TRANSMITTED TO DOE/M. WHITAKER 04/19/95

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

                                             January 30, 1995

MEMORANDUM FOR:     G. W. Cunningham, Technical Director

COPIES:             Board Members

FROM:               R. T. Davis

SUBJECT:            Backup Power Supply Systems, Idaho National
                    Engineering Laboratory - Idaho Chemical Processing
                    Plant, Report of Site Visit, November 30 - December 1,
                    1994

1.  Purpose:  This memorandum provides a report of a visit by Defense Nuclear
    Facilities Safety Board (DNFSB) staff members, Todd Davis and Dan Ogg, to
    the Idaho Chemical Processing Plant (ICPP) from November 30 to December 1,
    1994.  The review focused on backup power supplies (i.e.,  Backup Generators
    and Uninterruptible Power Supplies (UPSs)).

2.  Summary:  The review identified the following major issues and observations:

    a.  Lockheed Idaho Technologies Company (LITCO) recently changed the
        designation of most of their backup power supplies from emergency to
        optional standby as defined in the National Electric Code (NEC).  These
        generators are identified as vital equipment in Idaho National
        Engineering Laboratory (INEL) technical standard 4.1B1, Vital Equipment
        Operability, and supply loads identified in INEL technical standard
        4.1E1, ICPP Equipment Requiring Alternate Electrical Power.  Optional
        standby design requirements in the NEC are less stringent than
        emergency requirements and do not appear appropriate for ICPP loads
        requiring backup power.

    b.  All five backup generators reviewed by the staff have a connected load
        that exceeds the generator rated capacity.  LITCO states that operators
        will ensure generator overloading does not occur; however, the
        operating procedures do not identify any precautions or requirements
        concerning backup generator loading.  This deficiency will be corrected
        by installing additional backup generators as part of the utilities
        upgrade currently scheduled to begin in 1995 (scheduled to be complete
        in 2001).

    c.  Several criticality alarm warblers are supplied from the standby
        generators vice the emergency backup power supply.  Warblers are
        integral to criticality alarms which ensure personnel are warned of a
        criticality.

    d.  Preventive maintenance and testing of ICPP generators are not
        consistent with industry standards and DOE-STD-3003, Backup Power
        Sources for DOE Facilities (e.g., periodic fuel sampling and 24 hour
        load test).

    e.  Several flooded cell batteries that support backup power systems at
        ICPP were replaced with "maintenance free" batteries in 1990.  In the
        last four years, two battery cells have failed.  ICPP is in the process
        of qualifying an impedance measurement device to help predict battery
        failure.

3.  Background:  Backup power systems at ICPP provide power to criticality alarm
    systems, ventilation systems, instrumentation and control systems and other
    process related systems during loss of offsite power.  Backup generators
    typically use diesel engines as the source of energy while UPSs use
    batteries.   A UPS provides power for a short period (usually less than two
    hours) while backup generators supply power for an extended period.

4.  Discussion/Observations:  

    a.  Backup Generator Classification:  LITCO recently changed the
        designation of most of their backup power supplies from emergency to
        optional standby as defined in the NEC.  The only remaining emergency
        backup power supplies support criticality alarm systems.  However, the
        NEC definition of optional standby, "...intended to protect private
        business or property where life safety does not depend on the
        performance of the system...", is not consistent with the safety
        significance of some ICPP loads (e.g., ventilation systems to maintain
        differential pressure for contamination control and instrumentation
        associated with the New Waste Calcining Facility (NWCF)).  The NEC
        contains additional design requirements for emergency generators (e.g.,
        backup supply available in 10 seconds, automatic start and transfer,
        fuel requirements, and wiring separation).

        DOE Order 6430.1A requires emergency power systems (i.e., power systems
        which supply safety class loads) be qualified for design basis
        accidents and seismic category-I requirements.  In addition, emergency
        power systems are required to be fully redundant power generation,
        switching, and distribution systems that meet the IEEE class 1E
        criteria.  DOE Order 6430.1A refers to the NEC for optional standby
        system requirements.  While an IEEE class 1E backup power supply system
        may not be required or appropriate for the ICPP applications, the NEC
        requirements for emergency power, which are less stringent (e.g., no
        seismic and redundancy requirements), are appropriate.  The staff
        believes that the NEC emergency power and DOE-STD-3003 requirements for
        backup power systems are the minimum requirements appropriate for
        application to ICPP safety related backup power systems.

    b.  Generator Loading:  The connected load for all five ICPP backup
        generators reviewed by the staff exceeded the generator's rated
        capacity.  The generators may shut down or may be damaged if the actual
        loading exceeds the rated loading.  Both National Fire Protection
        Association (NFPA) 110, Emergency and Standby Power Systems, and DOE-
        STD-3003 require that the full load be within the continuous rating of
        the generator.  LITCO states that the running load is being controlled
        by the operators to ensure that generator overloading does not occur. 
        However, the operating procedures do not include a precaution or
        requirement for generator loading.

        This deficiency will be corrected as a part of the utilities upgrade
        project which will begin in 1995.  This project includes the
        installation of additional backup diesel generators.  The new backup
        generators will be installed in parallel with the existing generators. 
        The new parallel system will have sufficient capacity to supply the
        necessary loads with one of the generators out of service.  The utility
        control station, which is part of the utilities upgrade, will have
        remote indication and control of all ICPP backup generators and
        generator loading.  The utilities upgrade project is scheduled to be
        complete in 2001.

        Until the completion of the upgrade project, the staff believes that
        procedural controls or automatic load shedding are necessary to ensure
        the backup generators are not overloaded.

    c.  Criticality Alarm Warblers:  LITCO technical standard 4.1E1 identifies
        equipment which must be connected to emergency or standby power.  This
        standard notes that, while the criticality alarms are required to be
        connected to emergency power, the warblers associated with some of
        these alarms do not have emergency power backup.  DOE Order 6430.1A
        requires structures, systems and components that provide nuclear
        criticality safety to be capable of performing their criticality safety
        functions during and following design basis accidents and events. 
        Because loss of offsite power is a credible event, DOE Order 6430.1A
        requires that the warblers be supplied with emergency backup power.

    d.  Preventive Maintenance and Testing:  Both the U.S. Nuclear Regulatory
        Commission Regulatory Guide 1.9, Selection, Design, and Qualification
        of Diesel-Generator Units Used as Standby (Onsite) Electric Power
        Systems at Nuclear Power Plants, and DOE-STD-3003 require a 24-hour
        full load test every 18 months.  The backup generators at ICPP are
        loaded monthly for less than two hours.  Periodic demonstration of
        extended generator operation is necessary to identify problems not
        observed in the shorter tests.

        The Office of Nuclear Safety issued Safety Notice 94-01, Contamination
        of Emergency Diesel Generator Fuel Supplies, in July 1994.  This notice
        identifies several diesel fuel deficiencies at DOE facilities which may
        have prevented backup diesel generators from functioning as required. 
        While diesel fuel at ICPP is sampled and tested at the central storage
        facility, no program is in place to sample local fuel systems.  Local
        fuel systems for backup power generators are particularly susceptible
        to contamination because of the limited amount of fuel turnover.  The
        safety notice and DOE-STD-3003 include applicable periodic sampling and
        testing requirements for diesel fuel systems which will identify
        potential fuel problems.

    e.  Batteries:  The Augmented Evaluation Team, which was formed by DOE in
        1991 to review the reliability of DOE backup generators, concluded that
        battery problems in the backup generator starting system are the
        dominant contributor to generator failure.  In the past four years,
        ICPP has had two battery cells fail.  To better predict battery cell
        failure, an impedance measurement device is being qualified for use at
        ICPP.  Impedance measurement trending will allow early determination
        and replacement of defective battery cells.

5.  Future Staff Actions:  The staff intends to resolve concerns with the
    classification and design requirements of the backup generators.  Staff
    electrical reviews at the INEL are scheduled to occur approximately twice
    per year.