ML21167A351

Rev 5 Final Watermarked for ACRS

ML21167A351
Person / Time
Issue date:	06/01/2021
From:	Office of Nuclear Regulatory Research
To:
SJG1
Shared Package
ML21049A261	List: ML21167A351 ML21172A158 ML21173A176 ML21181A249 ML21181A253 ML21183A201 ML21183A202 ML21187A170 ML21187A171
References
RG-1.009, Rev 5
Download: ML21167A351 (20)

Text

U.S. NUCLEAR REGULATORY COMMISSION REGULATORY GUIDE 1.9, REVISION 5 Issue Date: April 2021 Technical Lead: Liliana Ramadan Written suggestions regarding this guide or development of new guides may be submitted through the NRCs public Web site in the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/, under Document Collections, in Regulatory Guides, at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/contactus.html.

Electronic copies of this RG, previous versions of RGs, and other recently issued guides are also available through the NRCs public Web site in the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/, under Document Collections, in Regulatory Guides. This RG is also available through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under ADAMS Accession Number (No.) ML21049A297. The regulatory analysis may be found in ADAMS under Accession No. ML14297A097. The associated draft guide DG-1303 may be found in ADAMS under Accession No. ML14281A071, and the staff responses to the public comments on DG-1303 may be found under ADAMS Accession No. ML21049A262.

APPLICATION AND TESTING OF ONSITE EMERGENCY ALTERNATING CURRENT POWER SOURCES IN NUCLEAR POWER PLANTS A. INTRODUCTION Purpose This regulatory guide (RG) provides guidance that the staff of the U.S. Nuclear Regulatory Commission (NRC) considers acceptable to comply with the NRC regulations for onsite emergency alternating current (AC) power sources in nuclear power plants. These power sources include emergency diesel generators (EDGs) and combustion turbine generators (CTGs). This RG may be used for other types of onsite emergency AC power sources. It may also be used for nonpower reactors and nuclear facilities with suitable justification and demonstration, as applicable. This guidance helps ensure that the onsite emergency AC power sources are qualified; have sufficient capacity, capability, independence, and testability; and have the necessary reliability and availability for design-basis events (DBEs).

This RG provides specific guidance in the areas of preoperational testing, periodic testing, reporting and recordkeeping requirements, and valid demands and failures. The preoperational and periodic testing provisions in this guide provide a basis for taking the corrective actions needed to maintain high inservice reliability of installed onsite emergency AC power sources. The data accumulated will assist ongoing performance monitoring for all onsite emergency AC power sources after installation and during service.

Applicability This RG applies to applicants and licensees subject to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities (Ref. 1), Appendix A, General Design Criteria for Nuclear Power Plants, and applicants and licensees for a power reactor combined license (COL) under 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants (Ref. 2).

RG-1.9, Rev. 5, Page 2 Applicable Regulations 10 CFR Part 50, Appendix A, provides minimum requirements for the principal design criteria that establish the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components (SSCs) important to safety to provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. The general design criteria (GDC) applicable to this RG include the following:

o GDC 2, Design Bases for Protection Against Natural Phenomena, requires that SSCs important to safety be designed to withstand the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches, without loss of capability to perform their safety functions.

o GDC 4, Environmental and Dynamic Effects Design Bases, relates to the capability of SSCs of the AC power system to withstand the effects of missiles and environmental conditions associated with normal operation, maintenance, testing, and postulated accidents.

o GDC 5, Sharing of Structures, Systems, and Components, requires that SSCs important to safety not be shared among nuclear power units unless such sharing will not significantly impair the SSCs ability to perform their safety functions, including an orderly shutdown and cooldown of the remaining units if there is an accident in one unit.

o GDC 17, Electric Power Systems, requires that onsite electric power systems have sufficient independence, capacity, capability, redundancy, and testability to ensure that (1) specified acceptable nuclear fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents, assuming a single failure.

o GDC 18, Inspection and Testing of Electric Power Systems, requires that electric power systems important to safety be designed to permit appropriate periodic inspection and testing to assess the continuity of the systems and the condition of their components.

o GDC 33, 34, 35, 38, 41, and 44 apply to operation of the onsite electric power system (in accordance with GDC 17) to ensure that the safety functions of the systems described in these criteria are accomplished.

10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, Criterion III, Design Control, and Criterion XI, Test Control, require that (1) measures be provided for verifying or checking the adequacy of design through design reviews, the use of alternative or simplified calculation methods, or the performance of a suitable testing program, and (2) a test program be established to ensure that systems and components perform satisfactorily and that the test program includes operational tests during nuclear power plant operation.

10 CFR 50.46, Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors, requires, in part, that each boiling or pressurized light-water nuclear power reactor fueled with uranium-oxide pellets within cylindrical Zircaloy or ZIRLO cladding be provided with an emergency core cooling system (ECCS).

RG-1.9, Rev. 5, Page 3 10 CFR 50.55a(h) states that protection systems must meet the requirements of the Institute of Electrical and Electronics Engineers (IEEE) Standard (Std) 603-1991, IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations (Ref. 3), or IEEE Std 279-1971, IEEE Standard: Criteria for Protection Systems for Nuclear Power Generating Stations (Ref. 4),

contingent on the date of construction permit issuance. The design-basis criteria identified in those standardsor, for plants with construction permits issued before January 1, 1971, the criteria identified in the licensing basis for such facilitiesinclude the range of transient and steady-state environmental conditions during normal, abnormal, and accident conditions during which the equipment must perform its safety functions.

10 CFR 50.63, Loss of all alternating current power, requires that each light-water-cooled nuclear power plant be able to withstand and recover from a station blackout (i.e., loss of offsite and onsite emergency AC power systems) for a specified duration. The reliability of onsite AC power sources is one of the main factors contributing to the risk of core melt as a result of a station blackout.

10 CFR Part 52 governs the issuance of early site permits, standard design certifications, COLs, standard design approvals, and manufacturing licenses for nuclear power facilities.

Related Guidance RG 1.6, Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems (Ref. 5), discusses independence between redundant standby (onsite) power sources and between their distribution systems.

RG 1.27, Ultimate Heat Sink for Nuclear Power Plants (Ref. 6), relates to the capacity of the ultimate heat sink and a mission time of 30 days.

RG 1.28, Quality Assurance Program Criteria (Design and Construction) (Ref. 7), provides guidance on establishing and implementing a quality assurance program for the design and construction of nuclear power plants and fuel reprocessing plants.

RG 1.32, Criteria for Power Systems for Nuclear Power Plants (Ref. 8), describes a method acceptable to the NRC staff for complying with the agencys regulations for the design, operation, and testing of electric power systems in nuclear power plants. Specifically, it provides guidance for meeting the GDC for the safety-related portions of systems and equipment in the AC power systems.

RG 1.75, Criteria for Independence of Electrical Safety Systems (Ref. 9), provides guidance on physical independence requirements of the circuits and electrical equipment that comprise or are associated with safety systems.

RG 1.81, Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants (Ref. 10), provides guidance on the sharing of onsite emergency and shutdown electric systems for multiunit nuclear power plants.

RG 1.89, Environmental Qualification of Certain Electric Equipment Important to Safety for Nuclear Power Plants (Ref. 11), provides guidance for meeting the regulations for environmental qualification.

RG-1.9, Rev. 5, Page 4 RG 1.100, Seismic Qualification of Electrical and Active Mechanical Equipment and Functional Qualification of Active Mechanical Equipment for Nuclear Power Plants (Ref. 12), discusses the seismic qualification of electrical equipment.

RG 1.118, Periodic Testing of Electric Power and Protection Systems (Ref. 13), discusses periodic testing of the performance of the components of the system.

RG 1.137, Fuel Oil Systems for Emergency Power Supplies (Ref. 14), provides the quality control requirements for diesel fuel oil because it is a safety-related component. The RG establishes the acceptable methods of verifying the quality of the fuel oil and fuel oil systems used in safety-related applications at nuclear power plants.

RG 1.155, Station Blackout (Ref. 15), provides guidance for meeting the regulations that require nuclear power plants to be capable of coping with a station blackout for a specified duration.

RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (Ref. 16),

describes methods that are acceptable for demonstrating compliance with the provisions of Section 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.

RG 1.164, Dedication of Commercial-Grade Items for Use in Nuclear Power Plants (Ref. 17),

provides guidance on the dedication of commercial-grade items and services used in nuclear power plants.

RG 1.189, Fire Protection for Nuclear Power Plants (Ref. 18), provides a comprehensive fire protection guidance document and identifies the scope and depth of fire protection that the staff considers acceptable for nuclear power plants.

NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP) (Ref. 19), provides guidance to the NRC staff in performing safety reviews under 10 CFR Part 50 and 10 CFR Part 52. Specifically, SRP Chapter 8, Electric Power, contains review guidance related to the onsite AC power system that includes those standby power sources, distribution systems, and auxiliary supporting systems provided to supply power to safety-related equipment or equipment important to safety for all normal operating and accident conditions.

Purpose of Regulatory Guides The NRC issues RGs to describe methods that are acceptable to the staff for implementing specific parts of the agencys regulations, to explain techniques that the staff uses in evaluating specific issues or postulated events, and to describe information that the staff needs in its review of applications for permits and licenses. Regulatory guides are not NRC regulations and compliance with them is not required.

Methods and solutions that differ from those set forth in RGs are acceptable if supported by a basis for the issuance or continuance of a permit or license by the Commission.

Paperwork Reduction Act This RG provides voluntary guidance for implementing the mandatory information collections in 10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).

RG-1.9, Rev. 5, Page 5 These information collections were approved by the Office of Management and Budget (OMB), approval numbers 3150-0011 and 3150-0151. Send comments regarding this information collection to the Information Services Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011 and 3150-0151), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street, NW, Washington, DC 20503; e-mail:

oira_submission@omb.eop.gov.

Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

RG-1.9, Rev. 5, Page 6 B. DISCUSSION Reason for Revision This revision (Revision 5) of RG 1.9 endorses, with supplements and clarifications, IEEE Std 387-2017, IEEE Standard for Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations (Ref. 20), and IEEE Std 2420-2019, IEEE Standard for Combustion Turbine-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations (Ref. 21). These standards delineate principal design criteria and qualification and testing guidelines to help ensure that EDGs and CTGs meet performance requirements. The NRC is issuing Revision 5 of this RG to provide current guidance, based on the generally accepted methods and procedures for EDGs, CTGs, and any other onsite power sources. Specifically, the onsite emergency AC power sources should be properly qualified, have sufficient capacity and capability, and have the necessary reliability and availability to operate as required under all design conditions. This programmatic guidance is the result of lessons learned from license amendment review activities and inspections, industry operating experience review, design certification reviews, COL application reviews, and NRC staff analysis. In addition, this RG supplements RG 1.32 by providing additional guidance based on generally accepted methods and procedures for onsite emergency alternate AC power supplies.

=

Background===

Onsite Emergency Alternating Current Power Sources Onsite emergency AC power sources are used to supply power to safety-related equipment or equipment important to safety for all operational events and during accident conditions. An onsite emergency AC power source selected for use in an electric power system should be able to (1) start and accelerate a number of large motor loads in rapid succession, while maintaining voltage and frequency within acceptable limits, (2) provide power promptly to engineered safety features if a loss of offsite power (LOOP) and an accident occur at the same time, and (3) supply power continuously to the equipment needed to maintain the plant in a safe condition if an extended LOOP occurs.

Knowledge of the characteristics of each load is essential to establish the bases for selecting an onsite emergency power source capable of accepting large loads in rapid succession. In large light-water nuclear power plants, the majority of the emergency loads are large induction motors. At full voltage, this type of motor draws a starting current of five to eight times its rated full-load current. The sudden, large increase in current drawn from the onsite emergency AC power source as a result of the startup of induction motors can result in substantial voltage reduction. This lower voltage could prevent a motor from starting (i.e., accelerating its load to rated speed in the required time) or could cause a running motor to coast down or stall. Other voltage-sensitive loads may be disconnected because of low voltage or if their associated contactors drop out. Recovery from the transient caused by starting large motors, or from the loss of a large load, could cause overspeed of the emergency generator prime mover that, if excessive, might result in a trip (i.e., loss of the safety-related power source). These same consequences can also result from the cumulative effect of a sequence of more moderate transients if the system is not permitted to recover sufficiently between successive steps in a loading sequence.

The uncertainties inherent in safety-load estimates at an early stage of design or before the COL stage are sometimes so large that it is prudent to provide a reasonable margin in selecting the load capabilities of the onsite emergency AC power source. Particularly for EDGs and CTGs, this margin, as discussed in IEEE Std 387-2017, Annex A, and IEEE Std 2420-2019, Annex A, can be achieved by estimating the loads conservatively and selecting EDGs or CTGS with continuous ratings that exceed the

RG-1.9, Rev. 5, Page 7 sum of the loads needed at any one time. A more accurate estimate of safety loads is possible during the operating license or COL stages of review because detailed designs should have been completed and component test and preoperational test data are usually available. However, the DBE loads during the operating license or COL stages should be within the continuous (or nominal) rating of the selected onsite emergency AC power source(s) with margin.

Class 1E, seismic Category I, and environmentally qualified equipment, instrumentation, and components are credited for the mitigation of the consequences of all accidents, events, and abnormal operating conditions postulated at nuclear plants, as discussed in RG 1.89 and RG 1.100. Under 10 CFR 50.46, the NRC requires, in part, that each light-water nuclear power reactor fueled with uranium oxide pellets within cylindrical Zircaloy or ZIRLO cladding be provided with an ECCS capable of maintaining the core temperature at an acceptably low value and removing decay heat produced from the long-lived radioactivity. The onsite emergency AC power system should provide Class 1E power for long-term operation of the ECCS, demonstrating compliance with 10 CFR 50.46 for extended operation.

The design of the onsite emergency AC power source should also incorporate high operational reliability, which should be maintained throughout the life of the onsite emergency AC power source by initiating a program designed to monitor, improve, and maintain reliability. If test programs are not adequately described in the COL or design control document, the creation of the detailed program should be a license condition. Increased operational reliability can be achieved through appropriate testing and maintenance as described in RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, as well as the appropriate level of causal analysis of all failures of the onsite emergency AC power source.

The reliability of onsite emergency AC power sources is important in the risk evaluation of core damage from a station blackout event. Thus, both attaining and maintaining the high reliability of onsite emergency AC power sources at nuclear power plants contribute greatly to reducing the probability of station blackout. RG 1.155 calls for the use of the reliability of the onsite emergency AC power source as one of the factors in determining the length of time a plant should be able to cope with a station blackout.

If all other factors (i.e., redundancy of onsite emergency AC power source, frequency of LOOP, and probable time needed to restore offsite power) remain constant, higher reliability of the onsite emergency AC power source could result in a lower probability of a station blackout, with a corresponding decrease in coping duration for certain plants.

The offsite power source (preferred power source) is not designed to withstand external events, as discussed in 10 CFR Part 50, Appendix A, GDC 2. For a natural event that results in catastrophic failure of the offsite power system or damage to the plant infrastructure required for the offsite power system, the offsite power system may not be available for an extended time. An accident condition such as a loss-of-coolant accident may result in high dose rates in the vicinity of the plant such that it may not be feasible to evaluate the operational capability of external non-safety-related plant equipment required to restore offsite power for many days. EDG mission time refers to the amount of time the EDG is required to operate to supply power to safety systems that mitigate the effects of accidents and events delineated in the safety analysis and to power the equipment necessary for long-term cooling. RG 1.27 states that the capacity of the ultimate heat sink should be sufficient to provide cooling for the time necessary to evaluate the plant conditions and take corrective actions related to the capacity of the ultimate heat sink and mission time of 30 days. In 10 CFR 50.46(b)(5), the NRC requires core cooling capability for an extended period of time (i.e., as long as radioactive materials are present in the core). The mission time for onsite emergency power sources can be up to 30 days. The typical 30-day duration is based on core cooling functions required for an accident concurrent with a LOOP, as well as time to restore offsite power from a LOOP, due to external events.

RG-1.9, Rev. 5, Page 8 Emergency Diesel Generators and Combustion Turbine Generators General industry practice is to specify a voltage reduction of 10-15 percent when starting large motors from large-capacity power systems and a maximum voltage reduction of 25-30 percent when starting these motors from limited-capacity power sources such as EDGs or CTGs. Evaluation of voltage reduction during load sequencing should consider the plant-specific equipment to prevent load interruption. Large induction motors can achieve rated speed in less than 5 seconds when powered from adequately sized EDGs or CTGs that can restore the bus voltage to 90 percent of nominal in about 1-2 seconds.

Motor-starting transients also affect the frequency of the emergency AC power source. This is primarily a concern with EDGs but may apply to other generator types.

Frequency perturbations could affect the operation of critical equipment, such as motor-operated valves and bypass power supplies associated with uninterruptible power systems. Motor-operated valves have critical stroke times considered in the safety analyses of the plant response time for DBEs. Plant safety analyses evaluate fluid flow rates in the ECCS and make assumptions about the steady-state speed of rotating equipment. The ability of the EDG to maintain steady-state voltage and frequency within an acceptable band can affect the performance capabilities of the ECCS motor loads (e.g., pumps, motor-operated valves, and fans) and bypass power supplies associated with uninterruptible power systems. Hence, voltage and frequency perturbations during load sequencing, coupled with an allowable operating band for EDGs during steady-state conditions, should be evaluated for their impact on critical parameters, such as flow rates and stroke times, assumed in plant safety analyses. The function of the EDG is to ensure that the safety functions of the systems described in GDC 33, 34, 35, 38, 41, and 44 will be accomplished in accordance with accident analyses.

The immediate operation of an overspeed trip device (usually set at 115 percent of nominal speed for EDGs or CTGs) protects an EDG or CTG from excessive overspeed, which can result from an improperly adjusted control system or governor failure. Similarly, to prevent substantial damage to the generator, the generator differential current trip must operate immediately upon occurrence of an internal fault. Other protective trips can also safeguard the EDGs or CTGs from possible damage. Conversely, spurious operation of a trip circuit lowers EDG and CTG availability and reliability. Consequently, it is important to ensure that these other protective trips do not prevent the EDGs and CTGs from performing their safety function during the accident mode of operation.

Consideration of International Standards The International Atomic Energy Agency (IAEA) works with member states and other partners to promote the safe, secure, and peaceful use of nuclear technologies. The IAEA develops Safety Requirements and Safety Guides for protecting people and the environment from harmful effects of ionizing radiation. These requirements and guides provide a system of Safety Standards Categories that reflect an international perspective on what constitutes a high level of safety. In developing or updating RGs, the NRC considers IAEA Safety Requirements, Safety Guides, and other relevant reports to benefit from the international perspectives, pursuant to the Commissions International Policy Statement and Management Directive and Handbook 6.6, Regulatory Guides (Ref. 22).

The following international standards provide similar design and preoperational testing guidelines:

RG-1.9, Rev. 5, Page 9 International Organization for Standardization (ISO)-21789, Gas Turbine Applications Safety, dated April 30, 2009 (Ref. 23), contains additional technical information and criteria useful for requirements for gas turbine applications.

IAEA Specific Safety Guide No. SSG-34, Design of Electrical Power Systems for Nuclear Power Plants, issued August 2016 (Ref. 24)., supersedes IAEA Safety Standard NS-G-1.8, Design of Emergency Power Systems for Nuclear Power Plants, issued 2004 (Ref. 25). The current version of Safety Guide No. SSG-34 considers developments in the design of emergency power systems for nuclear power plants and expands the scope to include all electric power systems that provide power to systems important to safety.

Even though these international standards are consistent with the basic safety principles considered in developing this RG, this revision of RG 1.9 does not endorse any of these ISO or IAEA standards.

Documents Discussed in Staff Regulatory Guidance This RG endorses, in part, the use of one or more codes or standards developed by external organizations, and other third-party guidance documents. These codes, standards and third-party guidance documents may contain references to other codes, standards or third-party guidance documents (secondary references). If a secondary reference has itself been incorporated by reference into NRC regulations as a requirement, then licensees and applicants must comply with that standard as set forth in the regulation. If the secondary reference has been endorsed in an RG as an acceptable approach for meeting an NRC requirement, then the standard constitutes a method acceptable to the NRC staff for meeting that regulatory requirement as described in the specific RG. If the secondary reference has neither been incorporated by reference into NRC regulations nor endorsed in an RG, then the secondary reference is neither a legally binding requirement nor a generic NRC-approved acceptable approach for meeting an NRC requirement. However, licensees and applicants may consider and use the information in the secondary reference, if appropriately justified, consistent with current regulatory practices, and consistent with applicable NRC requirements.

RG-1.9, Rev. 5, Page 10 C. STAFF REGULATORY GUIDANCE When they are implemented with supplements and clarifications, the NRC finds that IEEE Std 387-2017 and IEEE Std 2420-2019 provide acceptable design qualifications and periodic testing to comply with the NRC regulations for EDGs, CTGs, and other emergency AC standby power sources. The NRC staff endorses IEEE Std 387-2017 and IEEE Std 2420-2019, subject to the regulatory positions listed below.

C-1.

1st Staff Regulatory Guidance Position -Design and Testing Considerations for Onsite Emergency Alternating Current Power Sources Other than Emergency Diesel Generators and Combustion Turbine Generators For onsite emergency AC power sources other than EDGs and CTGs, the following considerations should be addressed to meet the regulations cited in Part A of this RG:

1.1 Safety classification. For the onsite emergency AC power system, describe or list components and assemblies necessary to enable the onsite emergency power source to meet its capabilities in accordance with the regulations (i.e., the safety-related function). These components and assemblies should consider aging as a potential cause of common-mode failures. In addition, describe or list components and assemblies necessary to enable the onsite emergency power system to perform a nonsafety-related function. For each nonsafety-related component or assembly, it should be verified (via test or analysis) that the component or assembly will not degrade the safety-related function.

1.2 Safety function. Specify the safety function and address startup, normal operation, safe-shutdown, accident, and post-accident operation.

1.3 Capacity, including but not limited to sizing. Using the load profile, demonstrate that the onsite emergency power source is able to provide power to loads important to safety with margin.

1.4 Capability, including but not limited to controls and protection. Demonstrate the capability to start and load under all design ambient conditions in combination with the full range of starting temperatures. Discuss operability and functional performance. Address failure modes and effects.

Discuss any interfaces and impacts to the onsite emergency AC power system. Address automatic and manual control systems for the onsite emergency AC power system, and discuss emergency controls and trips, as necessary. Discuss control power and starting capabilities. Address fuel storage and supply requirements, if applicable. Discuss instrumentation of the variables necessary for successful operation and to generate the abnormal, pre-trip, and trip signals required for alarm. Address electromagnetic and radiofrequency interference, grounding, and lightning protection provisions. Discuss any auxiliary systems, including but not limited to lubrication, ventilation, cooling, hydraulic, or pneumatic systems. If the onsite emergency AC power source has moving parts with high inertia, address the creation of internally generated missiles.

1.5 Physical and electrical independence. Additional information on the physical independence requirements of the circuits and electric equipment that comprise or are associated with safety systems appears in RG 1.75, which endorses IEEE Std 384-2018, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (Ref. 26). RG 1.6 discusses independence between redundant onsite AC power sources and their distribution systems. Discuss how independence will be demonstrated and, if shown by test, describe the test and specify the frequency of performing the test.

RG-1.9, Rev. 5, Page 11 1.6 Redundancy. Redundancy of safety-related components is necessary and should be such that a system safety function can be accomplished assuming a single failure. RG 1.81 addresses sharing of components, as required by GDC 5. Show that the onsite emergency electric power systems are designed to minimize undesirable interaction effects.

1.7 Availability including, but not limited to, automatic and manual capabilities. Discuss testing to demonstrate the continued capability.

1.8 Testability. Specify preventive maintenance, inspection, testing, and monitoring programs, including fixed-time or operating-time intervals. Specify the tests performed as part of site testing, preoperational testing, and periodic testing, as well as the frequency of the tests (e.g., monthly, semiannually, at refueling). RG 1.118 provides additional information on periodic testing. Address surveillance requirements and annunciation systems. Confirm that the onsite emergency power system has remote indication in the control room to display status of the system and local alarms. Discuss the means of communication between the onsite emergency AC power system testing locations and the main control room to confirm that the operators know the status under test. Discuss testing to demonstrate starting and operating under LOOP conditions, safety injection actuation signal, and combined safety injection actuation signal and LOOP.

1.9 Reliability. At minimum, demonstrate 95-percent reliability with 95-percent confidence (i.e., the minimum acceptable level for new designs to demonstrate reliable operation) of the onsite emergency power system. The NRC staff reviewed IEEE Std 352-2016, IEEE Guide for General Principles of Reliability Analysis of Nuclear Power Generating Station Systems and Other Nuclear Facilities (Ref. 27), and IEEE Std 577-2012, IEEE Standard Requirements for Reliability Analysis in the Design and Operation of Safety Systems for Nuclear Power Generating Stations (Ref. 28), and found that they contain additional technical information and criteria useful for quantitative and qualitative reliability analyses. In addition, the NRC staff reviewed IEEE Std 500-1984, IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations (Ref. 29), and found that this standard contains a method for collecting and presenting reliability data for use in reliability calculations. This revision of RG 1.9 does not endorse IEEE Std 352-2016, 577-2012, or 500-1984. When addressing the reliability of the onsite emergency AC power system, include the reliability of any support systems and fail-to-start or fail-to-run data, and use operational data.

1.10 Qualification. Provide a qualification test plan and qualification test report to demonstrate qualification of the onsite emergency power system. RG 1.89 and RG 1.100 provide additional information. RG 1.164 contains additional information for the commercial-grade dedication process.

1.11 Quality assurance program. Discuss the quality assurance program elements with sufficient detail to demonstrate compliance with 10 CFR Part 50, Appendix B, in accordance with the guidance in RG 1.28. RG 1.28 provides one method for meeting the requirements of 10 CFR Part 50, Appendix B, during the design and construction of SSCs that perform safety functions.

1.12 Station blackout. Address the redundancy and reliability of the onsite emergency AC power sources as part of the specified station blackout duration. In addition, if there is an alternate AC source, describe the diversity from the onsite emergency AC power sources. RG 1.155 provides additional information.

RG-1.9, Rev. 5, Page 12 1.13 Fire protection, including but not limited to fire prevention, detection, and suppression. Address methods to minimize both the probability of occurrence and the consequences of fire and explosion originating from the emergency AC power sources. RG 1.189 provides additional information.

C-2.

2nd Staff Regulatory Guidance Position - Design and Testing Considerations for Emergency Diesel Generators The following regulatory positions supplement the guidelines of IEEE Std 387-2017, as related to design and testing considerations:

2.1 EDGs should be designed so that they can be tested as described in IEEE Std 387-2017, Sections 5, 6, and 7. The design should allow testing of the EDGs to envelop the parameters of operation (e.g., manual start, automatic start, load sequencing, load shedding, and operation time),

normal standby conditions, and environments (e.g., temperature, humidity) that would be expected if an actual demand were placed on the system. If prelubrication or prewarming systems (or both) designed to maintain lube oil and jacket water at certain temperatures are normally in operation, this would constitute normal standby conditions for the given plant.

2.2 IEEE Std 387-2017, Clause 4.2.2, Operations, pertains to operating restrictions under different loading conditions. The following statement should supplement the guidance in this clause:

Cumulative operating time above the nominal rating of the EDG should be monitored for manufacturer and/or industry consensus group recommendations for accelerated maintenance requirements as appropriate 2.3 IEEE Std 387-2017, Clause 4.4, Table 1, Design and Application Considerations, Item 47, on design considerations for testability and synchronizing capability should be supplemented with the following statements:

a. Operation of the EDG in parallel with the preferred power source (test mode) and consequences of transient or degraded conditions in the preferred source should be considered for loading impact on the EDG.

b. Operation of the EDG in parallel with the preferred power source (test mode) and capability to respond to a concurrent accident, LOOP, or combined accident and LOOP signal should be considered during this condition.

2.4 IEEE Std 387 2017, Clause 4.5.1.7, Fuel Oil Storage and Supply Systems, should be supplemented with the following statement: The fuel oil storage and supply systems necessary to support the operation and function of the EDG system specific design and component features are included in American National Standards Institute/American Nuclear Society (ANSI/ANS) 59.51, Fuel Oil Systems for Emergency Diesel Generators (Ref. 30), with clarification provided in RG 1.137, Revision 2.

2.5 The NRC staff reviewed IEEE Std 387-2017, Clause 6.5.1, Prevention, Maintenance, Inspection, Testing, and Monitoring, and ANSI/ANS 59.52 1998, Lubricating Oil Systems for Safety Related Emergency Diesel Generators (Ref. 31), and found that the standard provides the additional information and criteria for lubricating oil syst ems for EDGs used in safety related applications. However, this revision of RG 1.9 does not endorse ANSI/ANS 59.52.

RG-1.9, Rev. 5, Page 13 2.6 IEEE Std 387 2017, Clause 7.2.1.6, Subsystem Test, should be supplemented with the following statement: The EDG site testing (IEEE Std 387-2017, Table 3) should include verification of all subsystems, such as fuel oil, lube oil, cooling and starting air tanks, and piping systems credited for operation of the EDG. If redundant trains of systems (e.g., starting air, fuel oil transfer) are used for each EDG, then test each system separately.

2.7 The maximum design basis loads should be within the continuous rating (as defined in IEEE Std 387 2017, Section 3, Definitions and Section 4.1.2.d, "Design Load) of the EDG with margin.

2.8 Design provisions should include the capability to test each EDG independently. Test equipment should not cause a loss of independence between redundant diesel generators or between EDG load groups. Testability should be considered when selecting and locating instrumentation sensors and critical components (e.g., governor, starting system components). Instrumentation sensors should be readily accessible and designed so that their inspection and calibration can be verified in place.

2.9 IEEE Std 387 2017, Clause 4.5.1.7, Fuel Oil Storage and Supply Systems, should be clarified with the following statement: The fuel stability should be considered for fuel storage. This is especially of concern when ultra-low sulfur diesel fuel or biodiesel blends are used. RG 1.137 provides additional information.

C-3.

3rd Staff Regulatory Guidance Position - Design and Testing Considerations for Combustion Turbine Generators:

The following regulatory positions supplement the guidelines of IEEE Std 2420-2019, as related to design and testing considerations:

3.1 The maximum design-basis loads should be within the continuous rating of the CTG with margin.

3.2 IEEE Std 2420-2019, Clause 3, should be supplemented with the following definitions pertaining to CTG reliability. Each CTG valid failure that results in declaration of the CTG being inoperable should count as one demand and one failure. Exploratory tests during corrective or preventive maintenance should not count as demands or failures. However, the successful test performed to declare the CTG operable following maintenance should count as a demand.

a.

Load-run demands: To be valid, the load/run attempt should follow a successful start and meet one of the following criteria (see the exceptions below):

(1) a load run of any duration that results from a real (i.e., not a test) automatic or manual signal, (2) a load-run test to satisfy the plants load and duration test specifications, and (3) other operations (e.g., special tests) in which the CTG is planned to run loaded for at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with at least 50-percent continuous rating.

b.

Load-run failures: A load-run failure should be counted when the CTG starts but does not pick up the load and run successfully. Any failure during a valid load-run demand should count (see the exceptions below). (For monthly surveillance tests, the CTG can be loaded at the rate recommended by the manufacturer to minimize stress and wear.) Any condition identified during maintenance inspections (with the CTG in the standby mode)

RG-1.9, Rev. 5, Page 14 that would have resulted in a load-run failure if a demand had occurred should count as a valid load-run demand and failure.

c.

Start demands: All valid and inadvertent start demands, including all start-only demands and all start demands that are followed by load/run demands, whether by automatic or manual initiation, are start demands. In a start-only demand, the CTG is started, but no attempt is made to load the CTG (see the exceptions below).

d.

Start failures: Any failure within the CTG system that prevents the generator from achieving a specified frequency (or speed) and voltage within the specified time allowance is classified as a valid start failure (see exceptions below). (For monthly surveillance tests, the CTG can be brought to rated speed and voltage in the time recommended by the manufacturer to minimize stress and wear.) Any condition identified during maintenance inspections (with the CTG in the standby mode) that would have resulted in a start failure if a demand had occurred should count as a valid start demand and failure.

e.

Exceptions: Unsuccessful attempts to start or load/run should not count as valid demands or failures when they can definitely be attributed to any of the following:

(1) any operation of a trip that would be bypassed in accident, LOOP, or combined accident and LOOP operation mode (e.g., high lubricant temperature trip),

(2) any trip that would have not met the coincident requirements during accident, LOOP, or combined accident and LOOP operation mode and determined to be due to a faulty sensor, (3) malfunction of equipment not required to operate during the accident, LOOP, or combined accident and LOOP operation mode (e.g., synchronizing circuitry),

(4) termination of the test because of alarmed or observed abnormal conditions (e.g., small fluid leaks) that would not have ultimately resulted in significant damage or failure of the CTG, (5) component malfunctions or operating errors that did not prevent the CTG from being restarted and brought to load within 5 minutes (i.e., without corrective maintenance or significant problem diagnosis), or (6) a failure to start because a portion of the starting system was disabled for test purposes, if followed by a successful start with the starting system in its normal alignment.

3.3 CTG systems may include evaporative inlet air coolers and water injection. These subsystems may add to the maximum load that can be supported. However, these subsystems also add complexity to the system and may require special maintenance to ensure continued operation. If these subsystems are provided and design-load calculations consider any additional power available due to the operation of these subsystems, then the performance and long-term reliability of these subsystems should be adequately demonstrated.

3.4 The high rotational speeds of CTGs may result in the creation of missiles upon failure of the rotational parts. Thus, all nearby safety-related equipment should be protected from the potential of missiles generated from the CTG rotor, including the protection of other nearby CTG systems.

RG-1.9, Rev. 5, Page 15 However, protection of subsystems associated with the same CTG unit that incurs the failure is not necessary, since failure of the rotor will make further use of these subsystems irrelevant (as long as these subsystems are not shared).

3.5 Because of the potential for explosion of residual fuel or fuel vapor remaining in the CTG, the exhaust system should be purged before startup or during shutdown. The starting and shutdown sequence systems should include an automatic gas purge process of the turbine to prevent damage to the turbine and downstream components by explosion on startup. The purge volume should be at least three volume changes of the gas turbine and downstream exhaust system equipment.

ISO-21789, Section 5.12.4, provides additional information.

3.6 The pressure loss associated with the air intakes may be significant. For this reason, the CTG design should consider the local environment and the possibility of condensation of moisture from the ambient humidity. The design should also consider humid air and condensed moisture generated by wet cooling towers or other onsite equipment. During cold periods, ice may form on the inlet structures and impede the air flow. When there is a potential for low ambient temperatures, the design should address the potential for ice accumulation on inlet air structures and include appropriate mitigating measures.

3.7 Inlet air filter design should consider preventing excessive increase in pressure loss due to particle deposition on the inlet air filter. When increase of pressure loss is not acceptable for CTG performance, the inlet air filter should be removed, replaced, or cleaned without power reduction of the CTG.

3.8 IEEE Std 2420-2019, Clause 4.4, Table 1, Design and Application Considerations, Item 46, on design considerations for testability and synchronizing capability, should be supplemented with the following:

a.

Operation of the CTG in parallel with the preferred power source (test mode) and consequences of transient or degraded conditions in the preferred source should be considered for loading impact on the CTG.

b.

Operation of the CTG in parallel with the preferred power source (test mode) and capability to respond to a concurrent accident, LOOP, or combined accident and LOOP signal should be considered during this condition.

3.9 In addition to IEEE Std 2420-2019, Clause 6.2.2, a sufficient number of valid start and load tests shall be performed to demonstrate a minimum reliability of 95 percent. RG 1.155 provides additional information.

3.10 IEEE Std 2420-2019, Clause 7.2.1.6, Subsystem Test, should be supplemented with the following statement: The CTG site testing (IEEE Std 2420-2019, Table 3) should include verification of all subsystems such as fuel oil, lube oil, cooling, starting, and piping systems credited for operation of the CTG. If redundant trains of systems (e.g., fuel oil transfer) are used for each CTG, then each system should be tested separately.

3.11 In addition to IEEE Std 2420-2019, Section C.3, the following items indicate the need for an overhaul and should be monitored when appropriate for a CTG based on the manufacturers recommendations:

RG-1.9, Rev. 5, Page 16

a.

decreasing runout time after shutdown, and

b.

deposits or deterioration of turbine blades or vanes (as inferred from ideal model results).

3.12 Design provisions should include the capability to test each CTG independently. Test equipment should not cause a loss of independence between redundant CTGs or between CTG groups.

Consider testability when selecting and locating instrumentation sensors and critical components (e.g., governor, starting system components). Instrumentation sensors should be readily accessible and designed to allow in-place verification of their inspection and calibration.

3.13 The fuel stability should be considered for fuel storage. This is especially of concern when ultra-low-sulfur diesel fuel or biodiesel blends are used. RG 1.137 provides additional information.

3.14 CTG maintenance activities performed during qualification should be documented in the qualification test report and added to the Technical Specification Surveillance Requirements (TSSR) to specify maintenance activity frequency. For example, fuel-nozzle cleaning maintenance performed before conducting the start and load acceptance tests during qualification should be documented in the qualification report to demonstrate successful qualification. In this example, a TSSR was added to document and address the testing frequency of once per 50 starts required for the fuel-nozzle cleaning maintenance activity.

RG-1.9, Rev. 5, Page 17 D. IMPLEMENTATON The NRC staff may use this regulatory guide as a reference in its regulatory processes, such as licensing, inspection, or enforcement. However, the NRC staff does not intend to use the guidance in this regulatory guide to support NRC staff actions in a manner that would constitute backfitting as that term is defined in 10 CFR 50.109, Backfitting, and as described in NRC Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests (Ref. 32), nor does the NRC staff intend to use the guidance to affect the issue finality of an approval under 10 CFR Part 52. The staff also does not intend to use the guidance to support NRC staff actions in a manner that constitutes forward fitting as that term is defined and described in Management Directive 8.4.

If a licensee believes that the NRC is using this regulatory guide in a manner inconsistent with the discussion in this Implementation section, then the licensee may file a backfitting or forward fitting appeal with the NRC in accordance with the process in Management Directive 8.4.

2.

Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at 301-415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.

Copies of Institute of Electrical and Electronics Engineers (IEEE) documents may be purchased from the Institute of Electrical and Electronics Engineers Service Center, 445 Hoes Lane, P.O. Box 1331, Piscataway, NJ 08855, or through the IEEEs public Web site at http://www.ieee.org/publications_standards/index.html.

Copies of International Atomic Energy Agency (IAEA) documents may be obtained through their Web site:

WWW.IAEA.Org/ or by writing the International Atomic Energy Agency, P.O. Box 100 Wagramer Strasse 5, A 400 Vienna, Austria. Telephone (+431) 2600-0; fax (+431) 2600-7; or e-mail Official.Mail@IAEA.Org.

Copies may be obtained from the American Society of Mechanical Engineers, Two Park Avenue, New York, NY 10016-5990; telephone (800) 843-2763. Purchase information is available through the ASME Web-based store http://www.asme.org/Codes/Publications RG-1.9, Rev. 5, Page 18 REFERENCES2

1.

U.S. Code of Federal Regulations (CFR), Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.

2.

CFR, Licenses, Certifications, and Approvals for Nuclear Power Plants, Part 52, Chapter I, Title 10, Energy.

3.

Institute of Electrical and Electronics Engineers, IEEE Standard 603-1991, IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations, Piscataway, NJ.

4.

IEEE Standard 279-1971, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations, Piscataway, NJ.

5.

U.S. Nuclear Regulatory Commission (NRC), Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems, Regulatory Guide (RG) 1.6, Washington, DC.

6.

NRC, Ultimate Heat Sink for Nuclear Power Plants, RG 1.27,Washington, DC.

7.

NRC, Quality Assurance Program Criteria (Design and Construction), RG 1.28, Washington, DC.

8.

NRC, Criteria for Power Systems for Nuclear Power Plants, RG 1.32, Washington, DC.

9.

NRC, Criteria for Independence of Electrical Safety Systems, RG 1.75, Washington, DC.

10.

NRC, Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants, RG 1.81, Washington, DC.

11.

NRC, Environmental Qualification of Certain Electric Equipment Important to Safety for Nuclear Power Plants, RG 1.89, Washington, DC.

12.

NRC, Seismic Qualification of Electrical and Active Mechanical Equipment and Functional Qualification of Active Mechanical Equipment for Nuclear Power Plants, RG 1.100, Washington, DC.

13.

NRC, Periodic Testing of Electric Power and Protection Systems, RG 1.118, Washington, DC.

RG-1.9, Rev. 5, Page 19

14.

NRC, Fuel Oil Systems for Emergency Power Supplies, RG 1.137, Washington, DC.

15.

NRC, Station Blackout, RG 1.155, Washington, D.C.

16.

NRC, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, RG 1.160, Washington, DC.

17.

NRC, Dedication of Commercial-Grade Items for Use in Nuclear Power Plants, RG 1.164, Washington, DC.

18.

NRC, Fire Protection for Nuclear Power Plants, RG 1.189, Washington, DC.

19.

NRC, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, NUREG-0800, Washington, DC.

20.

IEEE Standard 387-2017, IEEE Standard for Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations, Piscataway, NJ.

21.

IEEE Standard 2420-2019, IEEE Standard for Combustion Turbine-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations, Piscataway, NJ.

22.

NRC, Management Directive 6.6, Regulatory Guides, Washington, DC.

23.

International Organization for Standardization, ISO-21789, Gas Turbine ApplicationsSafety, Geneva, Switzerland, April 30, 2009.

24.

International Atomic Energy Agency (IAEA), Design of Electrical Power Systems for Nuclear Power Plants, Specific Safety Guide (SSG) No. SSG-34, Vienna, Austria, August 2004.

25.

IAEA, Design of Emergency Power Systems for Nuclear Power Plants, Safety Standard NS-G-1.8, Vienna, Austria, August 2004.

26.

IEEE Standard 384-2018, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits, Piscataway, NJ.

27.

IEEE Standard 352-2016, IEEE Guide for General Principles of Reliability Analysis of Nuclear Power Generating Station Systems and Other Nuclear Facilities, Piscataway, NJ.

28.

IEEE Standard 577-2012, IEEE Standard Requirements for Reliability Analysis in the Design and Operation of Safety Systems for Nuclear-Power Generating Stations, Piscataway, NJ.

29.

IEEE Std 500-1984, IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear Power Generating Stations, Piscataway, NJ.

30.

American National Standards Institute/American Nuclear Society (ANSI/ANS) 59.51, Fuel Oil Systems for Emergency Diesel Generators, La Grange Park, IL.

RG-1.9, Rev. 5, Page 20

31.

ANSI/ANS 59.52, Lubricating Oil Systems for Safety Related Emergency Diesel Generators, La Grange Park, IL.

32.

NRC, Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests, Washington, DC.