ML20246E473
| ML20246E473 | |
| Person / Time | |
|---|---|
| Issue date: | 07/10/1989 |
| From: | Serkiz A NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Kniel K NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| FRN-57FR14514, REF-GTECI-B-56, REF-GTECI-EL, RTR-REGGD-01.009, RTR-REGGD-1.009, TASK-B-56, TASK-OR AE06-1-080, AE6-1-80, NUDOCS 8907120253 | |
| Download: ML20246E473 (22) | |
Text
_ _.
o s
70L 101999 L
MEMORANDUM FOR:
Karl Kniel, Chief Reactor and Plant Safety Issues Branch Division of Safety Issue Resolution FROM:
Aleck Serkiz, Senior Task Manager Reactor and Plant Safety Issues Branch Division of Safety Issue Resolution
SUBJECT:
SUMMARY
OR RECENT 11EETINGS WITH NUMARC AND NRR/SELB STAFF (Ref: RG 1.9, Rev. 3, 6-26-89 Working Draft)
I Meeting Dates:
July 5 and 6, 1989 Location:
US NRC 5650 Nicholson Lane Rockville, Md.
To conclude discussions related to NUMARC comments received
Purpose:
on RG 1.9, Rev. 3 (Proposed)
Participants:
See enclosed attendees list Summary:
These meetings provided an opportunity for the participants to exchange views on the 6-26-89 working draft of RG 1.9, Rev. 3 which has evolved from a series of theetings in May and June 1989 involving RES, NRR and NUMARC representatives.
Enclosed are pages from the 6-26-89 draf t with notes indicating changes agreed to, differences of position, etc.
NUMARC representatives stated that understandings resulting from this meeting will be provided NUMARC's B-56 working group, and that NUMARC will provide follow-up comments on the 6-25-89 working draft.
With the exception of NRR's continued position that any EDG experiencing 3/20 failures must be subjected to accelerated testing, it appears that RG 1.9, Rev. 1 (revised) is nearing completion. NUMARC plans to transmit I
~
6907120253 690710 PDR REVGP ERGNUMRC PDC u______.
q g>,
, 7 +.7, g:
.j g..
I a revised Appendix D,NUMARC-8700 to the NRC.in Julyi1989, along with their coments on the 6-26-89 draft.-
~
+
Aleck Serkiz, Senior Task Manager
' Reactor and Plant Safety Issues Branch
' Division of Safety Issue Resolution
Enclosures:
1.
Attendees 2.
Selective Page Markups-(6-26-89 RG 1.9, Rev. 3 working draft).
DISTRIBUTION:
FDR RES Circ /Chron sNUDOCSo -
DSIR C/F RPSIB R/F RWHouston WMinners AThadani KKniel.
~PNorian MVagins JRuss Meeting Attendees O
r i
[KARLKNIEL/ MEMORANDUM].
\\
//de:a -
OFFC :RPSI B/DSIR thRPSIB/DSIR:RPSIB/DSJS:
NAME:ASerkiz/bgp:PNorian
- KKniel M *:
DATE:7/1/89
- 7 ///)/89
- 7//P/89 OFFICIAL RECORD COPY g,
c
?n?
l;c
1 DISCUSSIONS RELATED TO REGULATORY GUIDE 1.9, Rev. 3 (6-26-89 Working _ Draft)-
7-5-89 MTG.; Attendees (NLS-013) h Al Serkiz NRC/RES/RPSIB 301/492-3942 l-Mike.McGarry'
-BCP & R 202/371-5733 Alex Marion NUMARC.
202/872-1280 h
Karl Kniel NRC/RES/RPS!B 301/492-3950 Faust Rosa NRC/NRR/SELB 301/492-0837 Om Chopra NRC/NRR/SELB-301/492-0835.
'Ernie Lofgren SAIC 703/821-4492-1
.7-6-89 MTG; ATTENDEES (NLN-350)
Al Serkiz NRC/RES/RPSIB
'301/492-3942.
Faust Rosa NRC/NRR/SELB
-301/492-0837 Om Chopra NRC/NRR/SELB 301/492-0835 Tony Pletrangelo NUMARC.
202/872-1280 Mike McGarry BCP & R 202/371-5733 Alex Marion NUMARC 202/872-1280 Ernie Lofgren SAIC' 703/821,4492 l
- - _ - _ - _ -.-__---__ = _-- _ _-__- _ - -_ _ _. -___ __-_ - -
g_g,p E
t,3oex.t h t* AFT generator unit condition.
The design of the bypass circuitry gN should include the capability for (1) testing the status and operability of the bypass circuits, (2) alarming in the control i
room for-abnormal values of all bypass parameters, and (3) manually resetting the trip bypass function. Capability for automatic reset is not acceptable.
The cuidance of Section 5.5.4(2) of IEEE Std 387-1984, for retaining all protective devices during diesel generator testing does.not apply to a periodic test that demonstrates diesel generator system response under simulated accident conditions p_e_I Reculatory Position C.2.2.12.
DIESEL GENERATOR TESTING (a)
C.2, C2. Section 6, " Testing," and Section 7,
" Qualification Requirements," guidelines in IEEE Std 387-1984, should be supplemented as discussed below.
C.2.1 Definitions M
C.2.1 Definitions (b) The following definitions are (61 applicable to the positions of this Regulatory Guide which address testing, reliability calculations record-keeping and om6 4he gMg *m Qoct omh reporting of performance.
\\ocL6 -v'u w da w a.M S
" Start Demands":
-All valid and inadvertent start demands, including all start-only demands, whether by automatic or manual initiation.
A start-only demand is a demand in which the
_ 6?' ' g emergency generator.is started, attains q)6vifjp= voltage and frequency,but no attempt is made to load the generator. See
" Exceptions" below.
" Start Failures":
Any failure within the emergency generator system that prevents the generator from achieving specified frequency (or speed) and voltage is classified as a valid start failure.y Loading rate requirements may be similarly
" modified.
See " Exceptions" below.
" Load-run Demands":
All valid load-run demands.
To be valid, the load-run attempt must follow a successful start and meet one of the following criteria:
(See " Exceptions" below.)
I") Additional useful testina cuidance and test definitions _ pan be found in the U.S.
Industry Plant Performance Indicator Procram (PPIP) IRef.
1 and the ASME O&M Part 16." Inservice Testina and Maintenance of Diesel Drives at Nuclear Power Plants". fRef 1
(b)These definitions are consistant with the reportino rules for U.S.
Industry Plant Performance Indicator Procram (PPIP) 9 l
f 9
\\e.VtS,'th k h " W M M munO 5 & VEIN C
GL LYL 8
hCC
( be. Wo@+ +o vrJe speeA enQ vo%e M a he %W is M mam DaA mrecom memica M A mn&du.rer % vnh*rn,le b
r _
lo - ?A*-M v3tTt.t-t dr bPhP1 be\\ eke p- %G. %
aload-runofanydurationhndloadlevehhatresults o
from a real (non-test) automatic or manual signal i
l a load-run test with the intention to meet the plant's
{
o load and duration test specifications l
'other operations of-the emergency generator in which it o
is intended to run for at least one hour with at least 50 percent of design load
" Load-run Failures":
All valid load-run failures in which the emergency generator fails to meet the criteria above.
1 (Unsuccessful attempts that may be defined as invalid demands or g
G-failures are the same as those described under " Exceptions" below.)
Any failure during a load-run attempt resulting from a valid signal should be counted.
A load-run failure should be f
counted only when an engine successfully starts but does not pick $
up load and run successfully.
" Exceptions": Unsuccessful attempts to start or to load-run g
should not be counted as valid demands or failures when they can y d) be definitely attributed to any of the following:
J f h
spurious operation of a trip that would be bypassed in M
o the emergency operation mode 4/
malfunction of equipment that is not operable during the f'
emergency operating mode (e.g., synchronizing circuitry)
N o
o Small water or oil leaks that would not preclude safe
-d d o
emergency generator operation during an emergency b[<,
operating errors that definitely would not prevent the y"d o
emergency generator from being restarted and brought to load within a few minutes without corrective J
maintenance.
0+@
f o Tests that are terminated intentially because of an h
d alarmed abnormal condition that would not have ultimately k
resulted in significant diesel generator damage or
[w failure.
2 o A failure of equipment that is not part of the defined diesel generator unit design.
o A failure to start following an actual (manual or automatic). or inadverdant start demand (if actuated only
(
on a loss of offsite power), if restarted manually within five minutes from the first start attempt.
l
\\heGe
'h New s 10 bg 9egnae she as, mot u ct e-mohJ W
6 awe ~* wo
&e w h s. pec sA M l
+kese A s, wese. meebea th en ha.wce_RAM]
3 -
a ts A -
__a a__
_g
_g._m ss m
't INSERT ON PAGE 10 AFTER " LOAD-RUN FAILURES"
- 1dentified Potential f ailures": L Any condition that is alarmed by the EDG monitoring system or is identified in the course of maintenance inspections, while the EDG is in the standby mode, that would have resulted in either a' start. failure.or a load-run failure-if a demand had oi. curred should be considered a valid demand and failure.
Neu3 4 itR. $f4 kk[.k ME j
% %d6mMdd l
-4,
r-c._ e>4 -w.
ceN m%
g i
3,, A h e
e t. -
3
%m+
l l
l.
j 4
- - ~ -.. - - - _ - _ - _ _ _ _ _ _
U
. (Me.x2 4 W M:T DD*
gaxc-p @ b F 9.ep\\as: e% emt erator being declared h
Each emergency generator failure that results in t e gene dem Exploratory inoperable, should be counted as on nted as demands or tests during corrective maintenance and the succe following repair to verify ope'rability should not be coudeclare failures when the emergency generator has not been Moperobk g Q d te.s&s, m d%e, the_ Ebg W
~ N oum *~ g va \\Q %%,
~"'y to repeat Mk Ccu%.A cu verable.
C.2.2 TEST DESCRIPTIONS C.2.2,
" Test Descriotio_Dg":
The following test descriptions are applicable to Regulatory Positions C.3 and C.4.
Table C.2 describes the sequence of qualification and surveillance testing.
C.2.2.1
" Start-Test ":
Demonstrate proper startup from ambient conditions and verify that the recuired design voltage and frequency is attained.
For these tests, the diesel generator can be slow-started, be prelubricated, have prewarmed oil and water circulating, and should reach rated speed on a prespecified schedule that is selected to minimize stress and wear'.
C.2.2.2
" Load-Run Test":
Demonstrate full-plant emergency load carrying capability, or 90 to 95% of the continuous rating of the EDG, for an interval of not less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and until temperature equilibrium has been attained.
This test could be accomplished by synchronizing the generator with offsite power.
The loading and unloading of a diesel generator during this test should be gradual and based on a prescribed schedule that is selected to minimize stress and wear on the diesel generator.
C.2.2.3
" Fast Start Test":
Demonstrate that each diesel generator unit starts from ambient conditions (if a plant has normally operating prelube and prewarm systems this should constitute its ambient conditions) and verify that the diesel generator reaches stable rated voltage and frequency within acceptable limits and time, as defined in the plant technical specifications.
C.2.2.4
" Loss-of-Offsite (LOOP) Test":
Demonstrate by simulating a loss of offsite power that 1) the emergency buses are deenergized and the loads are shed from the emergency buses and 2) the diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, energizes the auto-connected shutdown loads through the load sequencer, and operates 11
g__
~_
l l
G 24-f4 QoeVMtr bkPT for a minimum of 5 minutes.
C.2.2.5 "SIAS Test":
Demonstrate that on a safety injection auto-start (SIAS) signal, the diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, and operate on standby for greater than or equal to 5 minutes.
C.2.2.6
" Combined SIAS and IDOP Test":
Demonstrate by simulating a loss of offsite power in conjunction with SIAS that
- 1) the emergency buses are deenergized and loads are shed form the emergency buses and 2) the diesel generator starts on the auto-start signal from its standby conditions, attains the i
required voltage and frequency within acceptable limits and time, energizes auto-connected loads through the load sequencer, and operates while loaded with the auto-connected loads for greater than or equal to 5 minutes.
C.2.2.7 "Sinale-Load Reiection Test":
Demonstrate the diesel generator capability to reject a loss of the largest M
single load and verify that the voltage and frequency requirements are met.
, goy, pA n
C.2.2.8
" Full-Load Reiection Test":
Demonsthte the diesel generator capability to reject a load equa
%.of the a.ctuAO emeraency power load, or 95% of the short time (2 hrs) ratina of the EDG vr4, and verify that the voltage requirements are met and that the unit will not trip on overspeed.
C.2.2.9
" Endurance and Marain Test":
Demonstrate full-load carrying capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, of which 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> should be at a load equivalent to 110% of the emergency design load or 95% of the 2-hour rating of the diesel, whichever is smaller and 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> at a load equivalent to the design load or 90-95% of the continuous rating, onthccertis&Ted atb;esonnertedhys-maruis whichever is smaller.
Verify that voltage and frequency requirements are maintained.
C.2.2.10
" Hot Re-Start Test":
Demonstrate hot restart functional capability at full-load temperature conditions by verifying that the diesel generator starts on a manual or auto-start signal, attains the required voltage and frequency within acceptable limits and time, and operates for longer than 5 minutes.
C.2.2.11
" Synchronizing Test":
Demonstrate the ability to a) synchronize the diesel generator unit with offsite power while the unit is connected to the emergency load, b) transfer this load to the offsite power, c) isolate the diesel generator unit, 12
f.
L G-2@
ce(xnb p2MT for a' minimum'of 5 minutes.
C.2.2.5 "SIAS Test":
Demonstrate that on a safety injection auto-start (SIAS) signal, the diesel generator starts on the auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, and operate on standby for greater than or equal to 5 minutes.. -
C.2.2.6
" Combined STAS and LOOP Test":
Demonstrate by simulating a loss of offsite power in conjunction with SIAS that
- 1) the emergency buses are deenergized and loads are shed form the emergency buses and 2) the diesel generator starts on the i
auto-start signal from its standby conditions, attains the required voltage and frequency within acceptable limits and time, energizes auto-connected loads through the load sequencer, and operates while loaded with the auto-connected loads for greater than or equal to 5 minutes.
C.2.2.7 "Sinale-Load Reiection Test":
Demonstrate the diesel generator capability to reject a loss of the largest single load and verify that the voltage and frequency j
requirements are met.
\\33(o R.
Demonsyhtethediesel C.2.2.8
" Full-Load Reiection Test":
o Leo % of the cLekwzJl l
generator capability to reject a load equa ower load, ohSNL W 4heMort tilne (b.hrh rat 4ca emeraency p%~bEdhimmalit-erb and verify T. hat the voltage I
of t.MA.BDG.
requirement'er~are_.metand tha% unit will not trip on overspeed.
C.2.2.9
" Endurance and Marain Test":
Demonstrate full-load of carrying capability for an interval'of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> should be at a load equivalent to 110% of the emergency design load or 95% of the 2-hour rating of the diesel, whichever is smaller and 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> at a load equivalent to the design load or 90-95% of the continuous rating, thr-thwssttwated ErotceconnestedNlwrtk.okis-aarein, whichever is smaller.
Verify that voltage and frequency requirements are maintained.
C.2.2.10
" Hot Re-Start Test":
Demonstrate hot restart functional capability at full-load temperature conditions by i
verifying that the diesel generator starts on a manual or auto-start signal, attains the required voltage and frequency within acceptable limits and time, and operates for longer than 5 minutes.
C.2.2.ll
'6 Synchronizing Test":
Demonstrate the ability to a) synchronize the diesel generator unit with offsite power while the unit is connected to the emergency load, b) transfer this load to the offsite power, c) isolate the diesel generator unit, 12 1
r e. -
i
(,
2Ao -&%
U,
$b*l'?W bW and d)) restore it to a standby-status.
C.2.2.12- " Protective - Trio Bvoass Test":
Demonstrate that
- all automatic' diesel generator trips (except engine overspeed, oil' pressure and generator differential) are automatically bypassed upon loss of voltage.on the emergency bus concurrent with.a s,afety injection actuation signal.
C.2.2.13 - " Test Mode Chanae-Over Test":
Demonstrate that with the diesel generator operating in the automatic test mode while connected to its bus, a simulated safety injection overrides the' test mode by 1) returning the diesel generator to standby operations and 2) automatically energizing the emergency loads from offsite power.
C.2.2.14
" Redundant Unit Test":
Demonstrate that by starting and running both redundant units simultaneously that potential common failure modes that may be undetected in single diesel generator unit tests do not occur.
C.2.3 Pre-Operational and Surveillance Testina C.2.3: Table C.2 relates pre-operational and surveillance tests to the anticipated schedule for performance (e.g.
scheduled preoperational, monthly surveillance, 6 month, g,Qg49t refueling period and 10-year testing).
\\oe All tests'should generally bm.6 1tnd 'fol%q9md W 98A gngitaeN,ogaration in accordance with the manufacture's "1 - @15g 7W recommendations for reducing engine wear, including cool-down operation at reduced power, followed by post-operation lubrication.
C.2.3.1:
" Pre-operational Testina":
A preoperational test program _should be implemented for all. diesel generator systems following assembly and installation at the site.
This program should include the tests identified in Table C.2, and carried out
_t per the test definition in Section C.2.2.
In addition, demonstrate through a minimum of 25 valid start and load' demands (or tests) without failure on each installed diesel generator unit that an acceptable level of reliability has been achieved to place the EDG into an operational category.
C.2.3.2: "Eprveillance Testina": After the plants are licensed (after fuel load), periodic surveillance testing of each diesel generator must demonstrate continued capability and reliability of the diesel generator unit to perform its intended function. At such time that the EIX3 is declared operational in accordance with plant technical specification, the following periodic test program should be implemented.
13
G-2G~9A a otGkW C.2.3.2.1: "Monthlv Testina:" After completion of the diesel generator unit reliability demonstration during preoperational testing, periodic testing of diesel generator units during normal plant operation should be performed.
Each diesel generator should be started and loaded as defined in Table C.2 at least once in 31 days (with maximum allowable extension not to exceed 25 percent of the surveillance interval) on a staggered basis.
C.2'.3.2.2: "Six Months' for 184 days) Testina": The design basis for nuclear power plants requires a capability for the diesel generators to make fast starts (as defined in the plant Technical Specifications) from standby conditions to provide the necessary power to mitigate the large break loss-of-coolant accident coincident with loss of offsite power.
It has been determined (based on a probabilistic risk analysis performed to examine the change in core melt frequency associated with lengthening the fast-start test interval) that relaxation of fast-start test frequency from once per month to once per 6 months would not appreciably increase risk.
Therefore, once every six months each diesel generator should be started from standby conditions (if a plant has normally operating prelube and prewarm systems this should constitute its standby conditions) to verify that the diesel generator reaches stable rated voltage and frequency within acceptable limits and time and operates for five minutes.
C.2.3.2.3.
"Refuelina Outace Testina:" Overall diesel generator system design capability should be demonstrated at every refueling outage by performance of the tests identified in Table C.2 C.2.3.2.4. " Ten Year Testina:" Demonstrate that the trains of standby electric power are independent once per 10 years (during a plant shutdown), or after any modifications that could affect diesel generator independence, whichever is the shorter, by starting all redundant units simultaneously to help identify certain common failure modes undetected in single diesel generator unit tests.
P
C.2.3.3 " Corrective Action Testina:" Following the occurence of a degrading situation as defined in Table C.3.4-1, for a problem EDG, the surveillance testing interval for that EDG should be reduced to no more that seven days, but no less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This test frequency should be maintained until seven consecutive failure free start and load-run tests have been performed to demonstrate effectiveness of corrective actions taken and recovery of reliability levels. At that time monthly surveillance testing can be resumed. However, if subsequent to the seven failure free tests, one or more additional failures occur such that there are again three or more failures in the 14 NJ Kps& 6,. MS M g ree- (4 % 6 c3 % 'T k v ulo @
m A2% (b c_,3,t\\
M h h-Ml dev+"
e 3
M M Fwu%.
u e4 d.% h m W c h a GC.m % 4 Dr o-k
(
. A-4 M 7
I
.Q0OLhlb-P9-McT) l qeh last 20 tests, the testing interval should again be reduced as 1
noted'above and maintained until seven consecutive failure free 3
tests have been performed. The EDG undergoing corrective action O
t testing should be considered " operable" unless other license requirements require' declaring the EDG inoperable.
h C.3 EDG RELIABILITY GOALS AND CALCULATIONS q
C.3,
" Reliability Goals'and Calculations: Reliability goals for emergency diesel generators (EDGs) and related calculational I
3 methodology are as follows:
p C3.1," Reliability Goals for Station Blackout:" In order to h
comply with 10 CFR Part 50, Section 50.63, " Loss of All Alternating Current Power", and the guidelines provided in Regulatory Guide 1.155, " Station Blackout", the minimum EDG reli-ability should be targeted at 0.95 per demand for each EDG for plants in emergency ac (EAC) Groups A,B, and C and at 0.975 per demand for each EDG for plants in EAC Group D (see Table 2 of RG k
p 1.155).
b e ?
C.3.2,"Desian Basis Accidents Assessment:" A quantitative Eh)
EDG reliability taraet for design basis accidents has not been established. If an EDG reliability estimate is needed for olant specific PRAs. such a reliability should be calculate'd usina only d
the successful "immediate" starts, where "immediate" is defined as the time required for the EDG to be available igI DBA LOCA and other limiting plant transient emergency electrical loads.
manually within 5 minutes from the first start attemot) deemed k ;) {!
Therefore, delayed starts (i.e. starts _that are restarted I
2 successful for station blackout assessments per exceptions noted 2
in regulatory position C.2.1, should be considered failures for s
this application.
C.3.3 Diesel Generator Reliability Calculations l
Calculation of EDG reliabilities should be based on the definitions consistant with the reporting rules for the U.S.
Industry Plant Performance Indicator Procram IRef.
1.
or eauivalent and the definitions in Reculatory Position C.2.1.
The evaluation of a nuclear unit's EDG reliability should take into account the demand and failure experience of all EDGs which provide standby power for the unit. Calculation of EDG reliability levels should be based on the last 50 and 100 demands
)
in the following manner:
(
l a) Start Reliability (SR) defined as, i
SR =
Number of Successful Starts i
Total Number of Valid Start Demands 15
)
G-24 SM tho@le bWM b) Load-run Reliability (IR) defined as:
^
LR =
Number of Successful Load-runs Total Number of Valid Load-Run Demands (SR) * (LR) c) EDG Reliability
=
Table C.3.3-1 provides guidance for combining data from individual EDG performance to arrive at a nuclear unit l
reliability estimate.
TABLE C.3.3-1.
COMBINING EDG FAILURE EXPERIANCE EDG Configuration Method for Combinina 2,3,4 EDGs dedicated to Use combined failure nuclear unit experience of all EDGs 2,3,4 EDGs shared between Use combined failure between units experience of all EDGs for all units 1 dedicated EDG at each Each unit uses the' combined unit and 1 shared between failure experience of its units dedicated EDG and the shared l
EDG 2 dedicated EDGs at each unit Each unit uses the combined and 1 shared between units failure experience of its dedicated EDG and the shared EDG 2 dedicated EDGs and 1 HPCS Use the combined failure EDG or diverse EDGs within the experience of similar EDGs and same unit separately consider the failure experience of different EDGs.
The calculations discussed above will be point estimates of reliability and will have inherent uncertainties due to available sample size, statQtical uncertainty and the characteristics of a sliding sample. / [7oint estimate reliability calculation 2for a 50 demand sample that falls below 92%, or a 100 demand sample that falls below 93% are hbrt>cht indications that the true underlying reliability may have fa'lleil below 95%, 6 shWBAfruigitdkan. Stu* kctions to be taken are discussed below.
kOf CN
-L$
pr T-b-BR M%
16 l
C___m._____m
C.3.4 EDG Reliability Proaram Monitorina i
Data from surveillance tests and unplanned starts can be b
used to estimate achievement of a nuclear unit's EDG reliability targets and to to also detect a deteriorating situation for both the reliablity program and individual EDGs. Failures encountered in the last 20, 50 and 100 demands can be related to nuclear unit target reliabilities as follows:
,,s Table C.3.4-1. Alert Levels and Remedial Actions Target Alert Demand Failure Remedial J,M Reliability Type Combinations (All EDGs)
Actions i
.95 Mild
[(2/20) and (4/50)] E (3/20)
(1)
O Strong (2/20) ADg (5/50) Aug (8/100)
(2)-
.975 Mild (3/20) E (4/50) g (5/100)
(1)
Strong (4/50) ADA (6/100)
(2)
W.n
.pjifg[gf Problem EDG 3/20 of last failures on (3) b the SAME EDG p
(1) Take action per Figure C.3.1 for Mild Alert.
(2) Take action per Figure C.3.1 for Strong Alert.
c F
v and perform testing per Reg. Position C.2.3.3.
~
F(3) If any individual EDG experiences 3 or more failures in the last 20 demands, perform tantino per Reg.
L Position C.2.3.3 {egardles3of alert leve D y
C.3.5 Recovery from a Strona Alert (EDG Procram) fev-omy ProMe.m E.b(x-Following completion of corrective actions due to a strong alert, restora ion of EDG reliability levels should be demonstrated v conductina seven consecutive failure-free starts gr,d load-runs as defined in Section C.2.3.3.
If during the corrective action testing, the number of failures in the last 20 demands is 5 or more (for a specific EDG)& that EDG should be declared inoperable and consideration should be given to undertaking a major overhaul,or by other necessary major repairs, in accordance with the manufacturer's recommendations for such all pior to returning the EDG to service, a series of 14 consecuti e failure-free start and load-run demand tests should be conducted. These 14 tests will constitute a new data base for that EDG in subsequent reliability estimates. Regular EDG surveillance testing should then commence.
?
aml hh 1 %%dg o mosw-t~, c.hus Ae ove A ax h. o.m A g \\osh 312.o f
4<a%xes
}
w J
17 ggg h%%g 9 g.
ex w e ciis M ww, 3
~
%f3 tad povt g%, Gg,f
& TRe,-&W q
l
~
s 2 @ dtr W
' 3gt l
C.4, RECORD KEEPING GUIDANCE i
C4, "Recordkeepino Criteria": Section 7.5.2,
" Records and Analysis," of IEEE Std 387-1984, should be supplemented as follows:
C4.~ 1,
" Data Locaina": All demands, as defined in Regulatory Position C2.1, should be logged and continually updated for each diesel generator based on surveillance testing and experienced failures.
The log should be maintained in auditable iorm and should include sufficient detail to permit review and audit of l
reliability calculations in accordance with Regulatory Position C3.3. The log should also include a re-calculated reliability b
,kik estimate following occurence of load-run demand failure.
/ 4 l
Maintenance, repair, and out-of-service time as well as j$
cumulative maintenance and operating data (hours of operation),
fby 76 should also be logged.
The out-of-service time should include the hours the diesel generator is removed from service (declared 4
inoperable) for preventive maintenance, corrective maintenance following a failure, modifications, or for support systems out of service.
The out-of-service time for diesel generators during refueling should also be logged if the diesel generator is electively removed from service (i.e., no failure has occurred).
After a failure experienced during refueling,the actual time spent in corrective maintenance should be logged as out-of-service time.
C.5, REPORTING CRITERIA i
C5,"Reportina Criteria":
All plants when reporting EDG 3
failures should conform with the provisions of 10CFR. 50.72, 10 CFR 50.73, 10 CFR 21, plant technical specifications, or other current NRC reporting regulations.
9 If a Mild Alert condition comes about, the NRC on-site
]
inspector should be notified and a report prepared in 30 days j
which would be maintained at the site for NRC audit. This i
report should include the following information:
y
- 1) A summary of all tests within the time period over which the last 20 valid tests were performed, with emphasis on those tests where failures have occured.
- 2) A description of the failures, underlying causes and corrective actions taken.
18
doctDJG Y9 G-74-Y#1 f
J M
b
- 3) An estimate of.the nuclear unit.EDG reliability level w
per Regulatory Position C.3 at the time a Mild Alert
'5 condition was entered and an estimate of the recovered M
reliability associated with corrective actions taken.
If a Strong Alert situation comes about, both the NRC Region and Headquarters should be notified within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and the activities cutined in column 3 of Figure C.3.1 should be undertaken. A' schedule for implementing corective actions and I "I L
demonstration of restored EDG reliability should be submitted to 2,
the NRC within 30 days.
g d
Actions implemented should be consistant with the requirements of the on-site EDG reliability program and integrated into that program.
C.6 Emeraency Diesel Generator (EDG) Reliability Proaram Regulatory Guide 1.155 describes a means acceptable to the and NRC staff for meeting the requirements of 10 CFR 50.63, identifies the need for an EDG reliability program to maintain and monitor EDG reliability levels to designed assure that selected reliability levels are being achieved.
This section provides guidance regarding the principal elements for such a reliability program. Although current industry practices may group activities such as discussed below somewhat differently, existing EDG reliability and maintenance programs should encompass the elements discussed below.
The principal elements of an EDG reliability program (or activities) should encompass the following:
1.
Identify an EDG reliability tarcet level corresponding to that selected for compliance with 10 CFR 50.63.
2.
A surveillance olan that identifies EDG subcomponents and subsystems, surveillance parameters, surveillance frequency, and incorporates manufacturer recommendations.
This plan should define the monitoring requirements to be used by the other elements of the EDG reliability program.
3.
Performance monitorina of important parameters on an ongoing basis to obtain information on the state of the EDG and components so that precursor conditions are identified prior to failure; can also be used for maintenance related activities.
19
j
. @24 -h l
j WWM r
4.
A' maintenance procram designed for both preventive and corrective actions based on operational history and past maintenance activities,' vendor recommendations, spare parts. considerations,_and the results of hM,g) surveillance monitoring.
Yb i
N I
5.
Failure analysis, including root cause M
analyses, that have been developed for the pf j
onsite'EDGs and that can be used to reduce failures and' root causes to correctable actions for avoidance in the future.
$>v1e CE4%
6.
Problem closeout n[sfcssfup'es that establish I
criteria for closeo'ui! 'of' reliability and operational related problems, and which provide-for follow-up surveillance to ensure that the problem has been corrected and that latent long term effects (i.e. excessive wear) will not recur.
7.
A data acquisition system (or' equivalent means) that provides for data capture, storage and retrieval capability to all elements of the reliability program.
8.
Defined responsibilities and manacement oversicht to ensure that the reliability 4
program elements are functioning effectively and that target reliability levels are being sustained.
The interaction of the respective EDG reliability program elements is shown in Figure C.6.1 The principal elements of an EDG reliability program as fd-defined above are provided as guidelines. Other reliability g
programs that include the same or similar activities may also be 4gh used.
One such example are $he TDI Owner's Group maintenance
- f. g and surveillance activities ;45:N' @fravWWhte2K Such C
I programs should be reviewed for consistency with R.G.1.155 and this regulatory guide.
O) Revision 2, Appendix 2, " Design Review / Quality Validation" L
report submitted 5/1/86, J. George (TDI) to H. Denton(NRC) was utilized in revising plant-specific Technical Specifications.
20 l
r e
d
% D;ccca ww'I RphTesN 0.2. ch ?4.yMfo>A3uk pp [{s Section c.6.1 Diese Generator Reliability Tarcet.
y RG 1.155 provides uidelines for selecting an EDG hr}*#7
- reliability target.
.cctien-C.2. provides guidance for periodic testing related to determining EDG reliability levels. Oc;tien-7' g.pq J>es provides guidance for estimating reliability levels being cchieved and corrective actions which should be taken to correct bifi,
a deteriorating situatio. 241A, b.3 Tasc% C.3 d A
C.6.2 Diesel Generator Surveillance Plan A surveillance plan.Lhould identify the EDG components (or cub-sytems), support systems and EDG boundary.
Figure.C.6.2 provides an overview of typical components'and EDG system boundary. Those components whose function is solely to support the EDG are to be' viewed as within the EDG boundary. The systems which provide support to'the EDG and perform other plant
- functions are outside the boundary, with the understanding that the boundary interface' function must be maintained. IEEE Std 387-1984 and ANSI /ASME OM-16f(Draft) provide similar definitions of components and. system boundaries and may also be used as appropriate guidance.
A. surveillance plan should consider the following:
1.
Reliability considerations related to EDG component and support systems design and operational characteristics. Significant common cause effects should also be identified.
2.
Engine manufacturer surveillance recommendations 3.
Potential for surveillance induced failures 4.
Engine / component aging considerations 5.
Prior operational history as derived from on-site EDG experience and for other engines of the same make at other nuclear plants.
This plan should provide the basis fer performance monitoring, maintenance activities and failure analysis procedures.
(
Figures C.6.3 and C.6.4 provide examples of types of periodic surveillance activities proven effective. When performing such surveillance it is important to capture the actual values of critical parameters'since such data would be i
21 j
i
4.N2.L*$
NN -;9M cxtremely useful in carrying out failure analyses, as well as
-providing data for long term EDG condition monitoring.
C.6.3 EDG Performance Monitorina ah h t endih-
@1A 3 s s s Performance monitoring h BatAtNtndlMC should be based on considerations discussed in Sect' ion C!6.2 and should be used to monitor & 4 tsf 4 those conditions that could be precursors to failures, or which can be correlated to long term degradation.
The examples shown in Figures C.6.4 and C.6.5 should be developed from on-site operational experience, industry-wide applicable data cnd manufacturer recommendations.
C.6.4 EDG Maintenance Procram A maintenance program should be based on reliability considerations and actively interface with other elements of the EDG reliability program. Proper maintenance is an important contributor.to EDG reliability from both preventive and corrective aspects. Generally speaking,'EDG maintenance programs chould be based on the following principles:
(a) Recommended vendor maintenance actions and schedule for implementation.
(b) Site-specific operational history and reliability characteristics of the EDG components and support systems.
(c) Spare parts considerations to ensure that such parts are in stock when needed, with ample spares.
(d) Factors as: repair time, potential failure severity, recurrence of known failures should be utilized to for scheduling maintenance.
(e). Long term maintenance scheduled during refueling outages should be based on engine performance experienced.
l C.6.5 EDG Failure Analysis and Root Cause Investigation An EDG reliability program should have failure analysis procedures designed to systematically reduce problems or failures to correctable actions.
Failure analysis starts from the most apparent symptoms and progresses to determination of underlying causes or incipient i.
conditions. Root cause analysis goes further and attempts to
' find underlying causes relating to design, engine operation or maintenance.
Figure C.6.5 outlines a systematic approach to 22 4
{ hut 1 T C
l (f) Input from Corrective Maintenance Activities
-(g) Industry-wide Operating Experience j
l C.6.8 Assioned Responsibilities & Manacement Oversloht An EDG reliability program should have clear assignment of responsibility for carrying out the respective program elements.
i Such assignments should be based on properly trained and i
qualified staff to perform the activities needed, and for ensuring that qualified personnel are assigned.
A management oversight function (or procedures) should also be available to review the effectiveness of the reliability i
program and reliability levels being sustained independent of the day-to-day EDG activities. Such a plant-wide function may already exist; however, a routine evaluation of EDG performance should be incorporated into the plant performance review process.
D.
IMPLEMENTATION The purpose of this section is to provide information to applicants regarding the NRC staff's plans for using this regulatory guide.
Except in those cases in which an applicant proposes an acceptable alternative method for complying with the specified portions of the Commission's regulations, the method to be described in this guide will be used in the evaluation of selection, design, qualification, and tes ting of diesel generator units used as onsite electric power systems for the following nuclear power plants:
- 1. Plants for which the construction permit is ist2ed after the issue date of the final guide,
- 2. Plants for which the operating license anolication is docketed 6 months or more after the issue date of the final guide, 3.
Plants for which the licensee voluntarily commits to the provisions of this guide.
In addition, the NRC intends to apply Regulatory Position C.6 of the guide with respect to the EDG reliability program to All operating plants.
The reliable operation of onsite emergency ac power sources should be ensured by a reliability program designed to maintain and monitor the reliability level of each over source over time for assurance that the selected km i mwam
& ek x
he a
4
( %* 9 4 %
e44e_c W ve.
\\
ura $ ere u w $fud-Nd
O d Draft TABLE C.2
~
PRE-OPERAT10hiAL & SURVEILLANCE TESTING Refueling tefer to Monthly Outege Cosition C 2.2 Pre Operational Perlocic 6* Month 18 Month
.10 Year t*eutato fest Program tests.
Tests.
Tests Tests for beseri tion C.2.2.1 X(a)
X Stort Test QVM I
p(
X ")
X
'C.2.2.2 Load Run Test N
X
}
X i
k h, at art Test gg C.2.2.4
/C)
W j
Loss-of *Df fsite Power (LOOP) Test X
. C.2.2.5
/C)
X 51 AS Test C.2 2.6 X
X Canbtned $1A5 & LOOP Test
' 51 5 Loed Rejection Test -
X C.2.2.8 X
' futt Load Rejection Test X
' C.2.2.9 X
X Endurance and Margin Test C.2.2.10 X
X f.at it2 start Test C.2.2.11' X
Synchronl2in0 Test X
C.2.7.12 X
X Frat.ative-Trip sypass test C.2.2.13 X
X ftst hade Change-over Test C.2.2.11.
X X
Redundant Unit Test Tech spec requirements take precedent to this table.
(a) Included in each of the 25 tests described in segulatory Position C.2.3.1 6 sonth test repeats 1 month test objectives with the eddition of fast starting (b) tonding conditions.
(c) LOOP and $1 AS tests can be conducted as part of the Contined SILS 8 LOOP Test.
L
_-_.__.__._._4
- f l'
,j1 f{
e asg v.w
,w a
s
.t gs ee s
e r
,d l
i
- en a
e y
Rt e
t i
r
)
e h
d g ee n
r e
s u s L.
t t
uywr r3 fr ci di t
Ime o:
t l e to ng e rr o
i y
t e
on istt i
l e
T i
p3
~
tt f
v.
b ai mg e es C
o nle n n fu ou e
r std a
i y
yo y yl n r
dtn e
. 2 C
iedri o r a ttua) e nca l
b.
R ebslow oncJ tn rx rt tlAoel s
e0 nei oe oi iea
. p eel t
DC l
tio R
hesu o e fi ssn0 eft tt tn lnfgc o rp e E
nt /s tr r.
n l
e.
t hnl u i ne a
ne1 m a at so ie,ee ne nos m
mo E
e a mse yest str oe o scAk gg ecn ea bei A
ir.soo f
c sr ssm ri rm b T
ht L
yt teende t ttes eno l v tn
- iiMc, in m o sr olt R tr s
g bi A fs rhl ouh o etde saf pr po ttEog sa tti I
etbilt o noot sln mu mi eoFrn eh rnt "u
os C
te c otc r opm( A pi Es Et Rn(ti Dc oec er ro b.
Dma Rp pP i
s D
it A o p ai o o o o
e o
O o
e 4
oh sfrcnf rt t
5 o%
t R
3 4
e T
g S
1 2
3 o
C r
i P
d n
n y
e u.4 t_
n I
t o
4 g
i b
ern me 3
e i
e voi ec t
u C
]cJ i
rdo bd id l
o/r nty oedn s
l gail Li e
rceo n
t R(
u i nes potcg it o
e ke rn/n 4
rcuid R
apeei a
l D
E E
T on lo mcr i
l T
an m ttgno s
ma r CJ d
A etot nuuet o
i*
e P
slise eoali P
m T o hi Z
aitor m-ln t
t s
c 0
e o
e ei m u eerio soem ms g
e 2 ens N
rvd t
t ofv e
et e
T t
niu crnri ml u Ob t
e ti a
nuooo r
dls R
Ic u
ebe i
Y D
smsc s
s ey rot n
Iscff ern ht or i
t err nfti o
t teo oo lm tp3 t
d oi a ef3 e
i 7w net e
idts Crtbr ro.
s NR s
ae Ro ag 2
s tR s o pd Wtst o ey.
u n
E et o cttr ttC c
o o
eenep ai s
p L
r em A%6C l
s A
uer h pe r rlr id tsm tie e
tJ.ae ntG sb p R
D i
r NaW eu yisD ns s
L e _rt f
uE oi i
d f
I e
. et mlG i j d
M waha t d eeD n
o a DrE o
a e
tf e
e r
mr n N
b r
i0 i
G v5fe e Ih e u au o t
O' rd ei c
1 R&
t v
t gevt a
i l
t e
ococ
(
3 c fn roba t
C W
en r pra s
R rode p e i
e E
riet a ev l
thi r
T otvt u
T ccra tutt g
A oep no c e
i P
e s e re r
F s b meor o
esfr s
i t o o i
v c
h ml e r c
T D of I
e c
ga n
ni o ib sa de.
I rl t
otn s le cea e T
vncrl r R
roa p u.
J. m l
E ui t
r L
stg a eu A
in edier fc unr c
ictwg O
noo o ro W
r i p ey t i ndn pe enooy eh Castt Rt o
o 6
,,s i
I i