ML070380553

of Regulatory Guide 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants (Formerly Draft Regulatory Guide DG-1172)

ML070380553
Person / Time
Issue date:	03/15/2007
From:	Aggarwal S K NRC/RES/DFERR/DDERA/IEEB
To:
Aggarwal S K (301)415-6005
Shared Package
ML070380143	List: ML070380553
References
DG-1172 RG-1.009, Rev 04
Download: ML070380553 (15)

Text

The U.S. Nuclear Regulatory Commission (NRC) issues regulatory guides to describe and make available to the public methods that the NRC staffconsiders acceptable for use in implementing specific parts of the agency's regulations, techniques that the staff uses in evaluating specific problemsor postulated accidents, and data that the staff need in reviewing applications for permits and licenses. Regulatory guides are not substitutesfor regulations, and compliance with them is not required. Methods and solutions that differ from those set forth in regulatory guides will be deemedacceptable if they provide a basis for the findings required for the issuance or continuance of a permit or license by the Comm ission.This guide was issued after consideration of comments received from the public. The NRC staff encourages and welcomes comments and suggestionsin connection with improvements to published regulatory guides, as well as items for inclusion in regulatory guides that are currently being developed. The NRC staff will revise existing guides, as appropriate, to accommodate comments and to reflect new information or experience. Written commentsmay be submitted to the Rules and Directives Branch, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.Regulatory guides are issued in 10 broad divisions: 1, Power Reactors; 2, Research and Test Reactors; 3, Fuels and Materials Facilities;4, Environmental and Siting; 5, Materials and Plant Protection; 6, Products; 7, Transportation; 8, Occupational Health; 9, Antitrust and Financial Review;and 10, General.Requests for single copies of draft or active regulatory guides (which may be reproduced) should be made to the U.S. Nuclear Regulatory Commission,Washington, DC 20555, Attention: Reproduction and Distribution Services Section, or by fax to (301) 415-2289; or by email to Distribution@nrc.gov. Electronic copies of this guide and other recently issued guides are available thr ough the NRC's public Web site under the Regulatory Guides documentcollection of the NRC's El ectronic Reading Room at http://www.nrc.gov/reading-rm/doc-collections/

and through the NRC's Agencywide DocumentsAccess and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. ML070380553.U.S. NUCLEAR REGULATORY COMMISSIONMarch 2007Revision 4 REGULATORY GUIDEOFFICE OF NUCLEAR REGULATORY RESEARCHREGULATORY GUIDE 1.9(Draft was issued as DG-1172, dated November 2006)APPLICATION AND TESTINGOF SAFETY-RELATED DIESEL GENERATORSIN NUCLEAR POWER PLANTS A. INTRODUCTIONGeneral Design Criterion 17, "Electric Power Systems," of Appendix A, "General Design Criteria for Nuclear Power Plants," to Title 10, Part 50, of the Code of Federal Regulations (10 CFR Part 50),"Domestic Licensing of Production and Utilization Facilities" (Ref. 1), requires that onsite electric power systems have sufficient independence, capacity, capability, redundancy, and testability to ensure that

(1) specified acceptable nuclear fuel design limits and design conditions of the reactor coolant pressure

boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled

and containment integrity and other vital functions are maintained in the event of postulated accidents, assuming a single failure.General Design Criterion 18, "Inspection and Testing of Electric Power Systems," of Appendix A to 10 CFR Part 50 requires that electric power systems important to safety be designed to permit

appropriate periodic inspection and testing to assess the continuity of the systems and the condition

of their components.

Criterion III, "Design Control," and Criterion XI, "Test Control," of Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," to 10 CFR Part 50 require

that (1) measures be provided for verifying or checking the adequacy of design through design reviews, the use of alternative or simplified calculational methods, or the performance of a suitable testing program and (2) a test program be established to ensure that systems and components perform satisfactorily

and that the test program include operational tests during nuclear power plant operation.

Rev. 4 of RG 1.9, Page 2 10 CFR 50.63, "Loss of All Alternating Current Power," requires that each light-water-cooled nuclear power plant must be able to withstand and recover from a station blackout [i.e., loss of offsite

and onsite emergency alternating current (ac) power systems] for a specified duration. The reliability

of onsite ac power sources is one of the main factors contributing to the risk of core melt as a result

of a station blackout.

Most onsite electric power systems use diesel generators as the chosen onsite emergency powersource. This regulatory guide provides guidance that the staff of the U.S. Nuclear Regulatory Commission (NRC) considers acceptable to comply with the Commission's regulations for safety-related diesel

generators intended for use as onsite emergency power sources in nuclear power plants - specifically, that the emergency diesel generators be selected with sufficient capacity, be qualified, and have

the necessary reliability and availability for design-basis events.

This regulatory guide relates to information collections that are covered by the requirements of 10 CFR Part 50 and 10 CFR Part 21, "Reporting of Defects and Noncompliance" (Ref. 2),

which the Office of Management and Budget (OMB) approved under OMB control number 3150-0011

and 3150-0035, respectively. The NRC may neither conduct nor sponsor, and a person is not required

to respond to, an information collection request or requirement unless the requesting document displays

a currently valid OMB control number.

B. DISCUSSION An emergency diesel generator selected for use in an onsite electric power system should have the capability to (1) start and accelerate a number of large motor loads in rapid succession, while

maintaining voltage and frequency within acceptable limits, (2) provide power promptly to engineered safety features if a loss of offsite power (LOOP) and a design-basis event occur during the same time period, and (3) supply power continuously to the equipment needed to maintain the plant in a safe condition

if an extended (e.g., 30-day period should be considered with refueling every 7 days) LOOP occurs.The Institute of Electrical and Electronics Engineers (IEEE) Standard 387, "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations" (IEEE Std 387-1995), issued in 1995 (Ref. 3), delineates principal design criteria and qualification

and testing guidelines to ensure that selected diesel generators meet performance requirements.

Working Group SC 4.2 of Subcommittee 4 (Auxiliary Power) of the IEEE Nuclear Power Engineering

Committee developed IEEE Std 387-1995, and the IEEE Standards Board approved the standard

on December 12, 1995.

A knowledge of the characteristics of each load is essential to establish the bases for selection of an emergency diesel generator that is able to accept large loads in rapid succession. The majority

of these emergency loads are large induction motors. At full voltage, this type of motor draws a starting

current of five to eight times its rated full-load current. These sudden large increases in current drawn

from the diesel generator as a result of the startup of induction motors can result in substantial voltage reductions. This lower voltage could prevent a motor from starting (i.e., accelerating its load to rated speedin the required time), or could cause a running motor to coast down or stall. Other voltage-sensitive loads might also be lost because of low voltage or if their associated contactors drop out. Recovery from

the transient caused by starting large motors, or from the loss of a large load, could cause diesel engine overspeed that, if excessive, might result in a trip of the engine (i.e., loss of the safety-related power source). These same consequences can also result from the cumulative effect of a sequence of more moderate transients if the system is not permitted to recover sufficiently between successive steps in a loading sequence.

Rev. 4 of RG 1.9, Page 3 General industry practice is to specify a voltage reduction of 10-15 percent when starting large motors from large-capacity power systems, and a maximum voltage reduction of 25-30 percent when starting these motors from limited-capacity power sources such as diesel generators. Voltage reduction during load sequencing should be evaluated in light of the plant-specific equipment to prevent

load interruption. Large induction motors can achieve rated speed in less than 5 seconds when powered

from adequately sized emergency diesel generators that are capable of restoring the bus voltage

to 90 percent of nominal in about 1-2 second(s).

Protection of the emergency diesel generator from excessive overspeed, which can result from an improperly adjusted control system or governor failure, is provided by the immediate operation

of a diesel generator trip, which is usually set at 115 percent of nominal speed. Similarly, to prevent

substantial damage to the generator, the generator differential current trip must operate immediately upon occurrence of an internal fault. Other protective trips can also safeguard the emergency diesel generators from possible damage. However, these trips could interfere with successful functioning of the diesel

generators when they are most needed (i.e., during design-basis events).

In addition, experience has shown that on numerous occasions, these protective trips have needlessly shut down emergency diesel generators because of spurious operation of a trip circuit.

Consequently, it is important to take measures to ensure that spurious actuation of these other protective

trips does not prevent the emergency diesel generators from performing their safety function during

the emergency mode of operation.

The uncertainties inherent in safety load estimates at an early stage of design or prior to the combined license stage are sometimes of such magnitude that it is prudent to provide a reasonable margin in selecting the load capabilities of the emergency diesel generators. This margin can be provided by estimating the loads conservatively and selecting the continuous rating of the emergency diesel

generators that exceeds the sum of the loads needed at any one time. A more accurate estimate of safety loads is possible during the operating license or combined license stages of review because detailed designs should have been completed and component test and preoperational test data are usually available.

However, the design-basis event loads during the operating license or combined license stages should bewithin the continuous rating of the emergency diesel generators with sufficient margin (i.e., not less than 5 percent).

The reliability of emergency diesel generators can be one of the main factors affecting the risk of core damage from a station blackout event. Thus, both attaining and maintaining the high reliability

of emergency diesel generators at nuclear power plants contribute greatly to reducing the probability of station blackout. Regulatory Guide 1.155, "Station Blackout" (Ref. 4), calls for the use of the reliability of the diesel generator as one of the factors in determining the length of time a plant should be able

to cope with a station blackout. If all other factors (i.e., redundancy of emergency diesel generators, frequency of LOOP, and probable time needed to restore offsite power) remain constant, a higher

reliability of the diesel generators will result in a lower probability of a station blackout, with a corresponding decrease in coping duration for certain plants.The design of the emergency diesel generators should also incorporate high operational reliability,and this high reliability should be maintained throughout their lifetime by initiating a reliability program that is designed to monitor, improve, and maintain reliability. Increased operational reliability can be

achieved through appropriate testing and maintenance, as well as an effective root cause analysis of all

emergency diesel generator failures.

Rev. 4 of RG 1.9, Page 4 This guide provides explicit guidance in the areas of preoperational testing, periodic testing, reporting and recordkeeping requirements, and valid demands and failures. The preoperational

and periodic testing provisions set forth in this guide provide a basis for taking the corrective actions

needed to maintain high inservice reliability of installed emergency diesel generators. The database

developed will assist ongoing performance monitoring for all emergency diesel generators

after installation and during service.Clause 2 of IEEE Std 387-1995 references several industry codes and standards. If a referencedstandard has been separately incorporated into the NRC's regulations, licensees and applicants must comply with that standard as set forth in the regulations. Similarly, if the NRC staff has endorsed a referenced

standard in a regulatory guide, that standard constitutes an acceptable method of meeting a regulatory

requirement as described in the given regulatory guide. Conversely, if a referenced standard has been neither incorporated into the NRC's regulations nor endorsed in a regulatory guide, licensees and applicantsmay consider and use the information in the referenced standard, if appropriately justified, consistent with regulatory practice.

Rev. 4 of RG 1.9, Page 5 C. REGULATORY POSITIONConformance with the guidelines in IEEE Std 387-1995 (Ref. 3) constitutes an acceptable methodfor satisfying the Commission's regulations with respect to the desig n, qualification, and periodic testing of diesel generators used as onsite electric power systems for nuclear power plants, subject to

the following exceptions.1.Design Considerations The following regulatory positions supplement the guidelines of IEEE Std 387-1995, as they relate to design considerations:1.1Clause 1.1.1, "Inclusions," of IEEE Std 387-1995 should be supplemented to include diesel generator auto controls, manual controls, and diesel generator output breaker.1.2When the characteristics of the required emergency diesel generator loads are not accurately known, such as during an early stage of design, each emergency diesel generator selected for an onsite

power supply system should have a continuous load rating (as defined in Section 3.2 of IEEE Std 387-1995) equal to the sum of the conservatively estimated connected loads (nameplate rating) that the diesel generator would power at any one time, plus a 10- to 15-percent margin.

In the absence of fully substantiated performance characteristics for mechanical equipment such as pumps, the electric motor drive ratings should be calculated using conservative estimatesof these characteristics (e.g., pump runout conditions and motor efficiencies of 90 percent or less, and power factors of 85 percent or less).1.3During the operating license or combined license stages of review, the maximum design-basis loads should be within the continuous rating (as defined in Section 3.2 of IEEE Std 387-1995)

of the diesel generator with sufficient margin (i.e., not less than 5 percent).1.4Clause 4.1.2 of IEEE Std 387-1995 pertains, in part, to the starting and load-accepting capabilities of the diesel generator. In conformance with Clause 4.1.2, each diesel generator should be

capable of starting and accelerating to rated speed, in the required sequence, all the needed

engineered safety features and emergency shutdown loads. The diesel generator should be

designed such that the frequency will not decrease, at any time during the loading sequence, to less than 95 percent of nominal and the voltage will not decrease to less than 75 percent

of nominal. (A larger decrease in voltage and frequency may be justified for a diesel generator

that carries only one large connected load.) Frequency should be restored to within 2 percent

of nominal in less than 60 percent of each load-sequence interval for a stepload increase, and less than 80 percent of each load-sequence interval for disconnection of the single largest load.

Voltage should be restored to within 10 percent of nominal within 60 percent of each

load-sequence interval. The acceptance value of the frequency and voltage should be based on

plant-specific analysis (where conservative values of voltage and frequency are measured)

to prevent load interruption. (A greater percentage of the load-sequence interval may be used

if it can be justified by analysis. However, the load-sequence interval should include sufficient

margin for the accuracy and repeatability of the load-sequence timer.) During recovery from

transients caused by disconnection of the largest single load, the speed of the diesel generator

should not exceed the nominal speed plus 75 percent of the difference between nominal speed

and the overspeed trip set point, or 115 percent of nominal (whichever is lower). Furthermore, the transient following a complete loss of load should not cause the diesel generator speed

to reach the overspeed trip set point.

Rev. 4 of RG 1.9, Page 61.5Emergency diesel generators should be designed so that they can be tested as described in Regulatory Position 2. The design should allow testing of the diesel generators to simulate

the parameters of operation (e.g., manual start, automatic start, load sequencing, load shedding, operation time), normal standby conditions, and environments (e.g., temperature, humidity)

that would be expected if actual demand were placed on the system. If prelubrication systems

or prewarming systems designed to maintain lube oil and jacket water cooling at certain temperatures (or both) are normally in operation, this would constitute normal standby conditions for the given plant.1.6Design provisions should include the capability to test each emergency diesel generator independently of the redundant units. Test equipment should not cause a loss of independence between redundant diesel generators or between diesel generator load groups. Testability should be considered in selecting and locating instrumentation sensors and critical components (e.g., governor, starting system components). Instrumentation sensors should be readily accessibleand designed so that their inspection and calibration can be verified in place. The overall design should include status indication and alarm features.1.7Clause 4.5.3.1 of IEEE Std 387-1995 pertains to status indication of diesel generator unit conditions. The following paragraphs should supplement the guidance in this clause:1.7.1A surveillance system should be provided with a remote indication in the control room to display emergency diesel generator status (i.e., under test, ready-standby, lockout).

A means of communication should also be provided between diesel generator testing

locations and the main control room to ensure that the operators know the status

of the diesel generator under test.1.7.2To facilitate the diagnosis of failure or malfunction, the surveillance system should indicate which of the emergency diesel generator protective trips has been activated first.1.8The following should supplement Clause 4.5.4 of IEEE Std 387-1995, which pertains to bypassing emergency diesel generator protective trips during emergency conditions:

The emergency diesel generator should be tripped automatically on engine overspeed and generator-differential overcurrent. A trip should be implemented with two or more

measurements for each trip parameter with coincident logic provisions for trip actuation.

The design of the coincident logic trip circuitry should include the capability to indicate individual sensor trips. The design of the bypass circuitry should include the capability to (1) test the status

and operability of the bypass circuits, (2) trigger alarms in the control room for abnormal values

of all bypass parameters (common trouble alarms may be used), and (3) manually reset the trip

bypass function. The capability to automatically reset the bypass function is not acceptable.

Clause 4.5.4(b) of IEEE Std 387-1995, which pertains to retaining all protective devices during emergency diesel generator testing, does not apply to periodic tests [safety injection

actuation system (SIAS), combined with SIAS and LOOP, and protective trip bypass]

that demonstrate diesel generator system response under simulated design-basis events.1.9Clause 4.5.2.2 of IEEE Std 387-1995 should be modified to read as follows:

Upon receipt of an emergency start-diesel signal, the automatic control system shall provide automatic startup and automatic adjustment of speed and voltage to a ready-to-load condition

in the emergency (isochronous) mode.

Rev. 4 of RG 1.9, Page 72.Diesel Generator Testing Clauses 3, 5, 6, and 7 of IEEE Std 387-1995 should be supplemented as discussed below.2.1Definitions Figure 1 illustrates those components and systems that should be considered to be withinthe emergency diesel generator boundary when evaluating failures. Systems that support the emergency diesel generator and perform other plant functions are depicted as being outside this boundary.

IEEE Std 387-1995 provides similar definitions of components and system boundaries and may also

be used as guidance; however, generator breakers should be considered as part of the diesel generator

boundary.The following definitions apply to the regulatory positions that address testing, recordkeeping, and reporting of emergency diesel generator performance:

Start demands

All valid and inadvertent start demands, including all start-only demands and all start demands that are followed by load-run demands, whether by automatic or manual initiation, are start

demands. In a start-only demand, the emergency diesel generator is started, but no attempt is made

to load the emergency diesel generator (see the exceptions below).

Start failures

Any failure within the emergency diesel generator system that prevents the generatorfrom achieving a specified frequency (or speed) and voltage within specified time allowance is classified as a valid start failure. (For monthly surveillance tests, the emergency diesel generator can be brought

to rated speed and voltage in the time recommended by the manufacturer to minimize stress and wear.)

Any condition identified during maintenance inspections (with the emergency diesel generator

in the standby mode) that would definitely have resulted in a start failure if a demand had occurred

should count as a valid start demand and failure.

Load-run demands

To be valid, the load-run attempt should follow a successful start and meet one of the following criteria (see the exceptions below):*a load-run of any duration that results from a real (i.e., not a test) automatic or manual signal

• a load-run test to satisfy the plant's load and duration test specifications

• other operations (e.g., special tests) in which the emergency diesel generator is planned to run for at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with at least 50 percent of design load Load-run failures

A load-run failure should be counted when the emergency diesel generator starts but does not pick up the load and run successfully. Any failure during a valid load-run demand should count (see the exceptions below). (For monthly surveillance tests, the emergency diesel generatorcan be loaded at the rate recommended by the manufacturer to minimize stress and wear.) Any condition identified during maintenance inspections (with the emergency diesel generator in the standby mode)

that definitely would have resulted in a load-run failure if a demand had occurred should count as

a valid load-run demand and failure.

Rev. 4 of RG 1.9, Page 8 Rev. 4 of RG 1.9, Page 9 Exceptions

Unsuccessful attempts to start or load-run should not count as valid demands or failures when they can definitely be attributed to any of the following:*any operation of a trip that would be bypassed in the emergency operation mode (e.g., high cooling-water temperature trip)*malfunction of equipment that is not required to operate during the emergency operating mode (e.g., synchronizing circuitry)*intentional termination of the test because of alarmed or observed abnormal conditions (e.g., small water or oil leaks) that would not have ultimately resulted in significant damage

or failure of the emergency generator*component malfunctions or operating errors that did not prevent the emergency diesel generatorfrom being restarted and brought to load within 5 minutes (i.e., without corrective maintenance or significant problem diagnosis)*a failure to start because a portion of the starting system was disabled for test purposes, if followed by a successful start with the starting system in its normal alignment Each diesel generator valid failure that results in declaration of the emergency diesel generator as being inoperable should count as one demand and one failure. Exploratory tests during corrective

or preventive maintenance should not count as demands or failures. However, the successful test

that is performed to declare the emergency diesel generator operable should count as a demand.2.2Test Descriptions The table on site testing from the standard is repeated in this guide as Table 1 to address supplementary guidance when required. The following test descriptions should be used in conjunction

with the preoperational and surveillance testing described in the table. The licensee should have

detailed procedures for each test described herein. The procedures should identify special arrangements

or changes in normal system configuration that must be made to put the emergency diesel generator

under test. Jumpers and other nonstandard configurations or arrangements should not be used

after initial equipment startup testing.

2.2.1 Starting

Test Clause 7.2.1.1 of IEEE Std 387-1995 should be supplemented as follows:

The acceptance criteria for frequency and voltage should be equal to or higher than the minimum required voltage and frequency within specified time allowance for the safety-related loads.2.2.2Slow-Start Test Clause 7.5.1 of IEEE Std 387-1995 should be supplemented as follows:

This test involves demonstrating proper startup from standby conditions, and verify thatthe required design voltage and frequency are attained. For this test, the emergency diesel generator can be slow-started and reach rated speed on a prescribed schedule to minimize stress and wear.

Rev. 4 of RG 1.9, Page 10 Table 1

Reference:

IEEE 387 Clause:TestsSite acceptance tests (7.2)*Pre-operational tests (7.3)*Availability tests (7.4.2.1)*(Surveillance)

System operation tests: shutdown/refueling (7.4.2.2)*

Independence tests 10 years (7.4.2.3)*Monthly6 Month7.2.1.1StartingXX7.2.1.2Load acceptance XX7.2.1.3Rated LoadXX7.2.1.4Load RejectionX 7.2.1.5ElectricalX 7.2.1.6SubsystemX 7.3.3ReliabilityX 7.5.1StartXX 7.5.2Load RunXX 7.5.3Fast StartXXX 7.5.4LOOPXX 7.5.5SIASX 7.5.6Combined SIAS and LOOP XX7.5.7Largest load rejection XX7.5.8Design load rejection XX7.5.9Endurance and load margin X a X7.5.10Hot restartXX7.5.11SynchronizingXX 7.5.12Protective trip bypass XX7.5.13Test mode override XX7.5.14IndependenceXX a Use 2 h and 22 h*IEEE Std 387-1995 Rev. 4 of RG 1.9, Page 11 2.2.3 Load Run (Load Acceptance) Test Clause 7.5.2 of IEEE Std 387-1995 should be supplemented as follows:This test involves demonstrating 90-100 percent of the continuous rating of the emergency diesel generator, for an interval of not less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and until attainment of temperature equilibrium.

This test may be accomplished by synchronizing the generator with offsite power. The loading and

unloading of an emergency diesel generator during this test should be gradual and based on

a prescribed schedule that is selected to minimize stress and wear on the diesel generator.

2.2.4 Rated

Load Test Clause 7.2.1.3 (a) of IEEE Std 387-1995 should be supplemented as follows:If the design-basis event loads are higher than the continuous rating of the emergency dieselgenerator, the test should be conducted at the worst case design-basis event loads.

2.2.5 LOOP Test Clause 7.5.4 of IEEE Std 387-1995 should be supplemented as follows:This test involves simulating a LOOP to demonstrate that (1) the emergency buses are deenergized and the loads are shed from the emergency buses, and (2) the emergency diesel generator starts

on the autostart signal from its standby conditions; attains the required voltage and frequency, and energizes permanently connected loads within acceptable limits and time; energizes all autoconnected shutdown loads through the load sequencer; and operates for greater than or equal to 5 minutes. If the required safety loads are not available, one or more equivalent load(s) may be used.

2.2.6 Combined

SIAS and LOOP Test Clause 7.5.6 of IEEE Std 387-1995 should be modified to read as follows:

This test involves demonstrating that emergency diesel generator can satisfactorily respond to a LOOP in conjunction with SIAS in whatever sequence they might occur [e.g., loss-of-coolant

accident (LOCA) followed by delayed LOOP or LOOP followed by LOCA]. A simultaneous

LOOP/LOCA event would be demonstrated by verifying that the diesel generator unit starts on

the auto-start signal from its standby conditions, attains the frequency and voltage within acceptablelimits and time, energizes the auto-connected shutdown loads through the load sequencer

within the acceptable limits of pump start time, and operates for a minimum of 5 minutes.2.2.7Largest Load Rejection Test Clause 7.5.7 of IEEE Std-1995 should be supplemented as follows:

This test involves demonstrating the emergency diesel generator's capability to reject a load equal to loss of the largest single load while operating at its design load power factor and verify

that the frequency and voltage requirements are met and the unit will not trip on overspeed.

Rev. 4 of RG 1.9, Page 122.2.8Design-Load Rejection Test Clause 7.5.8 of IEEE Std-1995 should be supplemented as follows:

This test involves demonstrating the emergency diesel generator's capability to reject a load equal to 90-100 percent of the continuous rating while operating at its design load power factor

and verify that the voltage requirements are met and that the unit will not trip on overspeed.

2.2.9 Endurance

and Load Margin Test Clause 7.5.9 of IEEE Std 387-1995 should be supplemented as follows:

This test involves demonstrating the capability of the emergency diesel generator at continuous rating and worst case power factor for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Of this period, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />

are at a load equal to 105-110 percent of the diesel generator's continuous rating, and 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />

are at a load equal to 90-100 percent of the generator's continuous rating. The test process

should verify that frequency and voltage requirements are maintained.

2.2.10 Hot Restart Test Clause 7.5.10 of IEEE Std 387-1995 should be supplemented as follows:This test involves demonstrating the hot restart functional capability at full load-temperatureconditions (after the emergency diesel generator has operated for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at continuous rating) by

verifying that the emergency diesel generator starts on a manual or auto-start signal, attains the

required frequency and voltage within acceptable limits and time, and operates for longer than 5

minutes. This test may be performed following the endurance and margin test described above.2.2.11Periodic-Trip Bypass Test Clause 7.5.12 of IEEE Std 387-1995 should be supplemented as follows:

This test involves demonstrating that automatic diesel generator unit trips are automatically bypassed as designed. Typically, engine overspend, generator differential current trip and those

trips retained with coincident logic are not bypassed. This test should also verify that the critical

protective trips that are not automatically bypassed perform their intended function.2.3Preoperational and Surveillance Testing Table 1 relates preoperational and surveillance tests to the anticipated schedule for performance(e.g., preoperational, monthly surveillance, 6-month testing, scheduled refueling period, and 10-year testing). A prelube period should precede all planned tests described in this regulatory guide. The tests should be in general accordance with the manufacturer's recommendations for reducing engine wear, including

cooldown operation at reduced power followed by postoperation lubrication.

2.3.1 Preoperational

TestingA preoperational test program should be implemented for all emergency diesel generator systemsfollowing assembly and installation at the site. This program should include the tests identified in Table 1.

In addition, through a minimum of 25 valid start and load demands without failure on eachinstalled emergency diesel generator, this test should demonstrate that the new emergency diesel generator has attained a level of reliability acceptable for entering into an operational category.

Rev. 4 of RG 1.9, Page 13

2.3.2 Surveillance

Testing After plants are licensed (after fuel load), periodic surveillance testing of each emergency diesel generator should demonstrate the continued capability and reliability of the diesel generator unit

to perform its intended function. When the emergency diesel generator is declared operational

in accordance with the plant's technical specifications, the following periodic test program should be

implemented.2.3.2.1Monthly Testing After completion of the reliability demonstration during preoperational testing, the emergency diesel generators should be periodically tested during normal plant operation. Each diesel generator

should be started as described in Regulatory Position 2.2.2 and loaded as described in Regulatory

Position 2.2.3 at least once every 31 days (with the maximum allowable extension not to exceed

25 percent of the surveillance interval).2.3.2.2Six-Month (or 184-Day) TestingThis test may substitute for a monthly test. To demonstrate the capability of the emergency diesel generator to start from standby conditions and provide the necessary power to mitigate a LOCA

coincident with a LOOP, each diesel generator should be started from standby conditions once every

6 months as described in Clause 7.5.3 of IEEE Std 387-1995. This will verify that the diesel generator

reaches the required voltage and frequency within acceptable limits and time as specified in the plant

technical specifications. Following this test, the emergency diesel generator should be loaded

as described in Clause 7.5.2 of IEEE Std 387-1995 (see also Table 1).2.3.2.3Refueling Outage Testing The capability of the overall emergency diesel generator design should be demonstrated during every refueling outage (or at a frequency of not more than every 24 months) by performing

the tests identified in Table 1. Certain tests may be conducted during the operating mode with NRC approval if the tests can be safely performed without increasing the probability of plant trip, loss of power to the safety buses, or LOOP.2.3.2.4Ten-Year Testing This testing involves demonstrating that the trains of standby electric power are independent at a frequency of once every 10 years (during a plant shutdown) or after any modifications that could

affect emergency diesel generator independence (whichever is shorter) by starting all redundant units simultaneously to identify certain common-failure modes undetected in single diesel generator unit tests (see also Table 1).3.Reporting CriteriaLicensees must conform to the reporting requirements of 10 CFR Part 21, "Reporting of Defects and Noncompliance" (Ref. 2); 10 CFR 50.72, "Immediate Notification Requirements for Operating

Nuclear Power Reactors"; and 10 CFR 50.73, "License Event Reporting System."

Rev. 4 of RG 1.9, Page 14 D. IMPLEMENTATION The purpose of this section is to provide information to applicants and licensees regarding the NRC staff's plans for using this regulatory guide. No backfitting is intended or approved

in connection with the issuance of this guide.

Except in those cases in which an applicant or licensee proposes or has previously established an acceptable alternative method for complying with specified portions of the NRC's regulations, the methods described in this guide will be used in evaluating (1) submittals in connection with

applications for construction permits, standard plant design certifications, operating licenses, early site

permits, and combined licenses; and (2) submittals from operating reactor licensees who voluntarily

propose to initiate system modifications involving diesel generators used as onsite emergency electric

power systems.

REGULATORY ANALYSIS / BACKFIT ANALYSIS The regulatory analysis and backfit analysis for this regulatory guide are available in Draft Regulatory Guide DG-1172, "Application and Testing of Safety-Related Diesel Generators

in Nuclear Power Plants" (Ref. 5). The NRC issued DG-1172 in November 2006 to solicit

public comment on the draft of this Revision 4 of Regulatory Guide 1.9.

1 All NRC regulations listed herein are available electronically through the Electronic Reading Room on the NRC's public Web site, at http://www.nrc.gov/reading-rm/doc-collections/cfr. Copies are also available for inspection or copying for a fee from the NRC's Public Document Room at 11555 Rockville Pike, Rockville, MD; the PDR's mailing

address is USNRC PDR, Washington, DC 20555; telephone (301) 415-4737 or (800) 397-4209; fax (301) 415-3548;

email PDR@nrc.gov

.2 Copies may be obtained from the Institute of Electrical and Electronics Engineers, Inc., IEEE Service Center, 445 Hoes Lane, P.O. Box 1331, Piscataway, NJ 08855.

3Regulatory Guide 1.155 is available electronically through the Electronic Reading Room on the NRC's public Web site, at http://www.nrc.gov/reading-rm/doc-collections/reg-guides/. Single copies may also be obtained free of charge by writing the Reproduction and Distribution Services Section, ADM, USNRC, Washington, DC 20555-0001, by fax

to (301) 415-2289, or by email to DISTRIBUTION@nrc.gov. Regulatory Guide 1.155 may also be purchased fromthe National Technical Information Service (NTIS). Details may be obtained by contacting NTIS at 5285 Port Royal Road, Springfield, Virginia 22161, online at http://www.ntis.gov , by telephone at (800) 553-NTIS (6847) or (703) 605-6000, or by fax to (703) 605-6900. Copies are also available for inspection or copying for a fee from the NRC's Public

Document Room (PDR), which is located at 11555 Rockville Pike, Rockville, Maryland; the PDR's mailing address

is USNRC PDR, Washington, DC 20555-0001. The PDR can also be reached by telephone at (301) 415-4737

or (800) 397-4209, by fax at (301) 415-3548, and by email to PDR@nrc.gov

.4 Draft Regulatory Guide DG-1172 is available electronically under Accession #ML062650307 in the NRC's Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html. Copies are also available for inspection or copying for a fee from the NRC's Public Document Room (PDR), which is

located at 11555 Rockville Pike, Rockville Maryland; the PDR's mailing address is USNRC PDR, Washington, DC

20555-0001. The PDR can also be reached by telephone at (301) 415-4737 or (800) 397-4209 by fax

at (301) 415-3548, and by email to PDR@nrc.gov

.Rev. 4 of RG 1.9, Page 15 REFERENCES 1.U.S. Code of Federal Regulations , Title 10, Part 50, "Domestic Licensing of Production and Utilization Facilities," U.S. Nuclear Regulatory Commission, Washington, DC.

1 2.U.S. Code of Federal Regulations , Title 10, Part 21, "Reporting of Defects and Noncompliance,"

U.S. Nuclear Regulatory Commission, Washington, DC.

13.IEEE Std 387-1995, "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," Institute of Electrical and Electronics

Engineers, Piscataway, NJ, 1995.

24.Regulatory Guide 1.155, "Station Blackout," U.S. Nuclear Regulatory Commission, Washington, DC.

35.Draft Regulatory Guide DG-1172, "Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants," U.S. Nuclear Regulatory Commission, Washington, DC, November 2006.

4