ML17332B013

Proposed Tech Specs Modifying Surveillance Testing of EDG During Refueling & Normal Operations

ML17332B013
Person / Time
Site:	Cook
Issue date:	11/10/1995
From:	INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG
To:
Shared Package
ML17332B012	List: ML17332B011 ML17332B013
References
NUDOCS 9511160295
Download: ML17332B013 (55)

Text

ELECTRICAL POWER SYSTEMS SURVEILLANCE RE UIREHENTS Continued 4.8.1.1.2 Each diesel generator shall be demonstrated OPERABLE-In accordance with the frequency specified in Table 4.8"1 on a STAGGEREO TEST BASIS by: 1.2.3.5.from standtry condidons and acldeves In less than or equal to 10 seconds.vottage~at60na20 V, and frequency i60n l.2 Hz.Verifying the fuel level in the day tank, Verifying the fuel level in the fuel storage tank, Verifying that the fuel transfer pump can be started and that it transfers fuel from the storage system to the day tank, Verifying that the diesel starts b.C.nd 6.'"Verifying that the diesel generator is.aligned to provide standby power to the associated emergency busses.Bgremoving accumulated water"+1)From the day tank at least once per 31.:days and after each occasion when the diesel is operated for greatei'han 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, and 2)From the storage tanks at least once per 31 days.By sampling new fuel oil"<in accordance with the applicable guidelines of ASTM 04057-81 prior to adding new fuel to the storage tanks and Verlfylng the rgeset ls synchroAlted and loaded and cnerates for greater than or~qual to 60 minutes at a load ol 3500 Inv, 1)By verifying, in accordance with the tests specified in ASTH 0975-81 and prior to adding the new fuel to the storage tanks, that the sample has: The diesel generator start 10 seconds from conditions sha be performed at least once per 184 days in these surveillance tests.All other engine starts for the purpose of this surveillance testing and compensatory action may be at reduced acceleration r ates as recommended by the manufacturer so that mechanical stress and wear on the diesel engine are minimized.

kk Momcntny load transients do not invalidate this test.+""The actions to be taken should any'of the properties be found outside of speci f i ed limits are'defined in the Bases.O.C.COOK" UNIT 1 3/4 8-3 AMENOMENT NO.'si5111'60295 951110 ,'PDR ADOCK, 05000515 P-.,"PDR..~484NUI~Jl"l II e'1%i h r'I~46 l~C4,r, H M:~alllall s la te~

'~I R l W t~t l'+IP phag~T/5 N ILK uP st o powsr fsolof of toss thon or~rtosl to O.BB for st tssst B factors.+S Co e ued c)Verifying that all aueomaeic diesel.generaeor trips, except engine overspeed and generator differential, are automaeically bypassed upon loss of voleage on the emergency bus and/or Safety Injecei.on accuaeion signal.7.Verifying that the diesel generaeor operates During this test the diesel generacor shall be loaded to 3500 kw.Within 5 minutes after compleeing this~~hour test, perform Surveillance Requiremene 4.8.1.1.2.a.4 (at existing conditions)

.*+8.Determine that the aueo-connected loads.to each diesel generator do not exceed 3500 kw.9.Verifying the diesel generaeor's capability eo: a)Synchronize with the offsiee power source while ehe generaeor is loaded with its emergency loads upon a simulated restoration of offsiee power.I b)Transfer its loads eo the offsite power source, and c)Be reseored eo its seandby seaeus.10.Verifying thae with the diesel generaeor operaeing in a tese mode awhile connected to its test load, a simulated Safety Injection signal overrides the test mode by: a)Returning the dieseL generaeor eo seandby operaeion, and b)Verifying the emergency loads are serviced by offsite power.11.Verifying thae the automatic sequence timing relays are OPERABLE with each load sequence time wiehin plus or minus 5%of ies required value and'thae each load is sequenced on within the design allowable time Limit.Ae lease once per 10 years by: 1)Employing one of the following cleaning methods eo clean the fuel oil storage tanks: a)Drain each fueL oil seorage eank, remove.the accumulaeed sedimene, and clean the eank, or*+If Surveillance Requirement 4.8.L.1.2.a.4 is aoe saeisfaceorily compleeed, ie is noe necessary eo repeat the preceditqp'Zdo-hour test.Instead, the diesel generaeor may be operaead ae 3500 kw for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or uncil operating temperature has seabilized.

Momsntay trsnslsnts otrtstdo tfto food snc'ower fstsor rsntfo do not frwsMsto tnfs ttst.COOK NUCLEAR PLANT-UNIT 1 3/4 8-6 AMENDMEHT NO.424 P.ly 1I C ELECTRICAL POWER SYSTEMS SURVEILLAHCE RE UIREMEHTS Continued pftesqfrf 1/s rnftfticvp 4.8.1.1.2 Each diesel generator shall be demonstrated OPERABLE: In accordance with the frequency specified in Table 4.8-1 on a STAGGEREO TEST BASIS by: l.2.3.Verifying the fuel level in the day tank, Verifying the fuel level in the fuel storage Verifying that the fuel transfer pump can be it transfers fue1 from the storage system to Verifying that the diesel starts tank, started and that the day tank, From standby conrstfons and~Vivos In less than or corral to 10 seconds, volteqeidt60aa20 V.snd frequency~60*1.2 Ht.b.and 6.:"-Verifying that the diesel generator is aligned to provide standby power to the associated emergency busses.Bf removing accumulated water"W~~1)From the day tank at least once per 33,-days and after each occasion when the diesel is operated for greatir than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, and Verffyfntf the dfesef fs synclvonrted and loaded and operates for tfreater then or~qrraf to 60 mfnrrtes at a load of 3500 fnv, C.2)From the storage tanks at least once per 31 days.By sampling new fuel oil~+in accordance with the applicable guidelines of ASTM 04057-81 prior to adding new fuel to the storage tanks and 1)By verifying, in accordance with the tests.specified in ASTH 0975-81 and prior to adding the new fuel to the storage tanks, that the sample has: " he diesel generator start 10 seconds rom conditions sha e performed at least once per 184 days in these surveillance tests.All other engine starts for the purpose of this surveillance testing and compensatory action may be at reduced acceleration rates as recommended by the manufacturer so that mechanical stress and wear on the diesel engine are minimized.

Morncntaty load transients do not invalidate dtis test""The actions to be taken should any of the properties be found outside of specified limits arel defined in the Bases.0.C.COOK-UNIT 2 3/4 8-3 AHEHOHEHT HO.

E f 1,~, l~tv<A o t ued 7.c)Verifying that all automatic diesel generator trips, except engine overspeed and generator differential, are automatically bypassed upon loss of voltage on the emergency bus and/or Safety In]ection actuation signal.et~power footer~qoet to 0.88 lor Verifying that the diesel generator operates~et reset 8 horrre.$During this test the diesel generator shall be loaded to 3500 kv.Within 5 minutes after completing this~-hour test, perform Surveillance Requirement 4.8.1.1.2.a.4 (at existing conditions).*f-8.Determine that the auto-connected loads'to each diesel generator do not exceed 3500 kv.9.Verifying the diesel generator's capability to: a)Synchronize with the offsite power source vhile the generator is loaded vith its emergency loads upon a simulated restoration of offsite power.bf Transfer its loads to the offsite power source, and c)Be restored to its standby status.10.Verifying that vith the diesel generator operating in a test mode while connected to its test load, a simulated Safety Injection signal overrides the test mode by: a)Retuz~ig the diesel generator to standby operation, and b)Verifying the emergency loads'ara serviced by offsite pover.11.Verifying that the automatic sequence timing relays are OPERABLE with each load sequence time within plus or minus 5%of its required value and that each load is sequenced on within the design allovable time limit.r At least once per 10 years by: 1)Employing one of the following cleaning methods to clean the fuel oil storage tanks: a)Drain each fuel oil storage tank, remove the accumulated sediment, and cLean the tank, or*+If Surveillance Requirement 4.8.1.1.2.a.4 is not satisfactorily completed, it is not necessary to repeat the preceding+-hour test.Instead, the diesel generator may be operated at 3500 kv for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or until operating temperature has stabilized.

power rector range oo not lrrregdete thle teel.COOK NUCLZM PLANT-UNIT 2 3/4 8-6 AMENDMEHT NO.4XQ+66-ATTACHMENT 3 TO AEP:NRC:0896K PROPOSED REVISED TECHNICAL SPECIFICATION PAGES

, 0 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREiiTS 3/4.8 ELECTRICAL POWER SYSTEMS SURVEILLANCE RE UIREMENTS Continued 4.8.1.1.2 Each diesel generator shall be demonstrated OPERABLE: a0 In accordance with the frequency specified in Table 4.8-1 on a STAGGERED TEST BASIS by: 1.Verifying the fuel level in the day tank, 2.Verifying the fuel level in the fuel storage tank, 3.Verifying the fuel transfer pump can be started and that it transfers fuel from the storage system to the day tank, Verifying the diesel starts from standby conditions and achieves in less than or equal to 10 seconds, voltage=4160~420 V, and frequency=60+1.2 Hz, Verifying the diesel is synchronized and loaded and operates for greater than or equal to 60 minutes at a load of 3500 kw", and 6.Verifying the diesel generator is aligned to provide standby power to the associated emergency busses.By removing accumulated water 1)From the day tank at least once per 31 days and after each occasion when the diesel is operated for greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, and 2)From the storage tanks at least once per 31 days.By sampling new fuel oil" in accordance with the applicable guidelines of ASTM D4057-81 prior to adding new fuel to the storage tanks and 1)By verifying, in accordance with the tests specified in ASTM D975-81 and prior to adding the new fuel to the storage tanks, that the sample has: The diesel generator start (10 seconds)from standby conditions shall be performed at least once per 184 days in these surveillance tests.All other engine starts for the purpose of this surveillance testing and compensatory action may be at reduced acceleration rates as recommended by the manufacturer so that mechanical stress and wear on the diesel engine are minimized.

Momentary load transients do not invalidate this test.The actions to Ue taken should any of the properties be found outside of specified limits are defined in the Bases.COOK NUCLEAR PLANT-UNIT 1 Page 3/4 8-3 AMEXDiWIENT

~

il~I'il 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.8 ELECTRICAL POWER SYSTEMS SURVEILLANCE RE UIREMENTS Continued c)Verifying that all automatic diesel generator trips, except engine overspeed and generator differential, are automatically bypassed upon loss of voltage on the emergency bus and/or Safety Injection actuation signal.Verifying that the diesel generator operates at a power factor of less than or equal to 0.86 for at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.During this test the diesel generator shall be loaded to 3500 kw.Within 5 minutes after completing this 8-hour test, perform Surveillance Requirement 4.8.1.1.2.a.4 (at existing conditions)." Determine that the auto-connected loads to each diesel generator do not exceed 3500 kw.9.Verifying the diesel generator's capability to: a)Synchronize with the offsite power source while the generator is loaded with its emergency loads upon a simulated restoration of offsite power.b)Transfer its loads to the offsite power source, and c)Be restored to its standby status.10.Verifying that with the diesel generator operating in a test mode while connected , to its test load, a simulated Safety Injection signal overrides the test mode by: a)Returning the diesel generator to standby operation, and b)Verifying the emergency loads are serviced by offsite power.11.Verifying that the automatic sequence timing relays are OPERABLE with each load sequence time within plus or minus 5%of its required value and that each load is sequenced on within the design allowable time limit.At least once per 10 years by: Employing one of the following cleaning methods to clean the fuel oil storage tanks: a)Drain each fuel oil storage tank, remove the accumulated sediment, and clean the tank, or Momentary transients outside the load and power factor range do not invalidate this test.If Surveillance Requirement 4.8.1.1.2.a.4 is not satisfactorily completed, it is not necessary to repeat the preceding 8-hour test.Instead, the diesel generator may be operated at 3500 kw for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or until operating temperature has stabilized.

COOK iNUCLEAR PLAiVI'-UNIT 1 Page 3/4 84 Ail'IENDiWENT 42$, 49, pi E g tj 0 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.8 ELECTRICAL POWER SYSTEMS SURVEILLANCE RE UIREMENTS Continued 4.8.1.1.2 Each diesel generator shall be demonstrated OPERABLE: In accordance with the frequency specified in Table 4.8-1 on a STAGGERED TEST BASIS by: 1.Verifying the fuel level in the day tank, 2.Verifying the fuel level in the fuel storage tank, 3.Verifying that the fuel transfer pump can be started and that it transfers fuel from the storage system to the day tank, 4.Verifying that the diesel starts from standby conditions and achieves in less than or equal to 10 seconds, voltage=4160~420 V, and frequency=60+1.2 Hz, Verifying the diesel is synchronized and loaded and operates for greater than or equal to 60 minutes at a load of 3500 kw, and Verifying that the diesel generator is aligned to provide standby power to the associated emergency busses.By removing accumulated water": 1)From the day tank at least once per 31 days and after each occasion when the diesel is operated for greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, and 2)From the storage tanks at least once per 31 days.By sampling new fuel oil" in accordance with the applicable guidelines of ASTM D4057-81 prior to adding new fuel to the storage tanks and 1)By verifying, in accordance with the tests specified in ASTM D975-81 and prior to adding the new fuel to the storage tanks, that the sample has: The diesel generator start (10 seconds)from standby conditions shall be performed at least once per 184 days in these surveillance tests.All other engine starts for the purpose of this surveillance testing and compensatory action may be at reduced acceleration rates as recommended by the manufacturer so that mechanical stress and wear on the diesel engine are minimized.

Momentary load transients do not invalidate this test.The actions to be taken should any of the properties be found outside of specified limits are defined in the Bases.COOK NUCLEAR PLAiVT-UNIT 2 Page 3/4 8-3 AMENDMENT 444, L)

~0 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.8'ELECTRICAL POPOVER SYSTEMS SURVEILLANCE RE UIREMENTS Continued c)Verifying that all automatic diesel generator trips, except engine overspeed and generator differential, are automatically bypassed upon loss of voltage on the emergency bus and/or Safety Injection actuation signal.Verifying that the diesel generator operates at a power factor of less than or equal to 0.86 for at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.During this test the diesel generator shall be loaded to 3500 kw.Within 5 minutes after completing this 8-hour test, perform Surveillance Requirement 4.8.1.1.2.e.4 (at existing conditions)." Determine that the auto-connected loads to each diesel generator do not exceed 3500 kw.Verifying the diesel generator's capability to: a)Synchronize with the offsite power source while the generator is loaded with its emergency loads upon a simulated restoration of offsite power.b)Transfer its loads to the offsite power source, and c)Be restored to its standby status.10.Verifying that with the diesel generator operating in a test mode while connected to its test load, a simulated Safety Injection signal overrides the test mode by:=a)Returning the diesel generator to standby operation, and b)Verifying the emergency loads are serviced by offsite power.11.Verifying that the automatic sequence timing relays are OPERABLE with each load sequence time within plus or minus 5%of its required value and that each load is sequenced on within the design allowable time limit.At least once per 10 years by: I)Employing one of the following cleaning methods to clean the fuel oil storage tanks: a)Drain each fuel oil storage tank, remove the accumulated sediment, and clean the tank, or Momentary transients outside the load and power factor range do not invalidate this test.If Surveillance Requirement 4.8.1.1.2.a 4 is not satisfactorily completed, it is not necessary to repeat the preceding 8-hour test.Instead, the diesel generator may be operated at 3500 kw for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or until operating temperature has stabilized.

COOK NUCLEAR PLANT-UNIT 2 Page 3/4 8-6 AMENDMENT~, 468, ATTACHMENT 4 TO AEP:NRC:0896X COOK NUCLEAR PLANT EMERGENCY DIESEL GENERATOR LOAD-RUN PERFORMANCE AND RELIABILITY DURING SHORT AND LONG DURATION TEST PERIODS r

Attachment 4 page I ABSTRACT The following study compares Cook Nuclear Plant emergency diesel generator performance during relatively short test runs to performance during significantly longer test durations.

A,statistical treatment of data over a twenty year period is used to develop an estimate of cumulative failure probability with respect to test run time.In addition, a review of previous emergency diesel generator performance studies is used to provide an industry wide comparison of load-run failure probabilities.

The study concludes that an endurance test duration of eight hours in lieu of the current twenty four hours would be acceptable for the emergency diesel generators at Cook Nuclear Plant.American Electric Power Attachment 4 page 2 TABLE OF CONTENTS Section 1.0 Introduction 2.0 Cook Nuclear Plant Diesel Generators

2.1 Specifications

Ec Major Components

2.2 Operations

Overview 3.0 Review of Cook Nuclear Plant Test Data 3.1 Valid Load-Run Criteria 3.2 Invalid Load-Run Criteria 3.3 Long Duration Load-Run Data 3.4 Short Duration Load-Run Data 3.5 Failure Characteristics 3.6 Data Analysis 4.0 Review of Selected Studies 4.1 BNL Technical Report¹A-3134 1-85 4.2 N SAC-108 4.3 NUREG/CR-5994 15 5.0 Industry Surveys 6.0 Conclusions

7.0 References

17 17 18 American Electric Fower

'l I t>k r Attachment

4.1.0 Introduction

page 3 This report focuses on emergency diesel generator (EDG)load-run performance at Cook Nuclear Plant.The report considers both long duration load-runs (greater 60 minutes)and short duration load-runs (60 minutes or less).The report does not consider EDG starting reliability.

This report has four primary objectives:

1)Review the load-run performance of emergency diesel generators (EDGs)at Cook Nuclear Plant with emphasis on the long duration test runs.2)Review existing studies, evaluations, and data to determine a measure of EDG load-run performance on an industry wide basis.3)Sample EDG 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> endurance test run performance at other nuclear power plants to provide comparison data.4)Construct a meaningful translation of this data in conjunction with existing studies, evaluations, and other data to determine a qualitative benchmark for evaluating the acceptability of reducing the 18 month EDG endurance test duration lrom the current 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> requirement for Cook Nuclear Plant.American Electric Popover pt Attachment 4 page 4 2.0 Cook Nuclear Plant Diesel Generators The data in sections 2.1 and 2.2 summarize important EDG specifications and operating requirements.

Both units at Cook Nuclear Plant are Westinghouse, 4-loop, pressurized water reactors.Unit 1 is rated 3250MWt and Unit 2 is rated 3411MWt.Four EDGs, two per unit.Each diesel engine is a Worthington Type SWB-12, 12 cylinder, heavy duty turbocharged diesel engine, with a continuous rated output of 4900BHP at 514RPM.Each generator is a General Electric, 4375KVA, 3500KW at 0.8 P.F., 514RPM, 3-phase, 60-cycle, 4160V, 25%voltage regulation, direct engine-driven synchronous type generator.

Each generator is equipped with a GE brushless exciter type SAR with a field rated 5.8A and 100VDC and, a static voltage regulator with its associated potential and sensing transformers.

The EDG system for each unit consists of two redundant, Class 1E, identical diesel generators which are individually capable of supplying sufficient power to operate one complete redundant train of engineered safety features (ESF)and protection systems required for safe shutdown of the unit.The EDGs are designed to start automatically upon receipt of a safety injection signal ancVor a loss of offsite power signal and be ready to accept loads within 10 seconds of receiving a start signal.During normal plant operation, the EDGs are on standby and are automatically available if ofBite power is lost.American Electric Popover I J CU N p'h E p)

Attachment 4 page 5 3.0 Review of Cook Nuclear Plant Test Data This section considers load-run test data from 1974 to 1994.The objectives of this section include examination of load-run data specifically associated with 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> surveillance tests.Accordingly, the study could have focused strictly on 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> surveillance test runs.However, it was felt that doing so could eliminate, or mask, insightful observations about the"quality" of EDG performance during other extended full load-runs and the characteristic behavior of load-run failures.In addition, the limited data available fiom the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> surveillance tests was not statistically significant.

Even by including all long duration (greater than 60 minutes)full load-runs, the database was still limited to 128 total tests.Therefore, data Rom short duration (60 minutes or less)load-runs is provided below for comparison and to facilitate analysis of the long duration full load-runs.

In evaluating EDG test data, the boundary and support systems of the EDG system were considered to include the diesel engine, the generator, the exciter and voltage regulator system, the control and protection system, the EDG lubricating oil system, EDG fuel oil system, EDG jacket water system, EDG starting air system, EDG intake air system, EDG exhaust gas system, and the control circuitry up to the immediate control power source.The criteria in Sections 3.1 and 3.2 were used to evaluate the validity of EDG test runs.The following criteria were based on references 5, 10, and 11.A load-run was counted as a valid demand, success, or failure if it satisfied either one of the following criteria: a.Termination'of the load-run prior to mission completion, due to abnormal conditions that would ultimately have resulted in the failure of the EDG, was counted as a valid demand and failure.b.Termination after completion of the intended mission was counted as a valid demand and success.America Electric Pointer Attachment 4 page 6 The following criteria were based on references 5, 10, and 11.A load-run was not counted as a valid demand, success, or failure when the load-run was prematurely terminated for any of the following reasons: a.A spurious operation of a trip that is bypassed in the emergency operating mode.b.A malfunction of equipment that is not operative in the emergency operating mode.c.An operating error that would not have prevented the EDG Gom being restarted and loaded within a few minutes and without corrective repairs.d.Observable abnormal conditions that would not have prevented the EDG from completing its mission during an actual emergency demand.33 rain-Rn a This section examined EDG load-run data which met the following criterion:

The EDG was successfully started with an intention to operate at full load for a duration greater than 60 minutes.The above criterion was used.to eliminate data from the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> monthly runs, which are performed at half load (1750KW), and to capture full (3500KW)load-run missions of significant duration (greater than 60 minutes).Also, the criterion distinguishes between EDG load-run data and EDG starting data by defining the load-run phase to begin only after a successful start.For comparison and analysis purposes, the data f'rom short duration (60 minutes or less)load-runs are provided separately in Section 3.4 below.Using the above criterion, a population of 128 load-runs was examined.From this population, 2 load-runs were deleted because they were actual demands which operated the EDG at less than full load.Also, 3 additional load-runs were deleted because the EDG was not operated at full load continuously during the surveillance duration.American Electric Popover Sic Attachment 4 page 7 Examination of the remaining data showed that 16 full load-run missions were prematurely aborted.This data required engineering evaluation based on the criteria presented in sections 3.1 and 3.2.In general, premature termination was associated with minor fuel oil leaks, personnel error, or spurious operation or malfunction of equipment that would not be operative during an emergency condition.

Out of the 16 premature terminations, zero terminations were determined to be valid load-run failures.The remaining 107 load-runs provided approximately 2,010 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of load-run data for an average run time duration of approximately 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br />.3.4 Short Duration Load-Run Data This section examined EDG load-run data which met the following criterion:

The EDG was successfully started with an intention to operate for a duration of'not more than 60 minutes.As part of the Individual Plant Examination (IPE), data collection and analysis were completed for EDGs over the period January 1983 through December 1992.The test data primarily examined monthly surveillance runs and other short duration tests which involve loading the diesel to at least 1750 KW.The study reviewed a total of 929 demands and found 12 start failures and 3 load-run failures.Per the above criterion, the 12 start failures were subtracted Rom the 929 demands to yield 917 valid load-run demands.Also, based on review of the data and the cumulative run time hours, it was determined that some of the 917 demands included runs over 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (some of the demands were actually 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> full load-runs).

In Section 3.3 above, the long duration full load-run missions were examined.Therefore, to prevent double counting and to condition these demands to a one hour average duration, 44 successful demands were deleted Gom the 917 remaining demands.Thus, 873 demands provided a total of 873 hours0.0101 days <br />0.243 hours <br />0.00144 weeks <br />3.321765e-4 months <br /> of operation.'he 3 load-run failures occurred within the first 30 minutes of operation during routine testing.American Electric Power

~I N, p P Attachment 4 page 8 35'Ir a eri i Prior to analyzing the above data, it is important to review the underlying characteristics of EDG failures.In general, EDG failures may occur as a result of the following:

a)End of nor7rral life of a conrponent or piece of eqrripment.

In general, preventative maintenance programs will reduce the number of age-related component failures.However, there is some statistical uncertainty associated with EDG component lifetimes.

This uncertainty creates the possibility of age-related failures.Thus, EDG components are subject to failure after a, requisite number of cumulative service hours, regardless of the length of the surveillance run during which the failure occurs.Therefore, to properly interpret the observation of a component failure during any given surveillance, it is important to carefully study the nature of the failure to determine if the component failure was precipitated by the actual surveillance duration or, rather, by the normal expected lifetime of a component (Appendix B of reference 12, provides useful information on age-related failure mechanisms).

If the failure distribution of a particular component is known, then the time of failure can be predicted.

Therefore, it can be concluded that excessive testing increases the probability of such failures and that the surveillance test duration should be minimized to reduce the risk of failure during an actual demand.b)Rcmdonr nralfirrrctr'on of components, desigrr arromalies, or incor7ect nraintenarrce.

These problems may surface over any time interval.In particular, it is intuitively obvious that the effects of small deviations 6'om maintenance procedures may be more difficult to identify and may require a longer time to appear.This suggests that, to identify all possible problems of this nature, the surveillance test duration should be maximized.

Note that items (a)and (b)present competing requirements.

Accordingly, the objective of EDG surveillance testing should be to expose as many of the type"b" failures as possible without accelerating the type"a" failures.If, however, the test time exceeds an optimal duration, T, then the number of type"a" failures being introduced could theoretically increase beyond the exposure rate of type"b" failures.Ideally, the surveillance test duration would be selected to minimize type"a" American Electric Popover E~~A g t Attachment 4 page 9 failures.In this case, it can be shown that a good approximation of the optimal test duration, T, can be determined by using an exponential probability density function for the EDG failure prob'ability.

The form of this function is shown below and is further developed in Section 3.6.where t=time and, A.and u are constants.

It is also worth noting that it is reasonable to expect that, for a machine that is designed for extended operation at fully loaded conditions, a majority of the primary failure modes would occur before the engine reaches thermal equilibrium (usually within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).Engine equilibrium temperature is defined as the time at which the jacket water and lube oil temperatures are both within+10'F of their normal operating temperatures established by the engine manufacturer (reference 11).The expectancy of a higher.'ailure probability during the first two hours of operation is consistent with Cook Nuclear Plant actual performance data, as indicated in Sections 3.3 and 3.4.3~6D A d In consideration of the failure characteristics discussed in Section 3.5, the following basic questions were addressed in this study: a)Hotv does fhefarlure probability Chrling short durafion runs conrpare wilh long duration runs?b)Over tvhat fest duration tvould the mnjority of FDG load-san failures be expected?To answer the above'questions, it is necessary to develop a technical approach for evaluating EDG unreliability as a function of surveillance test time.'herefore, the purpose of this section is to use actual performance data to establish a..statistical model that conservatively characterizes EDG failure probabilities over time.American Electric Poimr s 4 4 Attachment 4 page 10 Table 1: Data San>mary Short Duration Load-Run Data 1983-1993 Total Demands 873 Total Failures Average Duration Hours Total Hours 873 L'ong Duration Load-Run Data 1974-1994 Total Demands 107*cppQxUM1c vllllc Total Failures Average Duration Hours 19'otal Hours 2,010 V The above data can be reasonably characterized as a set of Bernoulli trials.That is, each valid test (or trial)can either be a success or failure, each success has a constant probability p, and each test is independent of the previous test.It is recognized that some of the tests may not be independent and identical, however, in many cases the assumptions of a series of Bernoulli trials will provide a good approximation..

Therefore, the binomial distribution is a reasonable selection for evaluating this type of data.Binomial Distribution Z=(n!/[(n-x)!*x!])*p"*(I-p)'

where Z equals the probability that out of n trials x failures will be observed given the failure probability, p.Also, it can be proven that the most probable value of p is p=x/n For example, for the short duration runs, p~=3/873=0.0034 and Z~=0.2244 American Electric Poiver Attachment 4 page 11 However, for the long duration runs with xt, W, a different approach must be taken to calculate p (i.e., the result pt,W is not statistically meaningful to answer the above questions).

By utilizing the binomial distribution function and the above data, a range for the parameter, p, can be determined for the long duration load-runs.

For any given value of n, it can be shown that the inequality, Z(x=0)>Z(x=1)is a bounding case and results in pp~and, therefore, 0.0034<pt<0.0093 For conservatism, assume pt&.0093, then the ratio pt gp~=2 74 To answer question"a" above, this result means that the failure probability associated with the long duration load-runs is 2.74 times greater than the failure probability for short duration load-runs.

Table Z:$0mmary of Fnilare Probabilities Short Ouration Load-Run Oata Probabilities 1983-1993¹Trials n 873 Failures X Failure Probability short 0.0034 Failure Rate/Hour 0.0034 Zshort 0.2244 Long Ouration Load-Run Probabilities 1974-1994¹Trials n Failures X Failure Probability pLong Failure Rate (/Hour)ZLong 107a'calculated value.0.0093 0.0005'.3680 American Electric Popover 8 lL i 4 Attachment 4 page 12 As discussed in Section 3.5, the optimal test duration would produce failures predominately due to type"b" occurrences.(random), as opposed to type"a" (component wear).As such, selecting an optimal test duration would mean that non-failure in previous test periods would not significantly change the failure probability in the future periods and also that the failure rate would be approximately constant over time.To determine the optimal test duration, the integral of the probability density function, introduced in Section 3.5, can be used to model the probability of EDG failures that could be observed over a time period;(O,t}.EDG Failure Probability Function, P(t)P(t)=(afA,)[l-e']

where c and A, are constants.

The constant A, is dependent on the failure probability of the short and long duration load-runs which were defined as short duration runs 5 60 minutes<long duration nms From Tables1and2above, at t=1hour, P=0.0034andat t=19 hours, P=0.0093.These values can be substituted into the above expression to first calculate X and then ct.The resulting values are shown below.0,=0.004294 X,=0.4637 Figure 1, below, shows a plot of P(t)using the above values of a and A, over a time period, t, from zero to twenty-four hours.American Electric Popover

\1 k$

Attachment 4-page 13 EDG Failure Probability 0.0095 0.0090 0.0085 0.0080 0.0075 0.0070 0.0065 0.0060 0.0055 P(t)0.0045 0.0040 0.0035 0.0030 0.0025 0.0020 0.0015 0.0010 0.0005 0.0000 0 2 4 6 8 10 12 14 16 18 20 22 24 TIME (hours)Figure l: Plot of I'(t)Figure 1 shows that after approximately ten hours theEDG failure probability would, increase at a very slow rate (i.e., dP(t)/dt=0).To better understand this result and to answer question"b" above, a plot ofP(t)normalized by P(M4 hrs)is shown below.Atnerican Electric Power 4 h~J~l I l 4 Attachment 4 page 14 k 1.0000 0.9500 0.9000 0.8500 0.8000 0.7500 0.7000 0.6500 0.6000 0.5500 P(t)IP(24) 05000 OA500 0.4000 0.3500 0.3000 0.2500 0.2000 0.1500 0.1000 0.0500 0.0000 0 Cumulative Failure Probability 2 4 6 8 10 12 14 16 18 20 22 24 TIME(hovrs)

Fignre 2: EDG Casnllati ve Failure I'robability From figure 2, it can be seen that approximately 98%of the failures occur within the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> while only 60%occur within the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of operation.

This may be an overly conservative estimation fiom the standpoint that, at Cook Nuclear Plant, all of the actual observed failures occurred within the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of operation.

American Electric Popover 4~1 r~1'Wp'I I P 4 y'l~rt W Attachment 4 page 15 4.0 Review of Selected Studies The purpose of this section is to provide a measure of EDG load-run performance on an industry wide basis.The studies reviewed below were selected because they provided discernible EDG performance data during the load-run phase of operation.(reference 7)In 1985, Brookhaven National Laboratory completed a study to examine EDG performance at Nuclear Power Plants in the United States during a four year period, from 1980 through 1983.The report did not distinguish between start and load-run failures but, rather, calculated overall failure rates normalized by total EDG years of operation.

Data was compiled from LER files, 10CFR50.55(e) reports, Nuclear Plant Reliability Data System, and Electric Power Research Institute document files.The study included 158 EDGs, produced by 12 different manufacturers (including Worthington), for a total of 588 EDG years.The reported total composite number of failures was 396 which corresponds to a failure rate of approximately 0.7 failures per EDG year.The report also studied the failure modes of different EDG manufacturers, with the exception of Trans-America Delaval.Also, the study provided a qualitative presentation of predominant failure modes based on the number of reported failures.Review of the report indicates that the five most dominant failure modes included instrumentation and controls systems, lubricating oil systems, speed and load control, cooling water systems, and starting systems.In 1986, EPRI completed a comprehensive study of EDG success/failure experience at Nuclear Power Plants in the United States during a three year period from 1983 through 1985.The study reviewed start and load-run reliability.

The criteria used to evaluate load-run data was similar to that used in Section 3.0 above.The load-run database included both plannel and unplanned (actual)demands that involved EDG operation at greater than 50%of plant essential safety function load rating for one hour or longer.For the period under study, a database of 13,808 load-runs was assembled.

The study reported 138 load-run failures which corresponded to an EDG unreliability of 0.0100 failures per demand.American Electric Poiver C

Attachment 4 page 16/R-5 4 (reference 4)In 1994, NUREG/CR-5994 presented recent operating experience to assess EDG unavailability due to testing, maintenance, and failures during reactor power operation and during plant shutdown.Section 3 of the report provided EDG industry-wide performance data over four years, 1988 through 1991, and used the empirical Hayes.method to analyze EDG Mure data.The data covers 195 EDGs at 63 plant sites and includes both actual and test load-run data.For plant sites, the mean load-run failure probability was 9.5E-03 failures per demand with a variance of 2.9E-05.Tnble 3: EDG Industry->vide Fnilare Probability History 1980-1983 (reference 7)number of Failures 396'umber of EDGs 158 number of EDG ears 588 failures per EDG ear 0.7 1983-1985 (reference 5)number of Failures 138 number of EDGs 154 number of load-runs 13,808 failures per demand 0.01 1988-1991 (reference 4)number of Failures 182 number of EDGs 195 number of load-runs 19,520 failures per demand 0.0095'Includes both start 4 loadie failures.American Electric Potver Attachment 4 page 17 5.0 Indust Surve s In an effort to provide more recent EDG performance data, a limited informal industry survey was conducted to specifically determine the approximate number of failures occurring before 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and the number of failures occurring after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> during the 18 month 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> surveillance test.Review of the data indicated that the industiy-wide EDG failure rates during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> surveillance tend to support the previous studies discussed in Section 4.0 (i.e,.failures/load-run demand<0.01).6.0 Conclusions Examination of the full load run data on the EDGs at Cook Nuclear Plant revealed that 3 valid load-run Mures occurred during short duration runs (t~60 minutes)and zero failures occurred during long duration runs (t>60 minutes).A conservative, statistically based, mathematical model was developed to determine the reliability of the EDG during the load-run phase of testing as a function of time.The model predicated that 60%of the valid load-run failures would occur within the first two hours of.operation, 95%in the first 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, and 98%in the first eight hours.Also, the more recent industry surveys, including the informal random surveys discussed in Section 5.0, are very consistent with the results found at Cook Nuclear Plant (i.e., failures/load-run demand<0.01).As explained in Section 3.5, the objective of the endurance test should be to expose as many of the random type failures as possible and to minimize EDG component wear.Thus, the optimal surveillance test duration, T, should be selected to provide reasonable assurance that the majority of incipient random failures are exposed without adversely impacting EDG availability, for an actual emergency demand.Also, consistent with actual performance data and engineering judgment, the period of liighest stress would occur during startup and before equilibrium conditions are established (0 5 T<2 hours).Therefore, based on actual performance data and related industry-wide surveys, an endurance test duration of T=8 hours is recommended to provide the necessary insight about EDG reliability.

Test durations greater than eight hours would not provide a significant operating safety benefit and would only serve to increase cumulative run time and the likelihood of age-related component failures.American Electric Posver

~~i Qt Attachment 4 7.0 References page 18 1)"A Reliability Program for Emergency Diesel Generators at Nuclear Power Plants-Program Structure," NUREG/CR-5078, SAND87-7176, Vol.1, April 1988.2)"A Reliability Program for Emergency Diesel Generators at Nuclear Power Plants-Maintenance, Surveillance, and Condition Monitoring," NUREG/CR-5078, SAND87-7176, Vol.2, December 1988.3)"Improvements to Technical Specification Surveillance Requirements," NUIREG-1366, December 1992.4)"Emergency Diesel Generator:

Maintenance and Failure Unavailability, and Their Risk Impacts," NUREG/CR-5994, BNL-NUREG-52363, November 1994.5)"The Reliability of Emergency Diesel Generators at U.S.Nuclear Power Plants," NSAC-108, September 1986.6)"A Simulation Study: Emergency Diesel Generator Availability," EPRI NP-1759, Interim.Report, March 1981.7)"A Review of Emergency Diesel Generator Performance at Nuclear Power Plants," Brookhaven National Laboratory, Technical Report A-3134 1-85, January 1985.8)"Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," NU1VIARC 87-00, Rev.1, August 1991.9)"Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at.Nuclear Power Plants," Regulatory Guide 1.108, Revision 1, August 1977.10)"Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants," Regulatory Guide 1.9, Revision 3, July 1993.11)"IEEE Standard Periodic Testing of Diesel-Generator Units Applied as Standby Power Supplies in Nuclear Power Generating Stations," IEEE Std 749-1983.12)"IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies in Nuclear Power Generating Stations," IEEE Std 387-1984.American Electric Power 1~l ll'la i Attachment 4 page 19 13)."IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations,".IEEE Std 500-1984 14)"Resolution of Generic Safety Issue B-56, Diesel Generator Reliability," SECY-93-044,~02/22f93.American Electric Pointer Pp h ATTACHMENT 5 TO AEP:NRC:0896X DONALD C.COOK NUCLEAR PLANT COST BENEFICIAL LICENSING ACTION EDG SURVEILLANCE TESTING TECHNICAL SPECIFICATION CHANGES I 4 E r f ,'%jg Attachment 5 to AEP:NRC:0896K Page 1 Regulatory Requirement:

Technical Specification T/S 4.8.1.1.2.e.7 requires scheduling of EDG 18 month surveillance during shutdown (refueling outages)and performing a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> endurance test run.Effect of Requirement:

The present 18 month 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> EDG endurance test does not provide a safety benefit commensurate with its cost.In addition, performing the required testing causes critical path complications and delays during the outage.Rationale for Regulatory Change: The rationale for the proposed changes is that the intent of regulatory surveillance requirement to demonstrate the ability of the EDG to operate for an extended period of time under fully loaded conditions will be preserved by maintaining an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> endurance test run.At the same time, these changes will better utilize plant resources and prevent critical path complications during the outages.Unnecessary diesel generator stress and wear will also be reduced.Additionally, the reduction from 24 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> will increase diesel availability and, thereby, reduce shutdown risk.Approximate Cost of Requirement:

The cost savings associated with reducing the 18 month 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> EDG surveillance test duration is provided below.The cost savings was calculated using an estimate of labor and materials required for performing the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> endurance run (on two diesels per unit)and multiplying this estimate by the proposed reduction in surveillance duration.Unit 1: remaining cycles 13 Unit 2: remaining cycles 15 2*13*16, 000*16/24$277, 333 2*15*16,000*16/24

$320,000 Total plant lifetime savings is approximately

$600,000.P

~e 4