per 7 days **
~
3 (but no less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) i Criteria for determining number of failures and valid j
demands shall be in accordance with Regulatory Position i
f C.2.1 of Regulatory Guide 1.9, Revision 3, where the number
?
of demands and failures is determined on a per diesel j
generator basis.
The criteria are-based upon counting only i
those failures that have an impact on the capability of the j
EDG to respond to a station blackout.. However,-the ACTION i
requirements must be met for those fast start failures that I
are excluded for determining the number of failures in the last 25 valid tests.
This test frequency shall be maintained until 7 consecutive i
failure-free' start and load-run demands have been performed.
If, subsequent to the 7 failure free tests, 1 or more additional failures occur such that~there are again 4 or l
more failures in the last 25 tests, the-testing interval shall again be reduced as noted above and maintained until 7 consecutive failure-free tests have been performed.
The changes to Table 4.8.1.1.2-1 are in the number of failures in
- j the last 25 valid tests.
The
- footnote is changed to reflect the updated criteria on valid tests and failures provided in 1
Regulatory Position C.2.1.of Revision 3 to Regulatory Guide 1.9.
(
~
The criteria are based upon counting-only those failures that have an impact on the capability of the EDG to respond to a station blackout. -Therefore, it is noted that the ACTION requirements must be met for those fast start-failures that are excluded for determining the number of failures in the last 25 valid tests. 'The ** footnote is changed to reflect testing' requirements noted in Regulatory _ Position C.3.4 of Regulatory Guide 1 9 and Initiative SA of NUMARC 87-00.
Individual-plant TS may have other notes relating to reducing the previous failure-2~
1
c.-.-,,.-a e
.ww.m.n-
_.,,z.,e, m,w,..w
,my
l 8
1 i
{e count to zero following a complete diesel overhaul.
With the i
change in the requirements for initiating and terminating the accelerated frequency for monthly surveillance requirements, notes related to reducing the previous failure count to zero following a complete diesel overhaul are no longer appropriate and should be deleted.
i The " Bases" Section for TS 3/4.8.1 should be updated to note that the basis for this TS also includes this generic letter.
Finally, with the implementation of recordkeeping requirements on EDG failures as a part of the above noted programmatic requirements for monitoring and maintaining EDG reliability, the staff has concluded that a special report for all EDG failures is no longer necessary.
Accordingly, the following provides an acceptable alternative for TS 4.8.1.1.3. This is consistent with Regulatory Position C.5 of Revision 3 to Regulatory Guide 1.9:
4.8.1.1.3 Reports - Reports on failures of the emergency diesel generators shall include the information noted in Regulatory Position C.5 of Regulatory Guide 1.9, Revision 3,
" Selection, Design, t
Qualification, Testing, and Reliability of Emergency Diesel Generator Units Used as Class lE Onsite Electric Power Systems at Nuclear Power Plants," Revision 3, 1990.
SUMMARY
The above alternative to the present requirements of Table l
4.8.1.1.2-1 will permit a reduction in the accelerated frequency of EDG monthly survcillance requirements.
Finally, a reduction I
I in the reporting requirements for EDG failures is also appropriate with the implementation.of recordkeeping requirements l
noted above.
l 3
l l
t e
-n--
.m..
,..a.
,-